commit b0e83059a36737db0e4425a461b04c535961e74a
Author: iris <2+iris@noreply.localhost>
Date:   Mon Aug 31 20:31:08 2026 -0400

    dev-updater: build an app on the machine, install it on the phone
    
    A Rust backend that discovers Android projects under configured roots,
    builds one on request, and serves the APK over pinned TLS on a WireGuard
    interface; an Android client that lists what is buildable, watches a build,
    and installs the result. Enrolment carries the token and the CA, so the
    phone trusts exactly the machine that issued it and nothing else.
    
    `AGENTS.md` is the working guide and `README.md` the configuration
    reference. The shared tunnel-and-TLS code lives in `vendor/wg-app-link`,
    which ai-app uses too.
    
    History before this point was squashed away, and a stale `config.json` went
    with it: nothing had read that file since the config moved to RON outside
    the checkout, and what it still held was one machine's absolute paths and
    the names of projects on it.

diff --git a/.claude/settings.json b/.claude/settings.json
new file mode 100644
index 0000000..d0f0a29
--- /dev/null
+++ b/.claude/settings.json
@@ -0,0 +1,8 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "env": {
+    "ANDROID_HOME": "/home/bob/Android/Sdk",
+    "ANDROID_SDK_ROOT": "/home/bob/Android/Sdk",
+    "PATH": "/home/bob/Android/Sdk/platform-tools:/usr/local/sbin:/usr/local/bin:/usr/bin:/usr/bin/site_perl:/usr/bin/vendor_perl:/usr/bin/core_perl:/usr/lib/rustup/bin:/home/bob/.local/bin"
+  }
+}
diff --git a/.dev-updater.ron b/.dev-updater.ron
new file mode 100644
index 0000000..f56f03e
--- /dev/null
+++ b/.dev-updater.ron
@@ -0,0 +1,47 @@
+// Read by Dev Updater -- this project's entry in its own list. Structured
+// as the body of the config: no outer parentheses, so nothing here is
+// indented for the sake of a wrapper.
+
+// What to call this project before there is a build to read a label from.
+label: "Dev Updater",
+
+// Where this project's own resources live. Read off the request path and
+// cached, because the `Script` variant would otherwise put a process
+// spawn on the manifest -- see `server/src/resources.rs`.
+resources: Ron("resources.ron"),
+
+// Walked in order, and the order is the point: the binary is built first
+// so that a failing APK build leaves the phone the APK it already had
+// rather than half of a matched pair.
+//
+// The server component is this process. That changes how it is *delivered*
+// -- restarting means exec-ing the binary just built, not asking the
+// script below to stop and start the code that is running (see
+// `restart.rs`) -- but nothing about how it is declared, installed or
+// reported on. The card is an ordinary one.
+components: [
+    Server(
+        name: "server",
+        // No cwd: this component is built and run from the checkout root,
+        // which is where the server looks for its own project. That is
+        // also what the generated unit takes as its working directory --
+        // started anywhere else this server finds no checkout of its own,
+        // and its card silently loses the branch line, its commit count
+        // and the Pull button.
+        build: "cargo build --release --manifest-path server/Cargo.toml",
+        // Managed, like anything else that just wants its binary kept
+        // running. Nothing about restarting *this* server lives in the
+        // script -- that is `restart.rs`, which defers the hand-over past
+        // the reply and spawns it detached. So there was nothing left for
+        // a script of its own to say.
+        service: Managed("server/target/release/dev-updater"),
+    ),
+    Apk(
+        name: "app",
+        // The command resolves against the project root and `cwd` says
+        // where to run it -- two different things, which is why this is
+        // not `./build-apk.sh`.
+        build: "app/build-apk.sh",
+        cwd: "app",
+    ),
+],
diff --git a/.gitignore b/.gitignore
new file mode 100644
index 0000000..e11f7fc
--- /dev/null
+++ b/.gitignore
@@ -0,0 +1,27 @@
+.gradle/
+build/
+app/androidApp/build/
+local.properties
+.kotlin/
+*.iml
+.idea/
+.DS_Store
+server/target/
+server/dev-updater.log
+
+# Private key material. The server keeps this in $XDG_CONFIG_HOME by
+# default; this catches a run pointed back into the repo with --certs.
+certs/
+
+# The added-apps list and the enrolled token hashes: machine-local
+# absolute paths, and whatever this particular machine has been pointed
+# at. Kept in $XDG_CONFIG_HOME by default, same as above -- this catches
+# a run with --config. Nothing here is shareable.
+config.ron
+
+# A test project fails its build while this exists; see test-projects/README.md.
+break-the-build
+
+# Dead: the live list is config.ron, kept in $XDG_CONFIG_HOME. This one was
+# an older format nothing reads, carrying one machine's absolute paths.
+config.json
diff --git a/.gitmodules b/.gitmodules
new file mode 100644
index 0000000..d5f4f96
--- /dev/null
+++ b/.gitmodules
@@ -0,0 +1,3 @@
+[submodule "vendor/wg-app-link"]
+	path = vendor/wg-app-link
+	url = git@git.arirex.me:iris/wg-app-link.git
diff --git a/AGENTS.md b/AGENTS.md
new file mode 100644
index 0000000..cc6584f
--- /dev/null
+++ b/AGENTS.md
@@ -0,0 +1,634 @@
+# dev-updater
+
+Serves locally-built debug APKs to a phone, and an Android app that
+installs them. See `README.md` first for what this is and how to run it;
+this file is the working notes on top of that.
+
+The central design point, worth not undoing by accident: **an app is a
+project path, not a file path.** Everything downstream — which APK, which
+package it replaces, its label, whether it's worth stripping — is derived
+from what's actually built under that path, at add time or per request.
+Nothing about any particular project is compiled in, and the app list is
+mutable at runtime from the phone.
+
+## Layout
+
+- `vendor/wg-app-link/` — a **submodule**, and the shared half of this and
+  ai-app: the WireGuard binding, the CA the app pins, QR enrollment,
+  owner-only file creation, and the RON house rules. A submodule rather
+  than a published crate because it pins an exact commit, so the two
+  servers cannot end up on versions of it that disagree. Clone with
+  `--recurse-submodules`; `git::pull` runs `submodule update` after the
+  merge, because a merge moves the recorded pointer without touching the
+  submodule's working tree and the build would otherwise keep compiling
+  the old contents.
+  What stays here is what differs: this server's routes, registry, build
+  walk and service contract, plus `auth.rs`, whose middleware is generic
+  over each project's own state -- only the token functions underneath it
+  are shared.
+- `server/` — Rust + Axum. `main.rs` is the bootstrap and the two
+  listeners; `routes.rs` has the whole HTTP table in its module doc
+  comment. `auth.rs` is the bearer token every TLS request carries,
+  applied once around the whole router so a new route cannot forget it. `registry.rs` owns the live app list and every mutation of it
+  (config writes funnel through `AppState::update`, so in-memory and
+  on-disk state can't come apart; the one other write is
+  `AppState::new`'s startup reconciliation, before anything can read the
+  list). `discover.rs` is the scanner,
+  `config.rs` the persisted schema and the RON both config files are in,
+  `apkinfo.rs` the `aapt2` reads,
+  `strip.rs` the slim-APK pipeline, `sdk.rs` the SDK/NDK tool lookups.
+- `app/` — Kotlin + Compose, a single `:androidApp` module. `UpdaterScreen.kt`
+  is the list, `AddAppScreen.kt` the add/settings screen, `AppsApi.kt` the
+  management calls, `UpdateManifest.kt` the read side, `ApkInstaller.kt` /
+  `InstalledBuilds.kt` the download-and-install path, `DownloadServer.kt`
+  the transport and `Link.kt` the two values it hands the shared library. `Theme.kt` is Catppuccin Mocha
+  mapped onto Material's roles, plus the four `ActionTone`s buttons come in
+  -- red takes something away, the scheme's mauve replaces it with the same
+  thing, green brings it up, blue puts a new build on the phone. What a
+  button does is said in colour rather than by which component it sits on,
+  so the same consequence looks the same everywhere. The mapping that
+  matters is the surface ladder: Mocha names its darks in order (Crust,
+  Mantle, Base, Surface 0) and Material asks for the same thing under other
+  names, so the page is Base, a component's outlined card stays Base beside
+  it, and a project's card is Surface 0 -- one visible step, which is all
+  the nesting has to say.
+  `NerdIcons.kt` names the icon glyphs,
+  which are drawn as *text* in a small Nerd Fonts subset rather than
+  as vector assets -- an icon beside a line of text wants that line's size,
+  colour and baseline, and a `Text` gets all three for free. The font is
+  generated: add a codepoint in `NerdIcons.kt` **and** in
+  `app/build-icon-font.sh`, then re-run the script, or the glyph silently
+  isn't there.
+
+## Checking your work
+
+- Server, from `server/`: `cargo fmt`, `cargo clippy --all-targets`, and
+  `../run-tests.sh`. All three every time, not just when a change looks
+  big enough to warrant them. The build is warning-clean and
+  `cargo fmt --check` passes; keep both true. Formatting is plain rustfmt
+  defaults with no `rustfmt.toml` — layout is not something to decide per
+  line, so take what it gives rather than hand-formatting against it.
+- App: from `app/`, `. ./android-env.sh && ./gradlew :androidApp:compileDebugKotlin`
+  (or `:androidApp:assembleDebug`), plus `./gradlew ktfmtFormat
+  ktfmtFormatScripts :androidApp:ktfmtFormat :androidApp:ktfmtFormatScripts`
+  and `./gradlew :androidApp:lintDebug`. Both are clean; keep them that
+  way. ktfmt is `kotlinLangStyle()` with nothing else configured, so
+  formatting is never a thing to decide per line.
+- Neither replaces running it. `app/run-android.sh` builds, installs and
+  launches on an emulator; screenshot with `adb shell screencap -p
+  /sdcard/x.png && adb pull /sdcard/x.png <local>`. Package
+  `com.example.devupdater`, activity `.MainActivity`.
+- **`test-projects/` is what to point it at**, rather than a real project.
+  Four fake ones -- a plain APK, one building two variants, one whose build
+  fails on demand, and a `Server` + `Apk` pair with a service and a
+  `resources:` declaration. They exist because a real project only does what
+  it happens to do, where these can be asked to fail, to be slow, or to
+  declare nothing. That directory's own README says how they are reached
+  (they are deliberately not scanned) and why each one builds into an
+  `app/` subdirectory; the short version of the second is that two levels is
+  what `find_apks` matches, so a test APK any shallower is offered as a
+  build of *this* project.
+- The server is easy to exercise directly, which is usually faster than
+  going through the UI — but it takes three things, and leaving any of
+  them out looks like the server being broken:
+
+  ```sh
+  # The CA it actually presents is the one in its config dir, not the
+  # stale certs/ left in the repo. The address is wg0's -- it binds that
+  # and nothing else, so 127.0.0.1 refuses the connection unless the
+  # server was started with --bind. And every route on this port needs
+  # the enrolled bearer token.
+  curl --cacert "${XDG_CONFIG_HOME:-$HOME/.config}/dev-updater/certs/ca.pem" \
+      -H "Authorization: Bearer $TOKEN" \
+      "https://$(ip -4 -o addr show wg0 | awk '{print $4}' | cut -d/ -f1):8090/manifest"
+  ```
+
+  Only the token's SHA-256 is stored, so there is no reading it back out
+  of `config.ron`: either use one printed by `--rotate-token`, or run a
+  throwaway server with `--config`/`--certs` pointed somewhere temporary
+  and `--bind 127.0.0.1`, which prints a fresh token at startup.
+
+## Things that have bitten
+
+- **Don't add a general recursive search to `discover.rs`.** It was
+  measured and rejected; the numbers are in that module's doc comment and
+  in the README. Extend `APK_PATTERNS` instead.
+- **`aapt2` and the strip pipeline never run on the manifest path.** A
+  process spawn or a zip walk there turns a 43 ms refresh into something a
+  phone notices, and the manifest is fetched on every open, resume and
+  Refresh. `aapt2` is add-time work cached in `config.ron`; stripping
+  belongs to the download alone, which is why the manifest reports the
+  size of whatever is on disk (`strip::serveable_now`) rather than
+  producing the slim copy to measure it.
+- **Both config files are RON with two house rules**, and
+  `wg_app_link::format` is the only place that knows them -- ai-app's files
+  are in the same shape, which is why they are shared rather than described
+  twice. `config.rs`'s own `format` module is now only the migration hook
+  in front of it, and goes when that does. A file is the *body*
+  of the struct -- no outer parentheses, so nothing is indented for a
+  wrapper -- because RON has no implicit top-level struct; `parse` adds the
+  paren and `render` strips it. And `IMPLICIT_SOME` is set on the
+  deserializer rather than by a header each file would have to carry, which
+  is why every optional field also needs `skip_serializing_if` so nothing
+  is written back that nobody typed. The two halves only round-trip
+  together: change one and every file on disk still loads while only
+  looking wrong, which is why the config test asserts the written shape.
+- **A `Server` component is driven through one script, run as
+  `<script> <subcommand>`.** `service.rs` knows the subcommands and the
+  four words `status` may print (`running`, `stopped`, `failed`,
+  `not-installed`); it knows nothing about systemd or OpenRC, and
+  shouldn't. Scripts run with stdin closed, because one that prompts would
+  hang rather than fail.
+  **On OpenRC, `status` reads the exit code and never the text**
+  (`0` started, `3` stopped, `32` crashed, anything else "could not find
+  out"). `rc-service status` prints its status line to *stderr*, so the
+  obvious check -- discard stderr, grep stdout for `crashed` -- throws away
+  the word it is looking for and reports a crashed service as `stopped`,
+  which is the exact lie the `failed` state exists to prevent. The codes
+  also distinguish "could not find out", which the text cannot: an
+  uninitialised user softlevel makes every call fail, and that is not a
+  state the service is in. Assign the code through `|| code=$?`, or `set
+  -e` kills the script before it can read one -- every answer but "running"
+  is a non-zero exit. Measured on OpenRC 0.63.3, not read.
+  **There is a guest to measure in**, at `~/vm/gentoo` on this machine --
+  `./start.sh`, then `./shell.sh 'cmd'`, ssh on 127.0.0.1:2223 as `tester`
+  with `guest_key`. Its own README is the reference. Everything in this
+  section, and the restart behaviour below, was run there rather than
+  reasoned about; do the same rather than trusting either the
+  documentation or a systemd result. Detecting OpenRC is itself a trap:
+  `rc-service --user --help` fails when `XDG_RUNTIME_DIR` is unset, so
+  probing with it first reports "no service manager here" on a machine
+  that has one.
+- **Which script is what `service:` says**, and it is a sum:
+  `Script("path")` for a project that carries its own, `Managed("the
+  binary")` for one that wants dev-updater's built-in. Two variants rather
+  than two optional fields, because a component picks one and "both" and
+  "neither" would be states the file could express that mean nothing. The
+  built-in is `server/src/service-default.sh`, compiled in, written to
+  `$XDG_DATA_HOME/dev-updater/service-default` at every startup so an
+  updated dev-updater cannot be driving last version's copy, and handed
+  its identity as arguments (`--name <key>-<component> --exec "..."`) so
+  the subcommand the caller appends still lands last. `service::driver` is
+  the single place the two variants become one command -- everything
+  downstream takes a command and cannot tell which it was, which is what
+  lets a project switch between them without anything else changing.
+  It is deliberately a *script* rather than an in-process implementation:
+  a built-in that ran through Rust would put systemd and OpenRC knowledge
+  back in the one place it has been kept out of, and the contract would
+  become a special case of itself. **dev-updater declares `Managed` like
+  anything else**, and has no service script of its own: nothing about
+  restarting this server lives in a script, it lives in `restart.rs`, so
+  there was nothing left for one to say. Its component carries `cwd: ".."`
+  because the unit's working directory has to be the checkout root -- that
+  is where this server looks for its own app project, and started anywhere
+  else its card silently loses the branch line, its commit count and the
+  Pull button. `start.sh` knows none of this: it runs
+  `dev-updater --service <subcommand>` on the binary it has just built,
+  which derives the name and the script from the same declaration the
+  running server reads. One place decides how this service is named and
+  invoked, which is the only reason a bootstrap script cannot drift away
+  from `service::driver`.
+  A managed service is named `<key>-<component>`, because a service
+  manager's names are one flat namespace across every project on the
+  machine. Switching a project from its own script to `Managed` therefore
+  changes the unit's name: **uninstall the old one first**, or its unit is
+  orphaned with nothing left pointing at it.
+- **Service state is checked off the request path**, in `ServiceChecks`
+  beside `git::RemoteChecks` and for the same reason: a process spawn per
+  server component on `/manifest` is exactly what that path must not do.
+  Which means it is subject to the same rule as a remote check: it lands
+  *after* the response that started it, so `checksPending` counts both, and
+  the phone waits on both (`ManifestEntry.checksOutstanding` for one card).
+  And the answering starts at startup rather than on the first request
+  (`main.rs`), so the window in which a component has no state is this
+  server's own start rather than something a phone has to sit through --
+  restarting is how this server is updated, which makes it the moment
+  somebody is most likely to be looking at the list.
+  Counting only remotes was a real bug and an invisible one: the state is
+  unknown only until the first answer of a server's life, remote checks
+  ordinarily outlast service ones, and the symptom is a component row with
+  no buttons -- so it showed up as "the buttons vanish after a restart if I
+  come back to the app too quickly", and only on whichever cards lost the
+  race. Nothing looked again until somebody hit Refresh.
+- **dev-updater declares itself as an ordinary `Server` + `Apk` pair**, but
+  its server component *is this process*, and that changes one thing only:
+  *when* it restarts. Running the script's `restart` inside the walk would
+  kill it before the APK is built and before anyone is told how it went, so
+  the restart is deferred past `finish`; the Restart route defers for the
+  same reason, since a script that killed this process before it could
+  answer would make a restart that worked read as a failed request. Once
+  deferred, both go through the one function (`restart::deferred`), which
+  asks the manager when the service is up and only otherwise execs the new
+  binary itself. Going through the manager is what makes a refreshed unit
+  apply -- an exec inherits the unit this process was started with, so a
+  pull that changed the service script would otherwise land only at the
+  next restart by hand. The button used to exec unconditionally, on the grounds
+  that exec keeps the PID; that made it the one restart a rewritten unit
+  never applied to, which is the kind of surprise a special case buys.
+  Deciding it in one place is what stops the two drifting again. `BuildState::is_self` is the flag, and it is passed in
+  rather than declared -- a file that could claim it is a file that can
+  make this server exec an arbitrary binary. A build that changed nothing
+  skips the restart altogether (`restart::binary_unchanged`): exec-ing into
+  an identical binary drops the phone's connection to deliver the build it
+  already had. It is a `stat` of the binary against what it was at startup
+  rather than a hash -- cargo installs a new binary by renaming over the
+  old one, so the inode alone answers it, and reading tens of megabytes to
+  learn the same thing would cost more than the restart it avoids. It says
+  "changed" whenever it cannot tell, because a needless restart costs a
+  second while a skipped one leaves the old build serving and reads as the
+  update having silently failed. The Restart *button* is unconditional --
+  somebody asked. Stop and Uninstall do go
+  through the script, and do strand the phone; the app confirms them
+  rather than hiding them.
+- **A remote git failure is shortened and explained in one place**
+  (`git::remote_failure`). Git's stderr runs to a paragraph of generic
+  advice, so the card gets the first line and the log gets all of it; and
+  when the failure was authentication, what this process can see of the
+  ssh agent is appended, because "works in my terminal, fails from the
+  service" is almost always `SSH_AUTH_SOCK` not being inherited by a
+  daemon, and that is invisible from a phone. Asked rather than assumed --
+  the note can say the agent is fine, which is what stops it being blamed.
+- **A branch with no upstream is not a broken one.** `can_pull` requires an
+  upstream as well as a checkout, which is what stops the card reporting
+  the same fact twice -- once as its own note and once as the check's
+  complaint about it -- and stops it offering a Pull that `git::pull`
+  would refuse. It is also not worth *saying*: plenty of checkouts have no
+  remote deliberately, and a card that mentions it every time is nagging
+  about a choice somebody made.
+
+- **The branch line is how a failed remote check is visible at all.** With
+  it gone, `newCommits` stays false and the card reads as an app with no
+  updates -- the same silent failure the self-entry note below describes.
+  It was deleted once by accident in a refactor and nothing failed; only
+  the display went quiet.
+
+- **Forcing git onto IPv4 is done in `GIT_SSH_COMMAND`, not on the git
+  subcommand.** `git fetch` takes `-4`; `git ls-remote` does not, and
+  answers "unknown switch `4'". `ls-remote` is what the new-commits check
+  runs, so splicing the flag onto every remote command turned the setting
+  into a switch that broke every card's commit count -- which is how it
+  was first written, and what `git::ssh_command` and
+  `forcing_ipv4_does_not_break_the_check` now hold in place. `fetch` keeps
+  the flag as well, since that is what carries the preference to an https
+  remote; ssh is covered either way.
+
+- **This server's own project is a row in `config.projects` like every
+  other, and everything in that row except `gitIpv4` is re-derived at
+  startup** by `registry::reconcile_self`. The row is what gives a
+  per-project setting one home -- it used to have to be keyed in a
+  separate `config.settings` list, because the one card that is always in
+  the list was the one card the setting could not be a field on. What is
+  derived stays derived: the path is the working directory (see below),
+  and the label and components come from the checkout's own
+  `.dev-updater.ron`, so a re-clone or a moved repo fixes itself at the
+  next start instead of leaving the row naming a directory nobody pulls.
+  Only what somebody chose is carried across. The declaration is accepted
+  by construction there, which is why `AppEntry::pending_declaration`
+  answers nothing for it: between a pull that rewrites the declaration and
+  the restart that follows, the row and the file can differ without that
+  meaning anything is waiting to be accepted. A config still carrying the
+  old keyed `settings` list loses it silently -- `Config` ignores fields it
+  does not know -- so a machine that skips straight past the version that
+  migrated one has its `gitIpv4` to set again.
+
+- **A component has two kinds of log, and the kind is an axis of its
+  own.** The build log is what this server captured while building it; the
+  runtime log is what the component wrote while running, reported by its
+  service script. They are asked for one kind at a time (`?kind=`), and the
+  modal gives each a tab -- opening on runtime, since what a service is
+  doing now is the usual question, and on build for the component a build
+  stopped at (`build_failed`). They were one list indexed by generation
+  once, and because build logs came first the runtime one sat at an index
+  nothing ever asked for: unreachable, and silent about it. ANSI escapes
+  are rendered rather than stripped (`AnsiLog.kt`) -- the colour is how a
+  process marked its own errors -- and sequences with no meaning on a
+  phone are consumed rather than printed, so a cursor movement cannot
+  arrive looking like a corrupted log.
+- **There are three sizes of refresh, and using the wrong one is what
+  makes the list feel like it has a mind of its own.** `refresh()` drops
+  the list to a spinner and asks every remote -- it belongs to arriving,
+  resuming, and the Refresh button, which are the moments somebody asked
+  to be shown the current state. Pull-to-refresh is the same ask without
+  the spinner, since the gesture brings its own indicator and taking the
+  list away underneath it would say the same thing twice. `applyOne` reads `GET /apps/{key}`
+  and puts that one entry back, so an action on one card cannot move or
+  change any other; every card action uses it, including adding one --
+  the Add screen hands back the key and the list fetches just that app.
+  `awaitCheck` is the middle one: ask a single checkout's remote and wait
+  on *that* answer, which the card's own refresh control and a freshly
+  added app both use. Waiting on the whole list to settle would make one
+  card's refresh sit behind another card's.
+
+- **The Add screen is drawn over the list, not in place of it.** Swapped
+  out, the list is composed again from nothing on the way back -- and
+  rebuilding it means fetching it, which is the whole-list refresh that
+  adding an app has no business causing. `describe` in `routes.rs` is the
+  one place a card is built, so `/manifest` and `GET /apps/{key}` cannot
+  come to describe the same app differently.
+
+- **A progress bar is drawn from counts the build reports, never from an
+  estimate**, and the knowledge of how to get those counts belongs to this
+  server rather than to each project. Two ways in, both ending as
+  `@@progress done/total` on the build's output:
+  cargo reports its own once `CARGO_TERM_PROGRESS_WHEN=always` is set,
+  which `spawn` sets for every build command, so a cargo build needs
+  nothing and must not be wrapped. Gradle cannot -- an init script is
+  refused by the configuration cache, and its rich console reports a
+  percentage only as a full-screen redraw that would make the output
+  unreadable -- so `server/src/build-progress.sh` does the `--dry-run`
+  count and the `> Task` tally, shipped by this server (`crate::shipped`)
+  and offered to build scripts as `$DEV_UPDATER_PROGRESS`. A script tests
+  for the variable rather than depending on it, so building by hand still
+  works. This is what stops each project carrying its own copy of the
+  same twenty-five lines.
+  Reading the output means splitting on carriage returns as well as
+  newlines: a tool redrawing a counter in place puts several updates and
+  then real output inside one `\n`-delimited line.
+- **Discovery must stay side-effect free.** It runs on every manifest
+  request and every suggestion scan.
+- **An app in the list is a *project*, and what it produces is its
+  components.** Ordinarily one `Apk`; a project that also runs a server on
+  the build machine declares a `Server` beside it. They are a sum, not one
+  struct with both halves' fields, and the common fields are repeated per
+  variant so the file reads `Apk(name: ...)` with nothing nested inside a
+  `kind`. `Component::same_declaration` destructures exhaustively, so
+  adding a field anywhere fails to compile until someone has said whether a
+  project declares it or this server measures it.
+- **A build reinstalls every server component's unit, not just changed
+  ones.** The unit is generated from a script in the repository, so a pull
+  can change how a service is *defined* rather than what it runs -- and
+  that has to land even when the build produced a byte-identical binary,
+  which is the ordinary case for a pull that only touched the script.
+  Installing is safe on a running service (it writes the unit and reloads;
+  it stops nothing), which is why `start.sh` has always done it every run.
+  It is deliberately not gated on `restart::binary_unchanged`: that answers
+  whether a *restart* is worth the interruption, and unit staleness is a
+  different question. Wiring the two together left the unit stale exactly
+  when the build had nothing to do.
+- **A build runs every component at once, and each reports for itself.**
+  They are independent -- a Rust build and a Gradle build share nothing but
+  the machine -- and measured here, together takes about three quarters of
+  the time one after the other does. The saving only appears when more than
+  one has work, which is what a pull produces.
+  The status is per component (`ComponentStatus`), so a card draws each
+  component's bar, timing and last line inside that component's own row;
+  the project's own area at the bottom keeps only what belongs to the whole
+  project, which is fetching and pulling. A bar under the card could only
+  ever say that *something* was happening, and with everything building at
+  once that is exactly what the reader is trying to find out.
+  A failure no longer stops the others -- they are already running -- so
+  the first failure in declaration order is the one reported, which is what
+  a walk in that order would have said. The phone draws every component in
+  a card of its own, including a project with only one: the flat layout it
+  used to get meant two shapes to keep in step, and put that APK's size up
+  beside the card's corner controls where it read as belonging to them.
+- **A project's own `.dev-updater.ron` is a request, never an
+  instruction.** It only runs once accepted from the phone, which copies
+  it into `config.ron`; `AppEntry::pending_declaration` is the whole gate.
+  Evaluate it *fresh* rather than caching it on the entry — the file
+  changes on a pull, and a pull writes no config, so nothing rebuilds the
+  entry list. Caching it meant a pull could swap the command out from
+  under a previous acceptance and nothing noticed until an unrelated
+  config write. Enforce it wherever a command would actually run, not
+  only where the list is built.
+  Two things follow that both went wrong the moment `resources:` joined
+  the gate. **Whatever `Declaration::matches_accepted` compares,
+  `AppState::approve_declaration` has to write** -- it compared the
+  resources declaration and wrote only the components, so accepting stored
+  half of what was being read back and the gate could never clear. The
+  press succeeded, so there was no error either; the card simply kept
+  asking. Adding a field to one without the other is the shape to watch
+  for, and the tests are what let it through: they built an "accepted"
+  config by hand instead of calling `approve_declaration`, so they
+  asserted a copy of the rule rather than the rule.
+  And **on the pull path the gate is asked after the fast-forward, never
+  before it** (`build_state::pull_and_build` takes a closure for exactly
+  this reason). The declaration lives in the checkout, so the pull is the
+  one thing that changes the answer -- a bool computed at the call site is
+  the answer for the commit being replaced, which made a pull that changed
+  the declaration build anyway. Pulling stays allowed while a request is
+  unaccepted, since taking commits runs git rather than the project's
+  command, and it is how the new request arrives to be read.
+- **Which build variant to serve is the phone's choice, not the server's.**
+  It arrives as `?variant=` on the download and is validated against the
+  discovered builds -- an unvalidated path would let a phone name any file
+  on disk to be served. Storing it server-side meant one enrolled device
+  silently changing what another was offered.
+- **The self entry's project is the working directory itself**, so this
+  server has to be started from the root of its own checkout -- which is
+  where everything else here is driven from, and what the service unit
+  sets (`WorkingDirectory=$REPO_ROOT`, not `server/`). Its components then
+  say where they live from there, exactly as any other project's do; there
+  is nothing special about this one's layout, which is the point of it not
+  being `app/` any more. It used to be
+  `CARGO_MANIFEST_DIR`, fixed when the binary was *compiled*, so a
+  re-clone or a move left the card watching a directory nobody pulls. The
+  symptom is why this is worth remembering: the entry keeps working and
+  keeps serving an APK, but silently loses its branch line, its Pull
+  button and its commit count, so it reads as an app that simply never has
+  an update. It took a "why can't my server see the new commits?" to find.
+  Startup warns when there is no checkout at the resolved path, which is
+  the only cheap moment to notice.
+- **A configured project pointing at this server's own project is a second
+  card for it.** `add_app` refuses it (the self entry is in the list it
+  checks against, and `self_project` is canonicalized so a symlink can't
+  make one directory look like two), so this only survives from a config
+  written while the self entry resolved somewhere else. It is not merely
+  redundant: it is not the self entry, so `is_self` is false and a build
+  through it would restart this server partway through its own build. `build_entries` warns rather than dropping
+  it -- dropping it would leave a config entry with no card and so no way
+  to remove it from the phone. The built-in card has no Remove button, so
+  the duplicate is the one that does.
+- **A project says where its own state is; nothing infers it.** The
+  `resources:` declaration points at a RON file, a script that prints the
+  same RON, or an inline struct, and it holds what a project would
+  otherwise write down in several places -- its `name`, and its `data` and
+  `config` directories when those are not `$XDG_*_HOME/<name>`. **The file
+  is the project's, not this server's**: its own code is meant to read the
+  same one, which is why `ResourceFacts` ignores unknown keys where
+  `Declaration` sets `deny_unknown_fields`, and why it goes through
+  `wg_app_link::format` like every other RON here.
+  A project that says nothing gets nothing -- the dialog reports not
+  knowing rather than filling in a directory. Two guesses were tried and
+  both rejected: the config key (`updater`, `app`, which resolve to
+  `~/.config/updater` and `~/.local/share/app`, neither of which exists)
+  and the checkout's directory name (right for both projects here, and
+  still an inference presented as a fact). Iris's call, and the reason is
+  the failure mode: a wrong path does not error, it reads as "this
+  component keeps nothing here".
+  Read **off the request path**, through `crate::checks` beside the git
+  and service checks, because `Script` spawns a process and `/manifest` is
+  fetched on every open, resume and Refresh. It is in `checksPending` with
+  the other two -- counting only some of them is the bug that once left
+  components with no buttons after a restart. And it is part of the
+  acceptance gate, since a `Script` runs: comparing the whole declaration
+  rather than the variant means changing which file is read is a change
+  somebody is asked about.
+
+- **Uninstall can take three things away, and the path on screen is the
+  only guard.** The dialog offers logs, data and config as separate
+  toggles -- only logs on by default, and ticking data forces logs on,
+  since a service that writes its log inside its own data directory would
+  lose it either way. `purge.rs` is the whole of it. Where the data and
+  config are comes from the project's `resources:` declaration, above; a
+  project that does not say gets two disabled toggles saying so, and the
+  four reasons a toggle is disabled are distinguishable on screen because
+  "couldn't read the resources" is a fault to fix while "doesn't say" is
+  an ordinary project.
+  A path is removed **wherever it points**, with no check that it
+  sits under the XDG directories -- Iris's call, over the alternative of
+  refusing anything outside them. What replaces that check is the dialog
+  showing each resolved path before the button can be pressed, so the
+  phone never asks for a path nobody saw. Anything that stops the path
+  being displayed removes the only guard there is.
+  Log paths are collected *before* the uninstall runs, because the script
+  that reports where a service's log lives is the thing being removed.
+
+- **The self entry can't be removable.** The app can only be updated
+  through this server, so an updater that can drop itself from its own list
+  strands the installed copy (recovery is a manual reinstall over the
+  bootstrap port).
+- **`/self` and `/self/apk` are a frozen contract, and the only rescue the
+  app has.** Every other route is reachable only by an app new enough to
+  understand it: change what `/manifest` says and an older app cannot read
+  the list, which is where the button that would replace it lives. So the
+  path that fetches a newer app depends on nothing likely to change --
+  two numbers, no nesting, no variants, no query parameters -- and the app
+  asks it on every launch and again after building its own project, which
+  is the moment the newer copy exists and the server it must keep talking
+  to has just changed. Add fields at your peril and never rename one;
+  anything richer belongs on a route an old app never calls. It does not
+  survive a changed CA, port or token, since those break the connection
+  before any route is reached: those stay one-way doors and `--download`
+  stays their answer.
+- **There is deliberately no general migration mechanism.** Iris's call:
+  each app decides its own, and the updater's job is only to be able to
+  get both halves of *itself* to the next version. A project that renames
+  or restructures its service is uninstalled and reinstalled from the card,
+  which works because dev-updater is not the thing being stopped.
+- **The bootstrap link (`--download`) serves the APK already on disk and
+  builds nothing.** Shipping a stale one there is the expensive mistake,
+  because a fresh install is not enrolled and everything that would replace
+  it -- Update, and the QR scan that enrols a device at all -- lives in the
+  copy being installed, so the only way out is another trip through
+  `--download`. It cost a round of "the scanner fix never landed" when the
+  fix was in the checkout the whole time. The startup line names the
+  variant and the build's age for that reason; run `./app/build-apk.sh`
+  first.
+- **Changing the pinned CA is a one-way door for any installed copy.** Same
+  reason. `wg_app_link::certs` deliberately won't regenerate an existing
+  CA; only the leaf is reissued, on every start.
+- **State is per machine, not in the repo**:
+  `$XDG_CONFIG_HOME/dev-updater/{config.ron,certs}`, owner-only. This
+  repo is shared with a VM at a different path, so a shared config hands
+  each machine the other's project paths, and a CA key in it is one that VM
+  could sign with. The APK pins the CA of whatever machine builds it
+  (`app/build-apk.sh`, `DEV_UPDATER_CA` overrides).
+- Freshness is the APK's **mtime** versus `PackageInfo.lastUpdateTime`, not
+  a version code — these are ad hoc rebuilds with nothing bumping a
+  version. It follows that a build and an install landing in the same
+  second can briefly read as "update available"; that's inherent, not a
+  bug to chase.
+
+## Running the server for real
+
+`./start.sh` is the shortest way back to a working state: it builds both
+halves, rewrites the service unit (so a pull that changes the service script
+takes effect) and starts or restarts it. Use it after a pull, or when the
+running server and the checkout have drifted.
+
+To run one by hand instead, launch it **from the repo root** -- that is
+where it looks for its own app project (`app/`), and started anywhere else
+its own card has no checkout -- and **fully detached from the calling
+shell**, not via an agent's background-task tracking, which ties its
+lifetime to the session:
+
+```sh
+setsid nohup /path/to/dev-updater </dev/null >server/dev-updater.log 2>&1 & disown -h
+```
+
+Verify with `ps -o pid,ppid,pgid,sid,tty,comm -p <pid>` — detached means
+`PPID 1`, its own `SID`, `TT ?`. Check for a stale instance first
+(`pgrep -af "[d]ev-updater" || true`): a second instance fails to bind and
+silently leaves the old one answering. Stop with
+`pkill -f "[d]ev-updater" || true`.
+
+**Run `pgrep -f`/`pkill -f` as a command of its own, with nothing else on
+the line, and bracket the first character of the pattern**
+(`"[d]ev-updater"`). Both also exit nonzero when nothing matches, which is
+the normal case; `|| true` that.
+
+Why the pattern alone isn't enough, since this keeps catching people: each
+command runs as `bash -c '<the whole command text>'`, so the wrapper's own
+argv contains every word you wrote. An unbracketed pattern therefore
+matches the shell running it — `pgrep` reports phantom matches and `pkill`
+kills that shell outright (exit 144, truncated output, reads exactly like
+the thing under test having crashed). Bracketing the pattern fixes only
+*that* word: any **other** mention of the same string on the line re-arms
+it. And you usually can't fix the other mention, because it is the real
+command —
+
+```sh
+# Kills its own shell: the pattern is bracketed, but the path below
+# still puts the plain string "target/debug/dev-updater" in the argv,
+# and bracketing *that* would change which file gets executed.
+pkill -f "[t]arget/debug/dev-updater" || true; setsid nohup ./target/debug/dev-updater …
+```
+
+so the only rule that always works is to keep them in separate commands:
+one to stop, one to start.
+
+One more way this bites, which bracketing does nothing about: `-f` matches
+the **whole command line**, so it also catches processes that merely have
+the string somewhere in a path. An agent's scratchpad directory is named
+after the repository, so anything launched with a path through it -- the
+Android emulator, say -- matches `[d]ev-updater` and gets killed along
+with the server. Match the binary rather than the project when stopping
+one: `pkill -f "[t]arget/debug/dev-updater"`.
+
+## Environment notes
+
+The machine itself — where the Android SDK is, that each command runs in a
+fresh shell so exports have to be chained, and each repo having its own
+emulator — is described once in `~/.claude/MACHINE.md`, which every
+session reads. What follows is what that means here.
+
+- `app/android-env.sh` applies the SDK override unconditionally, and
+  `.claude/settings.json` puts `platform-tools` alone on `PATH` so `adb`
+  works without sourcing anything. Everything else needs the env script.
+- **This repo has its own AVD, named `dev-updater`**, which is what
+  `app/run-android.sh` and `app/enroll-emulator.sh` default to; every
+  Android project on this machine has one named after it, and none of them
+  share. Two sessions in two repos on one emulator each silently replace
+  the app the other just installed, which reads as a build that never
+  landed rather than as interference.
+- **To exercise installing, add a throwaway test app**, not another repo's
+  real one. This server's whole job is putting *other* projects' builds on a
+  device, so trying that out needs something to install -- and a scratch
+  project you wrote is better for it than a real app, because you can make
+  it do whatever the case under test needs: fail its build, produce two
+  variants, change its label, bump nothing at all. A real app only does what
+  it happens to do. It goes in the list like any other project, so nothing
+  here needs to know it is a test.
+- **To actually drive the app on the emulator, use
+  `app/enroll-emulator.sh`** rather than working enrolment out again. There
+  is no camera to scan the QR with, so it fires the `devupdater://enroll`
+  intent the app already accepts, generating a token once and adding it to
+  `config.ron` beside any real phone's. Two things it exists to stop you
+  rediscovering: `adb shell am start -d` loses everything after the first
+  unescaped `&`, because the URI reaches the *device's* shell; and the
+  server must be started with `--bind 0.0.0.0` for the emulator to reach
+  it at all, since it otherwise binds wg0 and the emulator has no route
+  there. The script's header has the detail.
+  **It names the device rather than assuming there is only one**, which
+  matters more now that every repo has its own AVD: a second emulator
+  running beside this one makes every bare `adb` call exit 1 with "more
+  than one device/emulator", and the version that ran `adb get-state` read
+  that as *no emulator running* -- the opposite of what had happened, which
+  sends you off to start a third. It resolves the serial by AVD name the
+  way `run-android.sh` always has, defaults to `dev-updater`, takes
+  `--avd NAME` or `AVD_NAME=`, and when it cannot find that one it lists
+  what *is* attached instead of guessing which of the three situations it
+  is in.
+- The server needs `aapt2` (SDK build-tools) to add an app, and
+  `llvm-strip` (NDK) only for apps that need stripping.
diff --git a/CLAUDE.md b/CLAUDE.md
new file mode 100644
index 0000000..43c994c
--- /dev/null
+++ b/CLAUDE.md
@@ -0,0 +1 @@
+@AGENTS.md
diff --git a/README.md b/README.md
new file mode 100644
index 0000000..2dc1c97
--- /dev/null
+++ b/README.md
@@ -0,0 +1,521 @@
+# dev-updater
+
+Keeps a phone's locally-built debug APKs current, without a browser and
+without leaving files in the Downloads folder to clean up by hand.
+
+Two halves:
+
+- `server/` — a small Rust (Axum) server that runs on the build machine. It
+  is told about *projects*, finds the APKs built under them, and serves
+  them over pinned TLS.
+- `app/` — "Dev Updater", an Android app that lists what the server has,
+  shows which builds are newer than what's installed, and hands downloads to
+  the system package installer.
+
+Adding an app is done from the phone: point it at a project directory and
+the server works out the rest (which APK, which package it replaces, what
+to call it). Nothing about any particular project is compiled in.
+
+## Getting started
+
+```sh
+cargo build --release --manifest-path server/Cargo.toml
+./server/target/release/dev-updater --download   # generates its CA on first start
+./app/build-apk.sh                               # embeds that CA
+```
+
+Run it **from the repo root**, as above: the server takes its own app
+project from the working directory, and started elsewhere its own card has
+no checkout to pull. Once it is working, `./start.sh` does all of this and
+installs it as a service, which is the one command to run after a pull.
+
+Then install the app once by hand — nothing else can install it before it
+exists. `--download` serves its APK over plain HTTP at
+`http://<this machine>:8091`, so a link typed into the phone's browser
+downloads it directly. After that first install the app updates itself the
+same way it updates everything else, over the pinned TLS port, and
+`--download` isn't needed again.
+
+Open the app and scan the QR the server printed on first start — that is
+what enrolls the phone; see [below](#enrolling-a-phone). Then tap **Add**,
+put your repo directory in "Where to look", and the projects underneath it
+show up as one-tap suggestions — the ones built at least once, plus any
+carrying a `.dev-updater.ron` of their own, which can be added before
+their first build.
+
+To develop the app itself against a local emulator instead:
+
+```sh
+cd app && ./run-android.sh
+```
+
+## How an app gets found
+
+The path you give is to a *project*, never to an APK. The server
+rediscovers the build underneath it on every request, so an ordinary
+rebuild needs no reconfiguration, and a build landing in a different
+variant directory is picked up on its own.
+
+Discovery matches the handful of path shapes Android build tooling
+actually emits into (see `server/src/discover.rs` for the list — Gradle at
+one or two module levels, Flutter, and dioxus-cli's generated project).
+That is a deliberate choice over a general recursive search, which is far
+too slow to sit behind an interactive screen. Measured against one real
+28 GB / 39k-file project, warm cache:
+
+| approach | time |
+|---|---|
+| `find -name '*.apk'` | 406 ms |
+| the same, depth-limited | 305 ms |
+| the same, pruning `.git`/`deps`/`.fingerprint`/… | 132 ms |
+| the patterns actually used | **6 ms** |
+
+Depth limits buy nothing, because the breadth is in shallow Cargo/Gradle
+output directories. Supporting another build system means adding a pattern
+there.
+
+When a project has several builds, the newest wins and the card offers a
+**Variant** menu to pin a specific one instead. That choice lives on the
+phone, not on the server, and travels with the download — two devices
+enrolled against one build machine each pick for themselves. The path is
+checked against the builds the server can actually see, so a pin left
+pointing at something a `gradlew clean` removed falls back to the newest
+rather than failing.
+
+## Configuration
+
+`config.ron` (in `$XDG_CONFIG_HOME/dev-updater/`, created on first
+change, `--config` to move it) holds the repo roots, the added apps, and
+the hashes of the enrolled device tokens. It is written owner-only. It
+lives there rather than in the repo because it is per machine: paths in it
+resolve on the machine that wrote them, and a checkout shared between a
+machine and a VM would otherwise hand each the other's paths -- which
+showed up as every app reading "not built".
+
+Point `repoRoots` at as many directories as you like, including a
+directory another machine's projects are mounted at; discovery treats them
+all the same. Everything in it is editable from the phone.
+
+### Pulling and building from the phone
+
+An app whose project is a git checkout can be brought up to date from the
+phone, and needs no configuration to be pullable: the card shows the
+branch, and grows a **Pull** button when the remote actually has something
+this checkout doesn't. A button that is always there says nothing about
+whether pressing it would do anything, so its presence is the signal.
+Without a build command it pulls and stops, which is all it can honestly
+do — how a project builds is still never guessed.
+
+Give it a command to have Pull build as well:
+
+```ron
+projects: [
+    (
+        key: "ai-app",
+        projectPath: "~/repos/ai-app/app",
+        components: [Apk(name: "app", build: "./build-apk.sh")],
+    ),
+],
+```
+
+Better still, let the project carry that itself — see [below](#letting-a-project-carry-its-own-build-step).
+
+Set `gitPull: false` on a checkout that should never be moved from a
+phone. Paths accept `~`, and are shown that way.
+
+### Updating this server itself
+
+The **Dev Updater** card pulls and builds like any other, and is
+configured like any other: `.dev-updater.ron` in this repository
+declares its name and its two components — a `Server` (the binary) and an
+`Apk` (the phone app), built in that order. Its server row installs,
+starts, stops and reports like anyone else's.
+
+It is a row in `config.ron` like any other too, so anything set per
+project — `gitIpv4`, say — has somewhere to live for this card as well.
+Everything else in that row is rewritten at each start from the
+declaration above and from the directory the server was started in, so
+edit those rather than the row.
+
+What is compiled in is not *whether* it restarts but *how*. Its server
+component is this process, so restarting means exec-ing the binary just
+built rather than asking the service script to stop and start the code
+doing the asking — which would kill the build partway through, with
+nobody left to report how it went. The `exec` keeps the PID, so whatever
+supervises the server sees one continuous process rather than needing to
+be told to restart it. The Restart button takes the same route, and for
+the same reason: the script's restart would kill this process before it
+could answer, so a restart that worked would reach the phone as a failed
+request.
+
+Two buttons on that row are worth knowing about before pressing them.
+This app reaches the server *through* the server, so **Stop** and
+**Uninstall** strand the phone until someone starts it again on the build
+machine; the app says so and asks first. They are offered rather than
+hidden because there are good reasons to want them, and a button that
+silently does nothing is worse than one that warns.
+
+Its build step is the one that is never held for acceptance, because
+gating it would protect nothing: pulling this repository replaces the
+binary that would be doing the gating.
+
+That closes the loop: new commits land, you press Pull, and the server and
+the APK it offers are both current. No other app can ask for the same:
+restarting to pick up an unrelated project's build would drop every other
+request for no reason.
+
+Pull acts on the build machine — fetch, fast-forward, then run the command
+— while **Update** still means "install what's built onto this phone", so
+the two never mean each other.
+
+While it runs, the card says which step is happening, how long it has
+taken, what the finished steps took, and the last line the build printed.
+The command's output is read as it arrives rather than collected at the
+end, so a long build is visibly moving instead of being indistinguishable
+from a stuck one — and when it *is* slow, the phase timings say whether
+the time went to the network or the compiler.
+
+Deliberate limits, because a phone is a bad place to resolve a mess:
+
+- Only a fast-forward. A branch that has diverged is reported, not merged
+  or rebased.
+- A dirty working tree is refused outright, and left exactly as it was.
+- A branch tracking no upstream has nothing to pull, and says so.
+- Nothing is pulled without `gitPull`, and no build command is guessed.
+
+**Showing the list never changes your repositories.** It asks each remote
+what it has (`git ls-remote`) and asks whether that commit is already an
+ancestor of what is checked out — no objects downloaded, no tracking refs
+moved, no `FETCH_HEAD`. The question is deliberately "would a pull move
+HEAD?" rather than "does the remote differ from `origin/main`?": the
+latter calls a checkout that has fetched but not merged up to date, and
+calls one carrying local commits behind. Fetching is Pull's job, which is why
+the card says "new commits" rather than a count: counting needs the
+objects, and downloading them is the thing the button is for.
+
+Checks are started when the list loads — opening the app, resuming it, or
+pressing Refresh — and run concurrently, so several projects cost about
+one round trip rather than one each. There is no interval over which a
+previous answer is reused: one `ls-remote` is a fraction of a second, and
+rationing it meant a push made shortly after a check went unnoticed until
+the window expired. The only limit is that one checkout never has two
+checks running at once.
+
+**The list never waits for them.** It answers from what is already known
+and says a check is still running; the phone looks again a moment later
+and the "new commits" badge appears on its own — about a second after the
+list, in practice. This is worth stating because the obvious design —
+wait for the answer, then reply — made every reopen of the app stall
+behind a round trip to the git host. What the list is actually about
+(which apps have builds, and whether this phone has them) is entirely
+local and takes milliseconds.
+
+Those follow-up looks pass `?recheck=false`, which collects the answer
+without asking again. Otherwise each look would start a fresh check, find
+it outstanding, and never stop.
+
+Each check is still bounded by an SSH connect timeout and a hard stop, so
+an unreachable remote fails rather than hanging, and a failure keeps the
+last known answer instead of claiming there is nothing new. A pull marks
+its checkout current straight away, so a card stops offering what you just
+took.
+
+### On-demand builds
+
+An app whose committed build output isn't what a phone needs can declare a
+build step, run automatically right before that app is downloaded:
+
+```ron
+projects: [
+    (
+        key: "app-dioxus",
+        projectPath: "/home/you/repos/example/app-dioxus",
+        components: [
+            Apk(
+                name: "app",
+                build: "./build-android-arm.sh",
+                staleWhen: (
+                    path: "target/dx/app-dioxus/debug/android/app/app/src/main/jniLibs/arm64-v8a/libmain.so",
+                    olderThan: "target/dx/app-dioxus/debug/android/app/app/src/main/jniLibs/x86_64/libmain.so",
+                ),
+            ),
+        ],
+    ),
+],
+```
+
+The motivating case: an app with architecture-specific native code,
+iterated against an x86_64 emulator, leaves its arm64 slice stale.
+Rebuilding it on every local build would be wasted work, so it happens
+lazily at the one moment a real phone is about to be handed the APK — the
+app shows "Building for phone…" while it runs.
+
+`staleWhen` compares two build outputs against each other rather than
+either against source, which is what makes it cheap and needs no knowledge
+of what the build reads. The consequence is that it only means anything
+once `olderThan` has itself been built at least once.
+
+Paths are relative to `projectPath` (absolute ones are also accepted), and
+`build` is argv, run without a shell — written either as a line you would
+type or as explicit arguments; the string form splits on whitespace and
+has no quoting, so an argument containing a space needs the array.
+
+### Servers, and the service script
+
+A `Server` component is a long-running process on the **build machine**,
+and it names one script that this server drives it through:
+
+```ron
+Server(
+    name: "backend",
+    build: "cargo build --release --manifest-path ../server/Cargo.toml",
+    service: "../server/service",
+),
+```
+
+That script is run as `<script> <subcommand>` for `install`, `uninstall`,
+`start`, `stop`, `restart` and `status`. Nothing about systemd or OpenRC
+is compiled in here — which init system is present, and how a unit gets
+written into it, is knowledge that belongs where the service does. See
+`server/service` in this repository for one that handles both; it is meant
+to be copied.
+
+`status` has the only contract. It prints exactly one of:
+
+| | |
+|---|---|
+| `running` | the service is up |
+| `stopped` | installed, not running, because somebody stopped it |
+| `failed` | installed, not running, because it fell over |
+| `not-installed` | no unit for it |
+
+and exits 0. Anything else it prints, or any non-zero exit, means it could
+not tell — which the card shows as "couldn't check" rather than as a
+service that is down.
+
+`failed` earns its own word because both alternatives mislead. Reporting a
+crash as `stopped` sends you looking for who stopped it, and exiting
+non-zero reports "couldn't check" when the script found out perfectly
+well. Note that OpenRC *does* exit non-zero for a crashed service, so a
+script leaning on the exit status hits exactly that — read the word it
+prints instead. The card draws `failed` in red, beside the green it draws
+`running` in.
+
+**A service script must never prompt.** It is run with stdin closed and no
+terminal, so a `sudo` password prompt would not fail — it would hang until
+the timeout with the card stuck mid-action. Anything needing root should
+exit with a message telling you to run it by hand once.
+
+The card shows the state and offers only what fits it: `Install` when
+there is no unit, `Start` when it is stopped or failed, `Stop`/`Restart`
+when it is running. Uninstall asks first. State is read in the background on the same
+refresh that checks git remotes, never while the manifest is being built —
+asking a service manager costs a process spawn, and the manifest is
+fetched on every open and resume.
+
+A successful build restarts a server that is **already running**, and
+leaves a stopped one stopped: you stopped it on purpose, and a build is no
+reason to overrule that.
+
+### Letting a project carry its own build step
+
+Writing that block into this machine's `config.ron` works, but it puts
+project knowledge on the machine rather than in the project. A project can
+instead carry a `.dev-updater.ron` of its own, in the directory you would
+add — every key it understands, all of them optional.
+
+These files are [RON](https://github.com/ron-rs/ron) with one house rule: a
+file is the *body* of the config, so it has no outer parentheses and
+nothing in it is indented for them. Comments and trailing commas are fine,
+and an optional value is written as itself rather than wrapped in `Some`.
+
+```ron
+// What to call this project before there is a build to read a label from.
+// A built APK wins: it is the authority on what will actually install.
+label: "Thing",
+
+// Offer a Pull button. On by default; set false for a checkout that should
+// never be moved from a phone. Per project -- there is one checkout.
+gitPull: true,
+
+// What this project produces, in the order it should be produced. A
+// component that fails stops the ones after it.
+components: [
+    // An APK, installed on the phone.
+    Apk(
+        name: "app",
+        // The command, either as a line the way you would type it or as
+        // explicit arguments. It is argv either way, run without a shell:
+        // a program with a "/" in it resolves against the project
+        // directory, anything else is a PATH lookup. The string form
+        // splits on whitespace and has no quoting, so an argument
+        // containing a space needs the array.
+        build: "./build-android-arm.sh",
+        // Working directory, relative to the project. Omit to run in it.
+        cwd: ".",
+        // Serve a debug-symbol-stripped copy. Off by default, and a
+        // decision rather than something guessed from the APK's contents.
+        strip: false,
+        // Run the build before a download when the first path is older
+        // than the second. Omit it and it runs when a pull brings commits,
+        // or when nothing is built yet.
+        staleWhen: (
+            path: "…/arm64-v8a/libmain.so",
+            olderThan: "…/x86_64/libmain.so",
+        ),
+    ),
+    // A server on the build machine. Delivering one is restarting it, so a
+    // successful build does that -- there is no flag asking whether to.
+    // The script is what knows which init system is here; see above.
+    Server(
+        name: "backend",
+        build: "cargo build --release",
+        service: "../server/service",
+    ),
+],
+```
+
+Most projects need far less than that — a label and one component with a
+command is the usual whole of it:
+
+```ron
+label: "AI Sessions",
+
+components: [Apk(name: "app", build: "./build-apk.sh")],
+```
+
+dev-updater configures its own entry this way too, in `app/`, rather than
+compiling the answer in — see that file for the self-update shape.
+
+That file is a **request, not an instruction**. Nothing in it runs until
+you have read it on the app's card and pressed *Accept build step* —
+whereupon it is copied into `config.ron`, and from then on behaves
+exactly like a hand-written one. The card shows the request in full rather
+than a diff against the last one: these are a few lines, so reading the
+whole thing is quicker than reading a change to it, and doesn't depend on
+remembering the previous version. It is the same bargain an AUR helper
+offers when it shows you a PKGBUILD.
+
+If the file later changes — which is to say, when a `git pull` brings a
+new one — it goes back to being unaccepted: the card shows the new request
+and the previously accepted command stops running until you accept again.
+Pulling still works while something is waiting, and stops after the
+fast-forward; that is how the new request arrives to be read in the first
+place.
+
+The reason for the ceremony is that the two halves of this server carry
+very different risk. An APK it serves is sandboxed by Android and you
+already chose to install it. A component's `build` runs on the build machine
+as the user who started the server, so a checkout must never be able to
+change what that command is without anyone seeing it. Accepting is not a
+claim that the build *script* is safe — its contents live in the
+repository and change freely with every pull, which is exactly the trust
+anyone building the project already extends. It is the narrower claim that
+this project runs a build step at all, and that this is the one.
+
+## Enrolling a phone
+
+Every request to the TLS port carries a bearer token. Pinning
+authenticates the server to the phone; the token is the other direction,
+and it is needed because these routes can repoint the scanner, enumerate
+what is on disk, add apps by path, and run a configured build command on
+the build machine.
+
+The server generates one on first start and prints it as a QR code, which
+is the whole enrollment flow — open the app on an unenrolled phone, tap
+**Scan QR code**, and point it at the terminal. There is deliberately no
+manual-entry form: the token is 256 random bits, so typing it is not a
+thing anyone would do.
+
+```sh
+dev-updater --rotate-token   # a lost phone: invalidates every enrolled
+                             # token and prints a fresh QR
+```
+
+Only the SHA-256 of the token is stored, in `config.ron`, so a leaked
+config doesn't leak the credential — which also means it is shown exactly
+once, at the moment it is generated. On the phone it is kept encrypted
+under an Android Keystore key. Rejections are logged with the peer address
+and never with the header, and they are delayed slightly so a port scanner
+shows up as a slow drip.
+
+The bootstrap listener (`--download`) is deliberately *not* behind the
+token: it exists for a browser that has nothing to authenticate with yet,
+and it serves only this app's own APK.
+
+## Reachable only through WireGuard
+
+Both listeners bind the `wg0` address and nothing else, so neither is on
+the LAN. That is the outer of the two gates — the tunnel decides who can
+try, the token decides who is answered — and it is worth having on its own
+account: an unenrolled scanner never reaches the token check, and the
+bootstrap port's plain HTTP travels inside the tunnel's encryption. As a
+bonus the updater works away from home, which on a LAN address it never
+could.
+
+It fails to start if `wg0` is down rather than falling back. The escape
+hatch is explicit — `--bind 0.0.0.0` restores the old LAN behaviour, still
+behind the token but with nothing in front of it — because this server is
+also how a stranded app gets reinstalled, and that recovery shouldn't
+depend on the tunnel being healthy.
+
+## Why TLS, and why plain HTTP for the bootstrap
+
+Everything on the main port either *is*, or *decides*, what the app hands
+to `REQUEST_INSTALL_PACKAGES` next, so a MITM there could install arbitrary
+bytes. The app pins the dev CA in `certs/` and trusts nothing else — not
+even the system trust store.
+
+The `--download` bootstrap port is plain HTTP on purpose: a stock
+browser has nothing to pin against before the app is installed, so TLS
+there would only mean a trust-warning wall instead of a working link. It
+serves that one APK and nothing that can change server state.
+
+The server generates its own CA on first start, into
+`$XDG_CONFIG_HOME/dev-updater/certs` — outside the repo, so a machine
+that can read the repo can't read the key that signs certificates this app
+trusts. The app embeds whatever `ca.pem` is there when `app/build-apk.sh`
+runs, so the pinned certificate follows the machine that built the APK and
+there is nothing to paste.
+
+Regenerating the CA strands the installed app — it can only be updated
+*through* the pinned server — so recovery means rebuilding it and
+reinstalling over the bootstrap port.
+
+## Large APKs
+
+An APK whose native libraries make up most of its size can be served as a
+debug-symbol-stripped, re-signed copy (`<name>.slim.apk`, cached against the
+original's mtime+size). One real case goes 224 MB → 53 MB. The untouched
+build stays on disk for local `ndk-stack`/`logcat` work; only the slim copy
+is served.
+
+It is `strip: true` on the APK component, declared rather than detected.
+Whether the symbols are worth the transfer is a judgement about the
+project — a Compose app with a few small AndroidX `.so` files saves under
+1% — and guessing it from the APK's contents was a guess that then needed
+an override anyway. It stays this server's business rather than the build
+script's because it is a property of *this* hop to a phone: a project
+built without dev-updater has no reason to strip.
+
+## Testing
+
+The Kotlin half has no unit tests, but it does have two checks that
+should stay green: `./gradlew :androidApp:lintDebug` and ktfmt (`ktfmtCheck`,
+or `ktfmtFormat` to fix). Formatting is plain `kotlinLangStyle()` with
+nothing configured, the same bargain `cargo fmt` makes on the Rust side.
+
+`./run-tests.sh` (forwards arguments to `cargo test`). Covers the parts
+with logic worth testing: APK discovery, config round-tripping, staleness,
+the git read/pull/check split, token gating, certificate generation, the
+acceptance gate, and the self-restart predicate. The app is UI over the
+server's HTTP API and is verified by running it.
+
+## Versions
+
+Kotlin 2.4.10 · Compose Multiplatform 1.12.0 · AGP 9.3.2 · Gradle 9.7.1 ·
+JDK 21 · compileSdk/targetSdk 37. `server/` targets Rust edition 2024.
+
+Compose Multiplatform's material3 is on a separate release train and is
+pinned separately, at 1.9.0 — the newest material3 is still an alpha
+while runtime/foundation/ui are stable at 1.12.0.
diff --git a/app/NerdFonts-LICENSE b/app/NerdFonts-LICENSE
new file mode 100644
index 0000000..06eb073
--- /dev/null
+++ b/app/NerdFonts-LICENSE
@@ -0,0 +1,21 @@
+The MIT License (MIT)
+
+Copyright (c) 2014 Ryan L McIntyre
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
diff --git a/app/android-env.sh b/app/android-env.sh
new file mode 100755
index 0000000..e11b2be
--- /dev/null
+++ b/app/android-env.sh
@@ -0,0 +1,55 @@
+#!/bin/sh
+# Android SDK environment for this app's Gradle build: locates the SDK and
+# exports the PATH/env vars the build needs. Pure Kotlin/Gradle, so nothing
+# Rust/NDK-specific belongs here.
+#
+# Source this directly for one-off commands instead of going through the
+# full run-android.sh (which also creates/boots the emulator, builds,
+# installs, and launches):
+#
+#   . ./android-env.sh
+#   ./gradlew :androidApp:assembleDebug
+#   adb devices
+#
+# Safe to source repeatedly. Intentionally does NOT `set -e`/`set -u`: this
+# file is meant to be sourced into whatever shell is already running --
+# including a long-lived one a session reuses for unrelated commands -- and
+# changing that shell's error-handling options as a side effect of sourcing
+# would be surprising. run-android.sh, which does want strict mode, sets its
+# own `set -eu` before sourcing this.
+
+# Hardcoded (not derived from an inherited ANDROID_HOME) so this doesn't
+# silently follow whatever that happens to be set to elsewhere -- e.g. this
+# sandbox's own profile exports ANDROID_HOME=/opt/android-sdk system-wide, a
+# root-owned install this user can't write to. Everything needed lives under
+# the path below instead, matching Android Studio's own default SDK location
+# convention on Linux.
+SDK_ROOT="$HOME/Android/Sdk"
+ANDROID_HOME="$SDK_ROOT"
+ANDROID_SDK_ROOT="$SDK_ROOT"
+# ~/.local/bin is where the `android` CLI itself installs to (see its own
+# installer); adding it here too means sourcing this script guarantees a
+# working `android` command even in a shell that hasn't picked up
+# ~/.profile yet.
+PATH="$HOME/.local/bin:$SDK_ROOT/cmdline-tools/latest/bin:$SDK_ROOT/platform-tools:$SDK_ROOT/emulator:$PATH"
+# Pin the AVD directory explicitly so avdmanager (creation) and the emulator
+# binary (lookup at start time) are guaranteed to agree on where the AVD
+# lives -- left to their own defaults they can resolve different locations
+# and disagree on whether it exists.
+ANDROID_AVD_HOME="${ANDROID_AVD_HOME:-$HOME/.android/avd}"
+mkdir -p "$ANDROID_AVD_HOME"
+export ANDROID_HOME ANDROID_SDK_ROOT ANDROID_AVD_HOME PATH
+
+echo "==> Ensuring required SDK packages are installed in $SDK_ROOT"
+# $SDK_ROOT is user-owned (unlike /opt/android-sdk), so this genuinely
+# installs anything missing rather than just probing for it -- still
+# best-effort (`|| echo`) so a transient network hiccup doesn't abort a
+# script sourcing this under `set -e`.
+#
+# build-tools is needed twice over: by Gradle for this app's own build, and
+# by ../server at runtime for `aapt2` (reading a discovered APK's package
+# name) and `llvm-strip`/`apksigner` (the slim-APK pipeline).
+android sdk install "cmdline-tools/latest" "platform-tools" "emulator" \
+    "platforms/android-37.0" "build-tools/37.0.0" \
+    "system-images/android-36/google_apis/x86_64" \
+    || echo "    (non-fatal: see above)"
diff --git a/app/androidApp/build.gradle.kts b/app/androidApp/build.gradle.kts
new file mode 100644
index 0000000..17c24cb
--- /dev/null
+++ b/app/androidApp/build.gradle.kts
@@ -0,0 +1,126 @@
+plugins {
+    alias(libs.plugins.androidApplication)
+    alias(libs.plugins.composeMultiplatform)
+    alias(libs.plugins.composeCompiler)
+    alias(libs.plugins.ktfmt)
+}
+
+// See the root build script for why this style and not ktfmt's default.
+ktfmt { kotlinLangStyle() }
+
+// The CA this app pins is baked in at build time from the certificates on
+// the machine doing the build -- `$XDG_CONFIG_HOME/dev-updater/certs/ca.pem`,
+// which the server generates on first start. DEV_UPDATER_CA overrides it.
+//
+// Reading it rather than keeping a pasted copy in the source means the
+// trust anchor follows the build machine, the CA's private key never has
+// to exist anywhere near this repo, and regenerating a CA needs a rebuild
+// instead of a paste -- so a stale constant can't quietly disagree with
+// the server the app is trying to reach.
+val pinnedCaPath: String =
+    System.getenv("DEV_UPDATER_CA")
+        ?: "${System.getenv("XDG_CONFIG_HOME") ?: "${System.getProperty("user.home")}/.config"}" +
+            "/dev-updater/certs/ca.pem"
+
+abstract class GeneratePinnedCert : DefaultTask() {
+    /** Where the certificate is looked for, reported in failures. */
+    @get:Input abstract val caPath: Property<String>
+
+    /**
+     * The certificate itself, set only when it exists -- so a missing one produces this task's own
+     * instructions rather than Gradle's "no such input file", which doesn't say what to run.
+     */
+    @get:InputFile
+    @get:Optional
+    @get:PathSensitive(PathSensitivity.NONE)
+    abstract val caCertificate: RegularFileProperty
+
+    /** Wired by AGP through `addGeneratedSourceDirectory`. */
+    @get:OutputDirectory abstract val outputDir: DirectoryProperty
+
+    @TaskAction
+    fun generate() {
+        val path = caPath.get()
+        val ca = File(path)
+        if (!ca.isFile) {
+            throw GradleException(
+                "No CA certificate at $path.\n" +
+                    "Start the server once on this machine first -- it generates the CA the " +
+                    "app pins, and the certificate has to exist before an APK can embed it.\n" +
+                    "Set DEV_UPDATER_CA=/path/to/ca.pem to build against a different one."
+            )
+        }
+        val pem = ca.readText().trim()
+        if (!pem.startsWith("-----BEGIN CERTIFICATE-----")) {
+            throw GradleException("$path is not a PEM certificate.")
+        }
+        // The PEM must start immediately after the opening quotes: a
+        // leading newline costs Android's CertificateFactory its
+        // "-----BEGIN" sniff, so it tries DER instead and fails at runtime
+        // with an ASN.1 decode error, nowhere near this file.
+        val file = outputDir.get().file("PinnedCaCertificate.kt").asFile
+        file.parentFile.mkdirs()
+        file.writeText(
+            """
+            |// Generated from $path by the generatePinnedCert task. Do not edit.
+            |package com.example.devupdater
+            |
+            |const val PINNED_CA_PEM = ""${'"'}$pem
+            |""${'"'}
+            |
+            """
+                .trimMargin()
+        )
+    }
+}
+
+val generatePinnedCert =
+    tasks.register<GeneratePinnedCert>("generatePinnedCert") {
+        val ca = file(pinnedCaPath)
+        caPath.set(pinnedCaPath)
+        if (ca.isFile) {
+            caCertificate.set(ca)
+        }
+    }
+
+// AGP 9 wants generated sources registered through the variant API rather
+// than added to a source set, so the task dependency is carried properly.
+androidComponents {
+    onVariants { variant ->
+        variant.sources.java?.addGeneratedSourceDirectory(
+            generatePinnedCert,
+            GeneratePinnedCert::outputDir,
+        )
+    }
+}
+
+android {
+    namespace = "com.example.devupdater"
+    compileSdk = 37
+
+    defaultConfig {
+        applicationId = "com.example.devupdater"
+        minSdk = 24
+        targetSdk = 37
+        versionCode = 1
+        versionName = "1.0"
+    }
+    packaging { resources { excludes += "/META-INF/{AL2.0,LGPL2.1}" } }
+    buildTypes { getByName("release") { isMinifyEnabled = false } }
+    compileOptions {
+        sourceCompatibility = JavaVersion.VERSION_21
+        targetCompatibility = JavaVersion.VERSION_21
+    }
+}
+
+dependencies {
+    implementation(libs.compose.runtime)
+    implementation(libs.compose.foundation)
+    implementation(libs.compose.material3)
+    implementation(libs.compose.ui)
+    implementation(libs.androidx.activity.compose)
+    implementation(libs.zxing.embedded)
+    // The half of this app that is the same as ai-app's: pinned TLS, the
+    // enrollment store, and the scanner.
+    implementation(project(":link"))
+}
diff --git a/app/androidApp/src/main/AndroidManifest.xml b/app/androidApp/src/main/AndroidManifest.xml
new file mode 100644
index 0000000..1a3a086
--- /dev/null
+++ b/app/androidApp/src/main/AndroidManifest.xml
@@ -0,0 +1,101 @@
+<?xml version="1.0" encoding="utf-8"?>
+<manifest xmlns:android="http://schemas.android.com/apk/res/android"
+    xmlns:tools="http://schemas.android.com/tools">
+    <uses-permission android:name="android.permission.INTERNET" />
+    <!-- Lets this app hand a downloaded .apk to the system installer via
+         an ACTION_VIEW intent; without it the intent silently fails on
+         Android 8+ (see ApkInstaller.kt's canRequestInstall()). -->
+    <uses-permission android:name="android.permission.REQUEST_INSTALL_PACKAGES" />
+    <!-- Android 17 (API 37) made Local Network Protection mandatory: an app
+         targeting 37+ needs this runtime permission to reach *any* local
+         network address, including a plain socket to a LAN IP literal with
+         no discovery involved. Below 37 it doesn't exist and INTERNET
+         implicitly covers LAN access, which is why the other two apps here
+         (both still targeting 36) never needed it. Without it the traffic
+         is silently dropped, surfacing only as a connect timeout. See
+         MainActivity.kt's runtime request. -->
+    <uses-permission android:name="android.permission.ACCESS_LOCAL_NETWORK" />
+
+    <!-- Package visibility (API 30+): without this, PackageManager.getPackageInfo()
+         for another app throws NameNotFoundException even when it's
+         installed, see InstalledBuilds.kt, which queries lastUpdateTime to
+         tell "already have this build" apart from "update available." The
+         normal fix is a static queries allowlist, but that means a
+         manifest edit and a rebuild of this app every time a new app is
+         added to serve_apk.py's /manifest, which defeats the point of
+         driving the app list from that manifest in the first place. This
+         is a Play Store *policy* restriction (apps requesting it without
+         an approved use case get rejected from the Store), not something
+         the OS itself enforces, so it's free to declare here since this
+         app is never distributed through Play. F-Droid, a comparable
+         sideloaded app store/updater, does the same for the same reason. -->
+    <!-- Suppressed on this one permission only, never on the file or the
+         project. Lint is right that a queries declaration is normally the
+         answer, and the paragraph above is why it cannot be one here: the
+         packages to ask about are whatever the server's manifest lists at
+         runtime, which nothing declared at compile time can name. Left
+         unsuppressed this is the only error in an otherwise clean lint
+         run, and a check that always fails is a check nobody runs. -->
+    <uses-permission
+        android:name="android.permission.QUERY_ALL_PACKAGES"
+        tools:ignore="QueryAllPackagesPermission" />
+    <!-- Self-lookups are always visible regardless of the above; no
+         queries entry needed for this app's own package. -->
+
+    <application
+        android:label="Dev Updater"
+        android:allowBackup="true"
+        android:usesCleartextTraffic="true"
+        android:theme="@android:style/Theme.Material.Light.NoActionBar">
+        <activity
+            android:name=".MainActivity"
+            android:exported="true"
+            android:launchMode="singleTop"
+            android:theme="@android:style/Theme.Material.Light.NoActionBar">
+            <intent-filter>
+                <action android:name="android.intent.action.MAIN" />
+                <category android:name="android.intent.category.LAUNCHER" />
+            </intent-filter>
+            <!-- Enrollment: the server prints its devupdater://enroll QR to
+                 the terminal. This intent filter is the fallback path for a
+                 camera app that redirects a scanned devupdater:// URI here
+                 directly; the "Scan QR code" button on the not-enrolled
+                 screen (zxing-android-embedded) is the primary path and
+                 needs no filter, since it decodes the QR itself and hands
+                 the URI to parseEnrollmentUri in-process. -->
+            <intent-filter>
+                <action android:name="android.intent.action.VIEW" />
+                <category android:name="android.intent.category.DEFAULT" />
+                <category android:name="android.intent.category.BROWSABLE" />
+                <data android:scheme="devupdater" android:host="enroll" />
+            </intent-filter>
+        </activity>
+
+        <!-- The scanner behind the not-enrolled screen's "Scan QR code".
+             Declared here so it can drop the library CaptureActivity's
+             landscape pin: the code being scanned is usually on a monitor
+             in front of someone holding the phone upright.
+             zxing_CaptureTheme is the library's own fullscreen theme,
+             which is all the activity needs. -->
+        <activity
+            android:name="com.example.wgapplink.EnrollmentScanActivity"
+            android:clearTaskOnLaunch="true"
+            android:screenOrientation="fullSensor"
+            android:stateNotNeeded="true"
+            android:theme="@style/zxing_CaptureTheme"
+            android:windowSoftInputMode="stateAlwaysHidden" />
+
+        <!-- Exposes downloaded APKs (private app storage, see
+             ApkInstaller.kt's downloadApk()) to the system package
+             installer without making them world-readable. -->
+        <provider
+            android:name="androidx.core.content.FileProvider"
+            android:authorities="com.example.devupdater.fileprovider"
+            android:exported="false"
+            android:grantUriPermissions="true">
+            <meta-data
+                android:name="android.support.FILE_PROVIDER_PATHS"
+                android:resource="@xml/file_paths" />
+        </provider>
+    </application>
+</manifest>
diff --git a/app/androidApp/src/main/kotlin/com/example/devupdater/AddAppScreen.kt b/app/androidApp/src/main/kotlin/com/example/devupdater/AddAppScreen.kt
new file mode 100644
index 0000000..82c1571
--- /dev/null
+++ b/app/androidApp/src/main/kotlin/com/example/devupdater/AddAppScreen.kt
@@ -0,0 +1,448 @@
+package com.example.devupdater
+
+import androidx.compose.foundation.layout.Arrangement
+import androidx.compose.foundation.layout.Box
+import androidx.compose.foundation.layout.Column
+import androidx.compose.foundation.layout.PaddingValues
+import androidx.compose.foundation.layout.Row
+import androidx.compose.foundation.layout.Spacer
+import androidx.compose.foundation.layout.fillMaxSize
+import androidx.compose.foundation.layout.fillMaxWidth
+import androidx.compose.foundation.layout.height
+import androidx.compose.foundation.layout.imePadding
+import androidx.compose.foundation.layout.padding
+import androidx.compose.foundation.layout.width
+import androidx.compose.foundation.lazy.LazyColumn
+import androidx.compose.foundation.lazy.items
+import androidx.compose.foundation.text.KeyboardActions
+import androidx.compose.foundation.text.KeyboardOptions
+import androidx.compose.material3.Button
+import androidx.compose.material3.CardDefaults
+import androidx.compose.material3.CircularProgressIndicator
+import androidx.compose.material3.MaterialTheme
+import androidx.compose.material3.OutlinedCard
+import androidx.compose.material3.OutlinedTextField
+import androidx.compose.material3.Scaffold
+import androidx.compose.material3.SnackbarHost
+import androidx.compose.material3.SnackbarHostState
+import androidx.compose.material3.Text
+import androidx.compose.material3.TextButton
+import androidx.compose.runtime.Composable
+import androidx.compose.runtime.LaunchedEffect
+import androidx.compose.runtime.getValue
+import androidx.compose.runtime.mutableStateOf
+import androidx.compose.runtime.remember
+import androidx.compose.runtime.rememberCoroutineScope
+import androidx.compose.runtime.setValue
+import androidx.compose.ui.Alignment
+import androidx.compose.ui.Modifier
+import androidx.compose.ui.semantics.contentDescription
+import androidx.compose.ui.semantics.semantics
+import androidx.compose.ui.text.input.ImeAction
+import androidx.compose.ui.unit.dp
+import androidx.compose.ui.unit.sp
+import kotlinx.coroutines.Dispatchers
+import kotlinx.coroutines.launch
+import kotlinx.coroutines.withContext
+
+/**
+ * Adds an app to the list, by project path.
+ *
+ * Two ways in, because typing an absolute path on a phone keyboard is the real cost here: the
+ * suggestion list (what the server found under the configured repo roots) covers the normal case in
+ * one tap, and the free-text field below covers anything living outside those roots.
+ *
+ * The path is always to the *project*, never to an APK: the server rediscovers the build underneath
+ * it on every request, so a rebuild -- or one that lands in a different variant directory -- needs
+ * no reconfiguration here.
+ *
+ * Outcomes -- both the server's rejection messages and confirmations -- are reported through a
+ * snackbar rather than text on the screen: the triggering control can be anywhere in a long
+ * scrolling list, and by the time an "add" comes back the banner position is often scrolled out of
+ * view, so a message there would go unseen exactly when it matters.
+ *
+ * @param onChanged invoked after any successful change, so the list screen behind this one can
+ *   refetch rather than guessing at the new state.
+ */
+@Composable
+fun AddAppScreen(onAdded: (key: String) -> Unit, onBack: () -> Unit) {
+    val scope = rememberCoroutineScope()
+
+    val snackbar = remember { SnackbarHostState() }
+    var suggestions by remember { mutableStateOf<Suggestions?>(null) }
+    // Only the initial load reports failure on the screen itself: there is
+    // nothing else to show at that point, and it usually means the server
+    // is unreachable rather than one action having been refused.
+    var loadError by remember { mutableStateOf<String?>(null) }
+    var busy by remember { mutableStateOf(false) }
+    // The server is walking the repo roots. Shown rather than left silent
+    // because a rescan runs after every change here, and until it lands
+    // the list below is the state from *before* that change.
+    var scanning by remember { mutableStateOf(false) }
+    var newRoot by remember { mutableStateOf("") }
+    var pathText by remember { mutableStateOf("") }
+
+    fun loadSuggestions() {
+        scanning = true
+        scope.launch {
+            try {
+                val loaded = withContext(Dispatchers.IO) { fetchSuggestions() }
+                suggestions = loaded
+                loadError = null
+            } catch (e: DownloadServerException) {
+                loadError = e.message
+            } finally {
+                scanning = false
+            }
+        }
+    }
+
+    /**
+     * Runs one management call, then refetches so what's shown is the server's state, not a guess.
+     *
+     * [onSuccess] runs after [action] on the calling (main) dispatcher -- for UI state such as
+     * clearing a text field, which [action] itself must not touch since it runs on
+     * [Dispatchers.IO].
+     */
+    fun run(describe: String? = null, onSuccess: () -> Unit = {}, action: () -> Unit) {
+        if (busy) return
+        busy = true
+        scope.launch {
+            try {
+                withContext(Dispatchers.IO) { action() }
+                onSuccess()
+                loadSuggestions()
+                // Only where nothing on screen would otherwise show that
+                // it worked. Adding an app needs no announcement: the card
+                // it was added from says "Already added" the moment the
+                // rescan lands, which is the same fact sooner and without
+                // covering the list to say it.
+                describe?.let { snackbar.showSnackbar(it) }
+            } catch (e: DownloadServerException) {
+                // The server's message explains what to do about it ("point
+                // this at the app's project directory and build it once
+                // first"), so it's shown verbatim and kept up until
+                // dismissed rather than timing out mid-read.
+                snackbar.showSnackbar(
+                    e.message ?: "Failed",
+                    withDismissAction = true,
+                    duration = androidx.compose.material3.SnackbarDuration.Indefinite,
+                )
+            } finally {
+                busy = false
+            }
+        }
+    }
+
+    LaunchedEffect(Unit) { loadSuggestions() }
+
+    Scaffold(
+        // imePadding so the snackbar rides above the on-screen keyboard,
+        // which is otherwise up whenever a text field is in use -- exactly
+        // when a message is most likely to arrive.
+        modifier = Modifier.imePadding(),
+        snackbarHost = { SnackbarHost(snackbar) },
+    ) { insets ->
+        Column(Modifier.fillMaxSize().padding(insets).padding(16.dp)) {
+            Row(
+                verticalAlignment = Alignment.CenterVertically,
+                modifier = Modifier.fillMaxWidth(),
+            ) {
+                Text("Add an app", style = MaterialTheme.typography.headlineSmall)
+                // An add, a remove or a roots change is in flight. The
+                // controls go disabled anyway, but that says "not now"
+                // rather than "working on it".
+                if (busy) {
+                    Spacer(Modifier.width(8.dp))
+                    Working()
+                }
+            }
+            Spacer(Modifier.height(8.dp))
+
+            loadError?.let {
+                Text(it, color = MaterialTheme.colorScheme.error)
+                Spacer(Modifier.height(8.dp))
+            }
+
+            LazyColumn(Modifier.weight(1f)) {
+                item {
+                    Row(verticalAlignment = Alignment.CenterVertically) {
+                        Text("Found projects", style = MaterialTheme.typography.titleSmall)
+                        // Only once there is a list to be stale: before
+                        // that, the spinner below stands in for the whole
+                        // section rather than sitting beside a heading with
+                        // nothing under it.
+                        if (scanning && suggestions != null) {
+                            Spacer(Modifier.width(6.dp))
+                            Working()
+                        }
+                    }
+                    Spacer(Modifier.height(8.dp))
+                }
+
+                val found = suggestions
+                // What is already in the list isn't a suggestion: this
+                // section is for choosing something to add, and a row that
+                // can only tell you it has been added is one more thing to
+                // read past every time.
+                val addable = found?.projects.orEmpty().filterNot { it.added }
+                if (found == null) {
+                    item { CircularProgressIndicator() }
+                } else if (addable.isEmpty()) {
+                    item {
+                        Text(
+                            when {
+                                found.roots.isEmpty() ->
+                                    "No directories to scan yet -- add one under \"Scan " +
+                                        "directories\" below."
+                                // Told apart deliberately: "nothing here"
+                                // and "you already have all of it" are
+                                // different answers, and only one of them
+                                // is a reason to go looking at the paths.
+                                found.projects.isEmpty() ->
+                                    "Nothing found under the directories being scanned. A " +
+                                        "project shows up here once it has been built at " +
+                                        "least once, or as soon as it carries a " +
+                                        ".dev-updater.ron of its own."
+                                else ->
+                                    "Every project found under the directories being scanned " +
+                                        "has been added already."
+                            },
+                            style = MaterialTheme.typography.bodyMedium,
+                            color = MaterialTheme.colorScheme.onSurfaceVariant,
+                        )
+                    }
+                } else {
+                    items(addable, key = { it.path }) { project ->
+                        SuggestionCard(
+                            project = project,
+                            busy = busy,
+                            onAdd = {
+                                // The key comes back from the add so the
+                                // list can fetch that one app rather than
+                                // reloading itself to find it.
+                                var key: String? = null
+                                run(onSuccess = { key?.let(onAdded) }) {
+                                    key = addApp(project.path)
+                                }
+                            },
+                        )
+                        Spacer(Modifier.height(8.dp))
+                    }
+                }
+
+                item {
+                    Spacer(Modifier.height(16.dp))
+                    Text("Or add by path", style = MaterialTheme.typography.titleSmall)
+                    Spacer(Modifier.height(8.dp))
+                    // The button beside the field rather than under it, so
+                    // the pair reads as one control and the section is one
+                    // row tall instead of three.
+                    Row(
+                        verticalAlignment = Alignment.CenterVertically,
+                        modifier = Modifier.fillMaxWidth(),
+                    ) {
+                        OutlinedTextField(
+                            value = pathText,
+                            onValueChange = { pathText = it },
+                            label = { Text("Project directory") },
+                            placeholder = { Text("/path/to/project") },
+                            singleLine = true,
+                            keyboardOptions = KeyboardOptions(imeAction = ImeAction.Done),
+                            modifier = Modifier.weight(1f),
+                        )
+                        RowGlyphButton(
+                            glyph = PLUS_GLYPH,
+                            label = "Add this path",
+                            enabled = !busy && pathText.isNotBlank(),
+                            tone = ActionTone.Go,
+                            onClick = {
+                                val path = pathText.trim()
+                                var key: String? = null
+                                run(
+                                    onSuccess = {
+                                        pathText = ""
+                                        key?.let(onAdded)
+                                    }
+                                ) {
+                                    key = addApp(path)
+                                }
+                            },
+                        )
+                    }
+                }
+
+                // Last: this is set once and then rarely touched, unlike
+                // the two sections above it.
+                item {
+                    Spacer(Modifier.height(24.dp))
+                    Text("Scan directories", style = MaterialTheme.typography.titleSmall)
+                    Spacer(Modifier.height(8.dp))
+
+                    val roots = suggestions?.roots.orEmpty()
+                    roots.forEach { root ->
+                        // Editable in place: correcting a typo in a path
+                        // otherwise meant deleting the row and typing the
+                        // whole thing again. Keyed on what the server last
+                        // said, so a saved edit is replaced by what was
+                        // actually stored rather than left as typed.
+                        var edited by remember(root) { mutableStateOf(root) }
+                        Row(
+                            verticalAlignment = Alignment.CenterVertically,
+                            modifier = Modifier.fillMaxWidth(),
+                        ) {
+                            OutlinedTextField(
+                                value = edited,
+                                onValueChange = { edited = it },
+                                enabled = !busy,
+                                singleLine = true,
+                                keyboardOptions = KeyboardOptions(imeAction = ImeAction.Done),
+                                keyboardActions =
+                                    KeyboardActions(
+                                        onDone = {
+                                            val wanted = edited.trim()
+                                            if (wanted.isNotEmpty() && wanted != root) {
+                                                run {
+                                                    setRepoRoots(
+                                                        roots.map { if (it == root) wanted else it }
+                                                    )
+                                                }
+                                            }
+                                        }
+                                    ),
+                                modifier = Modifier.weight(1f),
+                            )
+                            RowGlyphButton(
+                                glyph = TRASH_GLYPH,
+                                label = "Stop scanning $root",
+                                enabled = !busy,
+                                tone = ActionTone.Destructive,
+                                onClick = { run { setRepoRoots(roots.filterNot { it == root }) } },
+                            )
+                        }
+                        Spacer(Modifier.height(4.dp))
+                    }
+
+                    // Adding is the text field plus the button beside it,
+                    // so there is no separate save step to forget: the
+                    // server rescans as part of the same call.
+                    Row(
+                        verticalAlignment = Alignment.CenterVertically,
+                        modifier = Modifier.fillMaxWidth(),
+                    ) {
+                        OutlinedTextField(
+                            value = newRoot,
+                            onValueChange = { newRoot = it },
+                            label = { Text("Add a directory") },
+                            placeholder = { Text("~/repos") },
+                            singleLine = true,
+                            keyboardOptions = KeyboardOptions(imeAction = ImeAction.Done),
+                            modifier = Modifier.weight(1f),
+                        )
+                        RowGlyphButton(
+                            glyph = PLUS_GLYPH,
+                            label = "Scan this directory",
+                            enabled = !busy && newRoot.isNotBlank(),
+                            tone = ActionTone.Go,
+                            onClick = {
+                                val added = newRoot.trim()
+                                run(onSuccess = { newRoot = "" }) { setRepoRoots(roots + added) }
+                            },
+                        )
+                    }
+                }
+            }
+
+            // Its own row, outside the scrolling list, so the way out is in
+            // the same place however far down somebody has got -- a long
+            // list must never put it below the fold.
+            Spacer(Modifier.height(8.dp))
+            Row(
+                horizontalArrangement = Arrangement.End,
+                modifier = Modifier.fillMaxWidth(),
+            ) {
+                Button(onClick = onBack) { Text("Done") }
+            }
+        }
+    }
+}
+
+/**
+ * The control at the end of one of this screen's rows: a plus, or a trash can.
+ *
+ * All of them are the same width, so every text field beside them ends at the same place -- rows of
+ * fields that stop at different points read as accidental, and these three are the same kind of
+ * row.
+ */
+@Composable
+private fun RowGlyphButton(
+    glyph: String,
+    label: String,
+    enabled: Boolean,
+    tone: ActionTone,
+    onClick: () -> Unit,
+) {
+    TextButton(
+        onClick = onClick,
+        enabled = enabled,
+        colors = tone.colors(),
+        contentPadding = PaddingValues(0.dp),
+        modifier = Modifier.width(ROW_CONTROL_WIDTH).semantics { contentDescription = label },
+    ) {
+        Text(glyph, fontFamily = NerdIcons, fontSize = 22.sp)
+    }
+}
+
+/** Shared by every trailing control here, so the fields all end level. */
+private val ROW_CONTROL_WIDTH = 56.dp
+
+@Composable
+private fun SuggestionCard(project: ProjectSuggestion, busy: Boolean, onAdd: () -> Unit) {
+    // Darker than the sheet it sits on, and outlined -- the same step the
+    // component cards make inside a project card. Filled, it was a shade
+    // off the surface behind it and read as part of it.
+    OutlinedCard(
+        modifier = Modifier.fillMaxWidth(),
+        colors =
+            CardDefaults.outlinedCardColors(containerColor = MaterialTheme.colorScheme.surface),
+    ) {
+        // The button is placed over the card rather than in a row with the
+        // build count. A Button is a good deal taller than the line beside
+        // it, so sharing a row made that row the button's height and left
+        // the count floating in the middle of it -- a card offering Add
+        // then didn't line up with the one above it saying "Already
+        // added". Out of the column's flow, the card reads the same
+        // whatever is in its corner.
+        Box(Modifier.fillMaxWidth().padding(12.dp)) {
+            Column {
+                Text(project.name, style = MaterialTheme.typography.titleMedium)
+                Text(
+                    project.path,
+                    style = MaterialTheme.typography.bodySmall,
+                    color = MaterialTheme.colorScheme.onSurfaceVariant,
+                )
+                Spacer(Modifier.height(4.dp))
+                Text(
+                    // Zero happens for a project that declares itself in a
+                    // .dev-updater.ron without having been built yet --
+                    // usually one whose build step is what produces the
+                    // first APK.
+                    when (project.apkCount) {
+                        0 -> "Not built yet"
+                        1 -> "1 build"
+                        else -> "${project.apkCount} builds"
+                    },
+                    style = MaterialTheme.typography.bodySmall,
+                    color = MaterialTheme.colorScheme.onSurfaceVariant,
+                )
+            }
+            Button(
+                enabled = !busy,
+                onClick = onAdd,
+                modifier = Modifier.align(Alignment.BottomEnd),
+            ) {
+                Text("Add")
+            }
+        }
+    }
+}
diff --git a/app/androidApp/src/main/kotlin/com/example/devupdater/AnsiLog.kt b/app/androidApp/src/main/kotlin/com/example/devupdater/AnsiLog.kt
new file mode 100644
index 0000000..603618c
--- /dev/null
+++ b/app/androidApp/src/main/kotlin/com/example/devupdater/AnsiLog.kt
@@ -0,0 +1,234 @@
+package com.example.devupdater
+
+import androidx.compose.ui.graphics.Color
+import androidx.compose.ui.text.AnnotatedString
+import androidx.compose.ui.text.SpanStyle
+import androidx.compose.ui.text.buildAnnotatedString
+import androidx.compose.ui.text.font.FontStyle
+import androidx.compose.ui.text.font.FontWeight
+import androidx.compose.ui.text.style.TextDecoration
+import androidx.compose.ui.text.withStyle
+
+/**
+ * Renders a log's ANSI escape sequences instead of showing them.
+ *
+ * Anything that writes to a terminal writes colour, and a service's output is a file only because
+ * something redirected it -- so the escapes arrive here whether or not anybody wanted them. Drawn
+ * rather than deleted, because the colour is information: it is how the process itself marked which
+ * lines are errors, and dropping it throws that away at the moment somebody is reading the log to
+ * find exactly those lines.
+ *
+ * The escapes are understood here rather than removed at the build machine because this is the end
+ * that knows what a colour should look like. The wire stays plain text, and [AnnotatedString.text]
+ * is the log without any of it -- which is what the Copy button puts on the clipboard, since escape
+ * codes are not what anyone wants to paste.
+ *
+ * **Sequences this does not understand are dropped, never printed.** Cursor movement, erase-line
+ * and the rest are meaningless without a terminal to act on, and leaving them in as text would be
+ * worse than the colours were: they would look like corruption in the log rather than like
+ * something the viewer chose not to do. So every escape is consumed; only the ones below have an
+ * effect.
+ */
+fun ansiAnnotated(text: String, base: Color): AnnotatedString {
+    val runs = parse(text, base)
+    return buildAnnotatedString {
+        for (run in runs) {
+            withStyle(run.style) { append(run.text) }
+        }
+    }
+}
+
+private const val ESC = ''
+
+/** The final byte of a CSI sequence is in this range; everything before it is parameters. */
+private val CSI_END = '@'..'~'
+
+private class Run(val text: String, val style: SpanStyle)
+
+/**
+ * The state a terminal carries between escapes.
+ *
+ * Held as fields rather than as a [SpanStyle] so that "no colour set" stays distinguishable from
+ * "the colour happens to be the default one" -- 39 (default foreground) has to be able to undo a
+ * previous 31 without knowing what 31 was.
+ */
+private data class Sgr(
+    val bold: Boolean = false,
+    val dim: Boolean = false,
+    val italic: Boolean = false,
+    val underline: Boolean = false,
+    val fg: Color? = null,
+    val bg: Color? = null,
+) {
+    /**
+     * Dim has no weight of its own in Compose, so it is drawn as reduced opacity on whatever the
+     * colour would otherwise be -- including the body colour, which is why [base] is needed here
+     * rather than left to the caller.
+     */
+    fun style(base: Color): SpanStyle {
+        val colour = fg ?: base
+        return SpanStyle(
+            color = if (dim) colour.copy(alpha = DIM_ALPHA) else colour,
+            background = bg ?: Color.Unspecified,
+            fontWeight = if (bold) FontWeight.Bold else null,
+            fontStyle = if (italic) FontStyle.Italic else null,
+            textDecoration = if (underline) TextDecoration.Underline else null,
+        )
+    }
+}
+
+/** Enough to read as quieter than the text beside it, while staying legible. */
+private const val DIM_ALPHA = 0.65f
+
+private fun parse(text: String, base: Color): List<Run> {
+    val runs = mutableListOf<Run>()
+    val pending = StringBuilder()
+    var sgr = Sgr()
+    var index = 0
+
+    fun flush() {
+        if (pending.isNotEmpty()) {
+            runs.add(Run(pending.toString(), sgr.style(base)))
+            pending.clear()
+        }
+    }
+
+    while (index < text.length) {
+        val char = text[index]
+        if (char != ESC) {
+            pending.append(char)
+            index++
+            continue
+        }
+        val next = text.getOrNull(index + 1)
+        when (next) {
+            '[' -> {
+                var end = index + 2
+                while (end < text.length && text[end] !in CSI_END) end++
+                if (end >= text.length) {
+                    // Cut off mid-sequence, which is what reading the tail
+                    // of a file does to whatever the first line was. There
+                    // is nothing after it to draw, so there is nothing to
+                    // decide.
+                    index = text.length
+                } else {
+                    if (text[end] == 'm') {
+                        flush()
+                        sgr = sgr.apply(text.substring(index + 2, end))
+                    }
+                    index = end + 1
+                }
+            }
+            // OSC: runs until BEL or the two-character string terminator.
+            // Consumed whole, since its payload is a window title or a
+            // hyperlink target rather than anything to show.
+            ']' -> {
+                var end = index + 2
+                while (end < text.length && text[end] != '') {
+                    if (text[end] == ESC && text.getOrNull(end + 1) == '\\') break
+                    end++
+                }
+                index = if (end >= text.length) text.length else end + 1
+            }
+            null -> index = text.length
+            // A two-character escape. Nothing here acts on one, so it goes.
+            else -> index += 2
+        }
+    }
+    flush()
+    return runs
+}
+
+/**
+ * Applies one SGR sequence's parameters.
+ *
+ * An empty parameter list means 0 (reset), which is what a bare `ESC[m` is; a code this does not
+ * know is skipped without disturbing the rest, so one unrecognised attribute cannot take the
+ * colours with it.
+ */
+private fun Sgr.apply(parameters: String): Sgr {
+    val codes = parameters.split(';').map { it.trim().toIntOrNull() ?: 0 }
+    var state = this
+    var index = 0
+    while (index < codes.size) {
+        when (val code = codes[index]) {
+            0 -> state = Sgr()
+            1 -> state = state.copy(bold = true)
+            2 -> state = state.copy(dim = true)
+            3 -> state = state.copy(italic = true)
+            4 -> state = state.copy(underline = true)
+            22 -> state = state.copy(bold = false, dim = false)
+            23 -> state = state.copy(italic = false)
+            24 -> state = state.copy(underline = false)
+            39 -> state = state.copy(fg = null)
+            49 -> state = state.copy(bg = null)
+            in 30..37 -> state = state.copy(fg = AnsiColors[code - 30])
+            in 90..97 -> state = state.copy(fg = AnsiColors[code - 90 + 8])
+            in 40..47 -> state = state.copy(bg = AnsiColors[code - 40])
+            in 100..107 -> state = state.copy(bg = AnsiColors[code - 100 + 8])
+            38,
+            48 -> {
+                val extended = extendedColour(codes, index)
+                if (extended == null) {
+                    // Malformed: the rest of this sequence cannot be
+                    // trusted to be parameters, so stop reading it rather
+                    // than treat a colour component as a code of its own.
+                    return state
+                }
+                state =
+                    if (code == 38) state.copy(fg = extended.first)
+                    else state.copy(bg = extended.first)
+                index = extended.second
+            }
+            else -> {} // Not understood, and so not applied.
+        }
+        index++
+    }
+    return state
+}
+
+/**
+ * Reads a `5;n` (256-colour) or `2;r;g;b` (24-bit) argument that follows a 38 or 48.
+ *
+ * Returns the colour and the index of its last parameter, or null if the sequence is too short to
+ * be either.
+ */
+private fun extendedColour(codes: List<Int>, at: Int): Pair<Color, Int>? =
+    when (codes.getOrNull(at + 1)) {
+        5 -> codes.getOrNull(at + 2)?.let { Pair(paletteColour(it), at + 2) }
+        2 -> {
+            val red = codes.getOrNull(at + 2)
+            val green = codes.getOrNull(at + 3)
+            val blue = codes.getOrNull(at + 4)
+            if (red == null || green == null || blue == null) null
+            else
+                Pair(
+                    Color(red.coerceIn(0, 255), green.coerceIn(0, 255), blue.coerceIn(0, 255)),
+                    at + 4,
+                )
+        }
+        else -> null
+    }
+
+/**
+ * One of the 256 palette colours.
+ *
+ * The first sixteen are the named ones, and so come from [AnsiColors] for the same reason those do.
+ * The rest are defined by the standard as arithmetic -- a 6x6x6 cube and a 24-step grey ramp -- so
+ * they are computed rather than mapped: they are already exact values rather than names, and there
+ * is nothing to translate.
+ */
+private fun paletteColour(index: Int): Color =
+    when (index) {
+        in 0..15 -> AnsiColors[index]
+        in 16..231 -> {
+            val offset = index - 16
+            val steps = intArrayOf(0, 95, 135, 175, 215, 255)
+            Color(steps[offset / 36], steps[(offset / 6) % 6], steps[offset % 6])
+        }
+        in 232..255 -> {
+            val grey = 8 + (index - 232) * 10
+            Color(grey, grey, grey)
+        }
+        else -> AnsiColors[7]
+    }
diff --git a/app/androidApp/src/main/kotlin/com/example/devupdater/ApkInstaller.kt b/app/androidApp/src/main/kotlin/com/example/devupdater/ApkInstaller.kt
new file mode 100644
index 0000000..5ae3b7c
--- /dev/null
+++ b/app/androidApp/src/main/kotlin/com/example/devupdater/ApkInstaller.kt
@@ -0,0 +1,121 @@
+package com.example.devupdater
+
+import android.content.Context
+import android.content.Intent
+import android.net.Uri
+import android.os.Build
+import android.provider.Settings
+import androidx.core.content.FileProvider
+import java.io.File
+import java.net.URLEncoder
+
+private const val DOWNLOAD_READ_TIMEOUT_MS = 15000
+
+// Downloads into this app's own private storage (`filesDir/apks/`, never
+// the shared Downloads directory) so there's nothing left behind to clean
+// up by hand -- each key's file is simply overwritten in place on the next
+// update, and a partial download (`.part`) never gets handed to the
+// installer.
+//
+// Never how a *first* install of this app happens: that goes over the
+// server's separate plain-HTTP bootstrap port, which is the one thing this
+// app's own code never talks to.
+fun downloadApk(
+    context: Context,
+    entry: ManifestEntry,
+    onProgress: (bytesRead: Long, total: Long) -> Unit,
+): File {
+    // The chosen build travels with the request rather than being
+    // stored on the server: it is this device's preference, and a
+    // second phone must not have its download changed by it. The
+    // server checks the path against the builds it can see, so a stale
+    // one falls back to the newest rather than naming a file.
+    val route =
+        when (val variant = chosenVariant(context, entry.key)) {
+            null -> entry.route
+            else -> "${entry.route}?variant=${URLEncoder.encode(variant, "UTF-8")}"
+        }
+    return downloadFromRoute(context, route, entry.key, onProgress)
+}
+
+/**
+ * Fetches one APK from [route] into private storage, named [name], and returns the file.
+ *
+ * Split from [downloadApk] because the app's own rescue path
+ * ([com.example.devupdater.SELF_APK_ROUTE]) must not need a [ManifestEntry] to reach it -- the
+ * manifest is exactly what an app too old to read it cannot use. One implementation so both get the
+ * same partial-file handling and the same progress reporting.
+ */
+fun downloadFromRoute(
+    context: Context,
+    route: String,
+    name: String,
+    onProgress: (bytesRead: Long, total: Long) -> Unit,
+): File {
+    val dir = File(context.filesDir, "apks").apply { mkdirs() }
+    val dest = File(dir, "$name.apk")
+    val tmp = File(dir, "$name.apk.part")
+
+    try {
+        requestFromServer(route, readTimeoutMs = DOWNLOAD_READ_TIMEOUT_MS) { connection ->
+            val total = connection.contentLengthLong
+            connection.inputStream.use { input ->
+                tmp.outputStream().use { output ->
+                    val buffer = ByteArray(65536)
+                    var readTotal = 0L
+                    while (true) {
+                        val read = input.read(buffer)
+                        if (read == -1) break
+                        output.write(buffer, 0, read)
+                        readTotal += read
+                        onProgress(readTotal, total)
+                    }
+                }
+            }
+        }
+    } catch (e: DownloadServerException) {
+        // The half-written file is worthless and would otherwise sit in
+        // private storage until the next successful download overwrote it.
+        tmp.delete()
+        throw e
+    }
+
+    if (!tmp.renameTo(dest)) {
+        tmp.copyTo(dest, overwrite = true)
+        tmp.delete()
+    }
+    return dest
+}
+
+// Android 8+ requires this app to hold "install unknown apps" for itself
+// specifically before the install intent below will do anything but bounce
+// back to a settings prompt -- checked explicitly up front so the caller
+// can send the user straight to that settings screen with a clear reason,
+// instead of a silent no-op tap.
+/**
+ * Asks the system to remove [packageName], which shows its own confirmation dialog before anything
+ * happens.
+ *
+ * ACTION_DELETE rather than PackageInstaller.uninstall(): it needs no permission at all, where the
+ * newer call wants REQUEST_DELETE_PACKAGES to put up the same dialog. Removing someone's app is not
+ * a thing to do quietly on their behalf, so the dialog is the point rather than a limitation being
+ * worked around.
+ */
+fun uninstallIntent(packageName: String): Intent =
+    Intent(Intent.ACTION_DELETE, Uri.parse("package:$packageName"))
+
+fun canRequestInstall(context: Context): Boolean =
+    Build.VERSION.SDK_INT < Build.VERSION_CODES.O ||
+        context.packageManager.canRequestPackageInstalls()
+
+fun requestInstallPermissionIntent(context: Context): Intent =
+    Intent(Settings.ACTION_MANAGE_UNKNOWN_APP_SOURCES, Uri.parse("package:${context.packageName}"))
+
+fun installApkIntent(context: Context, apkFile: File): Intent {
+    val uri = FileProvider.getUriForFile(context, "${context.packageName}.fileprovider", apkFile)
+    return Intent(Intent.ACTION_VIEW).apply {
+        setDataAndType(uri, "application/vnd.android.package-archive")
+        addFlags(Intent.FLAG_GRANT_READ_URI_PERMISSION)
+        addFlags(Intent.FLAG_ACTIVITY_NEW_TASK)
+    }
+}
diff --git a/app/androidApp/src/main/kotlin/com/example/devupdater/AppsApi.kt b/app/androidApp/src/main/kotlin/com/example/devupdater/AppsApi.kt
new file mode 100644
index 0000000..299843a
--- /dev/null
+++ b/app/androidApp/src/main/kotlin/com/example/devupdater/AppsApi.kt
@@ -0,0 +1,263 @@
+package com.example.devupdater
+
+import org.json.JSONArray
+import org.json.JSONObject
+
+// The routes behind the Add screen -- everything that *changes* which apps
+// this server serves, as opposed to reading the current list (see
+// UpdateManifest.kt) or downloading one (ApkInstaller.kt).
+//
+// All blocking network calls -- invoke from a background dispatcher. Each
+// throws DownloadServerException on failure, carrying the server's own
+// explanation ("no built APK found under ...", "already added as ...")
+// rather than a status code, since that message is written to be read here
+// and this screen is usually the only place it can be seen.
+
+// A project the server found under one of the configured repo roots and
+// can offer to add: one with a build in it, or one declaring itself in a
+// .dev-updater.ron, which can be added before its first build.
+data class ProjectSuggestion(
+    val path: String,
+    // The project directory's own name. The real label is read out of the
+    // APK when it's actually added, which is why it can differ from what
+    // the card ends up showing.
+    val name: String,
+    val apkCount: Int,
+    val mtime: Double,
+    // Already in the app list -- shown, but not offered again.
+    val added: Boolean,
+)
+
+data class Suggestions(
+    val roots: List<String>,
+    val projects: List<ProjectSuggestion>,
+)
+
+fun fetchSuggestions(): Suggestions =
+    requestFromServer("/suggestions") { connection ->
+        val body = JSONObject(connection.inputStream.bufferedReader().readText())
+        val roots = body.getJSONArray("roots")
+        val found = body.getJSONArray("suggestions")
+        Suggestions(
+            roots = (0 until roots.length()).map { roots.getString(it) },
+            projects =
+                (0 until found.length()).map { i ->
+                    val item = found.getJSONObject(i)
+                    ProjectSuggestion(
+                        path = item.getString("path"),
+                        name = item.getString("name"),
+                        apkCount = item.getInt("apkCount"),
+                        mtime = item.getDouble("mtime"),
+                        added = item.getBoolean("added"),
+                    )
+                },
+        )
+    }
+
+/** Adds the project at [path], answering with the key it was given. */
+fun addApp(path: String): String =
+    requestFromServer("/apps", method = "POST", jsonBody = jsonOf("path" to path)) { connection ->
+        JSONObject(connection.inputStream.bufferedReader().readText()).getString("key")
+    }
+
+fun removeApp(key: String) {
+    requestFromServer("/apps/$key", method = "DELETE") {}
+}
+
+/**
+ * Accepts the build step [key]'s project asks for in its own `.dev-updater.ron`, after it has been
+ * shown on the card.
+ *
+ * Carries no body: the server re-reads the project's file and stores what it finds there, so this
+ * can only ever accept what the project actually asks for and never a command composed here.
+ */
+fun approveDeclaration(key: String) {
+    requestFromServer("/apps/$key/approve", method = "POST") {}
+}
+
+/** Replaces the directories the server scans for suggestions. */
+fun setRepoRoots(roots: List<String>) {
+    val body = JSONObject().put("roots", JSONArray(roots)).toString()
+    requestFromServer("/roots", method = "PUT", jsonBody = body) {}
+}
+
+// Built through JSONObject rather than string interpolation so a path
+// containing a quote or backslash can't produce a malformed request.
+private fun jsonOf(vararg pairs: Pair<String, Any>): String =
+    JSONObject().apply { pairs.forEach { (key, value) -> put(key, value) } }.toString()
+
+/**
+ * Asks a server component's script to do something, on the *build machine* -- these are the one set
+ * of buttons on this screen that don't act on this phone.
+ *
+ * Answers with the state the component ended up in, so the card can show the result of what was
+ * just done rather than waiting for the next background check to notice.
+ */
+fun serviceAction(
+    key: String,
+    component: String,
+    action: String,
+    purge: Purge = Purge(),
+): ServiceActionResult {
+    val query =
+        if (purge.nothing) "" else "?logs=${purge.logs}&data=${purge.data}&config=${purge.config}"
+    return requestFromServer("/apps/$key/components/$component/$action$query", "POST") { connection
+        ->
+        val answer = JSONObject(connection.inputStream.bufferedReader().readText())
+        val left = answer.optJSONArray("leftBehind")
+        ServiceActionResult(
+            state = answer.getString("state"),
+            leftBehind = (0 until (left?.length() ?: 0)).map { left!!.getString(it) },
+        )
+    }
+}
+
+/**
+ * What Uninstall should take away besides the service itself.
+ *
+ * All three default to off here, so a caller that says nothing gets what uninstalling has always
+ * done. The dialog's own defaults are its business, and they are not these -- logs start ticked
+ * there, because a record of what already happened is the cheap one to lose.
+ */
+data class Purge(
+    val logs: Boolean = false,
+    val data: Boolean = false,
+    val config: Boolean = false,
+) {
+    val nothing: Boolean
+        get() = !logs && !data && !config
+}
+
+/**
+ * What a service action ended in.
+ *
+ * [leftBehind] is what Uninstall was asked to remove and could not, one line each, and it is empty
+ * for every other action. Not an error: the service is gone by then, so the request succeeded --
+ * what is reported is that something is still on disk, which is the thing the person would
+ * otherwise have to go to the build machine to find out.
+ */
+data class ServiceActionResult(val state: String, val leftBehind: List<String>)
+
+/**
+ * Ask the server to check this one project's remote and services again.
+ *
+ * Returns as soon as the checks are started, not when they answer -- they run off the request path
+ * on the server, exactly as the ones a manifest fetch starts do, so the answer arrives through a
+ * later read of the card ([fetchApp]) or of the whole list.
+ */
+fun recheckApp(key: String) {
+    requestFromServer("/apps/$key/recheck", method = "POST") {}
+}
+
+/**
+ * Replaces this machine's preferences for one project.
+ *
+ * The whole set every time, not one field: the screen that sends this has just shown every setting
+ * there is, so it knows the complete answer, and a partial update would need a rule for what a
+ * missing field means.
+ */
+fun setAppSettings(key: String, gitIpv4: Boolean) {
+    requestFromServer(
+        "/apps/$key/settings",
+        method = "PUT",
+        jsonBody = jsonOf("gitIpv4" to gitIpv4),
+    ) {}
+}
+
+/** One component's log, as the modal shows it. */
+/**
+ * Which of a component's two logs to read.
+ *
+ * Two kinds rather than one list. They answer different questions -- [Build] is what the build
+ * machine captured while building this component, [Runtime] is what the component itself wrote
+ * while running -- and a single list indexed by generation could only ever reach the first of them.
+ */
+enum class LogKind(val wire: String) {
+    Build("build"),
+    Runtime("runtime"),
+}
+
+data class ComponentLog(
+    /** Where it came from, so somebody at the build machine can open the whole file. */
+    val path: String,
+    val text: String,
+    /**
+     * There is more than this. Said rather than implied: a silently shortened log reads as a
+     * complete one that simply fails to explain the crash.
+     */
+    val truncated: Boolean,
+    /** How many generations exist, so the modal knows whether to offer a previous one at all. */
+    val generations: Int,
+)
+
+/**
+ * The tail of one component's log, from the build machine.
+ *
+ * [lines] counts back from the end, which is where anything interesting is; 0 asks for as much as
+ * the server is willing to read, and it says so through [ComponentLog.truncated] when that bites.
+ * [generation] is 0 for the current run and 1 for the one before it -- an index rather than a
+ * "previous" flag, because the script reports a list and this should not assume its length. It
+ * counts within a [kind]: the build log's previous generation is not the runtime log's, which is
+ * why switching kinds starts again at the current one.
+ *
+ * Given the manifest's timeout rather than the default: a large log is a real request that takes
+ * real time, and timing it out would report the server as unreachable when it is merely reading.
+ */
+fun componentLog(
+    key: String,
+    component: String,
+    lines: Int,
+    generation: Int,
+    kind: LogKind,
+): ComponentLog =
+    requestFromServer(
+        "/apps/$key/components/$component/logs" +
+            "?lines=$lines&generation=$generation&kind=${kind.wire}",
+        readTimeoutMs = MANIFEST_READ_TIMEOUT_MS,
+    ) { connection ->
+        val body = JSONObject(connection.inputStream.bufferedReader().readText())
+        ComponentLog(
+            path = body.getString("path"),
+            text = body.getString("text"),
+            truncated = body.optBoolean("truncated", false),
+            generations = body.optInt("generations", 1),
+        )
+    }
+
+// ---------------------------------------------------------------------------
+// The rescue contract.
+//
+// These two routes are how this app replaces itself, and the server treats
+// their shape as frozen -- see routes.rs. Everything else in this file
+// reads the manifest, which is the thing that changes; an app too old to
+// parse a new manifest cannot reach the button that would replace it, and
+// the only way back from that is a reinstall over the plain-HTTP bootstrap
+// port, by hand, at the machine.
+//
+// So nothing here may grow a dependency on the manifest, on a variant, or
+// on any field that might be added later. Two numbers and some bytes.
+
+/** Where the app's own build lives. A constant, because the whole point is that it never moves. */
+const val SELF_APK_ROUTE = "/self/apk"
+
+/** What the build machine has of this app: when it was built, and how big it is. */
+data class SelfBuild(val mtimeMillis: Long, val sizeBytes: Long)
+
+/**
+ * Asks whether the build machine has a copy of this app, and how new it is.
+ *
+ * Compared against `PackageInfo.lastUpdateTime` by the caller, which is the same freshness rule the
+ * list uses -- these are ad hoc rebuilds with nothing bumping a version code, so the timestamp is
+ * all there is.
+ */
+fun selfBuild(): SelfBuild =
+    requestFromServer("/self") { connection ->
+        val body = JSONObject(connection.inputStream.bufferedReader().readText())
+        SelfBuild(
+            // Seconds on the wire, because that is what the server's other
+            // timestamps use; milliseconds here, because that is what
+            // Android reports for an installed package.
+            mtimeMillis = (body.getDouble("mtime") * 1000).toLong(),
+            sizeBytes = body.getLong("size"),
+        )
+    }
diff --git a/app/androidApp/src/main/kotlin/com/example/devupdater/BuildStatus.kt b/app/androidApp/src/main/kotlin/com/example/devupdater/BuildStatus.kt
new file mode 100644
index 0000000..595f962
--- /dev/null
+++ b/app/androidApp/src/main/kotlin/com/example/devupdater/BuildStatus.kt
@@ -0,0 +1,109 @@
+package com.example.devupdater
+
+import org.json.JSONObject
+
+// The three routes that act on the *build machine* rather than this
+// phone, all answering the same shape:
+//
+//   POST /apps/{key}/pull     fetch, fast-forward the branch, then build
+//   POST /apps/{key}/prepare  build if the configured staleness rule says so
+//   POST /apps/{key}/build    build whether or not anything looks stale
+//   GET  /apps/{key}/status   poll either of the above
+//
+// Only an entry with a configured build step has them; the others answer
+// 404, which is why the screen offers them only when the manifest says so
+// (needsBuild / canPull).
+data class BuildStatus(
+    val stale: Boolean,
+    val building: Boolean,
+    val error: String?,
+    // What the whole *project* is doing ("fetching", "pulling"), and how
+    // long this run has taken. Work belonging to one component is in
+    // [components] instead, because that is where it is drawn.
+    val phase: String?,
+    val elapsedMs: Long,
+    val components: List<ComponentBuild>,
+) {
+    /** This component's part of the run, if it has reached it yet. */
+    fun component(name: String): ComponentBuild? = components.firstOrNull { it.name == name }
+}
+
+/**
+ * One component's part of a build.
+ *
+ * Drawn inside that component's own row rather than under the project, because a bar under the
+ * whole card could only say that *something* was happening — and with every component building at
+ * once, that is exactly the question the reader has.
+ */
+data class ComponentBuild(
+    val name: String,
+    // What it is doing now ("building", "installing", "restarting"), or
+    // null once it has finished.
+    val step: String?,
+    val elapsedMs: Long,
+    val progress: BuildProgressCount?,
+    val log: List<String>,
+    val error: String?,
+) {
+    /** The last thing it printed, if anything yet. */
+    fun lastLine(): String? = log.lastOrNull()?.trim()?.takeIf { it.isNotEmpty() }
+
+    val running: Boolean
+        get() = step != null
+}
+
+data class BuildProgressCount(val done: Long, val total: Long)
+
+// Blocking network calls -- invoke from a background dispatcher. The server
+// answers both routes immediately either way -- a rebuild it kicks off runs
+// in a background thread there, not inline with the request -- so neither
+// needs the multi-minute read timeout an actual build would.
+private fun requestBuildStatus(path: String, method: String): BuildStatus =
+    requestFromServer(path, method) { connection ->
+        val json = JSONObject(connection.inputStream.bufferedReader().readText())
+        val components = json.optJSONArray("components")
+        BuildStatus(
+            stale = json.getBoolean("stale"),
+            building = json.getBoolean("building"),
+            error = if (json.isNull("error")) null else json.getString("error"),
+            phase = if (json.isNull("phase")) null else json.optString("phase").ifEmpty { null },
+            elapsedMs = json.optLong("elapsedMs", 0),
+            components =
+                (0 until (components?.length() ?: 0)).map { index ->
+                    val component = components!!.getJSONObject(index)
+                    val log = component.optJSONArray("log")
+                    ComponentBuild(
+                        name = component.getString("name"),
+                        step =
+                            if (component.isNull("step")) null
+                            else component.optString("step").ifEmpty { null },
+                        elapsedMs = component.optLong("elapsedMs", 0),
+                        progress =
+                            component.optJSONObject("progress")?.let {
+                                BuildProgressCount(
+                                    done = it.getLong("done"),
+                                    total = it.getLong("total"),
+                                )
+                            },
+                        log = (0 until (log?.length() ?: 0)).map { line -> log!!.getString(line) },
+                        error =
+                            if (component.isNull("error")) null else component.getString("error"),
+                    )
+                },
+        )
+    }
+
+fun pullAndBuild(key: String): BuildStatus = requestBuildStatus("/apps/$key/pull", "POST")
+
+fun prepareBuild(key: String): BuildStatus = requestBuildStatus("/apps/$key/prepare", "POST")
+
+/**
+ * Builds because the person asked, not because anything looked stale.
+ *
+ * The staleness rules keep a download from rebuilding the world; they have no business overruling a
+ * button. This is also the only way a project already current with its checkout ever records what
+ * it was built from, which is what the "out of date" signal is compared against.
+ */
+fun buildNow(key: String): BuildStatus = requestBuildStatus("/apps/$key/build", "POST")
+
+fun buildStatus(key: String): BuildStatus = requestBuildStatus("/apps/$key/status", "GET")
diff --git a/app/androidApp/src/main/kotlin/com/example/devupdater/ComponentLogDialog.kt b/app/androidApp/src/main/kotlin/com/example/devupdater/ComponentLogDialog.kt
new file mode 100644
index 0000000..c521461
--- /dev/null
+++ b/app/androidApp/src/main/kotlin/com/example/devupdater/ComponentLogDialog.kt
@@ -0,0 +1,363 @@
+package com.example.devupdater
+
+import android.content.ClipData
+import android.content.ClipboardManager
+import android.content.Context
+import androidx.compose.foundation.background
+import androidx.compose.foundation.horizontalScroll
+import androidx.compose.foundation.layout.Column
+import androidx.compose.foundation.layout.PaddingValues
+import androidx.compose.foundation.layout.Row
+import androidx.compose.foundation.layout.Spacer
+import androidx.compose.foundation.layout.fillMaxWidth
+import androidx.compose.foundation.layout.height
+import androidx.compose.foundation.layout.heightIn
+import androidx.compose.foundation.layout.padding
+import androidx.compose.foundation.layout.width
+import androidx.compose.foundation.rememberScrollState
+import androidx.compose.foundation.shape.RoundedCornerShape
+import androidx.compose.foundation.text.KeyboardActions
+import androidx.compose.foundation.text.KeyboardOptions
+import androidx.compose.foundation.verticalScroll
+import androidx.compose.material3.AlertDialog
+import androidx.compose.material3.MaterialTheme
+import androidx.compose.material3.OutlinedTextField
+import androidx.compose.material3.PrimaryTabRow
+import androidx.compose.material3.Tab
+import androidx.compose.material3.Text
+import androidx.compose.material3.TextButton
+import androidx.compose.runtime.Composable
+import androidx.compose.runtime.LaunchedEffect
+import androidx.compose.runtime.getValue
+import androidx.compose.runtime.mutableStateOf
+import androidx.compose.runtime.remember
+import androidx.compose.runtime.setValue
+import androidx.compose.ui.Alignment
+import androidx.compose.ui.Modifier
+import androidx.compose.ui.focus.onFocusChanged
+import androidx.compose.ui.graphics.Color
+import androidx.compose.ui.platform.LocalContext
+import androidx.compose.ui.text.AnnotatedString
+import androidx.compose.ui.text.font.FontFamily
+import androidx.compose.ui.text.input.ImeAction
+import androidx.compose.ui.text.input.KeyboardType
+import androidx.compose.ui.text.style.TextOverflow
+import androidx.compose.ui.unit.dp
+import kotlinx.coroutines.Dispatchers
+import kotlinx.coroutines.withContext
+
+/** What the line field means when it is empty or zero: as much as the server will read. */
+private const val ALL_LINES = 0
+
+/** Enough to carry a stack trace and its cause, without being a file viewer. */
+private const val DEFAULT_LINES = 100
+
+/** Enough to hold a stack trace without being the whole screen. */
+private val LOG_HEIGHT = 360.dp
+
+/**
+ * The foot has four things in it -- a field, a generation toggle and two buttons -- and a dialog is
+ * narrow. Trimmed padding rather than smaller text, which would make these labels a different size
+ * from every other button in the app for a reason the reader cannot see.
+ */
+private val FOOT_BUTTON_PADDING = PaddingValues(horizontal = 8.dp)
+
+/** Wide enough for four digits, which is more lines than anybody asks for by hand. */
+private val LINES_FIELD_WIDTH = 76.dp
+
+/**
+ * The log's own panel, a step *down* the surface ladder rather than up.
+ *
+ * Everything else in the app nests by getting lighter -- page at Base, a project's card at Surface
+ * 0 -- but a log is not another card. It is a slab of somebody else's output quoted inside this
+ * app, and the thing that says so in one glance is the darkness a terminal has. Crust
+ * (`surfaceContainerLowest`) against the dialog's `surfaceContainerHigh` is the widest step this
+ * palette offers, which is what makes the boundary legible without a border drawing it.
+ *
+ * It also keeps [AnsiColors] doing what it was chosen for: those are Mocha accents picked to sit
+ * against a dark Mocha surface, so a log's own colours land on the background they were matched to.
+ */
+private val LOG_PANEL_SHAPE = RoundedCornerShape(4.dp)
+
+/** Keeps the first column off the panel's edge, at both ends of a horizontal scroll. */
+private val LOG_PANEL_PADDING = 8.dp
+
+/**
+ * One component's log, in full rather than as a snippet on the card.
+ *
+ * A modal because a log is something you go and read, not something a card should carry: a crash is
+ * usually a stack trace, which is unreadable in the three lines a card could spare and would push
+ * everything else off screen. The card says *that* it failed; this says what.
+ *
+ * Reachable whenever a component reports logs, not only after a failure — a running service's log
+ * is the thing you want while working out why it is behaving oddly, which is exactly when nothing
+ * has failed yet.
+ */
+@Composable
+fun ComponentLogDialog(
+    entryKey: String,
+    component: ProjectComponent,
+    onDismiss: () -> Unit,
+) {
+    val context = LocalContext.current
+    var lines by remember { mutableStateOf(DEFAULT_LINES.toString()) }
+    // What is actually being asked for, which is not what is being typed.
+    // Re-reading on every keystroke means "20" fetches 2 lines on the way
+    // to 20, and a slow read is started and abandoned for each digit --
+    // so the field is applied when it is submitted or left, not as it
+    // changes.
+    var requestedLines by remember { mutableStateOf(DEFAULT_LINES) }
+    val submitLines = { requestedLines = lines.toIntOrNull() ?: ALL_LINES }
+    var generation by remember { mutableStateOf(0) }
+    // Only a server runs here, so only a server can have a runtime log to
+    // switch to. An APK gets no tab row rather than a row of one, which
+    // would be a control that cannot do anything.
+    val hasBothKinds = component.kind == "server"
+    // What it is doing now is the usual question, so the runtime log is
+    // the default -- except for the component a build stopped at, where
+    // the thing worth reading is why it stopped, and for an APK, which
+    // has no runtime here and so no tab to escape to.
+    var kind by remember {
+        mutableStateOf(
+            if (!hasBothKinds || component.buildFailed) LogKind.Build else LogKind.Runtime
+        )
+    }
+    var log by remember { mutableStateOf<ComponentLog?>(null) }
+    // Rendered once per read rather than per recomposition, and kept out
+    // here so Copy can reach it: what goes on the clipboard is
+    // AnnotatedString's own plain text, which is the log with every escape
+    // already gone.
+    val bodyColour = MaterialTheme.colorScheme.onSurface
+    val rendered = remember(log, bodyColour) { log?.let { ansiAnnotated(it.text, bodyColour) } }
+    var failure by remember { mutableStateOf<String?>(null) }
+    var loading by remember { mutableStateOf(true) }
+
+    val available =
+        when (kind) {
+            LogKind.Build -> component.hasBuildLogs
+            LogKind.Runtime -> component.hasRuntimeLogs
+        }
+
+    // Re-read whenever any control moves. Keyed rather than driven by a
+    // callback so the two cannot disagree about what is on screen.
+    LaunchedEffect(entryKey, component.name, requestedLines, generation, kind) {
+        failure = null
+        // Nothing to fetch, and asking anyway would come back as a failure
+        // in red -- which is the wrong thing to say about a log that
+        // simply does not exist. The body explains it instead.
+        if (!available) {
+            log = null
+            loading = false
+            return@LaunchedEffect
+        }
+        loading = true
+        try {
+            log =
+                withContext(Dispatchers.IO) {
+                    componentLog(
+                        entryKey,
+                        component.name,
+                        requestedLines,
+                        generation,
+                        kind,
+                    )
+                }
+        } catch (e: DownloadServerException) {
+            log = null
+            failure = e.message ?: "Couldn't read the log"
+        }
+        loading = false
+    }
+
+    AlertDialog(
+        onDismissRequest = onDismiss,
+        title = { Text("${component.name} · log") },
+        text = {
+            Column {
+                if (hasBothKinds) {
+                    // Primary rather than the plain `TabRow`, which is
+                    // deprecated in favour of the two that say where they
+                    // sit -- these are this dialog's top-level
+                    // destinations. Matches what ai-app uses, so a tab row
+                    // means the same thing in both apps.
+                    //
+                    // Transparent, because a tab row is not a surface of
+                    // its own: the default paints `surface` behind the
+                    // tabs, which inside a dialog at
+                    // `surfaceContainerHigh` reads as a band of different
+                    // background under the controls, saying a change of
+                    // level that isn't there. The indicator and the label
+                    // carry the selection; the background has no part in
+                    // it.
+                    PrimaryTabRow(
+                        selectedTabIndex = if (kind == LogKind.Build) 0 else 1,
+                        containerColor = Color.Transparent,
+                    ) {
+                        // A generation is counted within a kind, so the
+                        // build log's previous run is not the runtime
+                        // log's. Switching kinds therefore starts again at
+                        // the current one rather than carrying an index
+                        // across to where it means something else.
+                        Tab(
+                            selected = kind == LogKind.Build,
+                            onClick = {
+                                kind = LogKind.Build
+                                generation = 0
+                            },
+                            text = { Text("Build") },
+                        )
+                        Tab(
+                            selected = kind == LogKind.Runtime,
+                            onClick = {
+                                kind = LogKind.Runtime
+                                generation = 0
+                            },
+                            text = { Text("Runtime") },
+                        )
+                    }
+                }
+                Spacer(Modifier.height(8.dp))
+                // Indeterminate, because the server does not report how
+                // far through a read it is -- and a bar drawn from a
+                // guess is worse than one that only spins.
+                if (loading) {
+                    ProgressBar()
+                    Spacer(Modifier.height(8.dp))
+                }
+                failure?.let {
+                    Text(it, color = MaterialTheme.colorScheme.error)
+                    Spacer(Modifier.height(8.dp))
+                }
+                // Not an error, and not drawn like one: there is simply no
+                // such log. Which of the two reasons it is stays unsaid
+                // because the build machine cannot tell them apart either
+                // -- a script with no log yet and a script that does not
+                // offer them both answer by reporting nothing.
+                if (!available) {
+                    Text(
+                        when (kind) {
+                            LogKind.Build ->
+                                "No build log yet — this component hasn't been built from here."
+                            LogKind.Runtime -> "This component reports no runtime log."
+                        },
+                        style = MaterialTheme.typography.bodySmall,
+                        color = MaterialTheme.colorScheme.onSurfaceVariant,
+                    )
+                }
+                log?.let { loaded ->
+                    if (loaded.truncated) {
+                        Text(
+                            "Showing the end of the log; there is more above it.",
+                            style = MaterialTheme.typography.bodySmall,
+                            color = MaterialTheme.colorScheme.onSurfaceVariant,
+                        )
+                    }
+                    Text(
+                        loaded.path,
+                        style = MaterialTheme.typography.bodySmall,
+                        color = MaterialTheme.colorScheme.onSurfaceVariant,
+                        maxLines = 1,
+                        // A path is identified by its tail.
+                        overflow = TextOverflow.StartEllipsis,
+                    )
+                    Spacer(Modifier.height(4.dp))
+                    Text(
+                        rendered.takeIf { loaded.text.isNotEmpty() }
+                            ?: AnnotatedString("(nothing in this log yet)"),
+                        style = MaterialTheme.typography.bodySmall,
+                        fontFamily = FontFamily.Monospace,
+                        // Both directions: a log wraps badly and a stack
+                        // trace is wide, so it scrolls rather than being
+                        // reflowed into something harder to read.
+                        //
+                        // The panel is painted outside the two scrolls, so
+                        // it is the window rather than the content: filled
+                        // inside the scroll it would be the width of the
+                        // longest line and slide away as the log was
+                        // scrolled, leaving the dark behind the text
+                        // rather than behind the area. `fillMaxWidth` for
+                        // the same reason -- a short log would otherwise
+                        // give a panel the width of its longest line, and
+                        // the block would change shape as the reader
+                        // paged through it.
+                        modifier =
+                            Modifier.fillMaxWidth()
+                                .heightIn(max = LOG_HEIGHT)
+                                .background(
+                                    MaterialTheme.colorScheme.surfaceContainerLowest,
+                                    LOG_PANEL_SHAPE,
+                                )
+                                .padding(LOG_PANEL_PADDING)
+                                .verticalScroll(rememberScrollState())
+                                .horizontalScroll(rememberScrollState()),
+                    )
+                }
+            }
+        },
+        // The whole foot is one row rather than the dialog's confirm and
+        // dismiss slots. Given two slots, Material stacks them the moment
+        // they do not fit, which put the controls *under* the buttons --
+        // so the row is built here and the dialog is handed one thing.
+        confirmButton = {
+            Row(
+                modifier = Modifier.fillMaxWidth(),
+                verticalAlignment = Alignment.CenterVertically,
+            ) {
+                OutlinedTextField(
+                    value = lines,
+                    onValueChange = { entered -> lines = entered.filter { it.isDigit() } },
+                    label = { Text("Lines") },
+                    singleLine = true,
+                    keyboardOptions =
+                        KeyboardOptions(
+                            keyboardType = KeyboardType.Number,
+                            imeAction = ImeAction.Done,
+                        ),
+                    keyboardActions = KeyboardActions(onDone = { submitLines() }),
+                    modifier =
+                        Modifier.width(LINES_FIELD_WIDTH)
+                            // Leaving the field counts as submitting it:
+                            // otherwise a number typed and then tapped
+                            // away from sits there looking applied and
+                            // isn't.
+                            .onFocusChanged { focus -> if (!focus.isFocused) submitLines() },
+                )
+                // Only when there is one to switch to. A toggle that does
+                // nothing teaches the reader that toggles here do nothing.
+                if ((log?.generations ?: 1) > 1) {
+                    TextButton(
+                        onClick = { generation = if (generation == 0) 1 else 0 },
+                        colors = ActionTone.Caution.colors(),
+                        contentPadding = FOOT_BUTTON_PADDING,
+                    ) {
+                        Text(if (generation == 0) "Current" else "Previous")
+                    }
+                }
+                Spacer(Modifier.weight(1f))
+                TextButton(
+                    enabled = rendered != null,
+                    onClick = {
+                        rendered?.let { copyToClipboard(context, component.name, it.text) }
+                    },
+                    contentPadding = FOOT_BUTTON_PADDING,
+                ) {
+                    Text("Copy")
+                }
+                TextButton(onClick = onDismiss, contentPadding = FOOT_BUTTON_PADDING) {
+                    Text("Done")
+                }
+            }
+        },
+    )
+}
+
+/**
+ * Puts the log on the clipboard.
+ *
+ * No confirmation: Android shows its own on the versions that do not, and saying it again would be
+ * announcing what the screen already told them.
+ */
+private fun copyToClipboard(context: Context, label: String, text: String) {
+    val clipboard = context.getSystemService(Context.CLIPBOARD_SERVICE) as ClipboardManager
+    clipboard.setPrimaryClip(ClipData.newPlainText(label, text))
+}
diff --git a/app/androidApp/src/main/kotlin/com/example/devupdater/DownloadServer.kt b/app/androidApp/src/main/kotlin/com/example/devupdater/DownloadServer.kt
new file mode 100644
index 0000000..1bdc5c2
--- /dev/null
+++ b/app/androidApp/src/main/kotlin/com/example/devupdater/DownloadServer.kt
@@ -0,0 +1,122 @@
+package com.example.devupdater
+
+import com.example.wgapplink.ServerSettings
+import java.io.IOException
+import java.net.HttpURLConnection
+import java.net.URL
+
+// Where the server is and how this device authenticates to it, from the
+// enrollment scan (see Link.kt). Held here because every call this
+// app makes goes through requestFromServer below -- the manifest, the
+// management routes behind the Add screen, the on-demand build routes, and
+// every APK download including this app's own self-update -- and the
+// screens would otherwise thread the same value through every one.
+//
+// All of it is HTTPS pinned against PINNED_CA_PEM (see Link.kt),
+// because everything here either is, or decides, what this app hands to the
+// system installer next. The server binds only the WireGuard interface, so
+// reaching it at all requires being an enrolled tunnel peer; the token is
+// what distinguishes this phone from anything else that is. The server's
+// *other* port (8091) is a separate, plain-HTTP bootstrap link for a
+// human's browser to install this app in the first place -- this app's own
+// code never talks to that one, and it carries no token.
+@Volatile private var settings: ServerSettings? = null
+
+fun useServer(chosen: ServerSettings) {
+    settings = chosen
+}
+
+/** The configured server, or null before this device is enrolled. */
+fun serverSettings(): ServerSettings? = settings
+
+private fun requireServer(): ServerSettings =
+    settings
+        ?: throw DownloadServerException(
+            "This device isn't enrolled yet. Scan the QR the server prints on startup."
+        )
+
+private const val CONNECT_TIMEOUT_MS = 5000
+
+/**
+ * Anything that went wrong talking to the download server, whichever route it was. One type rather
+ * than one per route: no caller ever needs to tell a failed `/manifest` fetch from a failed
+ * download by *type* -- each catches around the one call it made -- and the message already says
+ * which route and what happened.
+ */
+class DownloadServerException(message: String, cause: Throwable? = null) : Exception(message, cause)
+
+/**
+ * Runs one request against the download server, with the pinned-TLS setup and the failure
+ * translation every route here needs. [readBody] gets the connected, already-status-checked
+ * connection to read from.
+ *
+ * Blocking -- invoke from a background dispatcher.
+ *
+ * @param jsonBody a request body to send, for the routes that change server state. Set separately
+ *   from [method] because a method alone doesn't imply one -- DELETE here carries no body.
+ * @param readTimeoutMs how long to wait on the response body; a download's is necessarily longer
+ *   than a JSON route's.
+ */
+fun <T> requestFromServer(
+    path: String,
+    method: String = "GET",
+    jsonBody: String? = null,
+    readTimeoutMs: Int = 5000,
+    readBody: (HttpURLConnection) -> T,
+): T {
+    val server = requireServer()
+    val connection = URL("${server.baseUrl}$path").openConnection() as HttpURLConnection
+    try {
+        connection.applyPinnedTls()
+        connection.setRequestProperty("Authorization", "Bearer ${server.token}")
+        connection.requestMethod = method
+        connection.connectTimeout = CONNECT_TIMEOUT_MS
+        connection.readTimeout = readTimeoutMs
+        if (jsonBody != null) {
+            connection.doOutput = true
+            connection.setRequestProperty("Content-Type", "application/json")
+            connection.outputStream.use { it.write(jsonBody.encodeToByteArray()) }
+        }
+        // The management routes answer 204 with no body, and the server
+        // reports a rejected request (a path with nothing built under it,
+        // an app that's already added) as a 4xx whose *body* is the
+        // explanation written for this screen -- so read it rather than
+        // reporting a bare status code the user can do nothing with.
+        if (connection.responseCode !in 200..299) {
+            val detail = connection.errorStream?.bufferedReader()?.readText()?.trim()
+            throw DownloadServerException(
+                when {
+                    connection.responseCode == 401 ->
+                        "The server rejected this device's token. Re-enroll by scanning the " +
+                            "QR it prints (or rotate with --rotate-token and scan the new one)."
+                    detail.isNullOrEmpty() ->
+                        "Server returned HTTP ${connection.responseCode} for $path"
+                    else -> detail
+                }
+            )
+        }
+        return readBody(connection)
+    } catch (e: DownloadServerException) {
+        throw e
+    } catch (e: IOException) {
+        // Covers refused/timed-out connections as well as
+        // UnknownServiceException, which is what a cleartext-blocked
+        // request throws -- surfacing the real exception here (rather than
+        // a single canned message for every failure mode) is what actually
+        // lets this be diagnosed on a device with no logcat access.
+        throw DownloadServerException(
+            "Couldn't reach the server at ${server.baseUrl}$path " +
+                "(${e::class.simpleName}: ${e.message}) -- is dev-updater running, " +
+                "and is this device able to reach that address?",
+            e,
+        )
+    } catch (e: Exception) {
+        throw DownloadServerException(
+            "Reached ${server.baseUrl}$path but couldn't read its response " +
+                "(${e::class.simpleName}: ${e.message})",
+            e,
+        )
+    } finally {
+        connection.disconnect()
+    }
+}
diff --git a/app/androidApp/src/main/kotlin/com/example/devupdater/InstalledBuilds.kt b/app/androidApp/src/main/kotlin/com/example/devupdater/InstalledBuilds.kt
new file mode 100644
index 0000000..d84ab27
--- /dev/null
+++ b/app/androidApp/src/main/kotlin/com/example/devupdater/InstalledBuilds.kt
@@ -0,0 +1,93 @@
+package com.example.devupdater
+
+import android.content.BroadcastReceiver
+import android.content.Context
+import android.content.Intent
+import android.content.IntentFilter
+import android.content.pm.PackageManager
+import androidx.core.content.ContextCompat
+import java.io.File
+
+// These are ad hoc local rebuilds with no CI bumping a version code, so it
+// can't tell "already have this build" apart from "update available" --
+// during active development the version code routinely stays put across
+// many rebuilds. PackageManager tracks something better for this purpose
+// regardless: `lastUpdateTime`, the epoch millis of when the currently
+// installed copy was actually installed, maintained by the OS itself on
+// every install (including a plain `adb install -r`, unlike a
+// download-tracked-in-SharedPreferences approach, which would only learn
+// about installs that went through this app's own download button).
+// Compared directly against `/manifest`'s build-mtime epoch (see
+// UpdateManifest.kt) -- both are wall-clock timestamps, so as long as the
+// device and dev machine roughly agree on the time (true for an emulator
+// or a phone on the same LAN), "installed after the currently-served build
+// was produced" is a reliable proxy for "already have that build."
+//
+// Querying another app's PackageInfo needs package visibility on API 30+,
+// normally granted per-package via this app's own <queries> in
+// AndroidManifest.xml -- but that would mean a manifest edit (and a
+// rebuild) every time a new app is added to the server's /manifest. This
+// app instead holds QUERY_ALL_PACKAGES, which lets it query any installed
+// package by name with no such declaration. That permission is a Play
+// Store *policy* restriction, not something the OS itself enforces, so
+// it's free to use here since this app is never distributed through Play (F-Droid
+// takes the same approach for the same reason -- see AndroidManifest.xml).
+fun installedLastUpdateTimeMillis(context: Context, packageName: String): Long? =
+    try {
+        context.packageManager.getPackageInfo(packageName, 0).lastUpdateTime
+    } catch (_: PackageManager.NameNotFoundException) {
+        null
+    }
+
+// Whether this package is on this device at all -- same query, asked as
+// the question the caller actually has.
+fun isInstalled(context: Context, packageName: String): Boolean =
+    installedLastUpdateTimeMillis(context, packageName) != null
+
+// The installed APK's own file size, for showing "old size -> new size" next
+// to an available update -- same package-visibility caveat as above.
+fun installedApkSizeBytes(context: Context, packageName: String): Long? =
+    try {
+        val sourceDir =
+            context.packageManager.getPackageInfo(packageName, 0).applicationInfo?.sourceDir
+        sourceDir?.let { File(it).length() }
+    } catch (_: PackageManager.NameNotFoundException) {
+        null
+    }
+
+// PACKAGE_ADDED/PACKAGE_REPLACED are protected system broadcasts -- only
+// the OS can send them -- fired the moment PackageManager finishes
+// registering an install, which happens before the installer's own "App
+// installed" confirmation screen appears. That makes this a strictly
+// earlier and more precise signal than polling or waiting for this app's
+// activity to next resume (the latter only happens once the user backs out
+// of that confirmation screen). Context-registered rather than
+// manifest-declared since this app only cares about it while some screen
+// is actually observing install state, not for the whole time it's
+// installed -- see the paired unregisterReceiver call at the caller's
+// DisposableEffect.
+//
+// RECEIVER_NOT_EXPORTED is correct, not just required (API 33+ rejects a
+// context-registered receiver with neither flag): nothing but the system
+// can send this broadcast regardless, so there's no legitimate case for
+// another app to inject it here.
+fun registerPackageChangeReceiver(
+    context: Context,
+    onPackageChanged: (packageName: String) -> Unit,
+): BroadcastReceiver {
+    val receiver =
+        object : BroadcastReceiver() {
+            override fun onReceive(context: Context, intent: Intent) {
+                val packageName = intent.data?.schemeSpecificPart ?: return
+                onPackageChanged(packageName)
+            }
+        }
+    val filter =
+        IntentFilter().apply {
+            addAction(Intent.ACTION_PACKAGE_ADDED)
+            addAction(Intent.ACTION_PACKAGE_REPLACED)
+            addDataScheme("package")
+        }
+    ContextCompat.registerReceiver(context, receiver, filter, ContextCompat.RECEIVER_NOT_EXPORTED)
+    return receiver
+}
diff --git a/app/androidApp/src/main/kotlin/com/example/devupdater/Link.kt b/app/androidApp/src/main/kotlin/com/example/devupdater/Link.kt
new file mode 100644
index 0000000..2de6c5c
--- /dev/null
+++ b/app/androidApp/src/main/kotlin/com/example/devupdater/Link.kt
@@ -0,0 +1,45 @@
+package com.example.devupdater
+
+import com.example.wgapplink.PinnedTls
+import com.example.wgapplink.ServerStore
+import java.net.HttpURLConnection
+
+/**
+ * This app's two parameters to the shared link, and the objects built from them.
+ *
+ * Everything about reaching the build machine -- pinned TLS, the enrollment store, the scanner --
+ * is `wg-app-link`, shared with ai-app so a fix lands in both. What is left here is the two values
+ * that are genuinely per-app, in one place so nothing can disagree about them.
+ */
+private const val ENROLL_SCHEME = "devupdater"
+
+/**
+ * The Android Keystore key the token is sealed under.
+ *
+ * **Persisted on the device, so this string is not free to change.** A new value means the app
+ * cannot unseal the token it already stored, and an enrolled phone silently reads as not enrolled
+ * with nothing on screen to say why -- unlike the scheme, where a mismatch shows up immediately as
+ * a scanned code doing nothing. Carried over unchanged from before the link was shared, which is
+ * the only reason enrolled devices survived that change.
+ */
+private const val TOKEN_KEY_ALIAS = "dev-updater-token-key"
+
+/** Where this device's enrollment lives. Stateless, so one instance is all anything needs. */
+val serverStore = ServerStore(ENROLL_SCHEME, TOKEN_KEY_ALIAS)
+
+/**
+ * Built once and reused: the socket factory behind it is lazy, and every reconnect would otherwise
+ * redo the KeyStore and TrustManager setup.
+ */
+private val pinnedTls = PinnedTls(PINNED_CA_PEM)
+
+/**
+ * Trusts this machine's CA and nothing else, including the system store -- so a genuine certificate
+ * issued for another host is refused exactly as firmly as a self-signed one.
+ *
+ * An extension rather than a call at each site, so no request can be made without it by forgetting
+ * a line.
+ */
+fun HttpURLConnection.applyPinnedTls() {
+    pinnedTls.applyTo(this)
+}
diff --git a/app/androidApp/src/main/kotlin/com/example/devupdater/MainActivity.kt b/app/androidApp/src/main/kotlin/com/example/devupdater/MainActivity.kt
new file mode 100644
index 0000000..1993765
--- /dev/null
+++ b/app/androidApp/src/main/kotlin/com/example/devupdater/MainActivity.kt
@@ -0,0 +1,125 @@
+package com.example.devupdater
+
+import android.Manifest
+import android.content.Intent
+import android.os.Build
+import android.os.Bundle
+import android.widget.Toast
+import androidx.activity.ComponentActivity
+import androidx.activity.compose.setContent
+import androidx.activity.enableEdgeToEdge
+import androidx.activity.result.contract.ActivityResultContracts
+import androidx.compose.foundation.layout.Box
+import androidx.compose.foundation.layout.fillMaxSize
+import androidx.compose.foundation.layout.statusBarsPadding
+import androidx.compose.material3.MaterialTheme
+import androidx.compose.material3.Surface
+import androidx.compose.runtime.getValue
+import androidx.compose.runtime.mutableStateOf
+import androidx.compose.runtime.setValue
+import androidx.compose.ui.Modifier
+import androidx.core.view.WindowCompat
+
+class MainActivity : ComponentActivity() {
+    // Bumped whenever enrollment lands via a devupdater:// intent, so the
+    // composition below re-reads the stored settings.
+    private var settingsVersion by mutableStateOf(0)
+
+    // Registered up front since permission launchers must be registered
+    // before the activity reaches STARTED.
+    private val requestLocalNetworkPermission =
+        registerForActivityResult(ActivityResultContracts.RequestPermission()) {}
+
+    override fun onCreate(savedInstanceState: Bundle?) {
+        super.onCreate(savedInstanceState)
+
+        // Window.setStatusBarColor is deprecated and a flat no-op on
+        // Android 15+ (status bar is always transparent there); relying on
+        // it left the strip behind the status bar showing this legacy
+        // platform theme's default -- Theme.Material's teal colorPrimaryDark
+        // -- on older versions instead of the app's actual background.
+        // enableEdgeToEdge() makes the status bar transparent on every
+        // supported version instead, so the Surface below (now filling the
+        // true full screen, with no inset) paints straight through
+        // underneath it and the two can never mismatch.
+        enableEdgeToEdge()
+
+        // The app is dark-only (DevUpdaterColors), so the status bar icons
+        // are forced light -- Android doesn't infer icon colour from the
+        // background it ends up over, and the Surface below paints straight
+        // through underneath the bar.
+        WindowCompat.getInsetsController(window, window.decorView).isAppearanceLightStatusBars =
+            false
+
+        // Mandatory from Android 17 (API 37) on for anything targeting 37+,
+        // see the AndroidManifest declaration. Requested up front rather
+        // than lazily on first fetch because a denial is invisible at the
+        // socket layer: the OS just drops the traffic, so the app would
+        // otherwise report an ordinary-looking connect timeout with no hint
+        // that a permission is what's missing.
+        //
+        // **Still required when the server is reached over WireGuard**,
+        // which is the only way this app reaches it. Worth stating because
+        // the platform's own Local Network Definition says a local network
+        // "excludes cellular (WWAN) or VPN connections", which reads as
+        // exempting a tunnelled 10.66.0.1 -- and on the phone this is
+        // installed on, it does not. Measured against a real tunnel after
+        // that reading suggested the declaration could be dropped; it
+        // cannot.
+        //
+        // That phone runs GrapheneOS, so it is possible stock Android
+        // matches its own documentation here and this is a hardened-OS
+        // difference. Untested either way, and it does not change the
+        // answer: the permission stays, because the device it has to work
+        // on is the one it was measured on. Nothing local can check it --
+        // the emulator this is developed against is API 36, where the
+        // permission is not enforced at all.
+        if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.CINNAMON_BUN) {
+            requestLocalNetworkPermission.launch(Manifest.permission.ACCESS_LOCAL_NETWORK)
+        }
+
+        // Before the first composition, so the screens can call the server
+        // straight away rather than racing a load.
+        serverStore.load(this)?.let(::useServer)
+        handleEnrollment(intent)
+
+        setContent {
+            MaterialTheme(colorScheme = DevUpdaterColors) {
+                // Fills the true full screen (behind the status bar too, per
+                // enableEdgeToEdge() above) so this Surface's own background
+                // is what shows there. The inset is applied one level in
+                // instead, via statusBarsPadding() on the Box wrapping
+                // UpdaterScreen() -- it reads the actual system inset rather
+                // than assuming a fixed height, so it stays correct across
+                // devices/orientations/font scales -- so it's only the
+                // *content* that starts below the status bar, not the
+                // background underneath it.
+                Surface(modifier = Modifier.fillMaxSize()) {
+                    Box(modifier = Modifier.fillMaxSize().statusBarsPadding()) {
+                        UpdaterScreen(settingsVersion)
+                    }
+                }
+            }
+        }
+    }
+
+    // launchMode="singleTop": an enrollment scan while the app is open
+    // lands here rather than in a second activity instance.
+    override fun onNewIntent(intent: Intent) {
+        super.onNewIntent(intent)
+        handleEnrollment(intent)
+    }
+
+    private fun handleEnrollment(intent: Intent?) {
+        val uri = intent?.data ?: return
+        val settings = serverStore.parseEnrollmentUri(uri)
+        if (settings == null) {
+            Toast.makeText(this, "Not a valid enrollment code", Toast.LENGTH_LONG).show()
+            return
+        }
+        serverStore.save(this, settings)
+        useServer(settings)
+        settingsVersion++
+        Toast.makeText(this, "Enrolled with ${settings.baseUrl}", Toast.LENGTH_LONG).show()
+    }
+}
diff --git a/app/androidApp/src/main/kotlin/com/example/devupdater/NerdIcons.kt b/app/androidApp/src/main/kotlin/com/example/devupdater/NerdIcons.kt
new file mode 100644
index 0000000..ba717fd
--- /dev/null
+++ b/app/androidApp/src/main/kotlin/com/example/devupdater/NerdIcons.kt
@@ -0,0 +1,59 @@
+package com.example.devupdater
+
+import androidx.compose.ui.text.font.Font
+import androidx.compose.ui.text.font.FontFamily
+
+/**
+ * The icons the app draws, as glyphs in a Nerd Fonts subset rather than as vector assets.
+ *
+ * Drawing them as *text* is what makes them cheap: an icon beside a line of text wants that line's
+ * size, colour and baseline, and a `Text` gets all three for free where an `Icon` needs each one
+ * set and kept in step by hand.
+ *
+ * Ordinary Unicode won't do it -- there is no character for a git branch, and the ones that exist
+ * for the rest aren't reliably in an Android system font, so they arrive as tofu boxes on
+ * somebody's phone. The font here is `app/build-icon-font.sh`'s output: eight glyphs, 2 KB, from
+ * the 2.5 MB symbols font. Adding one means adding its codepoint in *both* places -- a codepoint
+ * here that the script didn't subset is a glyph that silently isn't there.
+ *
+ * All Material Design Icons bar one, so they read as one family; the exception is noted where it is
+ * declared.
+ */
+val NerdIcons = FontFamily(Font(R.font.nerd_icons))
+
+/** Nerd Fonts puts these in plane 15, so each is a surrogate pair. */
+private fun glyph(codePoint: Int) = String(Character.toChars(codePoint))
+
+/** `md-folder` -- a project's directory on the build machine. */
+val FOLDER_GLYPH = glyph(0xF024B)
+
+/** `md-source_branch` -- the branch that directory is on. */
+val BRANCH_GLYPH = glyph(0xF062C)
+
+/**
+ * `fa-server` -- a server component, running on the build machine.
+ *
+ * Font Awesome's rather than Material's: the `md-server` stack of three shelves is fussy at the
+ * size a component row draws it.
+ */
+val SERVER_GLYPH = glyph(0xF233)
+
+/** `md-cog` -- a card's own settings. */
+val SETTINGS_GLYPH = glyph(0xF0493)
+
+/** `md-plus` -- add a project to the list. */
+val PLUS_GLYPH = glyph(0xF0415)
+
+/** `md-refresh` -- re-read the manifest. */
+val REFRESH_GLYPH = glyph(0xF0450)
+
+/**
+ * `fa-book` -- what a component wrote.
+ *
+ * Font Awesome's, like the server glyph: Material's book icons are open-book shapes that read as
+ * "read this" rather than "a record of what happened".
+ */
+val LOG_GLYPH = glyph(0xF02D)
+
+/** `md-trash_can_outline` -- remove a scan directory. */
+val TRASH_GLYPH = glyph(0xF0A7A)
diff --git a/app/androidApp/src/main/kotlin/com/example/devupdater/SelfUpdateScreen.kt b/app/androidApp/src/main/kotlin/com/example/devupdater/SelfUpdateScreen.kt
new file mode 100644
index 0000000..32746be
--- /dev/null
+++ b/app/androidApp/src/main/kotlin/com/example/devupdater/SelfUpdateScreen.kt
@@ -0,0 +1,154 @@
+package com.example.devupdater
+
+import android.content.Context
+import androidx.compose.foundation.layout.Arrangement
+import androidx.compose.foundation.layout.Column
+import androidx.compose.foundation.layout.Row
+import androidx.compose.foundation.layout.Spacer
+import androidx.compose.foundation.layout.fillMaxWidth
+import androidx.compose.foundation.layout.height
+import androidx.compose.foundation.layout.padding
+import androidx.compose.material3.MaterialTheme
+import androidx.compose.material3.Text
+import androidx.compose.material3.TextButton
+import androidx.compose.runtime.Composable
+import androidx.compose.runtime.getValue
+import androidx.compose.runtime.mutableFloatStateOf
+import androidx.compose.runtime.mutableStateOf
+import androidx.compose.runtime.remember
+import androidx.compose.runtime.rememberCoroutineScope
+import androidx.compose.runtime.setValue
+import androidx.compose.ui.Alignment
+import androidx.compose.ui.Modifier
+import androidx.compose.ui.platform.LocalContext
+import androidx.compose.ui.unit.dp
+import kotlinx.coroutines.Dispatchers
+import kotlinx.coroutines.launch
+import kotlinx.coroutines.withContext
+
+/**
+ * Whether the build machine has a newer copy of *this app* than the one running.
+ *
+ * The only check in the app that goes nowhere near the manifest. That is the point: when this
+ * server changes what the manifest says, an app too old to read it loses the list — and the list is
+ * where the button that would replace it lives. Recovering from that means a reinstall over the
+ * plain-HTTP bootstrap port, by hand, at the machine. This path keeps working because there is
+ * almost nothing in it to break.
+ *
+ * It does not survive a changed CA, port or token, which break the connection before any route is
+ * reached. Those stay one-way doors.
+ *
+ * Answers null when there is nothing to offer, including when the server cannot be reached — a
+ * failed check is not an update, and this is not the screen that reports the server being down.
+ */
+suspend fun selfUpdateAvailable(context: Context): SelfBuild? =
+    withContext(Dispatchers.IO) {
+        runCatching {
+            val build = selfBuild()
+            val installed = installedLastUpdateTimeMillis(context, context.packageName)
+            // Newer than what is installed, by the same rule the list
+            // uses. Equal counts as current: a build and an install
+            // landing in the same second is not an update.
+            if (installed == null || build.mtimeMillis > installed) build else null
+        }
+            .getOrNull()
+    }
+
+/**
+ * Offers the newer build of this app, and installs it.
+ *
+ * A screen of its own rather than a row on the list, because the moment it matters most is the one
+ * where the list may not render at all. It asks for nothing but the two numbers
+ * [selfUpdateAvailable] already fetched.
+ */
+@Composable
+fun SelfUpdateScreen(build: SelfBuild, onDismiss: () -> Unit) {
+    val context = LocalContext.current
+    val scope = rememberCoroutineScope()
+    var downloading by remember { mutableStateOf(false) }
+    var progress by remember { mutableFloatStateOf(0f) }
+    var failure by remember { mutableStateOf<String?>(null) }
+
+    Column(modifier = Modifier.padding(24.dp)) {
+        Text("Update Dev Updater", style = MaterialTheme.typography.headlineSmall)
+        Spacer(Modifier.height(8.dp))
+        Text(
+            "The build machine has a newer build of this app (${formatSize(build.sizeBytes)}).",
+            style = MaterialTheme.typography.bodyMedium,
+            color = MaterialTheme.colorScheme.onSurfaceVariant,
+        )
+        Spacer(Modifier.height(4.dp))
+        Text(
+            "Taking it now keeps this app able to talk to the server after the server changes. " +
+                "This check does not use the app list, so it keeps working when the list does not.",
+            style = MaterialTheme.typography.bodySmall,
+            color = MaterialTheme.colorScheme.onSurfaceVariant,
+        )
+
+        failure?.let {
+            Spacer(Modifier.height(12.dp))
+            Text(it, color = MaterialTheme.colorScheme.error)
+        }
+
+        if (downloading) {
+            Spacer(Modifier.height(16.dp))
+            // Determinate, because the size is known before the first byte
+            // -- it came back with the check.
+            ProgressBar(fraction = { progress })
+        }
+
+        Spacer(Modifier.height(20.dp))
+        Row(
+            modifier = Modifier.fillMaxWidth(),
+            horizontalArrangement = Arrangement.End,
+            verticalAlignment = Alignment.CenterVertically,
+        ) {
+            TextButton(enabled = !downloading, onClick = onDismiss) { Text("Not now") }
+            TextButton(
+                enabled = !downloading,
+                colors = ActionTone.Primary.colors(),
+                onClick = {
+                    downloading = true
+                    failure = null
+                    scope.launch {
+                        try {
+                            val file =
+                                withContext(Dispatchers.IO) {
+                                    downloadFromRoute(context, SELF_APK_ROUTE, "self") { read, total
+                                        ->
+                                        progress = if (total > 0) read.toFloat() / total else 0f
+                                    }
+                                }
+                            // Checked rather than attempted, the same way
+                            // the list does it: without the permission the
+                            // installer bounces back a generic "not allowed
+                            // to install unknown apps" dialog that names
+                            // neither what was blocked nor what to do, and
+                            // the settings screen it means is one intent
+                            // away. Kept in step with `install` in
+                            // UpdaterScreen.kt, which makes the same check
+                            // for the same reason.
+                            if (canRequestInstall(context)) {
+                                // The system installer takes it from here
+                                // and asks for its own confirmation; this
+                                // app is replaced rather than told about it.
+                                context.startActivity(installApkIntent(context, file))
+                            } else {
+                                failure =
+                                    "Android needs permission to install apps from Dev Updater. " +
+                                        "The settings screen for it is open now; allow it and " +
+                                        "press Update again."
+                                context.startActivity(requestInstallPermissionIntent(context))
+                            }
+                        } catch (e: Exception) {
+                            failure = e.message ?: "Couldn't download the update"
+                        }
+                        downloading = false
+                    }
+                },
+            ) {
+                Text("Update")
+            }
+        }
+    }
+}
diff --git a/app/androidApp/src/main/kotlin/com/example/devupdater/Theme.kt b/app/androidApp/src/main/kotlin/com/example/devupdater/Theme.kt
new file mode 100644
index 0000000..ab5dce4
--- /dev/null
+++ b/app/androidApp/src/main/kotlin/com/example/devupdater/Theme.kt
@@ -0,0 +1,210 @@
+package com.example.devupdater
+
+import androidx.compose.foundation.layout.fillMaxWidth
+import androidx.compose.material3.ButtonColors
+import androidx.compose.material3.ButtonDefaults
+import androidx.compose.material3.LinearProgressIndicator
+import androidx.compose.material3.MaterialTheme
+import androidx.compose.material3.darkColorScheme
+import androidx.compose.runtime.Composable
+import androidx.compose.ui.Modifier
+import androidx.compose.ui.graphics.Color
+
+/**
+ * Catppuccin Mocha, as published in `catppuccin/palette`.
+ *
+ * Named rather than used as literals at the point of need, so the mapping below reads as the
+ * decision it is -- "a card is Surface 0" -- and so a value can be checked against the upstream
+ * palette without reading the layout that uses it.
+ */
+private object Mocha {
+    val Rosewater = Color(0xFFF5E0DC)
+    val Mauve = Color(0xFFCBA6F7)
+    val Red = Color(0xFFF38BA8)
+    val Peach = Color(0xFFFAB387)
+    val Yellow = Color(0xFFF9E2AF)
+    val Green = Color(0xFFA6E3A1)
+    val Teal = Color(0xFF94E2D5)
+    val Sky = Color(0xFF89DCEB)
+    val Blue = Color(0xFF89B4FA)
+    val Lavender = Color(0xFFB4BEFE)
+    val Text = Color(0xFFCDD6F4)
+    val Subtext0 = Color(0xFFA6ADC8)
+    val Overlay0 = Color(0xFF6C7086)
+    val Surface2 = Color(0xFF585B70)
+    val Surface1 = Color(0xFF45475A)
+    val Surface0 = Color(0xFF313244)
+    val Base = Color(0xFF1E1E2E)
+    val Mantle = Color(0xFF181825)
+    val Crust = Color(0xFF11111B)
+}
+
+/**
+ * The app's colour scheme: Catppuccin Mocha mapped onto Material's roles.
+ *
+ * The mapping that matters is the surface ladder. Mocha names its darks in order -- Crust, Mantle,
+ * Base, Surface 0, Surface 1 -- and Material asks for the same thing under different names, so the
+ * page is Base, a component's outlined card stays Base beside it, and a project's card is Surface
+ * 0: one visible step up, which is the whole of what the nesting has to say.
+ *
+ * Accents on this palette are light, so anything filled with one takes Crust for its text rather
+ * than the near-white the roles default to.
+ */
+val DevUpdaterColors =
+    darkColorScheme(
+        primary = Mocha.Mauve,
+        onPrimary = Mocha.Crust,
+        primaryContainer = Mocha.Surface1,
+        onPrimaryContainer = Mocha.Mauve,
+        secondary = Mocha.Lavender,
+        onSecondary = Mocha.Crust,
+        secondaryContainer = Mocha.Surface1,
+        onSecondaryContainer = Mocha.Lavender,
+        tertiary = Mocha.Rosewater,
+        onTertiary = Mocha.Crust,
+        background = Mocha.Base,
+        onBackground = Mocha.Text,
+        surface = Mocha.Base,
+        onSurface = Mocha.Text,
+        surfaceVariant = Mocha.Surface0,
+        onSurfaceVariant = Mocha.Subtext0,
+        surfaceContainerLowest = Mocha.Crust,
+        surfaceContainerLow = Mocha.Mantle,
+        surfaceContainer = Mocha.Base,
+        surfaceContainerHigh = Mocha.Surface0,
+        surfaceContainerHighest = Mocha.Surface0,
+        inverseSurface = Mocha.Text,
+        inverseOnSurface = Mocha.Base,
+        inversePrimary = Mocha.Mauve,
+        outline = Mocha.Overlay0,
+        outlineVariant = Mocha.Surface2,
+        error = Mocha.Red,
+        onError = Mocha.Crust,
+        errorContainer = Mocha.Surface1,
+        onErrorContainer = Mocha.Red,
+        scrim = Mocha.Crust,
+    )
+
+/**
+ * What pressing a button will do, said in colour.
+ *
+ * By consequence rather than by which component it sits on, so that the same consequence looks the
+ * same everywhere: Uninstall is the same red whether it takes away a service or an app.
+ *
+ * Each is a Mocha accent, which is the point of using a palette rather than picking shades: they
+ * were chosen to sit at one weight against a Mocha background, so no tone shouts over the others.
+ * They are all far too light to fill a button with, which is the thing to remember if one is ever
+ * reused as a container.
+ */
+enum class ActionTone {
+    /** Stop, Uninstall, Remove: takes something away. */
+    Destructive,
+
+    /** Restart, Reinstall: replaces what is there with the same thing. */
+    Caution,
+
+    /** Start, Install: brings up something that wasn't there. */
+    Go,
+
+    /** Update, Build, Pull: brings something new in. */
+    Primary,
+}
+
+/**
+ * A composable read rather than a constant on the enum, so [Caution] can be the scheme's own accent
+ * -- the colour the corner controls already use -- instead of a copy of it that drifts the first
+ * time the scheme changes.
+ */
+val ActionTone.color: Color
+    @Composable
+    get() =
+        when (this) {
+            ActionTone.Destructive -> Mocha.Red
+            ActionTone.Caution -> MaterialTheme.colorScheme.primary
+            ActionTone.Go -> Mocha.Green
+            ActionTone.Primary -> Mocha.Blue
+        }
+
+@Composable
+fun ActionTone.colors(): ButtonColors = ButtonDefaults.textButtonColors(contentColor = color)
+
+/**
+ * "There is something here": a service that is up. A branch with commits waiting takes
+ * [ActionTone.Primary] instead, because what it is really saying is that Pull would do something --
+ * so it is that button's colour.
+ */
+val runningColor: Color
+    @Composable get() = ActionTone.Go.color
+
+/**
+ * "This went wrong on its own": a service that fell over.
+ *
+ * The scheme's error colour rather than [ActionTone.Destructive], which happens to be the same red.
+ * They are the same red for different reasons, and a state is not an action -- Destructive means
+ * *this button takes something away*, and nothing here is a button.
+ */
+val failedColor: Color
+    @Composable get() = MaterialTheme.colorScheme.error
+
+/**
+ * The sixteen ANSI colours, in their standard order, as this palette's nearest members.
+ *
+ * A log carries colour as an index rather than a value -- "red", not a hex triple -- so what red
+ * *is* remains a decision for whoever draws it. Answering with Mocha's red rather than the VGA one
+ * keeps a log looking like part of the app instead of a terminal pasted into it, and keeps every
+ * colour legible against this background, which raw ANSI black on a dark surface is not.
+ *
+ * Indices 0-7 are the normal set and 8-15 the bright one. Mocha has no bright/normal pairs, so a
+ * bright colour is the same hue: the distinction exists in terminals to buy contrast this palette
+ * already has, and inventing a second shade for it would be inventing a difference the log does not
+ * mean.
+ */
+val AnsiColors: List<Color> =
+    listOf(
+        Mocha.Overlay0, // black -- not actual black, which would be invisible here
+        Mocha.Red,
+        Mocha.Green,
+        Mocha.Yellow,
+        Mocha.Blue,
+        Mocha.Mauve, // magenta
+        Mocha.Teal, // cyan
+        Mocha.Subtext0, // white
+        Mocha.Surface2, // bright black
+        Mocha.Red,
+        Mocha.Green,
+        Mocha.Peach, // bright yellow, warmed so it is not the same swatch twice
+        Mocha.Sky,
+        Mocha.Mauve,
+        Mocha.Teal,
+        Mocha.Text, // bright white
+    )
+
+/**
+ * The progress bar, everywhere this app draws one.
+ *
+ * Blue, which is [ActionTone.Primary] -- the colour of bringing something new in, and that is what
+ * every bar here is waiting on: a build, a download, a log being read. Consequence rather than
+ * location, the same rule the buttons follow, so a bar means the same thing wherever it appears.
+ *
+ * One composable because six places draw one, and six copies of a colour is five chances to
+ * disagree.
+ *
+ * [fraction] is null when there is nothing honest to draw a proportion from, which is most of the
+ * time: an estimated bar looks exactly like a measured one and the person watching cannot tell them
+ * apart, so a command that reports no count gets a bar that claims none.
+ */
+@Composable
+fun ProgressBar(modifier: Modifier = Modifier, fraction: (() -> Float)? = null) {
+    if (fraction == null) {
+        LinearProgressIndicator(
+            color = ActionTone.Primary.color,
+            modifier = modifier.fillMaxWidth(),
+        )
+    } else {
+        LinearProgressIndicator(
+            progress = fraction,
+            color = ActionTone.Primary.color,
+            modifier = modifier.fillMaxWidth(),
+        )
+    }
+}
diff --git a/app/androidApp/src/main/kotlin/com/example/devupdater/UpdateManifest.kt b/app/androidApp/src/main/kotlin/com/example/devupdater/UpdateManifest.kt
new file mode 100644
index 0000000..a4a2495
--- /dev/null
+++ b/app/androidApp/src/main/kotlin/com/example/devupdater/UpdateManifest.kt
@@ -0,0 +1,354 @@
+package com.example.devupdater
+
+import org.json.JSONObject
+
+data class ManifestEntry(
+    val key: String,
+    // Server-provided display name -- this app renders whatever /manifest
+    // sends rather than keeping its own hardcoded per-app label list, which
+    // is what lets the app list be edited at runtime from the Add screen
+    // with no rebuild here.
+    val label: String,
+    val filename: String,
+    val route: String,
+    // Null until this project has been built at least once -- there is no
+    // APK to read an identity out of before then, and inventing one would
+    // make the installed-version check compare against nothing.
+    val packageName: String?,
+    // What this project's APK used to install over, when it has been
+    // renamed. Android treats a renamed applicationId as an unrelated app,
+    // so that one is still installed and nothing will ever replace it --
+    // the card offers to remove it, but only while it is actually there.
+    val previousPackageName: String?,
+    // The project directory this app was added by. Shown on the card so
+    // it's possible to tell two similarly-named apps apart, and to spot an
+    // entry pointing somewhere unexpected.
+    val projectPath: String,
+    // Epoch seconds of the raw build's mtime, straight from the server --
+    // these are ad hoc local rebuilds with no CI bumping a version, so
+    // build freshness is the only meaningful signal, not a version code.
+    val mtime: Double,
+    val size: Long,
+    // True for an entry with an on-demand build step (see BuildStatus.kt)
+    // -- only then does this app call that entry's prepare/status routes,
+    // which 404 for an entry without one.
+    val needsBuild: Boolean,
+    // True for the server's own updater app, which can't be removed: it's
+    // the only route by which this app can ever replace itself.
+    val builtIn: Boolean,
+    // Force git's remote commands onto IPv4 for this project -- this
+    // machine's choice, editable from the card's settings.
+    val gitIpv4: Boolean,
+    // False when the project has no APK yet (never built, or cleaned).
+    // Such an entry is still listed rather than silently dropped -- it was
+    // added deliberately, so saying so beats it disappearing.
+    val built: Boolean,
+    // Every build discovered under the project, so a different one can be
+    // selected without another round trip.
+    val variants: List<ApkVariant>,
+    // What this project produces, in build order. One is the ordinary case
+    // and the card stays flat; more than one is drawn as a nested list, so
+    // a project that also runs a server says so without every single-app
+    // card growing a level of nesting to hold one thing.
+    val components: List<ProjectComponent>,
+    // The project's checkout, when it is in a git repository at all.
+    val git: GitStatus?,
+    // True when this app offers a Pull button (gitPull on the server, and
+    // a branch that tracks something). Pull acts on the build machine;
+    // Update acts on this phone.
+    val canPull: Boolean,
+    // Whether the remote has something this checkout doesn't, as of the
+    // server's last check. Not a count: the server asks what the remote
+    // has without downloading it, and counting needs the objects.
+    val newCommits: Boolean,
+    // This checkout's remote is being asked right now, so newCommits is
+    // the previous answer. Per app, so the card that is actually waiting
+    // is the one that says so.
+    val checkPending: Boolean,
+    // Why the last check produced no answer, when it produced none: the
+    // server's reason for a check that failed, or this app's own for one
+    // it stopped waiting on (see checksUnfinished). Null is the ordinary
+    // case. Kept apart from newCommits because "we don't know" and "the
+    // remote had nothing" are different answers, and only one of them is
+    // safe to show as an unremarkable branch name.
+    val checkError: String? = null,
+    // The build step this project asks for in its own .dev-updater.ron,
+    // which nobody has accepted yet -- RON, the form it was written in,
+    // shown verbatim for a person to read before it is allowed to run.
+    // Null once accepted, or for a project that asks for nothing. While it
+    // is set the server runs no build step for this app at all.
+    val pendingDeclaration: String?,
+)
+
+// A project's checkout, all read locally on the server.
+data class GitStatus(
+    val branch: String,
+    val dirty: Boolean,
+    val upstream: String?,
+    // The top of the checkout, already tilde-contracted by the server.
+    // What a person calls the project, and what Pull acts on -- the
+    // project path is a directory somewhere inside this.
+    val root: String,
+)
+
+// One thing a project produces. [kind] is "apk" (installed on this phone)
+// or "server" (installed and run on the build machine).
+//
+// [state] is only ever set for a server, and only once its script has been
+// asked: "running", "stopped", "failed", "notInstalled". Null with [checking] true
+// means the answer is still coming; null with [error] set means the script
+// could not say, which is a different thing from a service being down.
+data class ProjectComponent(
+    val name: String,
+    val kind: String,
+    val state: String?,
+    val checking: Boolean,
+    val error: String?,
+    // Whether what is built is current with the checkout: "current",
+    // "behind", or "unknown". Unknown is a real answer, not a fallback --
+    // never built here, no checkout to compare against, or uncommitted
+    // work in this component's directory, which makes the comparison
+    // unreliable rather than negative.
+    val freshness: String,
+    // There is at least one log of either kind, so the card offers the
+    // button that opens them.
+    val hasLogs: Boolean,
+    // The build machine wrote a build log for this component. False until
+    // it has been built there at least once.
+    val hasBuildLogs: Boolean,
+    // This component's script reports a runtime log. False for an APK,
+    // which does not run there, and false for a script that does not
+    // implement `logs` -- which is a first-class answer, not a failure,
+    // and is why the modal says which of the two it is rather than
+    // showing an empty log either way.
+    val hasRuntimeLogs: Boolean,
+    // The last build stopped at this component, which is the one case
+    // where its build log matters more than what it is doing now.
+    val buildFailed: Boolean,
+    // Where Uninstall's "remove data" and "remove config" would delete,
+    // and whether anything is there. Null for an APK, which keeps nothing
+    // on the build machine.
+    //
+    // The path is shown beside its toggle rather than kept for the log:
+    // the server removes a declared path wherever it points, with no
+    // check that it sits under the XDG directories, so this display is
+    // the only thing between an accepted declaration and the wrong
+    // directory. Do not reduce it to "data" and "config".
+    val dataPath: String?,
+    val configPath: String?,
+    val dataPresent: Boolean,
+    val configPresent: Boolean,
+    // A null path has three causes and they are different things to do
+    // about it, so the server says which: still reading the project's
+    // resources, could not read them, or the project simply does not say.
+    // The last is the ordinary case and not a fault.
+    val resourcesChecking: Boolean,
+    val resourcesError: String?,
+) {
+    // Only "behind" is worth saying. "Current" is what a card already
+    // implies, and "unknown" said out loud would be on most rows most of
+    // the time, which is how a mark stops meaning anything.
+    val isBehind: Boolean
+        get() = freshness == "behind"
+
+    val isServer: Boolean
+        get() = kind == "server"
+
+    val isInstalled: Boolean
+        get() = state != null && state != "notInstalled"
+
+    val isRunning: Boolean
+        get() = state == "running"
+
+    // Fell over rather than being stopped by anyone. Installed, so it
+    // still offers Start and Uninstall -- what changes is what the row
+    // says, not what it lets you do.
+    val isFailed: Boolean
+        get() = state == "failed"
+}
+
+// One discovered build of an app. `variant` is the Gradle-style build
+// variant name ("debug", "freeRelease") taken from the output directory.
+data class ApkVariant(
+    val path: String,
+    val variant: String,
+    val mtime: Double,
+)
+
+// The whole /manifest response. The repo roots ride along with the app list
+// rather than needing their own fetch, since the Add screen shows both and
+// they change together.
+data class Manifest(
+    val entries: List<ManifestEntry>,
+    val repoRoots: List<String>,
+    /**
+     * The server is still asking the git remotes what they have, so [ManifestEntry.newCommits] may
+     * change shortly. The list deliberately does not wait for that answer -- it would put a round
+     * trip in front of every reopen -- so this is the cue to look once more.
+     */
+    val checksPending: Boolean,
+)
+
+// In the units PackageInfo.lastUpdateTime reports, which is what this is
+// ever compared against (see InstalledBuilds.kt).
+fun ManifestEntry.mtimeMillis(): Long = (mtime * 1000).toLong()
+
+// When this device has pinned a build, that build's timestamp is the one
+// freshness is about -- the newest build being newer than the installed
+// copy says nothing when the newest is not what would be installed. Falls
+// back to the entry's own when the pinned one is gone, which is the same
+// build the server would fall back to serving.
+fun ManifestEntry.mtimeMillisFor(chosenVariantPath: String?): Long =
+    variants.firstOrNull { it.path == chosenVariantPath }?.let { (it.mtime * 1000).toLong() }
+        ?: mtimeMillis()
+
+// Whether anything about this card is still being worked out on the build
+// machine: its remote, or a service being asked what it is doing. Both
+// land after the response that started them, so a screen waiting on this
+// card waits on either -- stopping at the remote alone leaves a component
+// with no state, which is drawn as a row with no buttons, since which
+// buttons to offer is what the answer decides.
+val ManifestEntry.checksOutstanding: Boolean
+    get() = checkPending || components.any { it.checking }
+
+// The same list with every outstanding check marked as unfinished, for a
+// screen that has stopped waiting for the answers. The server may well
+// still be asking -- the next refresh or resume collects whatever it
+// landed on -- so this says only that nothing here is listening any more,
+// and the cards say "couldn't check" rather than falling back to the
+// blank line that means the remote answered and had nothing.
+fun Manifest.checksUnfinished(): Manifest =
+    copy(checksPending = false, entries = entries.map { it.checkUnfinished() })
+
+// The same for one entry, for a caller that was only ever waiting on one.
+//
+// A component being asked what it is doing is one of these too: its
+// spinner has to come down with the polling that fed it, or it turns for
+// ever promising an answer nothing is collecting -- and a row left with
+// no state and no explanation is a row with no buttons for a reason the
+// reader cannot see.
+fun ManifestEntry.checkUnfinished(): ManifestEntry =
+    copy(
+        checkPending = false,
+        checkError = if (checkPending) STOPPED_WAITING else checkError,
+        components =
+            components.map { component ->
+                if (component.checking) {
+                    component.copy(checking = false, error = STOPPED_WAITING)
+                } else {
+                    component
+                }
+            },
+    )
+
+private const val STOPPED_WAITING = "the check was still running when this app stopped waiting"
+
+// Longer than the other calls: answering asks the filesystem about every
+// app, and for one served as a stripped copy that can mean rebuilding the
+// slim APK first. Timing that out would report "couldn't reach the server"
+// about a server that is working.
+// Also used by a log read, which is slow for the same kind of reason: real
+// work on the build machine, not an unreachable server.
+internal const val MANIFEST_READ_TIMEOUT_MS = 15000
+
+// Blocking network call -- invoke from a background dispatcher. Returns a
+// List so the cards render in the order the server sent them.
+//
+// [recheck] false collects an answer already being worked on without
+// asking the git remotes again -- what a poll wants. Asking again on every
+// poll would leave an answer outstanding forever, so the loop would never
+// end (see UpdaterScreen's load()).
+fun fetchManifest(recheck: Boolean = true): Manifest =
+    requestFromServer(
+        if (recheck) "/manifest" else "/manifest?recheck=false",
+        readTimeoutMs = MANIFEST_READ_TIMEOUT_MS,
+    ) { connection ->
+        val body = JSONObject(connection.inputStream.bufferedReader().readText())
+        val apps = body.getJSONArray("apps")
+        Manifest(
+            entries = (0 until apps.length()).map { i -> readEntry(apps.getJSONObject(i)) },
+            checksPending = body.optBoolean("checksPending", false),
+            repoRoots =
+                body.getJSONArray("repoRoots").let { roots ->
+                    (0 until roots.length()).map { roots.getString(it) }
+                },
+        )
+    }
+
+/**
+ * One app, for a card that has just acted and wants only itself back.
+ *
+ * The whole manifest would do -- and did, before the server grew this route -- but fetching every
+ * app to use one of them asks the build machine to stat every APK it serves to answer a question
+ * about one.
+ */
+fun fetchApp(key: String): ManifestEntry =
+    requestFromServer("/apps/$key", readTimeoutMs = MANIFEST_READ_TIMEOUT_MS) { connection ->
+        readEntry(JSONObject(connection.inputStream.bufferedReader().readText()))
+    }
+
+/** One app as the server describes it, shared by both reads above. */
+private fun readEntry(entry: JSONObject): ManifestEntry {
+    val components = entry.optJSONArray("components")
+    val variants = entry.getJSONArray("variants")
+    return ManifestEntry(
+        key = entry.getString("key"),
+        label = entry.getString("label"),
+        filename = entry.getString("filename"),
+        route = entry.getString("route"),
+        packageName = entry.optString("package").ifEmpty { null },
+        previousPackageName = entry.optString("previousPackage").ifEmpty { null },
+        projectPath = entry.getString("projectPath"),
+        mtime = entry.getDouble("mtime"),
+        size = entry.getLong("size"),
+        needsBuild = entry.getBoolean("needsBuild"),
+        builtIn = entry.getBoolean("builtIn"),
+        gitIpv4 = entry.getBoolean("gitIpv4"),
+        built = entry.getBoolean("built"),
+        git =
+            entry.optJSONObject("git")?.let { git ->
+                GitStatus(
+                    branch = git.getString("branch"),
+                    dirty = git.getBoolean("dirty"),
+                    upstream = git.optString("upstream").ifEmpty { null },
+                    root = git.getString("root"),
+                )
+            },
+        canPull = entry.optBoolean("canPull", false),
+        newCommits = entry.optBoolean("newCommits", false),
+        checkError = entry.optString("checkError").ifEmpty { null },
+        checkPending = entry.optBoolean("checkPending", false),
+        pendingDeclaration = entry.optString("pendingDeclaration").ifEmpty { null },
+        components =
+            (0 until (components?.length() ?: 0)).map { j ->
+                val component = components!!.getJSONObject(j)
+                ProjectComponent(
+                    name = component.getString("name"),
+                    kind = component.optString("kind"),
+                    state = component.optString("state").ifEmpty { null },
+                    checking = component.optBoolean("checking", false),
+                    error = component.optString("error").ifEmpty { null },
+                    freshness = component.optString("freshness").ifEmpty { "unknown" },
+                    hasLogs = component.optBoolean("hasLogs", false),
+                    hasBuildLogs = component.optBoolean("hasBuildLogs", false),
+                    hasRuntimeLogs = component.optBoolean("hasRuntimeLogs", false),
+                    buildFailed = component.optBoolean("buildFailed", false),
+                    dataPath = component.optString("dataPath").ifEmpty { null },
+                    configPath = component.optString("configPath").ifEmpty { null },
+                    dataPresent = component.optBoolean("dataPresent", false),
+                    configPresent = component.optBoolean("configPresent", false),
+                    resourcesChecking = component.optBoolean("resourcesChecking", false),
+                    resourcesError = component.optString("resourcesError").ifEmpty { null },
+                )
+            },
+        variants =
+            (0 until variants.length()).map { j ->
+                val variant = variants.getJSONObject(j)
+                ApkVariant(
+                    path = variant.getString("path"),
+                    variant = variant.getString("variant"),
+                    mtime = variant.getDouble("mtime"),
+                )
+            },
+    )
+}
diff --git a/app/androidApp/src/main/kotlin/com/example/devupdater/UpdaterScreen.kt b/app/androidApp/src/main/kotlin/com/example/devupdater/UpdaterScreen.kt
new file mode 100644
index 0000000..dbea663
--- /dev/null
+++ b/app/androidApp/src/main/kotlin/com/example/devupdater/UpdaterScreen.kt
@@ -0,0 +1,2473 @@
+package com.example.devupdater
+
+import android.content.pm.PackageManager
+import android.net.Uri
+import android.os.SystemClock
+import androidx.activity.compose.BackHandler
+import androidx.activity.compose.rememberLauncherForActivityResult
+import androidx.activity.result.contract.ActivityResultContracts
+import androidx.compose.foundation.Image
+import androidx.compose.foundation.background
+import androidx.compose.foundation.clickable
+import androidx.compose.foundation.interaction.MutableInteractionSource
+import androidx.compose.foundation.layout.Arrangement
+import androidx.compose.foundation.layout.Box
+import androidx.compose.foundation.layout.Column
+import androidx.compose.foundation.layout.Row
+import androidx.compose.foundation.layout.Spacer
+import androidx.compose.foundation.layout.fillMaxSize
+import androidx.compose.foundation.layout.fillMaxWidth
+import androidx.compose.foundation.layout.height
+import androidx.compose.foundation.layout.padding
+import androidx.compose.foundation.layout.size
+import androidx.compose.foundation.layout.width
+import androidx.compose.foundation.layout.wrapContentSize
+import androidx.compose.foundation.rememberScrollState
+import androidx.compose.foundation.verticalScroll
+import androidx.compose.material3.AlertDialog
+import androidx.compose.material3.Button
+import androidx.compose.material3.Card
+import androidx.compose.material3.Checkbox
+import androidx.compose.material3.CircularProgressIndicator
+import androidx.compose.material3.DropdownMenu
+import androidx.compose.material3.DropdownMenuItem
+import androidx.compose.material3.ExperimentalMaterial3Api
+import androidx.compose.material3.FloatingActionButton
+import androidx.compose.material3.IconButton
+import androidx.compose.material3.MaterialTheme
+import androidx.compose.material3.OutlinedCard
+import androidx.compose.material3.Surface
+import androidx.compose.material3.Switch
+import androidx.compose.material3.Text
+import androidx.compose.material3.TextButton
+import androidx.compose.material3.pulltorefresh.PullToRefreshBox
+import androidx.compose.runtime.Composable
+import androidx.compose.runtime.DisposableEffect
+import androidx.compose.runtime.LaunchedEffect
+import androidx.compose.runtime.getValue
+import androidx.compose.runtime.mutableStateOf
+import androidx.compose.runtime.remember
+import androidx.compose.runtime.rememberCoroutineScope
+import androidx.compose.runtime.rememberUpdatedState
+import androidx.compose.runtime.setValue
+import androidx.compose.ui.Alignment
+import androidx.compose.ui.Modifier
+import androidx.compose.ui.graphics.asImageBitmap
+import androidx.compose.ui.layout.onSizeChanged
+import androidx.compose.ui.platform.LocalContext
+import androidx.compose.ui.platform.LocalDensity
+import androidx.compose.ui.semantics.contentDescription
+import androidx.compose.ui.semantics.semantics
+import androidx.compose.ui.text.font.FontFamily
+import androidx.compose.ui.text.style.TextOverflow
+import androidx.compose.ui.unit.Dp
+import androidx.compose.ui.unit.TextUnit
+import androidx.compose.ui.unit.dp
+import androidx.compose.ui.unit.sp
+import androidx.core.graphics.drawable.toBitmap
+import androidx.lifecycle.compose.LifecycleResumeEffect
+import com.google.zxing.client.android.Intents
+import com.journeyapps.barcodescanner.ScanContract
+import com.journeyapps.barcodescanner.ScanIntentResult
+import com.journeyapps.barcodescanner.ScanOptions
+import java.io.File
+import kotlinx.coroutines.Dispatchers
+import kotlinx.coroutines.delay
+import kotlinx.coroutines.launch
+import kotlinx.coroutines.withContext
+
+/** The launcher icon beside a card's name, about the height of its two lines. */
+private val APP_ICON_SIZE = 40.dp
+
+/** The icon on a component's row, sized to the text beside it. */
+private val COMPONENT_ICON_SIZE = 20.dp
+
+/** What a glyph needs to be to look the size of [COMPONENT_ICON_SIZE]. */
+private val COMPONENT_GLYPH_SIZE = 20.sp
+
+/**
+ * The drawn size of a glyph button: its own square, rather than the 48dp state layer an IconButton
+ * reserves by default.
+ *
+ * That default is what made these hard to place. A 48dp box centres its glyph, so the mark sits
+ * 24dp down whatever the box is aligned to, and every attempt to fix it from outside -- an offset,
+ * a baseline, aligning the glyph to the box's top -- moved or mispositioned something else. The
+ * last of those left the pressed-state ripple 24dp below the icon it belonged to, since the ripple
+ * follows the box and not the mark.
+ *
+ * A box that *is* the glyph has none of those problems: it aligns like any other content, and its
+ * ripple is centred on the thing pressed. The cost is the touch target, which is now this size
+ * rather than 48dp -- `minimumInteractiveComponentSize` is applied inside the caller's modifier, so
+ * a size set here wins over it.
+ */
+private val GLYPH_BUTTON_SIZE = 28.dp
+
+/**
+ * Restores the separation the 48dp boxes used to provide, now that the boxes are the size of what
+ * they draw: the two together come to the same 48dp centre-to-centre spacing these had before.
+ */
+private val GLYPH_BUTTON_GAP = 48.dp - GLYPH_BUTTON_SIZE
+
+/**
+ * How much of a card's top line the corner controls occupy, so the title beside them can stop
+ * before they start. Derived from the two of them rather than measured, so it cannot drift from
+ * what is actually drawn.
+ */
+private val CORNER_CONTROLS_WIDTH = GLYPH_BUTTON_SIZE * 2 + GLYPH_BUTTON_GAP
+
+private const val BUILD_POLL_INTERVAL_MS = 1500L
+
+/**
+ * How persistently to chase a remote check the server started in the background. The spinner stays
+ * up until the check is genuinely finished: stopping early left the branch line reading as though
+ * the remote had been asked and had nothing, which is a different and much worse thing to say than
+ * "still looking".
+ *
+ * The budget is not what decides when to stop -- the server does, and it already bounds every
+ * remote command it runs (`git.rs`'s REMOTE_HARD_TIMEOUT, 30s, on top of a 5s ssh connect timeout).
+ * This covers that with room for the local git calls either side of it, so reaching it means the
+ * server stopped answering rather than a remote being slow, and the card says so instead of
+ * guessing.
+ *
+ * The interval is what the "new commits" badge actually costs after a push, since the check itself
+ * is one `ls-remote` and lands well inside it. It is not lower still because each look re-reads
+ * every app's git status on the server, which is several subprocesses per app.
+ */
+private const val CHECK_POLL_BUDGET_MS = 45_000L
+private const val CHECK_POLL_INTERVAL_MS = 700L
+
+// A pull that restarts the server leaves it unreachable for well under a
+// second; these cover that with room to spare without making a genuine
+// outage take long to report.
+private const val REFRESH_ATTEMPTS_AFTER_PULL = 4
+private const val RESTART_WAIT_MS = 1000L
+
+private sealed class ManifestState {
+    data object Loading : ManifestState()
+
+    // A List, not a Map -- see UpdateManifest.kt -- so the card order below
+    // matches whatever order the server sent, with no separate hardcoded
+    // app list here to keep in sync with it.
+    data class Loaded(val manifest: Manifest) : ManifestState()
+
+    data class Error(val message: String) : ManifestState()
+}
+
+private sealed class CardState {
+    /**
+     * [status] is the server's live progress, refreshed on every poll, so the card can say which
+     * step is running and how long it has taken rather than showing an unchanging spinner for the
+     * length of a build.
+     */
+    data class Pulling(val status: BuildStatus?) : CardState()
+
+    /**
+     * A build somebody asked for outright, as opposed to one a pull or a download brought about.
+     * Its own state rather than reusing [Pulling], which is drawn as "Pulling and building" --
+     * nothing was pulled here, and a bar that says otherwise is the kind of small lie that makes a
+     * reader stop trusting the rest.
+     */
+    data class Rebuilding(val status: BuildStatus?) : CardState()
+
+    data class Preparing(val status: BuildStatus?) : CardState()
+
+    /**
+     * The request is out and the server hasn't started sending. For an app served as a stripped
+     * copy that is the strip pipeline running -- zip walk, llvm-strip, re-sign -- which takes
+     * seconds, and used to show as a download frozen at 0%.
+     *
+     * Named for the transport rather than "preparing", which is taken by the configured build step
+     * above; what a person reads is "preparing" either way.
+     */
+    data object Fetching : CardState()
+
+    /** [progress] is null when the response gave no length to measure against. */
+    data class Downloading(val progress: Float?) : CardState()
+
+    /**
+     * [retryPull] records which action failed, because Retry has to redo that one: a failed pull
+     * retried as a download would silently do something else than the button that produced the
+     * error.
+     */
+    data class Error(val message: String, val retryPull: Boolean = false) : CardState()
+}
+
+/** How far the list is dimmed behind a modal. One value, since two of them dim it. */
+private const val SCRIM_ALPHA = 0.6f
+
+/**
+ * The app list, and the Add screen reachable from it.
+ *
+ * One `if` rather than a navigation library: there are two screens and one level between them,
+ * which is not enough to need one.
+ */
+@Composable
+fun UpdaterScreen(settingsVersion: Int) {
+    // A second re-check trigger alongside settingsVersion: that one only
+    // bumps for a devupdater://enroll intent landing in MainActivity, but
+    // the in-app scanner below enrolls without ever going through an intent.
+    var inAppEnrollTick by remember { mutableStateOf(0) }
+    // Re-read on every enrollment: a plain remember would keep serving the
+    // pre-enrollment answer.
+    val enrolled = remember(settingsVersion, inAppEnrollTick) { serverSettings() != null }
+    if (!enrolled) {
+        NotEnrolled(onEnrolled = { inAppEnrollTick++ })
+        return
+    }
+
+    var adding by remember { mutableStateOf(false) }
+    // A newer build of *this app* on the build machine, if there is one.
+    // Asked over the rescue routes rather than read off the list, so it
+    // still answers when a manifest this app is too old to parse would
+    // not -- which is exactly when replacing this app matters most.
+    var selfUpdate by remember { mutableStateOf<SelfBuild?>(null) }
+    val selfUpdateContext = LocalContext.current
+    // On arrival, and again whenever this app's own project has just been
+    // built: the second is the moment the newer copy comes into existence,
+    // and the moment the server it has to keep talking to has just
+    // changed.
+    var selfUpdateTick by remember { mutableStateOf(0) }
+    LaunchedEffect(selfUpdateTick) { selfUpdate = selfUpdateAvailable(selfUpdateContext) }
+    // Keys of apps added on the Add screen, waiting to be taken into the
+    // list one at a time.
+    var added by remember { mutableStateOf<List<String>>(emptyList()) }
+
+    // The Add screen goes *over* the list rather than replacing it, so the
+    // list keeps its state and its place. Swapped out it would be built
+    // again from nothing on the way back, and rebuilding it means fetching
+    // it -- which is the whole-list refresh that adding an app has no
+    // business causing.
+    Box(Modifier.fillMaxSize()) {
+        AppListScreen(
+            added = added,
+            onAddedApplied = { added = emptyList() },
+            onAdd = { adding = true },
+            onOwnProjectBuilt = { selfUpdateTick++ },
+        )
+        selfUpdate?.let { build ->
+            // Over the list for the same reason the Add screen is, and
+            // dismissible for a stronger one: this appears unprompted, and
+            // an update that cannot be postponed is a demand rather than
+            // an offer.
+            BackHandler { selfUpdate = null }
+            Box(
+                Modifier.fillMaxSize()
+                    .background(MaterialTheme.colorScheme.scrim.copy(alpha = SCRIM_ALPHA))
+                    .clickable(
+                        interactionSource = remember { MutableInteractionSource() },
+                        indication = null,
+                    ) {
+                        selfUpdate = null
+                    },
+                contentAlignment = Alignment.Center,
+            ) {
+                Surface(
+                    shape = MaterialTheme.shapes.extraLarge,
+                    tonalElevation = 6.dp,
+                    modifier =
+                        Modifier.fillMaxWidth().padding(24.dp).clickable(
+                            interactionSource = remember { MutableInteractionSource() },
+                            indication = null,
+                        ) {},
+                ) {
+                    SelfUpdateScreen(build = build, onDismiss = { selfUpdate = null })
+                }
+            }
+        }
+        if (adding) {
+            // Back is the same gesture as Done here. Without this it falls
+            // through to the activity and closes the app, which reads as a
+            // crash when all somebody meant was to go back to the list.
+            BackHandler { adding = false }
+            // A modal over the list rather than a screen replacing it:
+            // this is a detour, and the dimmed list behind says the place
+            // you came from is still there. Tapping the dim dismisses it,
+            // which is what a modal is expected to do.
+            Box(
+                Modifier.fillMaxSize()
+                    .background(MaterialTheme.colorScheme.scrim.copy(alpha = SCRIM_ALPHA))
+                    .clickable(
+                        interactionSource = remember { MutableInteractionSource() },
+                        indication = null,
+                    ) {
+                        adding = false
+                    }
+            ) {
+                Surface(
+                    shape = MaterialTheme.shapes.extraLarge,
+                    tonalElevation = 6.dp,
+                    modifier =
+                        Modifier.fillMaxSize()
+                            .padding(16.dp)
+                            // Swallows taps that land on the sheet, so they
+                            // don't reach the dismissing scrim underneath.
+                            .clickable(
+                                interactionSource = remember { MutableInteractionSource() },
+                                indication = null,
+                            ) {},
+                ) {
+                    AddAppScreen(
+                        onAdded = { key -> added = added + key },
+                        onBack = { adding = false },
+                    )
+                }
+            }
+        }
+    }
+}
+
+/**
+ * Shown until this device has a token. There is no manual-entry form: the token is 256 random bits,
+ * so scanning is the only reasonable way in, and the server prints the QR every time it generates
+ * or rotates one.
+ */
+@Composable
+private fun NotEnrolled(onEnrolled: () -> Unit) {
+    val context = LocalContext.current
+    var scanError by remember { mutableStateOf<String?>(null) }
+    val scanLauncher =
+        rememberLauncherForActivityResult(ScanContract()) { result: ScanIntentResult ->
+            // Null contents means the user backed out of the scanner -- not an
+            // error, so nothing to report.
+            val contents = result.contents ?: return@rememberLauncherForActivityResult
+            val settings = serverStore.parseEnrollmentUri(Uri.parse(contents))
+            if (settings == null) {
+                scanError = "Not a valid enrollment code"
+            } else {
+                serverStore.save(context, settings)
+                useServer(settings)
+                onEnrolled()
+            }
+        }
+
+    val requestCamera =
+        rememberLauncherForActivityResult(ActivityResultContracts.RequestPermission()) { granted ->
+            if (granted) {
+                scanLauncher.launch(enrollmentScanOptions())
+            } else {
+                scanError =
+                    "Scanning needs the camera, and there is no other way in -- " +
+                        "the token is 256 random bits. Grant it in the system settings."
+            }
+        }
+
+    Column(Modifier.fillMaxSize().padding(24.dp)) {
+        Text("Dev Updater", style = MaterialTheme.typography.headlineSmall)
+        Spacer(Modifier.height(16.dp))
+        Text(
+            "This device isn't enrolled yet.",
+            style = MaterialTheme.typography.titleMedium,
+        )
+        Spacer(Modifier.height(8.dp))
+        Text(
+            "Start dev-updater on the build machine, then scan the QR it prints. " +
+                "It carries the address and this device's token.\n\n" +
+                "If it doesn't print one, the machine already has a token enrolled -- " +
+                "run it once with --rotate-token to issue a fresh one.",
+            style = MaterialTheme.typography.bodyMedium,
+            color = MaterialTheme.colorScheme.onSurfaceVariant,
+        )
+        Spacer(Modifier.height(16.dp))
+        Button(
+            onClick = {
+                // Hold the camera permission before the scanner starts.
+                // Letting its activity ask on our behalf is what the
+                // library does by default, and it opens the camera without
+                // waiting for the answer: the first-ever scan comes up as
+                // a live preview with "Sorry, the Android camera
+                // encountered a problem" over it, and works on the second
+                // try. Nothing is wrong with the camera, so nothing should
+                // say there is.
+                // Qualified: this package has its own Manifest, the
+                // /manifest response model.
+                if (
+                    context.checkSelfPermission(android.Manifest.permission.CAMERA) ==
+                        PackageManager.PERMISSION_GRANTED
+                ) {
+                    scanLauncher.launch(enrollmentScanOptions())
+                } else {
+                    requestCamera.launch(android.Manifest.permission.CAMERA)
+                }
+            },
+            modifier = Modifier.fillMaxWidth(),
+        ) {
+            Text("Scan QR code")
+        }
+        scanError?.let {
+            Spacer(Modifier.height(8.dp))
+            Text(it, color = MaterialTheme.colorScheme.error)
+        }
+    }
+}
+
+// PullToRefreshBox is still marked experimental in Material3. Opted into
+// for that one component rather than reimplemented: the alternative is a
+// hand-rolled nested-scroll connection and indicator, which is a great
+// deal more code to arrive at the same gesture, and worse at matching what
+// the platform does elsewhere.
+@OptIn(ExperimentalMaterial3Api::class)
+@Composable
+private fun AppListScreen(
+    added: List<String>,
+    onAddedApplied: () -> Unit,
+    onAdd: () -> Unit,
+    onOwnProjectBuilt: () -> Unit,
+) {
+    val context = LocalContext.current
+    val scope = rememberCoroutineScope()
+
+    var manifestState by remember { mutableStateOf<ManifestState>(ManifestState.Loading) }
+    var cardStates by remember { mutableStateOf<Map<String, CardState>>(emptyMap()) }
+    // Written only by updateInstalledState below, called from either of the
+    // two effects that follow -- so a fresh manifest, a package-change
+    // broadcast, and a return from the system installer all go through the
+    // same one path rather than each refreshing these their own way.
+    var installedTimes by remember { mutableStateOf<Map<String, Long?>>(emptyMap()) }
+    var installedSizes by remember { mutableStateOf<Map<String, Long?>>(emptyMap()) }
+    // Which build each project is pinned to on *this* device, read from
+    // local storage rather than the manifest. Held as state so picking one
+    // redraws the card without a round trip.
+    var chosenVariants by remember { mutableStateOf<Map<String, String>>(emptyMap()) }
+    // Which component of which project has a service action in flight.
+    // Per project, because that is the granularity of a card, and the row
+    // that is busy is the one that shows it.
+    var serviceBusy by remember { mutableStateOf<Map<String, String>>(emptyMap()) }
+
+    /**
+     * Replaces the list without showing it as loading, and keeps looking while the server says a
+     * remote check is still running.
+     *
+     * The server answers immediately rather than waiting on the git remotes, so "new commits"
+     * arrives a moment after the list does. That is the trade being made: the list is never held up
+     * by a round trip, and the badge catches up on its own instead of on a tap.
+     */
+    // [recheck] false starts the poll without asking any remote, for a
+    // caller that has already started the one check it cares about.
+    suspend fun load(recheck: Boolean = true): ManifestState {
+        val deadline = SystemClock.elapsedRealtime() + CHECK_POLL_BUDGET_MS
+        var first = recheck
+        while (true) {
+            // Only the first fetch asks the remotes; the rest are looking
+            // for the answer that one started.
+            val loaded = withContext(Dispatchers.IO) { fetchManifest(recheck = first) }
+            first = false
+            if (!loaded.checksPending) {
+                return ManifestState.Loaded(loaded)
+            }
+            if (SystemClock.elapsedRealtime() >= deadline) {
+                // Past the point where the server's own bound should have
+                // ended the check, so nothing is coming. The spinners have
+                // to come down with the polling that fed them -- one still
+                // turning would promise an answer nothing is collecting --
+                // but they are replaced by a card that says the check
+                // didn't finish, not by one that reads as "nothing new".
+                return ManifestState.Loaded(loaded.checksUnfinished())
+            }
+            manifestState = ManifestState.Loaded(loaded)
+            delay(CHECK_POLL_INTERVAL_MS)
+        }
+    }
+
+    // Whether a pull-to-refresh is still running, which is what keeps its
+    // indicator up. Separate from ManifestState.Loading because the point
+    // of the gesture is that the list stays where it is.
+    var pulling by remember { mutableStateOf(false) }
+
+    fun refreshByPull() {
+        if (pulling) return
+        pulling = true
+        cardStates = emptyMap()
+        scope.launch {
+            manifestState =
+                try {
+                    load()
+                } catch (e: DownloadServerException) {
+                    ManifestState.Error(e.message ?: "Unknown error")
+                }
+            pulling = false
+        }
+    }
+
+    fun refresh() {
+        manifestState = ManifestState.Loading
+        cardStates = emptyMap()
+        scope.launch {
+            manifestState =
+                try {
+                    load()
+                } catch (e: DownloadServerException) {
+                    ManifestState.Error(e.message ?: "Unknown error")
+                }
+        }
+    }
+
+    /**
+     * Puts one entry into the list: in place if it is already there, at the end if it isn't, which
+     * is where a just-added app belongs.
+     */
+    fun putEntry(entry: ManifestEntry) {
+        val current = manifestState as? ManifestState.Loaded ?: return
+        val entries = current.manifest.entries
+        manifestState =
+            ManifestState.Loaded(
+                current.manifest.copy(
+                    entries =
+                        when {
+                            entries.none { it.key == entry.key } -> entries + entry
+                            else -> entries.map { if (it.key == entry.key) entry else it }
+                        }
+                )
+            )
+    }
+
+    /** Takes one entry out, for the one action that ends a card. */
+    fun dropEntry(key: String) {
+        val current = manifestState as? ManifestState.Loaded ?: return
+        manifestState =
+            ManifestState.Loaded(
+                current.manifest.copy(
+                    entries = current.manifest.entries.filterNot { it.key == key }
+                )
+            )
+    }
+
+    /**
+     * Take the server's view of *one* card and leave every other card exactly as it was, returning
+     * the entry that landed.
+     *
+     * Three things it deliberately doesn't do, each of which the whole-list refresh does and each
+     * of which is wrong for an action on one card. It doesn't drop the list to a spinner, which
+     * would take every card away to report on one. It doesn't ask any remote: nothing happened to
+     * those checkouts, and the one acted on records its own result as it goes
+     * (`RemoteChecks::mark_current` on the server), so asking again would set every card spinning
+     * to re-learn what it already knew. And it doesn't wait for anyone else's outstanding check
+     * before applying what it came for.
+     *
+     * One app is one request: `GET /apps/{key}` describes it through the same code the whole list
+     * is built from, so a card fetched on its own can't come to say something different from the
+     * same card in a list.
+     */
+    suspend fun applyOne(key: String): ManifestEntry {
+        val fetched = withContext(Dispatchers.IO) { fetchApp(key) }
+        putEntry(fetched)
+        return fetched
+    }
+
+    /**
+     * Ask one checkout's remote and wait for that one answer.
+     *
+     * Waits on nothing else: the whole-list poll finishes when *no* check is outstanding, which
+     * would make one card's refresh sit behind another card's.
+     */
+    suspend fun awaitCheck(key: String) {
+        withContext(Dispatchers.IO) { recheckApp(key) }
+        val deadline = SystemClock.elapsedRealtime() + CHECK_POLL_BUDGET_MS
+        while (true) {
+            val landed = applyOne(key)
+            if (!landed.checksOutstanding) return
+            if (SystemClock.elapsedRealtime() >= deadline) {
+                // Past the point where the server's own bound should have
+                // ended it, so nothing is coming. The card says the check
+                // didn't finish rather than falling back to the blank line
+                // that means "the remote answered and had nothing".
+                putEntry(landed.checkUnfinished())
+                return
+            }
+            delay(CHECK_POLL_INTERVAL_MS)
+        }
+    }
+
+    // One card's worth of what Refresh does, for the control in its corner.
+    // Unlike everything else here this one does ask a remote, because
+    // asking is the whole point of it -- but for one checkout, and it waits
+    // only on that checkout's answer.
+    fun refreshOne(entry: ManifestEntry) {
+        scope.launch {
+            try {
+                awaitCheck(entry.key)
+            } catch (e: DownloadServerException) {
+                cardStates = cardStates + (entry.key to CardState.Error(e.message ?: "Failed"))
+            }
+        }
+    }
+
+    fun install(file: File) {
+        if (!canRequestInstall(context)) {
+            context.startActivity(requestInstallPermissionIntent(context))
+            return
+        }
+        context.startActivity(installApkIntent(context, file))
+    }
+
+    /** Pull acts on the build machine: fetch, fast-forward, rebuild. */
+    /**
+     * Runs a build on the build machine and follows it to the end, whichever button asked for it.
+     *
+     * One body for Pull and Rebuild because everything after "start it" is the same: poll while it
+     * runs, report a failure on the card, and re-read the entry once the server is answering again.
+     * They differ only in what they call and in what the progress bar is allowed to claim it is
+     * doing.
+     */
+    suspend fun followBuild(
+        entry: ManifestEntry,
+        retryPull: Boolean,
+        start: suspend () -> BuildStatus,
+        progress: (BuildStatus?) -> CardState,
+    ) {
+        cardStates = cardStates + (entry.key to progress(null))
+        try {
+            var status = withContext(Dispatchers.IO) { start() }
+            while (status.building) {
+                cardStates = cardStates + (entry.key to progress(status))
+                delay(BUILD_POLL_INTERVAL_MS)
+                status = withContext(Dispatchers.IO) { buildStatus(entry.key) }
+            }
+            val failure = status.error
+            if (failure != null) {
+                cardStates = cardStates + (entry.key to CardState.Error(failure, retryPull))
+                return
+            }
+            // The APK's mtime is what decides "update available", so the
+            // list has to come from the server again rather than be
+            // guessed at here.
+            //
+            // Retried, because building this server's own project rebuilds
+            // its binary and restarts it: the socket goes away for a
+            // moment, and reporting that as a failure would be telling
+            // somebody their update broke at the moment it worked.
+            //
+            // The card stays marked as being worked on until that entry
+            // lands, which is a second or several while this server
+            // restarts. Clearing it at the end of the build instead left
+            // the card reading as idle against a list still describing the
+            // state before it -- the same wrong group, arrived at from the
+            // other side.
+            repeat(REFRESH_ATTEMPTS_AFTER_PULL) { attempt ->
+                try {
+                    applyOne(entry.key)
+                    cardStates = cardStates - entry.key
+                    // Building this app's own project is what produces the
+                    // newer copy of it, and restarts the server it has to
+                    // keep talking to. So this is the moment to offer it,
+                    // rather than at some later launch.
+                    if (entry.builtIn) {
+                        onOwnProjectBuilt()
+                    }
+                    return
+                } catch (e: DownloadServerException) {
+                    if (attempt == REFRESH_ATTEMPTS_AFTER_PULL - 1) {
+                        cardStates = cardStates - entry.key
+                        manifestState = ManifestState.Error(e.message ?: "Unknown error")
+                    } else {
+                        delay(RESTART_WAIT_MS)
+                    }
+                }
+            }
+        } catch (e: DownloadServerException) {
+            cardStates =
+                cardStates + (entry.key to CardState.Error(e.message ?: "Failed", retryPull))
+        }
+    }
+
+    /** Pull acts on the build machine: fetch, fast-forward, rebuild. */
+    fun startPull(entry: ManifestEntry) {
+        scope.launch {
+            followBuild(
+                entry,
+                retryPull = true,
+                start = { pullAndBuild(entry.key) },
+                progress = { CardState.Pulling(it) },
+            )
+        }
+    }
+
+    /**
+     * Build because somebody asked, with nothing to pull and nothing looking stale -- which is the
+     * only way a project already current with its checkout ever records what it was built from.
+     */
+    fun startRebuild(entry: ManifestEntry) {
+        scope.launch {
+            followBuild(
+                entry,
+                retryPull = false,
+                start = { buildNow(entry.key) },
+                progress = { CardState.Rebuilding(it) },
+            )
+        }
+    }
+
+    fun startUpdate(entry: ManifestEntry) {
+        scope.launch {
+            if (entry.needsBuild) {
+                cardStates = cardStates + (entry.key to CardState.Preparing(null))
+                try {
+                    var status = withContext(Dispatchers.IO) { prepareBuild(entry.key) }
+                    while (status.building) {
+                        cardStates = cardStates + (entry.key to CardState.Preparing(status))
+                        delay(BUILD_POLL_INTERVAL_MS)
+                        status = withContext(Dispatchers.IO) { buildStatus(entry.key) }
+                    }
+                    val buildError = status.error
+                    if (buildError != null) {
+                        cardStates = cardStates + (entry.key to CardState.Error(buildError))
+                        return@launch
+                    }
+                } catch (e: DownloadServerException) {
+                    cardStates =
+                        cardStates +
+                            (entry.key to
+                                CardState.Error(e.message ?: "Couldn't prepare phone build"))
+                    return@launch
+                }
+            }
+
+            // Not "downloading" until something is actually coming down:
+            // the server may still be producing what it is about to send.
+            cardStates = cardStates + (entry.key to CardState.Fetching)
+            val file =
+                try {
+                    withContext(Dispatchers.IO) {
+                        downloadApk(context, entry) { read, total ->
+                            val progress = if (total > 0) read.toFloat() / total else null
+                            cardStates = cardStates + (entry.key to CardState.Downloading(progress))
+                        }
+                    }
+                } catch (e: DownloadServerException) {
+                    cardStates =
+                        cardStates + (entry.key to CardState.Error(e.message ?: "Download failed"))
+                    return@launch
+                }
+            cardStates = cardStates - entry.key
+            install(file)
+        }
+    }
+
+    /**
+     * Runs a management call, then refetches so the list reflects the server rather than a guess.
+     */
+    fun manage(entry: ManifestEntry, removes: Boolean = false, action: () -> Unit) {
+        scope.launch {
+            try {
+                withContext(Dispatchers.IO) { action() }
+                // This card's state only: another card's error is its own
+                // and has nothing to do with what just happened here.
+                cardStates = cardStates - entry.key
+                if (removes) dropEntry(entry.key) else applyOne(entry.key)
+            } catch (e: DownloadServerException) {
+                cardStates = cardStates + (entry.key to CardState.Error(e.message ?: "Failed"))
+            }
+        }
+    }
+
+    /**
+     * Runs one of a server component's actions on the build machine.
+     *
+     * Refreshes afterwards rather than trusting the reply alone: the reply says what that component
+     * ended up doing, and the list is what says whether anything else changed with it -- a service
+     * that starts may be the reason a card stops offering an update.
+     */
+    fun runServiceAction(
+        entry: ManifestEntry,
+        component: String,
+        action: String,
+        purge: Purge = Purge(),
+    ) {
+        serviceBusy = serviceBusy + (entry.key to component)
+        scope.launch {
+            try {
+                val result =
+                    withContext(Dispatchers.IO) {
+                        serviceAction(entry.key, component, action, purge)
+                    }
+                // Reported on the card the button was pressed on, because
+                // the request succeeded -- the service is gone -- and what
+                // is left to say is that something is still on the build
+                // machine, which nobody can see from here otherwise.
+                cardStates =
+                    if (result.leftBehind.isEmpty()) {
+                        cardStates - entry.key
+                    } else {
+                        cardStates +
+                            (entry.key to CardState.Error(result.leftBehind.joinToString("\n")))
+                    }
+                applyOne(entry.key)
+            } catch (e: DownloadServerException) {
+                cardStates = cardStates + (entry.key to CardState.Error(e.message ?: "Failed"))
+            } finally {
+                serviceBusy = serviceBusy - entry.key
+            }
+        }
+    }
+
+    fun updateInstalledState(entries: List<ManifestEntry>) {
+        // A project with no build yet has no package, so there is nothing
+        // installed to ask about -- which is exactly what null already
+        // means to the callers of these two maps.
+        installedTimes = entries.associate { entry ->
+            entry.key to entry.packageName?.let { installedLastUpdateTimeMillis(context, it) }
+        }
+        installedSizes = entries.associate { entry ->
+            entry.key to entry.packageName?.let { installedApkSizeBytes(context, it) }
+        }
+        chosenVariants =
+            entries
+                .mapNotNull { entry -> chosenVariant(context, entry.key)?.let { entry.key to it } }
+                .toMap()
+    }
+
+    LaunchedEffect(Unit) { refresh() }
+
+    // An app added on the Add screen is fetched on its own and appended.
+    // Reloading the list instead would put every other card back through
+    // its checks to learn about one that isn't in it yet.
+    //
+    // Its remote is asked straight afterwards, because a card that has
+    // never been checked reports no new commits -- which is the same thing
+    // it would say if the remote had been asked and had nothing, and there
+    // would be no way to tell the two apart.
+    LaunchedEffect(added) {
+        if (added.isEmpty()) return@LaunchedEffect
+        for (key in added) {
+            try {
+                applyOne(key)
+                awaitCheck(key)
+            } catch (e: DownloadServerException) {
+                // It is on the server either way; the next refresh or
+                // resume will bring it in.
+            }
+        }
+        onAddedApplied()
+    }
+
+    // The packages to look up come from the manifest itself, not a
+    // hardcoded local list, so this can only run once the fetch above has
+    // landed -- hence keying on the entries rather than on Unit.
+    //
+    // Re-run on every resume because an install finishes in the *system
+    // installer's* activity, with this screen stopped: PackageManager only
+    // reports the new lastUpdateTime once that's done, so querying at
+    // download time would always read the pre-install value and leave the
+    // card claiming an update is still available until someone hit Refresh.
+    // Resuming is exactly the moment the answer can have changed, and these
+    // are cheap local PackageManager lookups with no network involved (the
+    // manifest is deliberately left alone -- that's what Refresh is for).
+    //
+    // This is a fallback for cases the broadcast receiver below can't cover
+    // (this app's own process wasn't alive to receive it -- e.g. it was
+    // backgrounded and killed during the install, or the install happened
+    // via a plain `adb install` while this app wasn't running at all), not
+    // the primary path in the common case of installing through this
+    // screen's own Update button.
+    val loadedEntries = (manifestState as? ManifestState.Loaded)?.manifest?.entries
+    LifecycleResumeEffect(loadedEntries) {
+        loadedEntries?.let(::updateInstalledState)
+        onPauseOrDispose {}
+    }
+
+    // The manifest is refetched on resume too, not just the local install
+    // state: this screen is often left open for a long time, and commit
+    // counts come from the server, so returning to it should show what is
+    // true now rather than whenever it was last opened. A checkout already
+    // being asked about is not asked again (RemoteChecks::refresh), so a
+    // burst of resumes doesn't pile up round trips.
+    LifecycleResumeEffect(Unit) {
+        if (manifestState is ManifestState.Loaded) {
+            refresh()
+        }
+        onPauseOrDispose {}
+    }
+
+    // PackageManager reports a completed install as soon as it happens,
+    // regardless of whether this app's own activity is currently visible --
+    // see registerPackageChangeReceiver's own comment for why that's
+    // earlier than the resume above ever can be. rememberUpdatedState keeps
+    // the callback (registered once, not re-registered per manifest fetch)
+    // seeing the latest loaded entries without needing them as a key.
+    val currentEntries = rememberUpdatedState(loadedEntries)
+    DisposableEffect(Unit) {
+        val receiver =
+            registerPackageChangeReceiver(context) { packageName ->
+                currentEntries.value
+                    ?.takeIf { entries -> entries.any { it.packageName == packageName } }
+                    ?.let(::updateInstalledState)
+            }
+        onDispose { context.unregisterReceiver(receiver) }
+    }
+
+    // How much room the floating button takes at the foot of the list,
+    // measured from the button rather than written down: a card's own
+    // controls run to the bottom edge of the last card, and a number
+    // guessed here would either cover one of them or leave a gap.
+    var addButtonSpace by remember { mutableStateOf(0.dp) }
+    val density = LocalDensity.current
+
+    Box(Modifier.fillMaxSize()) {
+        Column(Modifier.fillMaxSize().padding(16.dp)) {
+            Row(
+                verticalAlignment = Alignment.CenterVertically,
+                modifier = Modifier.fillMaxWidth(),
+            ) {
+                Text(
+                    "Dev Updater",
+                    style = MaterialTheme.typography.headlineSmall,
+                    modifier = Modifier.weight(1f),
+                )
+                // A glyph rather than the word: it never changes, and a
+                // refresh arrow is read faster than it is spelled. Add is not
+                // here -- it is the button floating over the list.
+                IconGlyphButton(REFRESH_GLYPH, "Refresh", { refresh() })
+            }
+            Spacer(Modifier.height(16.dp))
+
+            when (val state = manifestState) {
+                is ManifestState.Loading -> CircularProgressIndicator()
+                is ManifestState.Error ->
+                    Column {
+                        // The message alone. It arrives from
+                        // DownloadServerException already saying what failed,
+                        // where, and what to try -- so a prefix here would
+                        // restate half of it in front of itself, and would
+                        // have to guess at which action produced it.
+                        Text(state.message, color = MaterialTheme.colorScheme.error)
+                        // A missing local-network permission looks identical to an
+                        // unreachable server from the socket's point of view, so
+                        // call it out rather than leaving it to be guessed at.
+                        if (!com.example.wgapplink.localNetworkAllowed(context)) {
+                            Spacer(Modifier.height(12.dp))
+                            Text(
+                                "This app doesn't have the local network permission, which " +
+                                    "Android 17+ requires to reach an address like this one. " +
+                                    "That alone would explain the failure above: without it " +
+                                    "the connection is dropped rather than refused, so it " +
+                                    "just times out. Grant it under Settings > Apps > " +
+                                    "Dev Updater > Permissions.",
+                                style = MaterialTheme.typography.bodyMedium,
+                                color = MaterialTheme.colorScheme.onSurfaceVariant,
+                            )
+                        }
+                    }
+                // The same thing the Refresh button does, minus the blank: the
+                // gesture shows its own indicator, so dropping the list to a
+                // spinner underneath it would say the same thing twice and take
+                // the list away while saying it.
+                is ManifestState.Loaded ->
+                    PullToRefreshBox(
+                        isRefreshing = pulling,
+                        onRefresh = ::refreshByPull,
+                        modifier = Modifier.fillMaxSize(),
+                    ) {
+                        Column(Modifier.fillMaxSize().verticalScroll(rememberScrollState())) {
+                            val entries = state.manifest.entries
+                            if (entries.isEmpty()) {
+                                Text(
+                                    "No apps yet. Tap Add to point this at a project on the build machine.",
+                                    style = MaterialTheme.typography.bodyMedium,
+                                    color = MaterialTheme.colorScheme.onSurfaceVariant,
+                                )
+                            }
+
+                            // "Up to date" means there is nothing waiting anywhere: no
+                            // commits to pull, and the build that is here is the one
+                            // installed. Counting the commits is what stops a card
+                            // moving groups the moment a pull finishes -- a checkout
+                            // that is behind was never up to date, so the pull that
+                            // rebuilds it changes what the card *says* without changing
+                            // where it sits. An app with nothing built is here too; it
+                            // is not up to date either.
+                            //
+                            // A build running on the build machine counts for the same
+                            // reason, and it has to be asked here rather than inferred
+                            // from the entry: a list that lands mid-pull reports a
+                            // checkout with nothing left to fetch and an APK nobody has
+                            // rebuilt yet, which is "up to date" in every term below,
+                            // and sent the card to the bottom group until the build
+                            // finished and brought it back. A card being made current
+                            // is not current yet.
+                            val (needAttention, upToDate) =
+                                entries.partition { entry ->
+                                    cardStates[entry.key].isBuilding() ||
+                                        !entry.built ||
+                                        entry.newCommits ||
+                                        !isUpToDate(
+                                            entry,
+                                            installedTimes[entry.key],
+                                            chosenVariants[entry.key],
+                                        )
+                                }
+
+                            // The two groups render identically; only the up-to-date one
+                            // gets a heading above it, since the ones needing an update
+                            // are the point of the screen and lead without one.
+                            for ((heading, group) in
+                                listOf(null to needAttention, "Up to date" to upToDate)) {
+                                if (group.isEmpty()) continue
+                                if (heading != null) {
+                                    Text(heading, style = MaterialTheme.typography.titleSmall)
+                                    Spacer(Modifier.height(8.dp))
+                                }
+                                group.forEach { entry ->
+                                    AppCard(
+                                        entry = entry,
+                                        installedLastUpdateTimeMillis = installedTimes[entry.key],
+                                        chosenVariantPath = chosenVariants[entry.key],
+                                        installedSizeBytes = installedSizes[entry.key],
+                                        cardState = cardStates[entry.key],
+                                        onUpdate = { startUpdate(it) },
+                                        onPull = { startPull(entry) },
+                                        onRebuild = { startRebuild(entry) },
+                                        onRefresh = { refreshOne(entry) },
+                                        onSettings = { gitIpv4 ->
+                                            manage(entry) { setAppSettings(entry.key, gitIpv4) }
+                                        },
+                                        onApprove = {
+                                            manage(entry) { approveDeclaration(entry.key) }
+                                        },
+                                        onRemove = {
+                                            forgetVariant(context, entry.key)
+                                            manage(entry, removes = true) { removeApp(entry.key) }
+                                        },
+                                        // Written here rather than sent to the server:
+                                        // it is this device's preference. Bumping the
+                                        // reload token is what redraws the card with
+                                        // the new choice and the mtime that goes with
+                                        // it.
+                                        onSelectVariant = { variant ->
+                                            chooseVariant(context, entry.key, variant?.path)
+                                            chosenVariants =
+                                                when (variant) {
+                                                    null -> chosenVariants - entry.key
+                                                    else ->
+                                                        chosenVariants + (entry.key to variant.path)
+                                                }
+                                        },
+                                        serviceBusy = serviceBusy[entry.key],
+                                        onServiceAction = { component, action, purge ->
+                                            runServiceAction(entry, component, action, purge)
+                                        },
+                                    )
+                                    Spacer(Modifier.height(12.dp))
+                                }
+                            }
+                            // Room for the floating button, so the last card's controls
+                            // can still be reached.
+                            Spacer(Modifier.height(addButtonSpace))
+                        }
+                    }
+            }
+        }
+
+        // Bottom right, over the list. Add is the one thing here that is
+        // not about a particular card, and it was competing for the top bar
+        // with Refresh, which is.
+        FloatingActionButton(
+            onClick = onAdd,
+            containerColor = MaterialTheme.colorScheme.primary,
+            contentColor = MaterialTheme.colorScheme.onPrimary,
+            modifier =
+                Modifier.align(Alignment.BottomEnd)
+                    // Before the padding, so what is measured is the whole
+                    // space the button occupies rather than the button alone --
+                    // that is what the list has to keep clear of.
+                    .onSizeChanged { addButtonSpace = with(density) { it.height.toDp() } }
+                    .padding(16.dp),
+        ) {
+            Text(PLUS_GLYPH, fontFamily = NerdIcons, fontSize = 22.sp)
+        }
+    }
+}
+
+@Composable
+private fun AppCard(
+    entry: ManifestEntry,
+    installedLastUpdateTimeMillis: Long?,
+    installedSizeBytes: Long?,
+    cardState: CardState?,
+    onUpdate: (ManifestEntry) -> Unit,
+    onPull: () -> Unit,
+    onRebuild: () -> Unit,
+    onRefresh: () -> Unit,
+    onSettings: (gitIpv4: Boolean) -> Unit,
+    onApprove: () -> Unit,
+    onRemove: () -> Unit,
+    chosenVariantPath: String?,
+    onSelectVariant: (ApkVariant?) -> Unit,
+    // Which component this card is running a service action for, if any --
+    // so the one being acted on is the one that shows it, rather than
+    // every row going quiet together.
+    serviceBusy: String?,
+    onServiceAction: (component: String, action: String, purge: Purge) -> Unit,
+) {
+    val upToDate = isUpToDate(entry, installedLastUpdateTimeMillis, chosenVariantPath)
+    var settingsOpen by remember { mutableStateOf(false) }
+    // Until the build step this project asks for has been accepted, the
+    // card is about that request and nothing else: no size, no components,
+    // no button offering to install something whose build nobody has
+    // agreed to run yet. The one thing kept is Remove, which is how you
+    // decline by getting rid of the card.
+    val awaitingApproval = entry.pendingDeclaration != null
+
+    // What the download would cost, and what it replaces. Belongs to the
+    // APK the same way the Update button does, and travels with it.
+    val sizeText =
+        if (awaitingApproval) null
+        else
+            when {
+                !entry.built -> null
+                !upToDate && installedSizeBytes != null ->
+                    "${formatSize(installedSizeBytes)} \u2192 ${formatSize(entry.size)}"
+                else -> formatSize(entry.size)
+            }
+
+    Card(Modifier.fillMaxWidth()) {
+        Column(Modifier.padding(16.dp)) {
+            // The two corner controls belong to the card, not to its title,
+            // so they sit beside the whole of what names it -- title and
+            // path together -- rather than in the title's own row, where
+            // they pushed the path onto a line of its own with nothing to
+            // its right. Aligned to the top of that pair, not centred on
+            // it: a corner control that drifts down as the block below it
+            // grows has stopped being in the corner.
+            // The corner controls are laid over the header rather than
+            // taking a column in it, so that only the line they actually
+            // sit beside gives up room for them. In a row of their own they
+            // shortened the whole block, and the path -- which is under
+            // them, not next to them -- was cut off well before the card's
+            // edge with nothing in the way.
+            Box(Modifier.fillMaxWidth()) {
+                Row(verticalAlignment = Alignment.Top, modifier = Modifier.fillMaxWidth()) {
+                    AppIcon(entry.packageName, Modifier.align(Alignment.CenterVertically))
+                    Spacer(Modifier.width(10.dp))
+                    Column(Modifier.weight(1f)) {
+                        // The one line that makes room for them: they are beside
+                        // it, and a title running under them is the thing that
+                        // would be in the way.
+                        Row(
+                            verticalAlignment = Alignment.CenterVertically,
+                            modifier = Modifier.fillMaxWidth().padding(end = CORNER_CONTROLS_WIDTH),
+                        ) {
+                            Text(
+                                entry.label,
+                                style = MaterialTheme.typography.titleMedium,
+                                modifier = Modifier.weight(1f),
+                            )
+                        }
+                        // Which project on the build machine this is, so two apps
+                        // with similar labels can be told apart and a wrong path
+                        // spotted -- and beside it the branch it is on.
+                        Row(verticalAlignment = Alignment.CenterVertically) {
+                            Text(
+                                FOLDER_GLYPH,
+                                fontFamily = NerdIcons,
+                                fontSize = 13.sp,
+                                color = MaterialTheme.colorScheme.onSurfaceVariant,
+                            )
+                            Spacer(Modifier.width(5.dp))
+                            Text(
+                                // The checkout, not the directory underneath it
+                                // that this server watches: the repository is
+                                // what a person calls the project, and it is
+                                // what Pull acts on.
+                                entry.git?.root ?: entry.projectPath,
+                                style = MaterialTheme.typography.bodySmall,
+                                color = MaterialTheme.colorScheme.onSurfaceVariant,
+                                maxLines = 1,
+                                // A path is identified by its tail, so one too
+                                // long for the row gives up its head rather than
+                                // the directory name that says which project
+                                // this is.
+                                overflow = TextOverflow.StartEllipsis,
+                            )
+                            entry.git?.let { git ->
+                                // Blue rather than a word: "new commits" spelled
+                                // out doubled the length of the line to say what
+                                // the Pull button below already offers, so the
+                                // branch is simply the colour of that button
+                                // when pressing it would do something.
+                                val branchColor =
+                                    when {
+                                        entry.newCommits -> ActionTone.Primary.color
+                                        else -> MaterialTheme.colorScheme.onSurfaceVariant
+                                    }
+                                Spacer(Modifier.width(10.dp))
+                                Text(
+                                    BRANCH_GLYPH,
+                                    fontFamily = NerdIcons,
+                                    fontSize = 13.sp,
+                                    color = branchColor,
+                                )
+                                Spacer(Modifier.width(4.dp))
+                                Text(
+                                    buildString {
+                                        append(git.branch)
+                                        // Not "new commits", which the colour
+                                        // says. And not the lack of an
+                                        // upstream either: plenty of
+                                        // checkouts have no remote on
+                                        // purpose, and saying so on every
+                                        // card is nagging about a choice
+                                        // somebody made. What is left is
+                                        // the one case where the colour
+                                        // would be read as an answer it
+                                        // isn't -- a check that gave none.
+                                        if (entry.checkError != null) {
+                                            append(" \u00b7 couldn't check")
+                                        }
+                                        // Not whether the working tree is dirty.
+                                        // It is true of a checkout somebody is
+                                        // working in nearly all the time, so it
+                                        // said nothing while being long enough
+                                        // to push the rest of the line out of
+                                        // the row. The server still reads it --
+                                        // a pull refuses over uncommitted
+                                        // changes -- and says so if you press
+                                        // Pull, which is the moment it matters.
+                                    },
+                                    style = MaterialTheme.typography.bodySmall,
+                                    color = branchColor,
+                                    maxLines = 1,
+                                    overflow = TextOverflow.Ellipsis,
+                                )
+                                if (entry.checkPending) {
+                                    Spacer(Modifier.width(6.dp))
+                                    Working()
+                                }
+                            }
+                        }
+                    }
+                }
+                Row(
+                    modifier = Modifier.align(Alignment.TopEnd),
+                    horizontalArrangement = Arrangement.spacedBy(GLYPH_BUTTON_GAP),
+                ) {
+                    // Refreshes this project alone -- the same checks the
+                    // list does on open, for one card, so a card that is out
+                    // of date doesn't cost a round trip for every other one.
+                    IconGlyphButton(REFRESH_GLYPH, "Refresh this project", onRefresh)
+                    IconGlyphButton(SETTINGS_GLYPH, "Settings", { settingsOpen = true })
+                }
+            }
+            // Every component gets a card, including a project that has
+            // only one. The alternative was to draw a lone APK flat and
+            // move its size and its button up to the project card, which
+            // meant two layouts to keep in step and a size sitting next to
+            // the corner controls, where it looked like it belonged to
+            // them.
+            if (!awaitingApproval) {
+                Spacer(Modifier.height(8.dp))
+                Column(verticalArrangement = Arrangement.spacedBy(8.dp)) {
+                    // What you install is what the card is for, so it comes
+                    // first however the project declared it. The declared
+                    // order is the *build* order -- dev-updater builds its
+                    // server before its APK on purpose -- and that stays as
+                    // it is; this sort is stable, so anything else keeps it.
+                    entry.components
+                        .sortedBy { it.isServer }
+                        .forEach { component ->
+                            ComponentCard(
+                                entryKey = entry.key,
+                                component = component,
+                                packageName = entry.packageName,
+                                // An APK's size sits where a server's state
+                                // does: the one thing worth knowing about it
+                                // besides its name.
+                                sizeText = sizeText.takeIf { !component.isServer },
+                                // This app reaches the server through this server.
+                                // Stopping or uninstalling it is the one action
+                                // here that cannot be undone from the phone.
+                                isOwnServer = entry.builtIn,
+                                build = componentBuild(cardState, component.name),
+                                // Being worked on right now, which the
+                                // component's own slice of the build says
+                                // directly rather than being inferred from a
+                                // project-wide phase name.
+                                working =
+                                    componentBuild(cardState, component.name)?.running == true,
+                                busy = serviceBusy == component.name,
+                                onAction = { action, purge ->
+                                    onServiceAction(component.name, action, purge)
+                                },
+                                controls = {
+                                    if (!component.isServer) {
+                                        // Said before the button, because it
+                                        // qualifies what pressing it gets you.
+                                        MismatchedPairNote(
+                                            self = component,
+                                            others = entry.components,
+                                        )
+                                        // The button that asked for it, then
+                                        // how far along it is: a bar reports on
+                                        // the control above it.
+                                        UpdateButton(
+                                            built = entry.built,
+                                            needsBuild = entry.needsBuild,
+                                            installed = installedLastUpdateTimeMillis != null,
+                                            upToDate = upToDate,
+                                            cardState = cardState,
+                                            onUpdate = { onUpdate(entry) },
+                                            onPull = onPull,
+                                        )
+                                        ApkProgress(cardState)
+                                    }
+                                },
+                            )
+                        }
+                }
+            }
+            // What there is to read before pressing anything, directly
+            // above the row that acts on it.
+            entry.pendingDeclaration?.let { requested -> PendingDeclaration(requested) }
+
+            // The card's own actions, as opposed to a component's: what
+            // acts on the whole project goes here, left to right in the
+            // order you would do it, with Remove held to the right edge.
+            //
+            // One row rather than a button wherever each happened to be
+            // needed. Remove sat above the pending declaration before this,
+            // which put the most destructive control on the card *over* the
+            // thing it would be destroying, and left the card with no
+            // settled place for its last line.
+            //
+            // Pull acts on the build machine, Update on this phone -- so
+            // both are offered, rather than one button meaning different
+            // things depending on what is stale. Below the components,
+            // because it acts on the whole checkout they are all built
+            // from, and reading it after them is reading it as the thing
+            // that covers all of them.
+            //
+            // Disabled rather than absent when there is nothing to pull: a
+            // button that comes and goes makes its presence the signal, and
+            // then a card with no Pull reads the same whether the remote
+            // had nothing or was never asked. A failed check enables it
+            // again, since pressing Pull is how you find out.
+            Row(
+                verticalAlignment = Alignment.CenterVertically,
+                modifier = Modifier.fillMaxWidth(),
+            ) {
+                // Not while a declaration is waiting to be read. The
+                // button says Build and would do no such thing -- the
+                // server pulls and stops for an unaccepted project -- and
+                // a card asking permission should not also be offering to
+                // act on the thing it is asking about. Hidden rather than
+                // disabled, which is the one place that beats the rule
+                // just below: absence is only ambiguous when nothing says
+                // why, and this card says why in the paragraph above it.
+                if (entry.canPull && !awaitingApproval) {
+                    TextButton(
+                        onClick = onPull,
+                        enabled =
+                            (entry.newCommits || entry.checkError != null) && cardState == null,
+                        colors = ActionTone.Primary.colors(),
+                    ) {
+                        Text("Pull & Build")
+                    }
+                }
+                if (!awaitingApproval && entry.needsBuild) {
+                    // Held apart from both neighbours by its own weights,
+                    // because it belongs to neither: it is not the pull,
+                    // and it is emphatically not the remove.
+                    Spacer(Modifier.weight(1f))
+                    TextButton(
+                        onClick = onRebuild,
+                        enabled = cardState == null,
+                        // The colour Restart and Reinstall wear: it
+                        // certainly does something, and what it leaves
+                        // behind is not obvious from here.
+                        colors = ActionTone.Caution.colors(),
+                    ) {
+                        Text("Rebuild")
+                    }
+                }
+                if (awaitingApproval) {
+                    // Green, like Start and Install: this turns on a build
+                    // step that was not running before. Left untinted it
+                    // would take the scheme's primary and so read as
+                    // Restart's colour, which is a different consequence.
+                    TextButton(onClick = onApprove, colors = ActionTone.Go.colors()) {
+                        Text("Accept build step")
+                    }
+                }
+                Spacer(Modifier.weight(1f))
+                // The server's own app keeps the button and loses the
+                // ability to press it: removing it would strand this app
+                // with no route left to update itself, and a control that
+                // vanishes on one card teaches less than one that is
+                // visibly not available.
+                TextButton(
+                    onClick = onRemove,
+                    enabled = !entry.builtIn,
+                    colors = ActionTone.Destructive.colors(),
+                ) {
+                    Text("Remove")
+                }
+            }
+            // Directly under the row Pull is on, for the same reason the
+            // APK's bar sits under its button: a bar reports on a control,
+            // and one placed away from it belongs to nothing in particular.
+            // This had gone missing entirely when Pull moved up here.
+            if (cardState is CardState.Pulling) {
+                BuildProgress("Pulling and building", cardState.status)
+            }
+            if (cardState is CardState.Rebuilding) {
+                BuildProgress("Building", cardState.status)
+            }
+
+            // Only while the old app is actually still there. The server
+            // remembers the name it was renamed from; whether anything
+            // answers to it is this device's question, and asking it here
+            // is what saves the server needing to be told when it stops
+            // being true.
+            val cardContext = LocalContext.current
+            val orphan = entry.previousPackageName?.takeIf { isInstalled(cardContext, it) }
+            if (orphan != null) {
+                Spacer(Modifier.height(4.dp))
+                Text(
+                    "Renamed from $orphan. Android treats that as a different " +
+                        "app, so it is still installed and nothing will replace it.",
+                    style = MaterialTheme.typography.bodySmall,
+                    color = MaterialTheme.colorScheme.onSurfaceVariant,
+                )
+                TextButton(onClick = { cardContext.startActivity(uninstallIntent(orphan)) }) {
+                    Text("Remove the old app")
+                }
+            }
+
+            // What is left to say about the card once its components have
+            // said their own part: a failure, or that there is no build to
+            // talk about yet. Progress is not here -- it belongs beside the
+            // button that asked for it, which is in the APK's own card.
+            //
+            // A failure is checked first: a project being built for the
+            // first time is both at once, and the failure is the more
+            // useful of the two.
+            when {
+                cardState is CardState.Error ->
+                    Text(cardState.message, color = MaterialTheme.colorScheme.error)
+
+                !entry.built && !awaitingApproval ->
+                    Text(
+                        if (entry.needsBuild) {
+                            "Not built yet -- Build runs this project's build step."
+                        } else {
+                            "No build found under this project yet."
+                        },
+                        style = MaterialTheme.typography.bodyMedium,
+                        color = MaterialTheme.colorScheme.onSurfaceVariant,
+                    )
+            }
+            // Why, under the branch line rather than in it: "couldn't
+            // check" up there is the part that changes how the line is
+            // read, and this is the part that says what to do about it.
+            // Whoever is looking at this card is on a phone and has no way
+            // to read the server's log.
+            //
+            // Not while the card is reporting a failure of its own, though:
+            // Pull asks the same remote the check asked, so the two say the
+            // same paragraph twice, and the one that ran because somebody
+            // pressed a button is the one they are waiting to read.
+            if (cardState !is CardState.Error) {
+                entry.checkError?.let { reason ->
+                    Text(
+                        reason,
+                        style = MaterialTheme.typography.bodySmall,
+                        color = MaterialTheme.colorScheme.error,
+                    )
+                }
+            }
+
+            // Only worth a row when there is actually a choice, which is
+            // rare -- the usual case is a single debug build, and an empty
+            // row here was leaving a band of space at the foot of every
+            // card for a control almost none of them have.
+            //
+            // And not while a declaration is waiting either: this picks
+            // which build gets installed, on a card that is offering no
+            // way to install one.
+            if (entry.variants.size > 1 && !awaitingApproval) {
+                Row(
+                    horizontalArrangement = Arrangement.End,
+                    modifier = Modifier.fillMaxWidth(),
+                ) {
+                    VariantPicker(entry.variants, chosenVariantPath, onSelectVariant)
+                }
+            }
+        }
+    }
+
+    if (settingsOpen) {
+        ProjectSettingsDialog(
+            entry = entry,
+            onDismiss = { settingsOpen = false },
+            onApply = { gitIpv4 ->
+                settingsOpen = false
+                onSettings(gitIpv4)
+            },
+        )
+    }
+}
+
+/**
+ * What this machine has chosen about one project, as opposed to what the project declares about
+ * itself.
+ *
+ * A dialog rather than a screen: it belongs to one card, and there is a card behind it to come back
+ * to. It will grow the rest of what the Add screen asks -- a label, which build to serve -- so it
+ * is a list of settings from the start, even holding one.
+ *
+ * Applied on Save rather than as each control moves, because a settings write is a round trip that
+ * rebuilds the entry on the server, and one per toggle flipped while making up your mind is a lot
+ * of them.
+ */
+@Composable
+private fun ProjectSettingsDialog(
+    entry: ManifestEntry,
+    onDismiss: () -> Unit,
+    onApply: (gitIpv4: Boolean) -> Unit,
+) {
+    // Keyed on what the server last said, so reopening after a save shows
+    // the saved value rather than a stale local one.
+    var gitIpv4 by remember(entry.gitIpv4) { mutableStateOf(entry.gitIpv4) }
+
+    AlertDialog(
+        onDismissRequest = onDismiss,
+        title = { Text(entry.label) },
+        text = {
+            Column {
+                Row(
+                    verticalAlignment = Alignment.CenterVertically,
+                    modifier = Modifier.fillMaxWidth(),
+                ) {
+                    Text(
+                        "Force IPv4 for git",
+                        style = MaterialTheme.typography.bodyLarge,
+                        modifier = Modifier.weight(1f),
+                    )
+                    Spacer(Modifier.width(12.dp))
+                    Switch(checked = gitIpv4, onCheckedChange = { gitIpv4 = it })
+                }
+            }
+        },
+        confirmButton = { TextButton(onClick = { onApply(gitIpv4) }) { Text("Save") } },
+        dismissButton = { TextButton(onClick = onDismiss) { Text("Cancel") } },
+    )
+}
+
+/**
+ * How far along whatever is on its way to this phone is.
+ *
+ * Drawn where its button is, inside the APK's component card: a bar reports on the control that
+ * started it, and one placed away from that control belongs to nothing in particular.
+ */
+@Composable
+private fun ApkProgress(cardState: CardState?) {
+    when (cardState) {
+        is CardState.Preparing -> BuildProgress("Building for phone", cardState.status)
+
+        is CardState.Fetching -> {
+            ProgressBar()
+            Spacer(Modifier.height(4.dp))
+            Text("Preparing the download...")
+        }
+
+        is CardState.Downloading -> {
+            val progress = cardState.progress
+            if (progress == null) {
+                ProgressBar()
+            } else {
+                ProgressBar(fraction = { progress })
+            }
+            Spacer(Modifier.height(4.dp))
+            Text(
+                if (progress == null) {
+                    "Downloading..."
+                } else {
+                    "Downloading... ${(progress * 100).toInt()}%"
+                }
+            )
+        }
+
+        // A pull is the project's, not the APK's, and is drawn at the foot
+        // of the card. Everything else here has nothing to show.
+        else -> {}
+    }
+}
+
+/**
+ * Build / Update / Reinstall / Retry: the one control here that puts something on this phone.
+ *
+ * Its own composable rather than inline in the component card, because what it should say is four
+ * cases of its own -- and deciding the label and the colour together, in one place, is what keeps
+ * the two from disagreeing.
+ */
+@Composable
+private fun UpdateButton(
+    built: Boolean,
+    needsBuild: Boolean,
+    /** Whether this phone has the app at all, which decides "Install". */
+    installed: Boolean,
+    upToDate: Boolean,
+    cardState: CardState?,
+    onUpdate: () -> Unit,
+    onPull: () -> Unit,
+) {
+    // A project with nothing built still gets a button when its (accepted)
+    // build step is what would produce the first APK -- otherwise adding it
+    // before that first build, which the server now allows, would leave no
+    // way to do it.
+    if (!built && !needsBuild) return
+
+    if (cardState is CardState.Error) {
+        TextButton(
+            onClick = { if (cardState.retryPull) onPull() else onUpdate() },
+            colors = ActionTone.Primary.colors(),
+        ) {
+            Text("Retry")
+        }
+        return
+    }
+
+    // Label and colour decided together: they are two ways of saying the
+    // same thing, and picking them apart is how they come to disagree.
+    val (label, tone) =
+        when {
+            // Nothing to compare against yet, so neither "Update" nor
+            // "Reinstall" is the honest word for it.
+            !built -> "Build" to ActionTone.Primary
+            // Nothing here to replace, so this is a first arrival rather than a
+            // newer one -- the same thing Start and Install are elsewhere, and
+            // coloured to match them.
+            !installed -> "Install" to ActionTone.Go
+            // Reinstalling replaces a build with the same build -- the same "are
+            // you sure that's what you meant" as a Restart, and coloured to
+            // match it.
+            upToDate -> "Reinstall" to ActionTone.Caution
+            else -> "Update" to ActionTone.Primary
+        }
+    // Disabled while something is running, rather than replaced by the bar
+    // that reports it. A control that disappears takes the reader's
+    // bearings with it, and what it says is still what pressing it would
+    // have done.
+    TextButton(
+        onClick = onUpdate,
+        enabled = cardState == null,
+        colors = tone.colors(),
+    ) {
+        Text(label)
+    }
+}
+
+/**
+ * The dot between a component's name and whatever is said about it.
+ *
+ * Its own composable, and always the ordinary text colour, because it is the card's punctuation
+ * rather than part of what it separates -- a green dot in front of "running" makes the separator
+ * look like it is carrying some of the meaning.
+ */
+@Composable
+private fun Separator() {
+    Spacer(Modifier.width(6.dp))
+    Text(
+        "\u00b7",
+        style = MaterialTheme.typography.bodyMedium,
+        color = MaterialTheme.colorScheme.onSurfaceVariant,
+    )
+    Spacer(Modifier.width(6.dp))
+}
+
+/**
+ * The app's own launcher icon, taken from the copy installed on this phone.
+ *
+ * Whatever the launcher would show, including the system default for an app that declares no icon
+ * of its own -- this is meant to be the same picture somebody already recognises from their home
+ * screen, so second- guessing the platform's answer would make it a different one.
+ *
+ * A question mark only where there is genuinely nothing: the app is not installed here, and there
+ * is nowhere else to look, since the APK it would come from is on the build machine and the
+ * manifest carries no image.
+ */
+@Composable
+private fun AppIcon(
+    packageName: String?,
+    modifier: Modifier = Modifier,
+    size: Dp = APP_ICON_SIZE,
+    glyphSize: TextUnit = 24.sp,
+) {
+    val context = LocalContext.current
+    val pixels = with(LocalDensity.current) { size.roundToPx() }
+    val icon =
+        remember(packageName, pixels) {
+            packageName
+                // Not installed is the ordinary case for a card, not a fault.
+                ?.let { name ->
+                    runCatching { context.packageManager.getApplicationIcon(name) }.getOrNull()
+                }
+                ?.toBitmap(pixels, pixels)
+                ?.asImageBitmap()
+        }
+    Box(modifier.size(size), contentAlignment = Alignment.Center) {
+        if (icon != null) {
+            Image(icon, contentDescription = null, modifier = Modifier.fillMaxSize())
+        } else {
+            Text(
+                "?",
+                fontSize = glyphSize,
+                color = MaterialTheme.colorScheme.onSurfaceVariant,
+                // See the server glyph: a character's line box is taller
+                // than the square it is being matched to, and text clips to
+                // what it is given.
+                modifier = Modifier.wrapContentSize(unbounded = true),
+            )
+        }
+    }
+}
+
+/**
+ * A glyph you can press: the icon equivalent of a TextButton.
+ *
+ * Its own composable so that Add, Refresh and a card's two corner controls are the same size and
+ * colour without each of them having to say so, and so the label none of them shows is still there
+ * for a screen reader.
+ */
+@Composable
+private fun IconGlyphButton(glyph: String, label: String, onClick: () -> Unit) {
+    IconButton(
+        onClick = onClick,
+        modifier = Modifier.size(GLYPH_BUTTON_SIZE).semantics { contentDescription = label },
+    ) {
+        Text(
+            glyph,
+            fontFamily = NerdIcons,
+            fontSize = 20.sp,
+            color = MaterialTheme.colorScheme.primary,
+        )
+    }
+}
+
+/**
+ * A build step this project asks for that nobody has accepted yet, shown in full for a person to
+ * read -- the way an AUR helper shows you a PKGBUILD before it builds anything.
+ *
+ * Shown rather than diffed against what was accepted before: these are a handful of lines, so the
+ * whole thing is quicker to take in than a diff would be, and reading it whole doesn't depend on
+ * having understood the previous version.
+ *
+ * Until Accept is pressed the server runs no build step for this app, so there is no hurry and
+ * nothing breaks by ignoring it -- Pull and Update keep working, they just don't run the project's
+ * command.
+ *
+ * The text only. Accept lives in the card's action row with Pull and Remove, so that the row is
+ * where every whole-project control is and Remove has one place it is always found.
+ */
+@Composable
+private fun PendingDeclaration(requested: String) {
+    Spacer(Modifier.height(8.dp))
+    Text(
+        "This project asks to run a build step on the build machine:",
+        style = MaterialTheme.typography.bodyMedium,
+    )
+    Spacer(Modifier.height(4.dp))
+    Text(
+        requested,
+        style = MaterialTheme.typography.bodySmall,
+        fontFamily = FontFamily.Monospace,
+        color = MaterialTheme.colorScheme.onSurfaceVariant,
+    )
+    Spacer(Modifier.height(4.dp))
+    Text(
+        "Nothing runs until you accept it, and a change to what it asks " +
+            "for brings it back here.",
+        style = MaterialTheme.typography.bodySmall,
+        color = MaterialTheme.colorScheme.onSurfaceVariant,
+    )
+}
+
+/**
+ * One component of a project: what it is called, and for a server, what it is doing and what can be
+ * done to it.
+ *
+ * Drawn as its own card inside the project's, indented by the caller. Two components' worth of
+ * name, state and buttons run together as flat rows, and the buttons are the reason it matters --
+ * Restart under a list of lines is ambiguous about what it restarts, while Restart inside a
+ * bordered box is not.
+ *
+ * The controls follow the state rather than being greyed out: a service that isn't installed offers
+ * Install and nothing else, because Start on something with no unit file is a button whose only
+ * outcome is an error message. Uninstall confirms first -- it can stop something that is serving,
+ * and unlike the APK side there is no system dialog in the way.
+ */
+/**
+ * One component's slice of whatever build is running for its project, if any.
+ *
+ * The card states that carry a build all carry the same thing; asking here rather than at each of
+ * them keeps the three in step, and there is nothing to show for the states that are not builds --
+ * a download or an install belongs to the APK's own controls.
+ */
+private fun componentBuild(cardState: CardState?, component: String): ComponentBuild? =
+    when (cardState) {
+        is CardState.Pulling -> cardState.status
+        is CardState.Rebuilding -> cardState.status
+        is CardState.Preparing -> cardState.status
+        else -> null
+    }?.component(component)
+
+/**
+ * Says that installing this build would pair it with something older.
+ *
+ * Components of a project are built at once and delivered as each finishes, so a build that stopped
+ * at one of them can leave this one rebuilt and its sibling not — a new app against the old server
+ * it talks to. Building in order used to make that impossible by never reaching the later component
+ * at all; building in parallel buys the time back and gives that up, so it is said instead.
+ *
+ * Only when *this* component is current and another is behind. Both behind is the ordinary state of
+ * a project nobody has built yet, and those two still match each other — warning about it would
+ * fire on every card with work waiting, which is how a warning stops being read.
+ *
+ * Said rather than prevented, and the button is left alone: sometimes the mismatch is exactly what
+ * somebody wants to install, and hiding the control would not stop them so much as leave them
+ * wondering where it went.
+ */
+@Composable
+private fun MismatchedPairNote(self: ProjectComponent, others: List<ProjectComponent>) {
+    if (self.freshness != "current") return
+    val behind = others.filter { it.name != self.name && it.freshness == "behind" }
+    if (behind.isEmpty()) return
+    val names = behind.joinToString(", ") { it.name }
+    Text(
+        if (behind.size == 1) "$names is older than this build, so the two would not match."
+        else "$names are older than this build, so they would not match.",
+        style = MaterialTheme.typography.bodySmall,
+        color = ActionTone.Caution.color,
+    )
+}
+
+@Composable
+private fun ComponentCard(
+    entryKey: String,
+    component: ProjectComponent,
+    /** The package an APK component installs, for its icon. */
+    packageName: String?,
+    sizeText: String?,
+    isOwnServer: Boolean,
+    /** This component's part of a build in progress, if it has one. */
+    build: ComponentBuild?,
+    working: Boolean,
+    busy: Boolean,
+    onAction: (String, Purge) -> Unit,
+    // Controls belonging to this component that only the caller can build
+    // -- an APK's Update button, which needs the project's build state.
+    // The service's own buttons are decided here, from the component.
+    controls: @Composable () -> Unit = {},
+) {
+    // The action awaiting confirmation, or null. One slot rather than a
+    // flag per action: they are mutually exclusive, and a second flag is
+    // a second thing to remember to clear.
+    var confirming by remember { mutableStateOf<String?>(null) }
+    var showingLog by remember { mutableStateOf(false) }
+    // What Uninstall has been asked to take away as well. Logs start
+    // ticked and the other two do not: the dialog's defaults, deliberately
+    // different from `Purge()`'s, which is what a caller with no dialog
+    // sends. Reset every time the dialog opens, so a choice made once and
+    // cancelled is not still ticked the next time.
+    var purge by remember { mutableStateOf(Purge(logs = true)) }
+    LaunchedEffect(confirming) { if (confirming != null) purge = Purge(logs = component.hasLogs) }
+
+    // Outlined rather than tinted. The tinted surfaces sit a step apart
+    // from the project card's own, which on a screen is close enough to
+    // read as one flat block -- tried, and the nesting was invisible. A
+    // border says "this is a thing" at any surface colour.
+    OutlinedCard(Modifier.fillMaxWidth()) {
+        Column(Modifier.padding(horizontal = 12.dp, vertical = 8.dp)) {
+            // No height set on the row. Capping it at the icon's size cut
+            // the descenders off the text beside it -- a Text clips to the
+            // height it is given, and "running" has a g. The icon is the
+            // same size as a line of this text anyway, so the row comes out
+            // the same height without being told.
+            Row(verticalAlignment = Alignment.CenterVertically) {
+                // Both kinds get the same square, so a server's glyph and
+                // an app's icon are the same size as each other -- one
+                // drawn smaller than the other reads as the row meaning
+                // less, rather than as a different kind of thing.
+                Box(
+                    Modifier.size(COMPONENT_ICON_SIZE),
+                    contentAlignment = Alignment.Center,
+                ) {
+                    if (component.isServer) {
+                        Text(
+                            SERVER_GLYPH,
+                            fontFamily = NerdIcons,
+                            // Larger than the square in font terms: a glyph
+                            // is drawn well inside its line box, so matching
+                            // the numbers would draw it noticeably smaller
+                            // than the icon beside it.
+                            fontSize = COMPONENT_GLYPH_SIZE,
+                            color = MaterialTheme.colorScheme.onSurfaceVariant,
+                            // Which means its line box is taller than the
+                            // square, and text clips to the height it is
+                            // given. Measured unbounded and drawn centred
+                            // instead: the row keeps the icon's height and
+                            // the glyph keeps all of itself.
+                            modifier = Modifier.wrapContentSize(unbounded = true),
+                        )
+                    } else {
+                        // The app's own icon, the same one the project card
+                        // shows: this row is about the thing that gets
+                        // installed, and that is what it looks like.
+                        AppIcon(
+                            packageName,
+                            size = COMPONENT_ICON_SIZE,
+                            glyphSize = COMPONENT_GLYPH_SIZE,
+                        )
+                    }
+                }
+                Spacer(Modifier.width(6.dp))
+                Text(
+                    component.name,
+                    style = MaterialTheme.typography.bodyMedium,
+                    color = MaterialTheme.colorScheme.onSurfaceVariant,
+                )
+                // Nothing at all until its script has been asked -- an
+                // unknown state is not a state, and a dot introducing
+                // nothing is worse than no dot.
+                // Said in words, not by colour alone: "behind the
+                // checkout" is a difference in kind from "running", and a
+                // reader has no way to learn a colour that means it.
+                val behind = component.isBehind
+                val status =
+                    when {
+                        !component.isServer -> null
+                        component.error != null -> "couldn't check"
+                        component.state == null -> null
+                        component.isRunning -> "running"
+                        // Not folded into "stopped": stopped is a state
+                        // somebody chose, and calling a crash that sends
+                        // the reader looking for who chose it.
+                        component.isFailed -> "failed"
+                        component.isInstalled -> "stopped"
+                        // Nothing for a service that isn't installed: the row
+                        // offers Install and nothing else, which says it more
+                        // plainly than a state would, and saying both makes the
+                        // absence of a thing look like a condition it is in.
+                        else -> null
+                    }
+                status?.let {
+                    Separator()
+                    Text(
+                        it,
+                        style = MaterialTheme.typography.bodyMedium,
+                        color =
+                            when {
+                                component.isRunning -> runningColor
+                                component.isFailed -> failedColor
+                                else -> MaterialTheme.colorScheme.onSurfaceVariant
+                            },
+                    )
+                }
+                if (behind) {
+                    Separator()
+                    Text(
+                        "out of date",
+                        style = MaterialTheme.typography.bodyMedium,
+                        // The colour Pull & Build wears, because that is
+                        // the button this is telling you to press.
+                        color = ActionTone.Primary.color,
+                    )
+                }
+                sizeText?.let {
+                    Separator()
+                    Text(
+                        it,
+                        style = MaterialTheme.typography.bodyMedium,
+                        color = MaterialTheme.colorScheme.onSurfaceVariant,
+                    )
+                }
+                if (working || busy || component.checking) {
+                    Spacer(Modifier.width(6.dp))
+                    Working()
+                }
+                if (component.hasLogs) {
+                    // Pushed to the far edge rather than following the
+                    // text: it belongs to the component, not to whatever
+                    // the row happens to say about it, and a control that
+                    // slides about as the state changes is harder to find
+                    // than one always in the same corner.
+                    Spacer(Modifier.weight(1f))
+                    IconGlyphButton(LOG_GLYPH, "Show ${component.name}'s log") { showingLog = true }
+                }
+            }
+
+            component.error?.let { reason ->
+                Text(
+                    reason,
+                    style = MaterialTheme.typography.bodySmall,
+                    color = MaterialTheme.colorScheme.error,
+                )
+            }
+
+            // The caller's content and the service's own never appear
+            // together -- controls belong to an APK, service buttons to a
+            // server -- so each gets the card's full width instead of
+            // sharing a row. A progress bar in particular wants all of it.
+            // Before the controls, and inside this component's own card:
+            // what is happening to *this* component belongs with it, not
+            // under the project where it could be any of them.
+            build?.let {
+                Spacer(Modifier.height(6.dp))
+                ComponentBuildProgress(it)
+            }
+            controls()
+            // Nothing to offer until its script has been asked: the buttons
+            // depend on the answer, and guessing which to show would mean
+            // showing one that fails.
+            //
+            // Once asked they stay, and go dim for the second or two the
+            // script takes rather than leaving: a row that vanishes on
+            // every press makes its own presence the signal, and takes the
+            // card's height with it on the way out and back.
+            if (component.isServer && component.state != null) {
+                Row(verticalAlignment = Alignment.CenterVertically) {
+                    if (!component.isInstalled) {
+                        TextButton(
+                            onClick = { onAction("install", Purge()) },
+                            enabled = !busy,
+                            colors = ActionTone.Go.colors(),
+                        ) {
+                            Text("Install")
+                        }
+                    } else {
+                        if (component.isRunning) {
+                            // Restart is not confirmed even for this app's own
+                            // server: it comes back, and comes back as the build
+                            // that is on disk.
+                            TextButton(
+                                onClick = {
+                                    if (isOwnServer) confirming = "stop"
+                                    else onAction("stop", Purge())
+                                },
+                                enabled = !busy,
+                                colors = ActionTone.Destructive.colors(),
+                            ) {
+                                Text("Stop")
+                            }
+                            TextButton(
+                                onClick = { onAction("restart", Purge()) },
+                                enabled = !busy,
+                                colors = ActionTone.Caution.colors(),
+                            ) {
+                                Text("Restart")
+                            }
+                        } else {
+                            TextButton(
+                                onClick = { onAction("start", Purge()) },
+                                enabled = !busy,
+                                colors = ActionTone.Go.colors(),
+                            ) {
+                                Text("Start")
+                            }
+                        }
+                        TextButton(
+                            onClick = { confirming = "uninstall" },
+                            enabled = !busy,
+                            colors = ActionTone.Destructive.colors(),
+                        ) {
+                            Text("Uninstall")
+                        }
+                    }
+                }
+            }
+        }
+    }
+
+    if (showingLog) {
+        ComponentLogDialog(
+            entryKey = entryKey,
+            component = component,
+            onDismiss = { showingLog = false },
+        )
+    }
+
+    confirming?.let { action ->
+        val stopping = action == "stop"
+        AlertDialog(
+            onDismissRequest = { confirming = null },
+            title = {
+                Text(
+                    if (stopping) {
+                        "Stop ${component.name}?"
+                    } else {
+                        "Uninstall ${component.name}?"
+                    }
+                )
+            },
+            text = {
+                Column {
+                    Text(
+                        buildString {
+                            if (stopping) {
+                                append("This stops the service on the build machine.")
+                            } else {
+                                append(
+                                    "This removes the service from the build machine and stops " +
+                                        "it if it is running. The built files stay where they are."
+                                )
+                            }
+                            // Said plainly rather than by disabling the button:
+                            // there are good reasons to do this from here, and
+                            // the one thing that matters is knowing beforehand
+                            // that the way back is the build machine.
+                            if (isOwnServer) {
+                                append(
+                                    "\n\nThis app talks to that server. Once it is down, nothing " +
+                                        "here can bring it back -- you will need to start it on " +
+                                        "the build machine yourself."
+                                )
+                            }
+                        }
+                    )
+                    if (!stopping) {
+                        Spacer(Modifier.height(16.dp))
+                        PurgeToggles(
+                            component = component,
+                            purge = purge,
+                            onChange = { purge = it },
+                        )
+                    }
+                }
+            },
+            confirmButton = {
+                TextButton(
+                    // The same red the button that opened this dialog
+                    // wears. What a control does is said in colour here,
+                    // so the one that actually takes something away must
+                    // not be the only place that says it in words --
+                    // beside a plain Cancel, two identically coloured
+                    // buttons make the destructive one the easier
+                    // mis-tap.
+                    colors = ActionTone.Destructive.colors(),
+                    onClick = {
+                        val asked = if (stopping) Purge() else purge
+                        confirming = null
+                        onAction(action, asked)
+                    },
+                ) {
+                    Text(if (stopping) "Stop" else "Uninstall")
+                }
+            },
+            dismissButton = { TextButton(onClick = { confirming = null }) { Text("Cancel") } },
+        )
+    }
+}
+
+/**
+ * The three things Uninstall can take away besides the service.
+ *
+ * Separate toggles rather than one "and clean up" switch, because what losing each costs is
+ * different: logs are a record of what already happened, data is what the thing produced while it
+ * ran, and config is what somebody sat down and typed. So only logs start ticked.
+ *
+ * Each row names the **exact path** that will be removed. That is not detail for the curious: the
+ * build machine deletes the path wherever it points, with no check that it sits under the usual
+ * directories, so this is the only place it is ever seen before it goes.
+ *
+ * A row that cannot be used says which of four reasons it is, because they are different things to
+ * do next: the build machine is still reading the project's resources; it could not read them; the
+ * project does not say where this lives; or it says, and there is nothing there. An earlier version
+ * derived the directory from the checkout's name, which made "we guessed wrong" and "there is
+ * nothing here" the same sentence.
+ */
+@Composable
+private fun PurgeToggles(component: ProjectComponent, purge: Purge, onChange: (Purge) -> Unit) {
+    // Why a path is missing, when the reason is about reading this
+    // project's resources rather than about the path itself. Shared by
+    // both rows, because one read answers for both.
+    val unreadable: String? =
+        when {
+            component.resourcesChecking -> "still finding out where this project keeps things"
+            component.resourcesError != null -> "couldn't read this project's resources"
+            else -> null
+        }
+
+    Column {
+        PurgeToggle(
+            label = "Remove logs",
+            // The logs are the build machine's own files, so they can go
+            // whatever the project says about itself. Removing the data
+            // takes them too -- a service that writes its log inside its
+            // own data directory loses it either way -- so the row says
+            // so rather than being left ticked in a way the build machine
+            // would quietly override.
+            detail =
+                when {
+                    purge.data -> "included with the data"
+                    component.hasLogs -> "build and runtime logs"
+                    else -> "no logs on the build machine"
+                },
+            checked = purge.logs || purge.data,
+            enabled = component.hasLogs && !purge.data,
+            onCheckedChange = { onChange(purge.copy(logs = it)) },
+        )
+        PurgeToggle(
+            label = "Remove data",
+            detail =
+                component.dataPath ?: unreadable ?: "this project doesn't say where data lives",
+            note =
+                if (component.dataPath != null && !component.dataPresent) "nothing there" else null,
+            dimmed = component.dataPath == null || !component.dataPresent,
+            checked = purge.data,
+            enabled = component.dataPresent,
+            onCheckedChange = { onChange(purge.copy(data = it)) },
+        )
+        PurgeToggle(
+            label = "Remove config",
+            detail =
+                component.configPath ?: unreadable ?: "this project doesn't say where config lives",
+            note =
+                if (component.configPath != null && !component.configPresent) "nothing there"
+                else null,
+            dimmed = component.configPath == null || !component.configPresent,
+            checked = purge.config,
+            enabled = component.configPresent,
+            onCheckedChange = { onChange(purge.copy(config = it)) },
+        )
+        // Said once, under the rows it explains, rather than inside both
+        // of them: the complaint is one sentence about the project, not
+        // about either directory, and repeating it would make two rows
+        // look like two problems.
+        component.resourcesError?.let {
+            Text(
+                it,
+                style = MaterialTheme.typography.bodySmall,
+                color = MaterialTheme.colorScheme.error,
+                modifier = Modifier.padding(top = 8.dp),
+            )
+        }
+    }
+}
+
+/**
+ * One row of [PurgeToggles].
+ *
+ * The path wraps rather than truncating. A path is identified by its tail, so cutting the end
+ * removes exactly what somebody checking it is looking for -- and this is the one moment that
+ * checking matters.
+ */
+@Composable
+private fun PurgeToggle(
+    label: String,
+    detail: String,
+    checked: Boolean,
+    enabled: Boolean,
+    onCheckedChange: (Boolean) -> Unit,
+    /** A second line under [detail], for a reason the detail does not itself carry. */
+    note: String? = null,
+    /** Recede the detail: it stands in for a path, or names one with nothing at it. */
+    dimmed: Boolean = false,
+) {
+    Row(verticalAlignment = Alignment.CenterVertically) {
+        Checkbox(checked = checked, enabled = enabled, onCheckedChange = onCheckedChange)
+        Column(Modifier.padding(start = 4.dp)) {
+            Text(
+                label,
+                style = MaterialTheme.typography.bodyMedium,
+                color =
+                    if (enabled) MaterialTheme.colorScheme.onSurface
+                    else MaterialTheme.colorScheme.onSurfaceVariant,
+            )
+            Text(
+                detail,
+                style = MaterialTheme.typography.bodySmall,
+                color =
+                    // The path itself is the thing being confirmed, so it
+                    // reads as ordinary text; a row with nothing to remove
+                    // is the one that recedes.
+                    if (dimmed) MaterialTheme.colorScheme.outline
+                    else MaterialTheme.colorScheme.onSurfaceVariant,
+            )
+            // In words, not only in the dimming. Greyed-out says "you
+            // can't have this" and leaves why to be guessed, where the
+            // reasons a row is greyed are different things to do next.
+            note?.let {
+                Text(
+                    it,
+                    style = MaterialTheme.typography.bodySmall,
+                    color = MaterialTheme.colorScheme.outline,
+                )
+            }
+        }
+    }
+}
+
+@Composable
+private fun VariantPicker(
+    variants: List<ApkVariant>,
+    chosenPath: String?,
+    onSelect: (ApkVariant?) -> Unit,
+) {
+    var expanded by remember { mutableStateOf(false) }
+    val selected = variants.firstOrNull { it.path == chosenPath }
+
+    Box {
+        TextButton(onClick = { expanded = true }) {
+            Text("Variant: ${selected?.variant ?: "newest"}")
+        }
+        DropdownMenu(expanded = expanded, onDismissRequest = { expanded = false }) {
+            // Explicitly offered, because it is the default and there has
+            // to be a way back to it once a variant has been picked.
+            DropdownMenuItem(
+                text = { Text(if (selected == null) "newest ✓" else "newest") },
+                onClick = {
+                    expanded = false
+                    onSelect(null)
+                },
+            )
+            variants.forEach { variant ->
+                DropdownMenuItem(
+                    text = {
+                        Text(
+                            if (variant.path == chosenPath) "${variant.variant} ✓"
+                            else variant.variant
+                        )
+                    },
+                    onClick = {
+                        expanded = false
+                        onSelect(variant)
+                    },
+                )
+            }
+        }
+    }
+}
+
+/**
+ * What the *project* is doing right now: fetching, pulling.
+ *
+ * Only the steps that belong to the whole project. Work belonging to a component is drawn in that
+ * component's own row by [ComponentBuildProgress], because every component builds at once and a bar
+ * under the card could only say that something, somewhere, was happening.
+ *
+ * A build takes long enough that "is it stuck?" is a real question, so the elapsed time is shown
+ * rather than a bar that only moves.
+ */
+@Composable
+private fun BuildProgress(label: String, status: BuildStatus?) {
+    // Nothing at all once the work belongs to components: they each draw
+    // their own, and a second bar under them saying "building" reports the
+    // same thing again in the one place that cannot say which component it
+    // means. Between pressing the button and the first component starting
+    // there is no phase either, and a bar for that moment would flash.
+    val phase = status?.phase ?: return
+    ProgressBar()
+    Spacer(Modifier.height(4.dp))
+    Text("$label: $phase ${formatDuration(status.elapsedMs)}")
+}
+
+/**
+ * One component's own progress, inside its row.
+ *
+ * The bar fills only when the command reports a count of its own. There is no estimate to fall back
+ * on, deliberately: a bar drawn from how long the last run took looks exactly like one drawn from
+ * real work, and being right most of the time is not something the person watching it can check. A
+ * command that says nothing gets a bar that says nothing.
+ *
+ * A component that has finished collapses to its duration alone. Its block stays -- a step that
+ * vanishes the instant it succeeds takes its own duration with it -- but the count and the last
+ * line it printed go, because every component builds at once and those two outlive the work they
+ * describe: a full bar's numbers and a frozen line of output sit there looking live next to a
+ * sibling that genuinely still is. What it took is the whole of what a finished component has left
+ * to say. The failed case keeps its error, which is an outcome rather than residue.
+ */
+@Composable
+private fun ComponentBuildProgress(build: ComponentBuild) {
+    val counted = build.progress?.takeIf { it.total > 0 }
+    val step = build.step
+    if (step != null) {
+        if (counted == null) {
+            ProgressBar()
+        } else {
+            ProgressBar(fraction = { counted.done.toFloat() / counted.total })
+        }
+        Spacer(Modifier.height(4.dp))
+    }
+    Text(
+        when {
+            step != null ->
+                buildString {
+                    append(step)
+                    append(" ${formatDuration(build.elapsedMs)}")
+                    if (counted != null) append("  ${counted.done}/${counted.total}")
+                }
+            // "done" for a component that fell over reads as a component
+            // that succeeded, and the error below it is the only thing
+            // saying otherwise -- so the word itself has to be able to say
+            // which of the two happened.
+            build.error != null -> "failed after ${formatDuration(build.elapsedMs)}"
+            else -> "done in ${formatDuration(build.elapsedMs)}"
+        },
+        style = MaterialTheme.typography.bodySmall,
+        color = MaterialTheme.colorScheme.onSurfaceVariant,
+    )
+    build.error?.let {
+        Text(
+            it,
+            style = MaterialTheme.typography.bodySmall,
+            color = MaterialTheme.colorScheme.error,
+        )
+    }
+    if (step != null) {
+        build.lastLine()?.let {
+            Text(
+                it,
+                style = MaterialTheme.typography.bodySmall,
+                color = MaterialTheme.colorScheme.onSurfaceVariant,
+                maxLines = 2,
+                overflow = TextOverflow.Ellipsis,
+            )
+        }
+    }
+}
+
+private fun formatDuration(ms: Long): String =
+    if (ms < 10_000) "%.1fs".format(ms / 1000.0) else "${(ms + 500) / 1000}s"
+
+/**
+ * Whether the build machine is producing a new build for this card.
+ *
+ * The distinction the grouping needs. A pull or a prepare changes what the card will say about
+ * itself, so it belongs with the ones still waiting; a download or an install only delivers what
+ * the card already said was waiting, and a Reinstall deliberately changes nothing. Counting those
+ * would take a card out of "Up to date" for the length of a download and put it straight back --
+ * the same jump this is here to stop.
+ */
+private fun CardState?.isBuilding(): Boolean =
+    this is CardState.Pulling || this is CardState.Preparing || this is CardState.Rebuilding
+
+private fun isUpToDate(
+    entry: ManifestEntry,
+    installedLastUpdateTimeMillis: Long?,
+    chosenVariantPath: String?,
+): Boolean =
+    installedLastUpdateTimeMillis != null &&
+        installedLastUpdateTimeMillis >= entry.mtimeMillisFor(chosenVariantPath)
+
+internal fun formatSize(bytes: Long): String {
+    val mb = bytes / 1024.0 / 1024.0
+    return "%.1f MB".format(mb)
+}
+
+/**
+ * How the enrollment QR is scanned, in one place because two callers reach it -- straight from the
+ * button when the camera permission is already held, and from the permission result when it has
+ * just been granted.
+ *
+ * MIXED_SCAN is the load-bearing part: ZXing otherwise looks only for a dark code on a light
+ * ground, and the QR this server prints is block characters in the terminal's foreground colour
+ * (auth.rs, Dense1x2), so on a dark-themed terminal it comes out as a photographic negative the
+ * scanner silently never matches. Which way round it renders is the terminal's business, not
+ * something this app should depend on. The mixed decoder alternates normal and inverted frames,
+ * costing half the frame rate at each polarity and nothing else.
+ */
+private fun enrollmentScanOptions(): ScanOptions =
+    ScanOptions()
+        .setDesiredBarcodeFormats(ScanOptions.QR_CODE)
+        .setCaptureActivity(com.example.wgapplink.EnrollmentScanActivity::class.java)
+        // Follow the phone, not the library's landscape pin.
+        .setOrientationLocked(false)
+        .addExtra(Intents.Scan.SCAN_TYPE, Intents.Scan.MIXED_SCAN)
diff --git a/app/androidApp/src/main/kotlin/com/example/devupdater/VariantChoice.kt b/app/androidApp/src/main/kotlin/com/example/devupdater/VariantChoice.kt
new file mode 100644
index 0000000..43b9dee
--- /dev/null
+++ b/app/androidApp/src/main/kotlin/com/example/devupdater/VariantChoice.kt
@@ -0,0 +1,43 @@
+package com.example.devupdater
+
+import android.content.Context
+
+/*
+ * Which build of an app this device wants, when it wants a particular one.
+ *
+ * Per device, not per server. Two phones enrolled against one build
+ * machine each look at the same projects, and one of them picking a
+ * release build has no business changing what the other is offered -- so
+ * the choice lives here and travels with the download request, rather than
+ * being written into the server's config.
+ *
+ * Keyed by the project key, which the server promises never to change: it
+ * is the same identifier the downloaded file is named after.
+ *
+ * The path is the server's, not this device's, and is checked there against
+ * the builds it can actually see. Nothing here can name a file into
+ * existence; a stale choice -- a variant deleted by a `gradlew clean` --
+ * falls back to the newest build rather than failing.
+ */
+
+private const val PREFS_NAME = "variants"
+
+/** The build [key] is pinned to on this device, or null for "the newest". */
+fun chosenVariant(context: Context, key: String): String? =
+    context.getSharedPreferences(PREFS_NAME, Context.MODE_PRIVATE).getString(key, null)
+
+/** Passing null goes back to "whatever is newest", which is the default. */
+fun chooseVariant(context: Context, key: String, path: String?) {
+    val prefs = context.getSharedPreferences(PREFS_NAME, Context.MODE_PRIVATE)
+    if (path == null) {
+        prefs.edit().remove(key).apply()
+    } else {
+        prefs.edit().putString(key, path).apply()
+    }
+}
+
+/**
+ * Forgets a project's choice, for one being removed -- otherwise a key reused by a later project
+ * would inherit a preference nobody set.
+ */
+fun forgetVariant(context: Context, key: String) = chooseVariant(context, key, null)
diff --git a/app/androidApp/src/main/kotlin/com/example/devupdater/Working.kt b/app/androidApp/src/main/kotlin/com/example/devupdater/Working.kt
new file mode 100644
index 0000000..871774f
--- /dev/null
+++ b/app/androidApp/src/main/kotlin/com/example/devupdater/Working.kt
@@ -0,0 +1,25 @@
+package com.example.devupdater
+
+import androidx.compose.foundation.layout.size
+import androidx.compose.material3.CircularProgressIndicator
+import androidx.compose.runtime.Composable
+import androidx.compose.ui.Modifier
+import androidx.compose.ui.unit.dp
+
+/**
+ * "The server hasn't finished working this out."
+ *
+ * Small enough to sit inline beside the thing it qualifies, so it can be put next to whichever
+ * value is still provisional rather than covering a whole screen. Anything the server decides in
+ * the background gets one -- a value shown without it is meant to be read as settled.
+ *
+ * One composable rather than a size and a stroke width repeated per site, so every one of them
+ * reads as the same mark.
+ */
+@Composable
+fun Working(modifier: Modifier = Modifier) {
+    CircularProgressIndicator(
+        modifier = modifier.size(12.dp),
+        strokeWidth = 1.5.dp,
+    )
+}
diff --git a/app/androidApp/src/main/res/font/nerd_icons.ttf b/app/androidApp/src/main/res/font/nerd_icons.ttf
new file mode 100644
index 0000000..437c903
Binary files /dev/null and b/app/androidApp/src/main/res/font/nerd_icons.ttf differ
diff --git a/app/androidApp/src/main/res/xml/file_paths.xml b/app/androidApp/src/main/res/xml/file_paths.xml
new file mode 100644
index 0000000..4ea4737
--- /dev/null
+++ b/app/androidApp/src/main/res/xml/file_paths.xml
@@ -0,0 +1,4 @@
+<?xml version="1.0" encoding="utf-8"?>
+<paths>
+    <files-path name="apks" path="apks/" />
+</paths>
diff --git a/app/build-apk.sh b/app/build-apk.sh
new file mode 100755
index 0000000..22b060a
--- /dev/null
+++ b/app/build-apk.sh
@@ -0,0 +1,84 @@
+#!/bin/sh
+# Builds the updater app's own APK.
+#
+#   ./build-apk.sh
+#
+# The APK pins the CA on *this* machine ($XDG_CONFIG_HOME/dev-updater/certs/ca.pem,
+# or DEV_UPDATER_CA), so build it on the machine that runs the server: an app
+# built somewhere else trusts a CA that server can't present, and simply won't
+# connect. Start dev-updater once first if there are no certificates yet -- it
+# generates them --; the build stops with that instruction if it can't find one.
+#
+# Unlike ./run-android.sh, this touches no emulator: it only produces the file.
+# This is the updater itself, so a fresh install can't come *through* the
+# updater: serve it over the plain-HTTP bootstrap port instead
+# (dev-updater --download) and open http://<this machine>:8091 on the phone.
+set -eu
+
+SCRIPT_DIR=$(cd "$(dirname "$0")" && pwd)
+cd "$SCRIPT_DIR"
+
+# Prefer an SDK this machine has already configured -- the host and the dev
+# VM don't keep it in the same place, and android-env.sh is written for the
+# VM's layout (it also installs missing packages, which isn't wanted here).
+if [ -n "${ANDROID_HOME:-}" ] && [ -d "${ANDROID_HOME}" ]; then
+    echo "==> Using ANDROID_HOME=$ANDROID_HOME"
+elif [ -n "${ANDROID_SDK_ROOT:-}" ] && [ -d "${ANDROID_SDK_ROOT}" ]; then
+    ANDROID_HOME="$ANDROID_SDK_ROOT"
+    export ANDROID_HOME
+    echo "==> Using ANDROID_SDK_ROOT=$ANDROID_SDK_ROOT"
+elif [ -d "$HOME/Android/Sdk" ]; then
+    ANDROID_HOME="$HOME/Android/Sdk"
+    ANDROID_SDK_ROOT="$ANDROID_HOME"
+    export ANDROID_HOME ANDROID_SDK_ROOT
+    echo "==> Using $ANDROID_HOME"
+else
+    echo "No Android SDK found. Set ANDROID_HOME to it, or install one" >&2
+    echo "(Android Studio's default location is ~/Android/Sdk)." >&2
+    exit 1
+fi
+
+CA="${DEV_UPDATER_CA:-${XDG_CONFIG_HOME:-$HOME/.config}/dev-updater/certs/ca.pem}"
+if [ -f "$CA" ]; then
+    # Printed so a wrong or stale certificate is visible here rather than as
+    # a handshake failure on the phone: it should match the CA the server
+    # you are going to talk to generated, which is the one in the directory
+    # named above unless DEV_UPDATER_CA points elsewhere.
+    FINGERPRINT=$(openssl x509 -in "$CA" -pubkey -noout 2>/dev/null \
+        | openssl pkey -pubin -outform der 2>/dev/null \
+        | openssl dgst -sha256 -binary 2>/dev/null \
+        | openssl base64 2>/dev/null || echo "(openssl unavailable)")
+    echo "==> Pinning the CA at $CA"
+    echo "    fingerprint: $FINGERPRINT"
+else
+    echo "No CA certificate at $CA -- run the server on this machine" >&2
+    echo "first, or set DEV_UPDATER_CA to one. The APK has to embed it at build time." >&2
+    exit 1
+fi
+
+echo "==> Building"
+# Dev Updater ships a wrapper that turns a Gradle build into the
+# `@@progress done/total` lines its cards draw a real bar from, and points
+# $DEV_UPDATER_PROGRESS at it when it is the one running this. Gradle
+# cannot report a count any other way -- see the wrapper's own header --
+# and having it there rather than here is what stops every project copying
+# the same twenty-five lines of counting. Built by hand, the variable is
+# unset and the build simply runs.
+if [ -x "${DEV_UPDATER_PROGRESS:-}" ]; then
+    "$DEV_UPDATER_PROGRESS" gradle ./gradlew :androidApp:assembleDebug
+else
+    ./gradlew :androidApp:assembleDebug
+fi
+
+APK="$SCRIPT_DIR/androidApp/build/outputs/apk/debug/androidApp-debug.apk"
+echo
+echo "==> Built $APK"
+[ -f "$APK" ] && ls -lh "$APK" | awk '{print "    " $5}'
+echo
+echo "To get it onto the phone:"
+echo "  - if the installed copy still trusts this CA, hit Update on the"
+echo "    'Dev Updater' entry in the app itself;"
+echo "  - if the CA was regenerated, the installed copy can no longer reach"
+echo "    the server, so reinstall over the bootstrap port instead:"
+echo "        dev-updater --download"
+echo "    then open http://<this machine>:8091 in the phone's browser."
diff --git a/app/build-icon-font.sh b/app/build-icon-font.sh
new file mode 100755
index 0000000..4a30314
--- /dev/null
+++ b/app/build-icon-font.sh
@@ -0,0 +1,57 @@
+#!/usr/bin/env bash
+# Rebuilds androidApp/src/main/res/font/nerd_icons.ttf.
+#
+# The app draws a handful of icons -- a folder, a git branch, a server, a
+# cog -- as text in a Nerd Fonts glyph, rather than as vector assets or as
+# ordinary Unicode. Unicode has no character for most of these, and the
+# ones it does have are not reliably in an Android system font, so they
+# land as tofu boxes on somebody's phone.
+#
+# The whole symbols font is 2.5 MB for the handful below, so what is
+# committed is a subset. Add a codepoint to GLYPHS below and to NerdIcons.kt (the two
+# lists have to agree -- a codepoint in the Kotlin but not here is a glyph
+# that silently doesn't exist), then run this and commit the result.
+#
+# Needs python3 and network access; fontTools is fetched into a temporary
+# venv, so nothing has to be installed on the machine.
+set -euo pipefail
+
+# Codepoint, then the Nerd Fonts glyph name it came from. All from the
+# Material Design Icons set bar one, so they look like one family; the
+# exception is noted on its own line.
+GLYPHS=(
+    U+F024B  # md-folder
+    U+F062C  # md-source_branch
+    U+F233   # fa-server
+    U+F0493  # md-cog
+    U+F0415  # md-plus
+    U+F0450  # md-refresh
+    U+F0A7A  # md-trash_can_outline
+    U+F02D   # fa-book
+)
+
+url=https://github.com/ryanoasis/nerd-fonts/releases/latest/download/NerdFontsSymbolsOnly.zip
+out="$(cd "$(dirname "$0")" && pwd)/androidApp/src/main/res/font/nerd_icons.ttf"
+work="$(mktemp -d)"
+trap 'rm -rf "$work"' EXIT
+
+echo "Fetching $url"
+curl -fsSL -o "$work/nf.zip" "$url"
+python3 -c 'import sys,zipfile; zipfile.ZipFile(sys.argv[1]).extractall(sys.argv[2])' "$work/nf.zip" "$work"
+
+python3 -m venv "$work/venv"
+"$work/venv/bin/pip" -q install fonttools
+
+unicodes="$(IFS=,; echo "${GLYPHS[*]}")"
+mkdir -p "$(dirname "$out")"
+# The Mono face: every glyph gets the same advance, so an icon occupies the
+# same width whichever one it is and a row of them lines up with the row
+# above. The proportional face varies the advance per glyph, which puts the
+# text after each icon at a slightly different place.
+"$work/venv/bin/pyftsubset" "$work/SymbolsNerdFontMono-Regular.ttf" \
+    --unicodes="$unicodes" \
+    --layout-features= \
+    --drop-tables+=DSIG \
+    --output-file="$out"
+
+echo "Wrote $out ($(stat -c %s "$out") bytes) with ${#GLYPHS[@]} glyphs"
diff --git a/app/build.gradle.kts b/app/build.gradle.kts
new file mode 100644
index 0000000..7bfecec
--- /dev/null
+++ b/app/build.gradle.kts
@@ -0,0 +1,17 @@
+plugins {
+    alias(libs.plugins.androidApplication) apply false
+    alias(libs.plugins.androidLibrary) apply false
+    alias(libs.plugins.composeMultiplatform) apply false
+    alias(libs.plugins.composeCompiler) apply false
+    // Applied here as well as in :androidApp, because a project only
+    // formats its own files -- this one owns the two build scripts at the
+    // root, and that module owns the Kotlin.
+    alias(libs.plugins.ktfmt)
+}
+
+// ktfmt offers exactly two styles. This is the one in kotlinlang.org's
+// coding conventions; the other is Google's 2-space internal style.
+// Picked as the language's own standard rather than because it matches
+// what is here -- matching is a consequence, and would be the wrong
+// reason (code rule 27).
+ktfmt { kotlinLangStyle() }
diff --git a/app/enroll-emulator.sh b/app/enroll-emulator.sh
new file mode 100755
index 0000000..adbe60c
--- /dev/null
+++ b/app/enroll-emulator.sh
@@ -0,0 +1,181 @@
+#!/bin/sh
+# Enrols the Android emulator against this machine's dev-updater, without a
+# camera and without a QR code.
+#
+#   ./app/enroll-emulator.sh [--host 10.0.2.2] [--port 8090] [--avd dev-updater]
+#
+# Enrolling normally means scanning the QR the server prints. There is no
+# camera on a headless emulator, so this uses the other path the app already
+# supports: the `devupdater://enroll` intent that MainActivity handles for
+# camera apps that redirect a scanned URI. Firing it with `am start` is the
+# whole trick.
+#
+# It is idempotent. A token for the emulator is generated once and kept in
+# $XDG_DATA_HOME/dev-updater/emulator-token; later runs reuse it, so
+# re-enrolling after reinstalling the app costs nothing and never touches
+# the token belonging to a real phone.
+#
+# Two things that cost an afternoon each, written down so they don't again:
+#
+#  1. **`adb shell am start -d "...?a=1&b=2"` silently loses everything
+#     after the first `&`.** The URI is handed to the *device's* shell,
+#     which treats `&` as "run in background" no matter how carefully it was
+#     quoted on this side. The symptom is an intent that starts the app and
+#     enrols nothing, with no error anywhere. Escape them: `\&`.
+#
+#  2. **More than one emulator can be attached, and then bare `adb` fails.**
+#     Every `adb` call here names a device, because `adb get-state` and
+#     `adb shell` both exit 1 with "more than one device/emulator" the
+#     moment a second AVD is running -- and the old version read that as
+#     "no emulator is running", which is the opposite of what happened and
+#     sends you off to start a third. The device is chosen by AVD *name*
+#     rather than by taking the only one attached, so it cannot enrol
+#     somebody else's emulator by accident.
+#
+#  3. **The server has to be listening somewhere the emulator can reach.**
+#     Inside the emulator, 10.0.2.2 is this machine. dev-updater binds wg0
+#     and nothing else by default, which the emulator has no route to, so
+#     the app reports the server as unreachable. Start it with
+#     `--bind 0.0.0.0` for the duration of the test. The CA already covers
+#     10.0.2.2 -- `local_addresses` in main.rs puts it there deliberately --
+#     so TLS is not the problem, and a TLS error means something else.
+set -eu
+
+HOST=10.0.2.2
+PORT=8090
+# Defaulted from the environment the same way run-android.sh reads it, so
+# the two agree about which emulator "the emulator" means; the flag is here
+# because this script already takes its other settings that way.
+AVD_NAME="${AVD_NAME:-dev-updater}"
+while [ $# -gt 0 ]; do
+    case "$1" in
+        --host) HOST=$2; shift 2 ;;
+        --port) PORT=$2; shift 2 ;;
+        --avd) AVD_NAME=$2; shift 2 ;;
+        *) echo "usage: $0 [--host H] [--port P] [--avd NAME]" >&2; exit 2 ;;
+    esac
+done
+
+PACKAGE=com.example.devupdater
+CONFIG="${XDG_CONFIG_HOME:-$HOME/.config}/dev-updater/config.ron"
+STATE_DIR="${XDG_DATA_HOME:-$HOME/.local/share}/dev-updater"
+TOKEN_FILE="$STATE_DIR/emulator-token"
+
+command -v adb >/dev/null 2>&1 || {
+    echo "adb is not on PATH -- add \$HOME/Android/Sdk/platform-tools." >&2
+    exit 1
+}
+# Prints the adb serial of a running instance of AVD "$1", or nothing.
+# Lifted from run-android.sh, which has always had to do this: `adb -e`
+# works only when exactly one emulator is attached and cannot tell ours
+# apart from somebody else's.
+avd_serial() {
+    for s in $(adb devices | awk '$2 == "device" {print $1}'); do
+        if [ "$(adb -s "$s" emu avd name 2>/dev/null | head -n1 | tr -d '\r')" = "$1" ]; then
+            echo "$s"
+            return 0
+        fi
+    done
+}
+
+SERIAL=$(avd_serial "$AVD_NAME")
+if [ -z "$SERIAL" ]; then
+    # Three different situations, and saying the wrong one costs an
+    # afternoon: nothing running, something running that isn't this AVD,
+    # or adb itself not answering. The list is what tells them apart, so
+    # it is printed rather than described.
+    attached=$(adb devices | awk '$2 == "device" {print $1}')
+    if [ -z "$attached" ]; then
+        echo "No emulator is running. Start one with app/run-android.sh first." >&2
+    else
+        echo "No emulator named '$AVD_NAME' is running. These are attached:" >&2
+        for s in $attached; do
+            echo "    $s  ($(adb -s "$s" emu avd name 2>/dev/null | head -n1 | tr -d '\r'))" >&2
+        done
+        echo "Pass --avd NAME to pick one, or start '$AVD_NAME' with app/run-android.sh." >&2
+    fi
+    exit 1
+fi
+echo "==> Using $SERIAL (AVD '$AVD_NAME')"
+
+# Every adb call from here names the device: with a second emulator
+# attached, a bare one exits 1 rather than picking.
+adb() { command adb -s "$SERIAL" "$@"; }
+
+# Generated once and kept, so this script can be run again after a
+# reinstall without adding a second entry to the server's config every time.
+if [ ! -f "$TOKEN_FILE" ]; then
+    mkdir -p "$STATE_DIR"
+    # Alphanumeric only: the token goes in a URI, and anything needing
+    # percent-encoding would have to survive two shells to get there.
+    tr -dc 'A-Za-z0-9' < /dev/urandom | head -c 32 > "$TOKEN_FILE"
+    chmod 600 "$TOKEN_FILE"
+    echo "==> Generated an emulator token in $TOKEN_FILE"
+fi
+TOKEN=$(cat "$TOKEN_FILE")
+HASH=$(printf %s "$TOKEN" | sha256sum | cut -d' ' -f1)
+
+# Only the hash is stored server-side, so this is what the config needs.
+RESTART_NEEDED=no
+if [ ! -f "$CONFIG" ]; then
+    echo "No config at $CONFIG -- start dev-updater once to create it." >&2
+    exit 1
+elif grep -q "$HASH" "$CONFIG"; then
+    echo "==> The server already knows this token"
+else
+    # Inserted rather than replacing the token list: a real phone's
+    # enrolment lives in the same list and must survive this.
+    tmp=$(mktemp)
+    awk -v hash="$HASH" '
+        { print }
+        /^tokens: \[/ && !done {
+            print "    ("
+            print "        name: \"emulator\","
+            print "        sha256: \"" hash "\","
+            print "    ),"
+            done = 1
+        }
+    ' "$CONFIG" > "$tmp"
+    cp "$tmp" "$CONFIG"
+    rm -f "$tmp"
+    chmod 600 "$CONFIG"
+    echo "==> Added an 'emulator' token to $CONFIG"
+    RESTART_NEEDED=yes
+fi
+
+if [ "$RESTART_NEEDED" = yes ]; then
+    # The server reads its config at startup, so a token added underneath a
+    # running one is not yet a token it will accept.
+    echo "==> Restart dev-updater now so it reads the new token, then re-run this."
+    echo "    (the running server, if any, still has the old list in memory)"
+    exit 1
+fi
+
+# force-stop first: an already-running activity receives this through
+# onNewIntent, and whether that path enrols is not something to depend on.
+adb shell am force-stop "$PACKAGE" >/dev/null 2>&1 || true
+before=$(adb shell run-as "$PACKAGE" cat shared_prefs/server.xml 2>/dev/null || echo none)
+
+# The backslashes are load-bearing -- see the note at the top.
+adb shell am start -a android.intent.action.VIEW \
+    -d "devupdater://enroll?host=$HOST\&port=$PORT\&token=$TOKEN" >/dev/null 2>&1
+
+# The app seals the token under a Keystore key before writing it, so the
+# stored blob differs even for the same token. Changed is the signal; equal
+# means the intent never landed.
+attempt=0
+while [ "$attempt" -lt 15 ]; do
+    sleep 1
+    after=$(adb shell run-as "$PACKAGE" cat shared_prefs/server.xml 2>/dev/null || echo none)
+    if [ "$after" != "$before" ]; then
+        echo "==> Enrolled against $HOST:$PORT"
+        echo "    If the app still says the server is unreachable, it is listening"
+        echo "    on the wrong interface: restart it with --bind 0.0.0.0."
+        exit 0
+    fi
+    attempt=$((attempt + 1))
+done
+
+echo "The app's stored settings did not change, so the intent did not land." >&2
+echo "Check that $PACKAGE is installed (app/run-android.sh) and try again." >&2
+exit 1
diff --git a/app/gradle.properties b/app/gradle.properties
new file mode 100644
index 0000000..35a9610
--- /dev/null
+++ b/app/gradle.properties
@@ -0,0 +1,7 @@
+org.gradle.jvmargs=-Xmx2048M -Dfile.encoding=UTF-8
+org.gradle.parallel=true
+org.gradle.caching=true
+org.gradle.configuration-cache=true
+kotlin.code.style=official
+android.useAndroidX=true
+android.nonTransitiveRClass=true
diff --git a/app/gradle/libs.versions.toml b/app/gradle/libs.versions.toml
new file mode 100644
index 0000000..9a03e29
--- /dev/null
+++ b/app/gradle/libs.versions.toml
@@ -0,0 +1,42 @@
+[versions]
+agp = "9.3.2"
+kotlin = "2.4.10"
+compose-multiplatform = "1.12.0"
+# Compose Multiplatform's material3 is on its own release train, so it is
+# pinned separately rather than following the version above. Checked
+# 2026-08-28: the newest material3 is 1.12.0-alpha03, so 1.9.0 is still
+# the current *stable* one while runtime/foundation/ui are stable at
+# 1.12.0. Not a stale pin -- the two trains are simply this far apart.
+compose-material3 = "1.9.0"
+# The Gradle wrapper around ktfmt. Checked against the Gradle Plugin
+# Portal 2026-08-28: 0.27.0 is the latest, published 2026-08-03.
+ktfmt-gradle = "0.27.0"
+androidx-activityCompose = "1.13.0"
+# Checked against Maven Central 2026-08-25.
+zxing-embedded = "4.3.0"
+androidx-core-ktx = "1.17.0"
+
+[libraries]
+androidx-activity-compose = { module = "androidx.activity:activity-compose", version.ref = "androidx-activityCompose" }
+# In-app QR scanner: a ready-made scanning Activity (camera preview, runtime
+# permission prompt, flashlight toggle) reached through the AndroidX Activity
+# Result API (ScanContract, added in 4.3.0). Fully offline -- no Play
+# Services / ML Kit model download involved.
+zxing-embedded = { module = "com.journeyapps:zxing-android-embedded", version.ref = "zxing-embedded" }
+# Required by the shared link library, which uses the KTX `edit` block.
+androidx-core-ktx = { module = "androidx.core:core-ktx", version.ref = "androidx-core-ktx" }
+# Declared directly rather than through the `compose.*` accessors, which
+# Compose Multiplatform 1.11 deprecates.
+compose-runtime = { module = "org.jetbrains.compose.runtime:runtime", version.ref = "compose-multiplatform" }
+compose-foundation = { module = "org.jetbrains.compose.foundation:foundation", version.ref = "compose-multiplatform" }
+compose-ui = { module = "org.jetbrains.compose.ui:ui", version.ref = "compose-multiplatform" }
+compose-material3 = { module = "org.jetbrains.compose.material3:material3", version.ref = "compose-material3" }
+
+[plugins]
+androidApplication = { id = "com.android.application", version.ref = "agp" }
+# For the shared link subproject: a subproject resolves plugin versions
+# from the build including it rather than from its own.
+androidLibrary = { id = "com.android.library", version.ref = "agp" }
+composeMultiplatform = { id = "org.jetbrains.compose", version.ref = "compose-multiplatform" }
+composeCompiler = { id = "org.jetbrains.kotlin.plugin.compose", version.ref = "kotlin" }
+ktfmt = { id = "com.ncorti.ktfmt.gradle", version.ref = "ktfmt-gradle" }
diff --git a/app/gradle/wrapper/gradle-wrapper.jar b/app/gradle/wrapper/gradle-wrapper.jar
new file mode 100644
index 0000000..eddabd2
Binary files /dev/null and b/app/gradle/wrapper/gradle-wrapper.jar differ
diff --git a/app/gradle/wrapper/gradle-wrapper.properties b/app/gradle/wrapper/gradle-wrapper.properties
new file mode 100644
index 0000000..ad7845b
--- /dev/null
+++ b/app/gradle/wrapper/gradle-wrapper.properties
@@ -0,0 +1,9 @@
+distributionBase=GRADLE_USER_HOME
+distributionPath=wrapper/dists
+distributionUrl=https\://services.gradle.org/distributions/gradle-9.7.1-bin.zip
+networkTimeout=10000
+retries=0
+retryBackOffMs=500
+validateDistributionUrl=true
+zipStoreBase=GRADLE_USER_HOME
+zipStorePath=wrapper/dists
diff --git a/app/gradlew b/app/gradlew
new file mode 100755
index 0000000..249efbb
--- /dev/null
+++ b/app/gradlew
@@ -0,0 +1,248 @@
+#!/bin/sh
+
+#
+# Copyright © 2015 the original authors.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# SPDX-License-Identifier: Apache-2.0
+#
+
+##############################################################################
+#
+#   gradlew start up script for POSIX generated by Gradle.
+#
+#   Important for running:
+#
+#   (1) You need a POSIX-compliant shell to run this script. If your /bin/sh is
+#       noncompliant, but you have some other compliant shell such as ksh or
+#       bash, then to run this script, type that shell name before the whole
+#       command line, like:
+#
+#           ksh gradlew
+#
+#       Busybox and similar reduced shells will NOT work, because this script
+#       requires all of these POSIX shell features:
+#         * functions;
+#         * expansions «$var», «${var}», «${var:-default}», «${var+SET}»,
+#           «${var#prefix}», «${var%suffix}», and «$( cmd )»;
+#         * compound commands having a testable exit status, especially «case»;
+#         * various built-in commands including «command», «set», and «ulimit».
+#
+#   Important for patching:
+#
+#   (2) This script targets any POSIX shell, so it avoids extensions provided
+#       by Bash, Ksh, etc; in particular arrays are avoided.
+#
+#       The "traditional" practice of packing multiple parameters into a
+#       space-separated string is a well documented source of bugs and security
+#       problems, so this is (mostly) avoided, by progressively accumulating
+#       options in "$@", and eventually passing that to Java.
+#
+#       Where the inherited environment variables (DEFAULT_JVM_OPTS, JAVA_OPTS,
+#       and GRADLE_OPTS) rely on word-splitting, this is performed explicitly;
+#       see the in-line comments for details.
+#
+#       There are tweaks for specific operating systems such as AIX, CygWin,
+#       Darwin, MinGW, and NonStop.
+#
+#   (3) This script is generated from the Groovy template
+#       https://github.com/gradle/gradle/blob/3d91ce3b8caaf77ad09f381f43615b715b53f72c/platforms/jvm/plugins-application/src/main/resources/org/gradle/api/internal/plugins/unixStartScript.txt
+#       within the Gradle project.
+#
+#       You can find Gradle at https://github.com/gradle/gradle/.
+#
+##############################################################################
+
+# Attempt to set APP_HOME
+
+# Resolve links: $0 may be a link
+app_path=$0
+
+# Need this for daisy-chained symlinks.
+while
+    APP_HOME=${app_path%"${app_path##*/}"}  # leaves a trailing /; empty if no leading path
+    [ -h "$app_path" ]
+do
+    ls=$( ls -ld "$app_path" )
+    link=${ls#*' -> '}
+    case $link in             #(
+      /*)   app_path=$link ;; #(
+      *)    app_path=$APP_HOME$link ;;
+    esac
+done
+
+# This is normally unused
+# shellcheck disable=SC2034
+APP_BASE_NAME=${0##*/}
+# Discard cd standard output in case $CDPATH is set (https://github.com/gradle/gradle/issues/25036)
+APP_HOME=$( cd -P "${APP_HOME:-./}" > /dev/null && printf '%s\n' "$PWD" ) || exit
+
+# Use the maximum available, or set MAX_FD != -1 to use that value.
+MAX_FD=maximum
+
+warn () {
+    echo "$*"
+} >&2
+
+die () {
+    echo
+    echo "$*"
+    echo
+    exit 1
+} >&2
+
+# OS specific support (must be 'true' or 'false').
+cygwin=false
+msys=false
+darwin=false
+nonstop=false
+case "$( uname )" in                #(
+  CYGWIN* )         cygwin=true  ;; #(
+  Darwin* )         darwin=true  ;; #(
+  MSYS* | MINGW* )  msys=true    ;; #(
+  NONSTOP* )        nonstop=true ;;
+esac
+
+
+
+# Determine the Java command to use to start the JVM.
+if [ -n "$JAVA_HOME" ] ; then
+    if [ -x "$JAVA_HOME/jre/sh/java" ] ; then
+        # IBM's JDK on AIX uses strange locations for the executables
+        JAVACMD=$JAVA_HOME/jre/sh/java
+    else
+        JAVACMD=$JAVA_HOME/bin/java
+    fi
+    if [ ! -x "$JAVACMD" ] ; then
+        die "ERROR: JAVA_HOME is set to an invalid directory: $JAVA_HOME
+
+Please set the JAVA_HOME variable in your environment to match the
+location of your Java installation."
+    fi
+else
+    JAVACMD=java
+    if ! command -v java >/dev/null 2>&1
+    then
+        die "ERROR: JAVA_HOME is not set and no 'java' command could be found in your PATH.
+
+Please set the JAVA_HOME variable in your environment to match the
+location of your Java installation."
+    fi
+fi
+
+# Increase the maximum file descriptors if we can.
+if ! "$cygwin" && ! "$darwin" && ! "$nonstop" ; then
+    case $MAX_FD in #(
+      max*)
+        # In POSIX sh, ulimit -H is undefined. That's why the result is checked to see if it worked.
+        # shellcheck disable=SC2039,SC3045
+        MAX_FD=$( ulimit -H -n ) ||
+            warn "Could not query maximum file descriptor limit"
+    esac
+    case $MAX_FD in  #(
+      '' | soft) :;; #(
+      *)
+        # In POSIX sh, ulimit -n is undefined. That's why the result is checked to see if it worked.
+        # shellcheck disable=SC2039,SC3045
+        ulimit -n "$MAX_FD" ||
+            warn "Could not set maximum file descriptor limit to $MAX_FD"
+    esac
+fi
+
+# Collect all arguments for the java command, stacking in reverse order:
+#   * args from the command line
+#   * the main class name
+#   * -classpath
+#   * -D...appname settings
+#   * --module-path (only if needed)
+#   * DEFAULT_JVM_OPTS, JAVA_OPTS, and GRADLE_OPTS environment variables.
+
+# For Cygwin or MSYS, switch paths to Windows format before running java
+if "$cygwin" || "$msys" ; then
+    APP_HOME=$( cygpath --path --mixed "$APP_HOME" )
+
+    JAVACMD=$( cygpath --unix "$JAVACMD" )
+
+    # Now convert the arguments - kludge to limit ourselves to /bin/sh
+    for arg do
+        if
+            case $arg in                                #(
+              -*)   false ;;                            # don't mess with options #(
+              /?*)  t=${arg#/} t=/${t%%/*}              # looks like a POSIX filepath
+                    [ -e "$t" ] ;;                      #(
+              *)    false ;;
+            esac
+        then
+            arg=$( cygpath --path --ignore --mixed "$arg" )
+        fi
+        # Roll the args list around exactly as many times as the number of
+        # args, so each arg winds up back in the position where it started, but
+        # possibly modified.
+        #
+        # NB: a `for` loop captures its iteration list before it begins, so
+        # changing the positional parameters here affects neither the number of
+        # iterations, nor the values presented in `arg`.
+        shift                   # remove old arg
+        set -- "$@" "$arg"      # push replacement arg
+    done
+fi
+
+
+# Add default JVM options here. You can also use JAVA_OPTS and GRADLE_OPTS to pass JVM options to this script.
+DEFAULT_JVM_OPTS='"-Xmx64m" "-Xms64m"'
+
+# Collect all arguments for the java command:
+#   * DEFAULT_JVM_OPTS, JAVA_OPTS, and optsEnvironmentVar are not allowed to contain shell fragments,
+#     and any embedded shellness will be escaped.
+#   * For example: A user cannot expect ${Hostname} to be expanded, as it is an environment variable and will be
+#     treated as '${Hostname}' itself on the command line.
+
+set -- \
+        "-Dorg.gradle.appname=$APP_BASE_NAME" \
+        -jar "$APP_HOME/gradle/wrapper/gradle-wrapper.jar" \
+        "$@"
+
+# Stop when "xargs" is not available.
+if ! command -v xargs >/dev/null 2>&1
+then
+    die "xargs is not available"
+fi
+
+# Use "xargs" to parse quoted args.
+#
+# With -n1 it outputs one arg per line, with the quotes and backslashes removed.
+#
+# In Bash we could simply go:
+#
+#   readarray ARGS < <( xargs -n1 <<<"$var" ) &&
+#   set -- "${ARGS[@]}" "$@"
+#
+# but POSIX shell has neither arrays nor command substitution, so instead we
+# post-process each arg (as a line of input to sed) to backslash-escape any
+# character that might be a shell metacharacter, then use eval to reverse
+# that process (while maintaining the separation between arguments), and wrap
+# the whole thing up as a single "set" statement.
+#
+# This will of course break if any of these variables contains a newline or
+# an unmatched quote.
+#
+
+eval "set -- $(
+        printf '%s\n' "$DEFAULT_JVM_OPTS $JAVA_OPTS $GRADLE_OPTS" |
+        xargs -n1 |
+        sed ' s~[^-[:alnum:]+,./:=@_]~\\&~g; ' |
+        tr '\n' ' '
+    )" '"$@"'
+
+exec "$JAVACMD" "$@"
diff --git a/app/gradlew.bat b/app/gradlew.bat
new file mode 100644
index 0000000..8508ef6
--- /dev/null
+++ b/app/gradlew.bat
@@ -0,0 +1,82 @@
+@rem
+@rem Copyright 2015 the original author or authors.
+@rem
+@rem Licensed under the Apache License, Version 2.0 (the "License");
+@rem you may not use this file except in compliance with the License.
+@rem You may obtain a copy of the License at
+@rem
+@rem      https://www.apache.org/licenses/LICENSE-2.0
+@rem
+@rem Unless required by applicable law or agreed to in writing, software
+@rem distributed under the License is distributed on an "AS IS" BASIS,
+@rem WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+@rem See the License for the specific language governing permissions and
+@rem limitations under the License.
+@rem
+@rem SPDX-License-Identifier: Apache-2.0
+@rem
+
+@if "%DEBUG%"=="" @echo off
+@rem ##########################################################################
+@rem
+@rem  gradlew startup script for Windows
+@rem
+@rem ##########################################################################
+
+@rem Set local scope for the variables, and ensure extensions are enabled
+setlocal EnableExtensions
+
+set DIRNAME=%~dp0
+if "%DIRNAME%"=="" set DIRNAME=.
+@rem This is normally unused
+set APP_BASE_NAME=%~n0
+set APP_HOME=%DIRNAME%
+
+@rem Resolve any "." and ".." in APP_HOME to make it shorter.
+for %%i in ("%APP_HOME%") do set APP_HOME=%%~fi
+
+@rem Add default JVM options here. You can also use JAVA_OPTS and GRADLE_OPTS to pass JVM options to this script.
+set DEFAULT_JVM_OPTS="-Xmx64m" "-Xms64m"
+
+@rem Find java.exe
+if defined JAVA_HOME goto findJavaFromJavaHome
+
+set JAVA_EXE=java.exe
+%JAVA_EXE% -version >NUL 2>&1
+if %ERRORLEVEL% equ 0 goto execute
+
+echo. 1>&2
+echo ERROR: JAVA_HOME is not set and no 'java' command could be found in your PATH. 1>&2
+echo. 1>&2
+echo Please set the JAVA_HOME variable in your environment to match the 1>&2
+echo location of your Java installation. 1>&2
+
+"%COMSPEC%" /c exit 1
+
+:findJavaFromJavaHome
+set JAVA_HOME=%JAVA_HOME:"=%
+set JAVA_EXE=%JAVA_HOME%/bin/java.exe
+
+if exist "%JAVA_EXE%" goto execute
+
+echo. 1>&2
+echo ERROR: JAVA_HOME is set to an invalid directory: %JAVA_HOME% 1>&2
+echo. 1>&2
+echo Please set the JAVA_HOME variable in your environment to match the 1>&2
+echo location of your Java installation. 1>&2
+
+"%COMSPEC%" /c exit 1
+
+:execute
+@rem Setup the command line
+
+
+
+@rem Execute gradlew
+@rem endlocal doesn't take effect until after the line is parsed and variables are expanded
+@rem which allows us to clear the local environment before executing the java command
+endlocal & "%JAVA_EXE%" %DEFAULT_JVM_OPTS% %JAVA_OPTS% %GRADLE_OPTS% "-Dorg.gradle.appname=%APP_BASE_NAME%" -jar "%APP_HOME%\gradle\wrapper\gradle-wrapper.jar" %* & call :exitWithErrorLevel
+
+:exitWithErrorLevel
+@rem Use "%COMSPEC%" /c exit to allow operators to work properly in scripts
+"%COMSPEC%" /c exit %ERRORLEVEL%
diff --git a/app/run-android.sh b/app/run-android.sh
new file mode 100755
index 0000000..f97f8ad
--- /dev/null
+++ b/app/run-android.sh
@@ -0,0 +1,130 @@
+#!/bin/sh
+# Builds and runs this app on an emulator, creating/booting the AVD first if
+# it isn't already up.
+#
+# Environment setup (SDK location, PATH, ...) lives in ./android-env.sh,
+# which can also be sourced directly for one-off commands; see its header
+# comment. The emulator handling below is inline rather than in its own
+# shared script because this repo has exactly one app, so there's no second
+# caller to share it with.
+#
+# Goes through classic avdmanager/emulator/adb rather than the newer
+# `android` CLI's emulator subsystem: that one manages its own AVD pool and
+# would start a *second* instance alongside whatever is already running.
+set -eu
+
+APP_ID="com.example.devupdater"
+
+# One AVD per repository, named after it, which is how the other Android
+# projects on this machine are set up: two sessions working in two repos
+# otherwise fight over one emulator instance, and neither can tell that the
+# app it just installed was replaced by the other one's.
+# This app installs *other* projects' builds, so exercising it needs
+# something to install -- but that something should be a throwaway app you
+# control, added to the list like any other project, not another repo's real
+# app sharing this emulator. AVD_NAME=... overrides the name if you do need
+# a second one.
+AVD_NAME="${AVD_NAME:-dev-updater}"
+DEVICE_PROFILE="${DEVICE_PROFILE:-pixel_10}"
+SYSTEM_IMAGE="${SYSTEM_IMAGE:-system-images;android-36;google_apis;x86_64}"
+
+SCRIPT_DIR=$(cd "$(dirname "$0")" && pwd)
+cd "$SCRIPT_DIR"
+
+# shellcheck source=./android-env.sh
+. ./android-env.sh
+
+# Prints the adb serial of a running instance of AVD "$1", or nothing. Unlike
+# `adb -e` (which only works when exactly one emulator is attached, and
+# can't tell $AVD_NAME apart from some other AVD attached separately), this
+# checks by name so it can't mistake someone else's emulator for ours.
+avd_serial() {
+    for s in $(adb devices | awk '$2 == "device" {print $1}'); do
+        if [ "$(adb -s "$s" emu avd name 2>/dev/null | head -n1 | tr -d '\r')" = "$1" ]; then
+            echo "$s"
+            return 0
+        fi
+    done
+}
+
+echo "==> Ensuring emulator system image is installed"
+android sdk install emulator "$SYSTEM_IMAGE" || echo "    (non-fatal: see above)"
+
+if [ ! -f "$ANDROID_AVD_HOME/$AVD_NAME.ini" ]; then
+    echo "==> Creating AVD '$AVD_NAME' ($DEVICE_PROFILE, $SYSTEM_IMAGE)"
+    echo no | avdmanager create avd \
+        -n "$AVD_NAME" \
+        -k "$SYSTEM_IMAGE" \
+        --device "$DEVICE_PROFILE" \
+        --sdcard 512M
+else
+    echo "==> Reusing existing AVD '$AVD_NAME'"
+fi
+
+# avdmanager defaults new AVDs to hw.keyboard=no, which disables forwarding
+# the host keyboard into the emulator and leaves you dependent on the
+# on-screen keyboard. Force it on so typing works -- this app has a
+# free-text path field, so that matters more here than most.
+CONFIG_INI="$ANDROID_AVD_HOME/$AVD_NAME.avd/config.ini"
+if [ -f "$CONFIG_INI" ]; then
+    grep -v '^hw\.keyboard=' "$CONFIG_INI" >"$CONFIG_INI.tmp"
+    echo "hw.keyboard=yes" >>"$CONFIG_INI.tmp"
+    mv "$CONFIG_INI.tmp" "$CONFIG_INI"
+fi
+
+SERIAL=$(avd_serial "$AVD_NAME")
+if [ -n "$SERIAL" ]; then
+    echo "==> Emulator '$AVD_NAME' already running ($SERIAL)"
+else
+    # Clean up a stray/crashed process for this AVD, if any, so it doesn't
+    # end up with two instances fighting over the same AVD directory. The
+    # bracketed first character keeps the pattern from matching the shell
+    # running this script, which has the pattern text on its own command
+    # line -- unbracketed, this kills that shell mid-run.
+    pkill -f "[e]mulator.*-avd $AVD_NAME" >/dev/null 2>&1 || true
+
+    EMU_LOG="/tmp/$AVD_NAME-emulator.log"
+    : >"$EMU_LOG"
+    # Real GPU acceleration when a display is available; headless software
+    # rendering otherwise (e.g. a VM with no display attached).
+    if [ -n "${DISPLAY:-}" ] || [ -n "${WAYLAND_DISPLAY:-}" ]; then
+        echo "==> Starting emulator '$AVD_NAME' with GPU acceleration (-gpu host)"
+        emulator -avd "$AVD_NAME" -gpu host -no-audio >"$EMU_LOG" 2>&1 &
+    else
+        echo "==> No display available (DISPLAY/WAYLAND_DISPLAY unset) -- starting" \
+            "emulator '$AVD_NAME' headless with software rendering (-gpu swiftshader_indirect)"
+        emulator -avd "$AVD_NAME" -gpu swiftshader_indirect -no-audio -no-window \
+            >"$EMU_LOG" 2>&1 &
+    fi
+    EMU_PID=$!
+
+    i=0
+    booted=""
+    while [ "$i" -lt 150 ]; do
+        if ! kill -0 "$EMU_PID" 2>/dev/null; then
+            echo "Emulator process exited unexpectedly. Log output:" >&2
+            cat "$EMU_LOG" >&2
+            exit 1
+        fi
+        SERIAL=$(avd_serial "$AVD_NAME")
+        if [ -n "$SERIAL" ]; then
+            booted=$(adb -s "$SERIAL" shell getprop sys.boot_completed 2>/dev/null | tr -d '\r')
+            [ "$booted" = "1" ] && break
+        fi
+        i=$((i + 1))
+        sleep 2
+    done
+    if [ "$booted" != "1" ]; then
+        echo "Emulator did not finish booting in time. Log output:" >&2
+        cat "$EMU_LOG" >&2
+        exit 1
+    fi
+fi
+
+echo "==> Building debug APK"
+./gradlew :androidApp:assembleDebug
+
+APK="androidApp/build/outputs/apk/debug/androidApp-debug.apk"
+echo "==> Installing and launching $APK"
+adb -s "$SERIAL" install -r "$APK"
+adb -s "$SERIAL" shell am start -n "$APP_ID/.MainActivity"
diff --git a/app/settings.gradle.kts b/app/settings.gradle.kts
new file mode 100644
index 0000000..69d8131
--- /dev/null
+++ b/app/settings.gradle.kts
@@ -0,0 +1,25 @@
+rootProject.name = "DevUpdater"
+
+pluginManagement {
+    repositories {
+        google()
+        gradlePluginPortal()
+        mavenCentral()
+    }
+}
+
+dependencyResolutionManagement {
+    repositories {
+        google()
+        mavenCentral()
+    }
+}
+
+include(":androidApp")
+
+// The shared link, as a subproject of this build rather than a published
+// artifact, so it stays locked to whatever commit the submodule points at
+// -- the same arrangement the Rust half uses with a path dependency.
+include(":link")
+
+project(":link").projectDir = file("../vendor/wg-app-link/app")
diff --git a/build-self.sh b/build-self.sh
new file mode 100755
index 0000000..ba72fdf
--- /dev/null
+++ b/build-self.sh
@@ -0,0 +1,24 @@
+#!/bin/sh
+# Rebuilds this server and its app, in the order a self-update needs.
+#
+# For running by hand. The "Dev Updater" card no longer calls this: the two
+# halves are declared as a Server and an Apk component in
+# app/.dev-updater.ron, and a build walks components in order, so the order
+# below is expressed there now.
+#
+# Still has two callers, so it stays: ./start.sh builds through it, and a
+# server started before the components change has the old declaration in
+# memory pointing straight here -- the pull that carries that change is
+# built from it.
+#
+# The APK is built last and deliberately after the binary: if the build
+# fails, the phone keeps being offered the APK it already had rather than
+# a half-updated pair.
+set -eu
+cd "$(dirname "$0")"
+
+echo "==> Building the server"
+cargo build --release --manifest-path server/Cargo.toml
+
+echo "==> Building the app"
+./app/build-apk.sh
diff --git a/resources.ron b/resources.ron
new file mode 100644
index 0000000..c63eab5
--- /dev/null
+++ b/resources.ron
@@ -0,0 +1,18 @@
+// This project's own resources: the values it would otherwise have to
+// write down in several places.
+//
+// Structured as the body of the struct, with no outer parentheses, which
+// is the house rule every RON file here follows -- `wg_app_link::format`
+// is the only thing that knows it, so both this project's code and Dev
+// Updater read the file the same way.
+//
+// Dev Updater reads the keys it understands (see `Resources` in
+// `server/src/config.rs`) and ignores the rest, so anything else this
+// project needs to keep in one place belongs here too.
+
+// What this project calls itself for the purpose of keeping state, which
+// is where `~/.local/share/dev-updater` and `~/.config/dev-updater` come
+// from. Not the crate name, which answers to a registry's namespace
+// rather than to this; and not the label, which is what a person reads on
+// a card.
+name: "dev-updater",
diff --git a/run-tests.sh b/run-tests.sh
new file mode 100755
index 0000000..377ae42
--- /dev/null
+++ b/run-tests.sh
@@ -0,0 +1,12 @@
+#!/bin/sh
+# Runs this repo's tests. Extra arguments are forwarded to `cargo test`,
+# e.g. `./run-tests.sh discover` to run just the discovery tests.
+#
+# Only `server/` has tests: it holds all the logic worth testing (APK
+# discovery, config round-tripping, staleness, the git read/pull/check
+# split, token gating, certificate generation), while the Android app is
+# UI over its HTTP API. Verifying the app means running it -- see the
+# README.
+set -eu
+cd "$(dirname "$0")/server"
+exec cargo test "$@"
diff --git a/server/Cargo.lock b/server/Cargo.lock
new file mode 100644
index 0000000..4de2254
--- /dev/null
+++ b/server/Cargo.lock
@@ -0,0 +1,1981 @@
+# This file is automatically @generated by Cargo.
+# It is not intended for manual editing.
+version = 4
+
+[[package]]
+name = "adler2"
+version = "2.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "320119579fcad9c21884f5c4861d16174d0e06250625266f50fe6898340abefa"
+
+[[package]]
+name = "aes"
+version = "0.9.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f8eb277bec05f56a0e0591f155a484cbd0f4f07ff2905051a48c72f004f7ed58"
+dependencies = [
+ "cipher",
+ "cpubits",
+ "cpufeatures",
+]
+
+[[package]]
+name = "aho-corasick"
+version = "1.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c982642fa9e8606056828ee9a8505737230110bb1099153c79efe865c59d12ba"
+dependencies = [
+ "memchr",
+]
+
+[[package]]
+name = "anstream"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "824a212faf96e9acacdbd09febd34438f8f711fb84e09a8916013cd7815ca28d"
+dependencies = [
+ "anstyle",
+ "anstyle-parse",
+ "anstyle-query",
+ "anstyle-wincon",
+ "colorchoice",
+ "is_terminal_polyfill",
+ "utf8parse",
+]
+
+[[package]]
+name = "anstyle"
+version = "1.0.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "940b3a0ca603d1eade50a4846a2afffd5ef57a9feac2c0e2ec2e14f9ead76000"
+
+[[package]]
+name = "anstyle-parse"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "52ce7f38b242319f7cabaa6813055467063ecdc9d355bbb4ce0c68908cd8130e"
+dependencies = [
+ "utf8parse",
+]
+
+[[package]]
+name = "anstyle-query"
+version = "1.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "40c48f72fd53cd289104fc64099abca73db4166ad86ea0b4341abe65af83dadc"
+dependencies = [
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "anstyle-wincon"
+version = "3.0.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "291e6a250ff86cd4a820112fb8898808a366d8f9f58ce16d1f538353ad55747d"
+dependencies = [
+ "anstyle",
+ "once_cell_polyfill",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "anyhow"
+version = "1.0.104"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "330a5ed07fa54e4702c9d6c4174f74427fc0ef6e214bbd677ae50a5099946470"
+
+[[package]]
+name = "arc-swap"
+version = "1.9.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c049c0be4daef0b145cb3555416b3b8ef5b7888a38aea1a3a155801fe7b0810b"
+dependencies = [
+ "rustversion",
+]
+
+[[package]]
+name = "asn1-rs"
+version = "0.7.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b7f43a50ac4fdca5df8e885c21b835997f0a1cdee65494a6847694a98652d9d8"
+dependencies = [
+ "asn1-rs-derive",
+ "asn1-rs-impl",
+ "displaydoc",
+ "nom",
+ "num-traits",
+ "rusticata-macros",
+ "thiserror",
+ "time",
+]
+
+[[package]]
+name = "asn1-rs-derive"
+version = "0.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3109e49b1e4909e9db6515a30c633684d68cdeaa252f215214cb4fa1a5bfee2c"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+ "synstructure",
+]
+
+[[package]]
+name = "asn1-rs-impl"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7b18050c2cd6fe86c3a76584ef5e0baf286d038cda203eb6223df2cc413565f7"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "atomic-waker"
+version = "1.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1505bd5d3d116872e7271a6d4e16d81d0c8570876c8de68093a09ac269d8aac0"
+
+[[package]]
+name = "autocfg"
+version = "1.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f2032f911046de80f0a198e0901378627c33f59ea0ac00e363d481118bd70a53"
+
+[[package]]
+name = "aws-lc-rs"
+version = "1.18.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ce2b2dcc879c3bae0d371e77c99f2238400ef24ec001394befa67b6e543add9e"
+dependencies = [
+ "aws-lc-sys",
+ "zeroize",
+]
+
+[[package]]
+name = "aws-lc-sys"
+version = "0.44.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f09fae7be8bb3174e05c6afdb34199e6dc0c7c04ba9fa237b1967adfbde27483"
+dependencies = [
+ "cc",
+ "cmake",
+ "dunce",
+ "fs_extra",
+ "pkg-config",
+]
+
+[[package]]
+name = "axum"
+version = "0.8.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "31b698c5f9a010f6573133b09e0de5408834d0c82f8d7475a89fc1867a71cd90"
+dependencies = [
+ "axum-core",
+ "bytes",
+ "form_urlencoded",
+ "futures-util",
+ "http",
+ "http-body",
+ "http-body-util",
+ "hyper",
+ "hyper-util",
+ "itoa",
+ "matchit",
+ "memchr",
+ "mime",
+ "percent-encoding",
+ "pin-project-lite",
+ "serde_core",
+ "serde_json",
+ "serde_path_to_error",
+ "serde_urlencoded",
+ "sync_wrapper",
+ "tokio",
+ "tower",
+ "tower-layer",
+ "tower-service",
+ "tracing",
+]
+
+[[package]]
+name = "axum-core"
+version = "0.5.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "08c78f31d7b1291f7ee735c1c6780ccde7785daae9a9206026862dab7d8792d1"
+dependencies = [
+ "bytes",
+ "futures-core",
+ "http",
+ "http-body",
+ "http-body-util",
+ "mime",
+ "pin-project-lite",
+ "sync_wrapper",
+ "tower-layer",
+ "tower-service",
+ "tracing",
+]
+
+[[package]]
+name = "axum-server"
+version = "0.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b1df331683d982a0b9492b38127151e6453639cd34926eb9c07d4cd8c6d22bfc"
+dependencies = [
+ "arc-swap",
+ "bytes",
+ "either",
+ "fs-err",
+ "http",
+ "http-body",
+ "hyper",
+ "hyper-util",
+ "pin-project-lite",
+ "rustls",
+ "rustls-pki-types",
+ "tokio",
+ "tokio-rustls",
+ "tower-service",
+]
+
+[[package]]
+name = "base64"
+version = "0.22.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "72b3254f16251a8381aa12e40e3c4d2f0199f8c6508fbecb9d91f575e0fbb8c6"
+
+[[package]]
+name = "base64"
+version = "0.23.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ac07cdecf99051d9a5238b80f35af32cdeba5b336e55d957b318b50137e18da5"
+
+[[package]]
+name = "bit-vec"
+version = "0.9.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b71798fca2c1fe1086445a7258a4bc81e6e49dcd24c8d0dd9a1e57395b603f51"
+dependencies = [
+ "serde",
+]
+
+[[package]]
+name = "bitflags"
+version = "2.13.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b588b76d00fde79687d7646a9b5bdf3cc0f655e0bbd080335a95d7e96f3587da"
+dependencies = [
+ "serde_core",
+]
+
+[[package]]
+name = "block-buffer"
+version = "0.12.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d2f6c7dbe95a6ed67ad9f18e57daf93a2f034c524b99fd2b76d18fdfeb6660aa"
+dependencies = [
+ "hybrid-array",
+ "zeroize",
+]
+
+[[package]]
+name = "bumpalo"
+version = "3.20.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "72f5acc6cb2ba439de613abc23857ec3d78374d8ed5ac84e9d11336e87da8649"
+
+[[package]]
+name = "bytes"
+version = "1.12.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fc652a48c352aef3ea3aed32080501cf3ef6ed5da78602a020c991775b0aff04"
+
+[[package]]
+name = "bzip2"
+version = "0.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f3a53fac24f34a81bc9954b5d6cfce0c21e18ec6959f44f56e8e90e4bb7c346c"
+dependencies = [
+ "libbz2-rs-sys",
+]
+
+[[package]]
+name = "cc"
+version = "1.4.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0ad534f4357a5264cce5019c989cf66a4f0dc4e0d1b1d15f8aacec0ff7360273"
+dependencies = [
+ "find-msvc-tools",
+ "jobserver",
+ "libc",
+ "shlex",
+]
+
+[[package]]
+name = "cfg-if"
+version = "1.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9330f8b2ff13f34540b44e946ef35111825727b38d33286ef986142615121801"
+
+[[package]]
+name = "chacha20"
+version = "0.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d524456ba66e72eb8b115ff89e01e497f8e6d11d78b70b1aa13c0fbd97540a81"
+dependencies = [
+ "cfg-if",
+ "cpufeatures",
+ "rand_core",
+]
+
+[[package]]
+name = "cipher"
+version = "0.5.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e8cf2a2c93cd704877c0858356ed03480ff301ee950b43f1cbe4573b088bfa6c"
+dependencies = [
+ "crypto-common",
+ "inout",
+]
+
+[[package]]
+name = "clap"
+version = "4.6.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "473c7e07f409a8d772161724aa8db6a765a2532a70f9667eeb7b49d3d02fbdca"
+dependencies = [
+ "clap_builder",
+ "clap_derive",
+]
+
+[[package]]
+name = "clap_builder"
+version = "4.6.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7b48fea5a88e9ae728a2dcbedbfc0e730f7d60da42e1cb049a83c9fb8b789889"
+dependencies = [
+ "anstream",
+ "anstyle",
+ "clap_lex",
+ "strsim",
+]
+
+[[package]]
+name = "clap_derive"
+version = "4.6.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d012d2b9d65aca7f18f4d9878a045bc17899bba951561ba5ec3c2ba1eed9a061"
+dependencies = [
+ "heck",
+ "proc-macro2",
+ "quote",
+ "syn 3.0.3",
+]
+
+[[package]]
+name = "clap_lex"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c8d4a3bb8b1e0c1050499d1815f5ab16d04f0959b233085fb31653fbfc9d98f9"
+
+[[package]]
+name = "cmake"
+version = "0.1.58"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c0f78a02292a74a88ac736019ab962ece0bc380e3f977bf72e376c5d78ff0678"
+dependencies = [
+ "cc",
+]
+
+[[package]]
+name = "cmov"
+version = "0.5.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0c9ea0ac24bc397ab3c98583a3c9ba74fa56b09a4449bbe172b9b1ddb016027a"
+
+[[package]]
+name = "colorchoice"
+version = "1.0.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1d07550c9036bf2ae0c684c4297d503f838287c83c53686d05370d0e139ae570"
+
+[[package]]
+name = "const-oid"
+version = "0.10.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a6ef517f0926dd24a1582492c791b6a4818a4d94e789a334894aa15b0d12f55c"
+
+[[package]]
+name = "constant_time_eq"
+version = "0.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3d52eff69cd5e647efe296129160853a42795992097e8af39800e1060caeea9b"
+
+[[package]]
+name = "cpubits"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "15b85f9c39137c3a891689859392b1bd49812121d0d61c9caf00d46ed5ce06ae"
+
+[[package]]
+name = "cpufeatures"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8b2a41393f66f16b0823bb79094d54ac5fbd34ab292ddafb9a0456ac9f87d201"
+dependencies = [
+ "libc",
+]
+
+[[package]]
+name = "crc32fast"
+version = "1.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8498c871161e1742aaa9d52551b2d6ebdd4c3d45a3be423e3728f33b955be550"
+dependencies = [
+ "cfg-if",
+]
+
+[[package]]
+name = "crypto-common"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ce6e4c961d6cd6c9a86db418387425e8bdeaf05b3c8bc1411e6dca4c252f1453"
+dependencies = [
+ "hybrid-array",
+]
+
+[[package]]
+name = "ctutils"
+version = "0.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7d5515a3834141de9eafb9717ad39eea8247b5674e6066c404e8c4b365d2a29e"
+dependencies = [
+ "cmov",
+]
+
+[[package]]
+name = "data-encoding"
+version = "2.11.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4583a4551df46e2792f82ceeac45e850d2e2d5debba0b91f102385cda5b11f06"
+
+[[package]]
+name = "deflate64"
+version = "0.1.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ac6b926516df9c60bfa16e107b21086399f8285a44ca9711344b9e553c5146e2"
+
+[[package]]
+name = "der-parser"
+version = "10.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "07da5016415d5a3c4dd39b11ed26f915f52fc4e0dc197d87908bc916e51bc1a6"
+dependencies = [
+ "asn1-rs",
+ "displaydoc",
+ "nom",
+ "num-bigint",
+ "num-traits",
+ "rusticata-macros",
+]
+
+[[package]]
+name = "deranged"
+version = "0.5.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7cd812cc2bc1d69d4764bd80df88b4317eaef9e773c75226407d9bc0876b211c"
+
+[[package]]
+name = "dev-updater"
+version = "0.1.0"
+dependencies = [
+ "anyhow",
+ "axum",
+ "axum-server",
+ "clap",
+ "filetime",
+ "ron",
+ "serde",
+ "serde_json",
+ "tempfile",
+ "thiserror",
+ "tokio",
+ "tokio-util",
+ "tower",
+ "tracing",
+ "tracing-subscriber",
+ "wg-app-link",
+ "zip",
+]
+
+[[package]]
+name = "digest"
+version = "0.11.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f1dd6dbb5841937940781866fa1281a1ff7bd3bf827091440879f9994983d5c2"
+dependencies = [
+ "block-buffer",
+ "const-oid",
+ "crypto-common",
+ "ctutils",
+ "zeroize",
+]
+
+[[package]]
+name = "displaydoc"
+version = "0.2.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c6232dd377dcc64799954cbd3a9bb882e9cdc1308ccd87b1c098f1fb2eaf82a8"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 3.0.3",
+]
+
+[[package]]
+name = "dunce"
+version = "1.0.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "92773504d58c093f6de2459af4af33faa518c13451eb8f2b5698ed3d36e7c813"
+
+[[package]]
+name = "either"
+version = "1.18.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "252afb9ae5eaa683babdc6a068b3f5726eb19e05070c731f9b2a23a7c3e8ed34"
+
+[[package]]
+name = "equivalent"
+version = "1.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "877a4ace8713b0bcf2a4e7eec82529c029f1d0619886d18145fea96c3ffe5c0f"
+
+[[package]]
+name = "errno"
+version = "0.3.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb"
+dependencies = [
+ "libc",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "fastrand"
+version = "2.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "da7c62ceae207dd37ea5b845da6a0696c799f85e97da1ab5b7910be3c1c80223"
+
+[[package]]
+name = "filetime"
+version = "0.2.29"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5c287a33c7f0a620c38e641e7f60827713987b3c0f26e8ddc9462cc69cf75759"
+dependencies = [
+ "cfg-if",
+ "libc",
+]
+
+[[package]]
+name = "find-msvc-tools"
+version = "0.1.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d45db016d36b838f563236e9193d0ee6ce38f3f68b6c94e914b4929c96bbb890"
+
+[[package]]
+name = "flate2"
+version = "1.1.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "843fba2746e448b37e26a819579957415c8cef339bf08564fe8b7ddbd959573c"
+dependencies = [
+ "miniz_oxide",
+ "zlib-rs",
+]
+
+[[package]]
+name = "fnv"
+version = "1.0.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3f9eec918d3f24069decb9af1554cad7c880e2da24a9afd88aca000531ab82c1"
+
+[[package]]
+name = "form_urlencoded"
+version = "1.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cb4cb245038516f5f85277875cdaa4f7d2c9a0fa0468de06ed190163b1581fcf"
+dependencies = [
+ "percent-encoding",
+]
+
+[[package]]
+name = "fs-err"
+version = "3.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b91aa448ca50d7e79433bdf3ee8d99215430d2ec02ade5aefab2a073a1822e8a"
+dependencies = [
+ "autocfg",
+ "tokio",
+]
+
+[[package]]
+name = "fs_extra"
+version = "1.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "42703706b716c37f96a77aea830392ad231f44c9e9a67872fa5548707e11b11c"
+
+[[package]]
+name = "futures-channel"
+version = "0.3.34"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b1f9e3d69d39e4862ffed03ed071a76f9a13ba1d9109d355b0f0aa6b15e393c4"
+dependencies = [
+ "futures-core",
+]
+
+[[package]]
+name = "futures-core"
+version = "0.3.34"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "92d699e522242e69e3003b94ecc1f960f3a5e015aa7c5d7486e65ad01dd94f5e"
+
+[[package]]
+name = "futures-sink"
+version = "0.3.34"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1944426bf7d03f1d14f708785e4b33efd750b36d48a157b836b3efc15ede8e1d"
+
+[[package]]
+name = "futures-task"
+version = "0.3.34"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cd417de3d1d015fc3bfd2b1ea46dfc7bab72ef86f1cc7cc9c78e728b34a6d1fd"
+
+[[package]]
+name = "futures-util"
+version = "0.3.34"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0d50a92467f8ba5dd6e3ee5d4bd04d73ab2e4e1c44474a0674821dfce14b79bc"
+dependencies = [
+ "futures-core",
+ "futures-task",
+ "pin-project-lite",
+ "slab",
+]
+
+[[package]]
+name = "getrandom"
+version = "0.2.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ff2abc00be7fca6ebc474524697ae276ad847ad0a6b3faa4bcb027e9a4614ad0"
+dependencies = [
+ "cfg-if",
+ "libc",
+ "wasi",
+]
+
+[[package]]
+name = "getrandom"
+version = "0.4.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "300e883d756b2e4ec94e02791f39b04b522276138852cfc41d9fb7e904106099"
+dependencies = [
+ "cfg-if",
+ "js-sys",
+ "libc",
+ "r-efi",
+ "rand_core",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "h2"
+version = "0.4.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "839c0e8a181239723652be9062bb56ca5bf5f64011f73b623f6f4fc59086a228"
+dependencies = [
+ "atomic-waker",
+ "bytes",
+ "fnv",
+ "futures-core",
+ "futures-sink",
+ "http",
+ "indexmap",
+ "slab",
+ "tokio",
+ "tokio-util",
+ "tracing",
+]
+
+[[package]]
+name = "hashbrown"
+version = "0.17.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ed5909b6e89a2db4456e54cd5f673791d7eca6732202bbf2a9cc504fe2f9b84a"
+
+[[package]]
+name = "heck"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2304e00983f87ffb38b55b444b5e3b60a884b5d30c0fca7d82fe33449bbe55ea"
+
+[[package]]
+name = "hmac"
+version = "0.13.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6303bc9732ae41b04cb554b844a762b4115a61bfaa81e3e83050991eeb56863f"
+dependencies = [
+ "digest",
+]
+
+[[package]]
+name = "http"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "918d3568bebf352712bc2ef3d46a8bcf1a75b373be6539de198e9105cbbf9ce0"
+dependencies = [
+ "bytes",
+ "itoa",
+]
+
+[[package]]
+name = "http-body"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ca2a8f2913ee65f60facd6a5905613afaa448497a0230cc41ce022d93290bc2c"
+dependencies = [
+ "bytes",
+ "http",
+]
+
+[[package]]
+name = "http-body-util"
+version = "0.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "23169fe34a5fbcdd3f3862e78fb9b6fccd5f02a6dc6f732547005d45631ce71c"
+dependencies = [
+ "bytes",
+ "futures-core",
+ "http",
+ "http-body",
+ "pin-project-lite",
+]
+
+[[package]]
+name = "httparse"
+version = "1.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6dbf3de79e51f3d586ab4cb9d5c3e2c14aa28ed23d180cf89b4df0454a69cc87"
+
+[[package]]
+name = "httpdate"
+version = "1.0.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "df3b46402a9d5adb4c86a0cf463f42e19994e3ee891101b1841f30a545cb49a9"
+
+[[package]]
+name = "hybrid-array"
+version = "0.4.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "707114b52a152fa7bdb290cd7cd5912d9467273b6d74e21b8d81aca1f8533f6b"
+dependencies = [
+ "typenum",
+]
+
+[[package]]
+name = "hyper"
+version = "1.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d22053281f852e11534f5198498373cbb59295120a20771d90f7ed1897490a72"
+dependencies = [
+ "atomic-waker",
+ "bytes",
+ "futures-channel",
+ "futures-core",
+ "h2",
+ "http",
+ "http-body",
+ "httparse",
+ "httpdate",
+ "itoa",
+ "pin-project-lite",
+ "smallvec",
+ "tokio",
+]
+
+[[package]]
+name = "hyper-util"
+version = "0.1.20"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "96547c2556ec9d12fb1578c4eaf448b04993e7fb79cbaad930a656880a6bdfa0"
+dependencies = [
+ "bytes",
+ "http",
+ "http-body",
+ "hyper",
+ "pin-project-lite",
+ "tokio",
+ "tower-service",
+]
+
+[[package]]
+name = "if-addrs"
+version = "0.15.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c0a05c691e1fae256cf7013d99dad472dc52d5543322761f83ec8d47eab40d2b"
+dependencies = [
+ "libc",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "indexmap"
+version = "2.14.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d466e9454f08e4a911e14806c24e16fba1b4c121d1ea474396f396069cf949d9"
+dependencies = [
+ "equivalent",
+ "hashbrown",
+]
+
+[[package]]
+name = "inout"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4250ce6452e92010fdf7268ccc5d14faa80bb12fc741938534c58f16804e03c7"
+dependencies = [
+ "hybrid-array",
+]
+
+[[package]]
+name = "is_terminal_polyfill"
+version = "1.70.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a6cb138bb79a146c1bd460005623e142ef0181e3d0219cb493e02f7d08a35695"
+
+[[package]]
+name = "itoa"
+version = "1.0.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8f42a60cbdf9a97f5d2305f08a87dc4e09308d1276d28c869c684d7777685682"
+
+[[package]]
+name = "jobserver"
+version = "0.1.35"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1c00acbd29eabad4a2392fa0e921c874934dbbf4194312ad20f04a0ed67a3cb3"
+dependencies = [
+ "getrandom 0.4.3",
+ "libc",
+]
+
+[[package]]
+name = "js-sys"
+version = "0.3.104"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0e0c1080212aad755ea003d18543e8768dd432c48819efd73a7bf1e39b7a5a3a"
+dependencies = [
+ "cfg-if",
+ "futures-util",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "lazy_static"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bbd2bcb4c963f2ddae06a2efc7e9f3591312473c50c6685e1f298068316e66fe"
+
+[[package]]
+name = "libbz2-rs-sys"
+version = "0.2.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "34b357333733e8260735ba5894eb928c02ecc69c78715f01a8019e7fa7f2db4c"
+
+[[package]]
+name = "libc"
+version = "0.2.189"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3eaf3ede3fee6db1a4c2ee091bf8a8b4dccdc6d17f656fb07896ee72867612f2"
+
+[[package]]
+name = "linux-raw-sys"
+version = "0.12.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "32a66949e030da00e8c7d4434b251670a91556f4144941d37452769c25d58a53"
+
+[[package]]
+name = "log"
+version = "0.4.34"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f9f8bd3e56ce4dfc153cf470fffbfa98c7620958b312ca5c3a4b8d5181fd13c6"
+
+[[package]]
+name = "lzma-rust2"
+version = "0.16.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ca93e534d1142d1d0dcca6d25fe302508a5dfb40b302802904577725ea0b695b"
+dependencies = [
+ "sha2",
+]
+
+[[package]]
+name = "matchers"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d1525a2a28c7f4fa0fc98bb91ae755d1e2d1505079e05539e35bc876b5d65ae9"
+dependencies = [
+ "regex-automata",
+]
+
+[[package]]
+name = "matchit"
+version = "0.8.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "47e1ffaa40ddd1f3ed91f717a33c8c0ee23fff369e3aa8772b9605cc1d22f4c3"
+
+[[package]]
+name = "memchr"
+version = "2.8.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cf8baf1c55e62ffcace7a9f06f4bd9cd3f0c4beb022d3b367256b91b87513d98"
+
+[[package]]
+name = "mime"
+version = "0.3.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6877bb514081ee2a7ff5ef9de3281f14a4dd4bceac4c09388074a6b5df8a139a"
+
+[[package]]
+name = "minimal-lexical"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "68354c5c6bd36d73ff3feceb05efa59b6acb7626617f4962be322a825e61f79a"
+
+[[package]]
+name = "miniz_oxide"
+version = "0.8.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1fa76a2c86f704bdb222d66965fb3d63269ce38518b83cb0575fca855ebb6316"
+dependencies = [
+ "adler2",
+ "simd-adler32",
+]
+
+[[package]]
+name = "mio"
+version = "1.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "30d65c71f1ce40ab09135ce117d742b9f8a19ff91a41a8b57ed50bc2de59c427"
+dependencies = [
+ "libc",
+ "wasi",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "nom"
+version = "7.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d273983c5a657a70a3e8f2a01329822f3b8c8172b73826411a55751e404a0a4a"
+dependencies = [
+ "memchr",
+ "minimal-lexical",
+]
+
+[[package]]
+name = "nu-ansi-term"
+version = "0.50.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7957b9740744892f114936ab4a57b3f487491bbeafaf8083688b16841a4240e5"
+dependencies = [
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "num-bigint"
+version = "0.4.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c89e69e7e0f03bea5ef08013795c25018e101932225a656383bd384495ecc367"
+dependencies = [
+ "num-integer",
+ "num-traits",
+]
+
+[[package]]
+name = "num-conv"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "521739c6d2bac4aa25192232afe6841231376b2b26d4d9fae5ecf8ca5772e441"
+
+[[package]]
+name = "num-integer"
+version = "0.1.47"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7ce2d95d4b3734dc35aa2f45e1aa22cd416814592a4f9d9205e11affd5b8e10b"
+dependencies = [
+ "num-traits",
+]
+
+[[package]]
+name = "num-traits"
+version = "0.2.19"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "071dfc062690e90b734c0b2273ce72ad0ffa95f0c74596bc250dcfd960262841"
+dependencies = [
+ "autocfg",
+]
+
+[[package]]
+name = "oid-registry"
+version = "0.8.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "12f40cff3dde1b6087cc5d5f5d4d65712f34016a03ed60e9c08dcc392736b5b7"
+dependencies = [
+ "asn1-rs",
+]
+
+[[package]]
+name = "once_cell"
+version = "1.21.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9f7c3e4beb33f85d45ae3e3a1792185706c8e16d043238c593331cc7cd313b50"
+
+[[package]]
+name = "once_cell_polyfill"
+version = "1.70.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "384b8ab6d37215f3c5301a95a4accb5d64aa607f1fcb26a11b5303878451b4fe"
+
+[[package]]
+name = "pbkdf2"
+version = "0.13.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "112d82ceb8c5bf524d9af484d4e4970c9fd5a0cc15ba14ad93dccd28873b0629"
+dependencies = [
+ "digest",
+ "hmac",
+]
+
+[[package]]
+name = "pem"
+version = "3.0.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1d30c53c26bc5b31a98cd02d20f25a7c8567146caf63ed593a9d87b2775291be"
+dependencies = [
+ "base64 0.22.1",
+ "serde_core",
+]
+
+[[package]]
+name = "percent-encoding"
+version = "2.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9b4f627cb1b25917193a259e49bdad08f671f8d9708acfd5fe0a8c1455d87220"
+
+[[package]]
+name = "pin-project-lite"
+version = "0.2.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a89322df9ebe1c1578d689c92318e070967d1042b512afbe49518723f4e6d5cd"
+
+[[package]]
+name = "pkg-config"
+version = "0.3.34"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f6b464fbc74e149a392436b17d523f769e057cb6877f6a5c4618bc6f11800548"
+
+[[package]]
+name = "powerfmt"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "439ee305def115ba05938db6eb1644ff94165c5ab5e9420d1c1bcedbba909391"
+
+[[package]]
+name = "ppmd-rust"
+version = "1.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "efca4c95a19a79d1c98f791f10aebd5c1363b473244630bb7dbde1dc98455a24"
+
+[[package]]
+name = "proc-macro2"
+version = "1.0.107"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "985e7ec9bb745e6ce6535b544d84d6cd6f7ad8bd711c398938ae983b91a766d9"
+dependencies = [
+ "unicode-ident",
+]
+
+[[package]]
+name = "qrcode"
+version = "0.14.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d68782463e408eb1e668cf6152704bd856c78c5b6417adaee3203d8f4c1fc9ec"
+
+[[package]]
+name = "quote"
+version = "1.0.47"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1fbf4db142a473a8d80c26bbf18454ed458bf8d26c8219c331daecfdbd079001"
+dependencies = [
+ "proc-macro2",
+]
+
+[[package]]
+name = "r-efi"
+version = "6.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f8dcc9c7d52a811697d2151c701e0d08956f92b0e24136cf4cf27b57a6a0d9bf"
+
+[[package]]
+name = "rand"
+version = "0.10.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c7f5fa3a058cd35567ef9bfa5e75732bee0f9e4c55fa90477bef2dfcdbc4be80"
+dependencies = [
+ "chacha20",
+ "getrandom 0.4.3",
+ "rand_core",
+]
+
+[[package]]
+name = "rand_core"
+version = "0.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "63b8176103e19a2643978565ca18b50549f6101881c443590420e4dc998a3c69"
+
+[[package]]
+name = "rcgen"
+version = "0.14.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "091e7a8e7d86e6feb87a27ce8e2cba29d49eff9507afeebefab7eeb2ca667fb4"
+dependencies = [
+ "pem",
+ "ring",
+ "rustls-pki-types",
+ "time",
+ "x509-parser",
+ "yasna",
+]
+
+[[package]]
+name = "regex-automata"
+version = "0.4.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ad8553b9b26413251cbf30e620595c7a41b3887f03da04579c0e6b0d6a06b4b2"
+dependencies = [
+ "aho-corasick",
+ "memchr",
+ "regex-syntax",
+]
+
+[[package]]
+name = "regex-syntax"
+version = "0.8.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d6f6ff9a378485b298a5286656da665ba74413d36db0979633275d2e708145d4"
+
+[[package]]
+name = "ring"
+version = "0.17.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a4689e6c2294d81e88dc6261c768b63bc4fcdb852be6d1352498b114f61383b7"
+dependencies = [
+ "cc",
+ "cfg-if",
+ "getrandom 0.2.17",
+ "libc",
+ "untrusted",
+ "windows-sys 0.52.0",
+]
+
+[[package]]
+name = "ron"
+version = "0.12.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "81116b9531d61eabc41aeb228e4b6b2435bcca3233b98cf3b3077d4e6e9debb3"
+dependencies = [
+ "bitflags",
+ "once_cell",
+ "serde",
+ "serde_derive",
+ "typeid",
+ "unicode-ident",
+]
+
+[[package]]
+name = "rusticata-macros"
+version = "4.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "faf0c4a6ece9950b9abdb62b1cfcf2a68b3b67a10ba445b3bb85be2a293d0632"
+dependencies = [
+ "nom",
+]
+
+[[package]]
+name = "rustix"
+version = "1.1.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b6fe4565b9518b83ef4f91bb47ce29620ca828bd32cb7e408f0062e9930ba190"
+dependencies = [
+ "bitflags",
+ "errno",
+ "libc",
+ "linux-raw-sys",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "rustls"
+version = "0.23.43"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0283386ce02abc0151e1761d08802dfe86c173b0b494af5cbc086574e453da06"
+dependencies = [
+ "aws-lc-rs",
+ "once_cell",
+ "rustls-pki-types",
+ "rustls-webpki",
+ "subtle",
+ "zeroize",
+]
+
+[[package]]
+name = "rustls-pki-types"
+version = "1.15.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2f4925028c7eb5d1fcdaf196971378ed9d2c1c4efc7dc5d011256f76c99c0a96"
+dependencies = [
+ "zeroize",
+]
+
+[[package]]
+name = "rustls-webpki"
+version = "0.103.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f3c3cf1d8b1e7d4927e2d154c3fcb02979afb9939629c62cd9048d4f07b60ac2"
+dependencies = [
+ "aws-lc-rs",
+ "ring",
+ "rustls-pki-types",
+ "untrusted",
+]
+
+[[package]]
+name = "rustversion"
+version = "1.0.23"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cf54715a573b99ac80df0bc206da022bcd442c974952c7b9720069370852e21f"
+
+[[package]]
+name = "ryu"
+version = "1.0.23"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9774ba4a74de5f7b1c1451ed6cd5285a32eddb5cccb8cc655a4e50009e06477f"
+
+[[package]]
+name = "serde"
+version = "1.0.229"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4148590afebada386688f18773da617792bf2ef03ffc1e4cbd2b1d45b023e0ba"
+dependencies = [
+ "serde_core",
+ "serde_derive",
+]
+
+[[package]]
+name = "serde_core"
+version = "1.0.229"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "67dca2c9c51e58a4791a4b1ed58308b39c64224d349a935ab5039aa360942a48"
+dependencies = [
+ "serde_derive",
+]
+
+[[package]]
+name = "serde_derive"
+version = "1.0.229"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e7a5d71263a5a7d47b41f6b3f06ba276f10cc18b0931f1799f710578e2309348"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 3.0.3",
+]
+
+[[package]]
+name = "serde_json"
+version = "1.0.151"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c841b55ecdae098c80dcae9cf767f6f8a0c2cdb3416bbef72181df4d0fe73f14"
+dependencies = [
+ "itoa",
+ "memchr",
+ "serde",
+ "serde_core",
+ "zmij",
+]
+
+[[package]]
+name = "serde_path_to_error"
+version = "0.1.20"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "10a9ff822e371bb5403e391ecd83e182e0e77ba7f6fe0160b795797109d1b457"
+dependencies = [
+ "itoa",
+ "serde",
+ "serde_core",
+]
+
+[[package]]
+name = "serde_urlencoded"
+version = "0.7.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d3491c14715ca2294c4d6a88f15e84739788c1d030eed8c110436aafdaa2f3fd"
+dependencies = [
+ "form_urlencoded",
+ "itoa",
+ "ryu",
+ "serde",
+]
+
+[[package]]
+name = "sha1"
+version = "0.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "aacc4cc499359472b4abe1bf11d0b12e688af9a805fa5e3016f9a386dc2d0214"
+dependencies = [
+ "cfg-if",
+ "cpufeatures",
+ "digest",
+]
+
+[[package]]
+name = "sha2"
+version = "0.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "446ba717509524cb3f22f17ecc096f10f4822d76ab5c0b9822c5f9c284e825f4"
+dependencies = [
+ "cfg-if",
+ "cpufeatures",
+ "digest",
+]
+
+[[package]]
+name = "sharded-slab"
+version = "0.1.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f40ca3c46823713e0d4209592e8d6e826aa57e928f09752619fc696c499637f6"
+dependencies = [
+ "lazy_static",
+]
+
+[[package]]
+name = "shlex"
+version = "2.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f8fadd59c855ef2080decdef8ff161eb6661b86933c9d82e5ba29dc602a55aba"
+
+[[package]]
+name = "simd-adler32"
+version = "0.3.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3a219298ac11a56ea9a6d2120044824d6f01aeb034955e7af7bc16858527deea"
+
+[[package]]
+name = "slab"
+version = "0.4.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0c790de23124f9ab44544d7ac05d60440adc586479ce501c1d6d7da3cd8c9cf5"
+
+[[package]]
+name = "smallvec"
+version = "1.15.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8ed6a63f02c8539c91a8685a86f4099661ba3da017932f6ebbea6de3f0fa7c90"
+
+[[package]]
+name = "socket2"
+version = "0.6.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c3d1e2c7f27f8d4cb10542a02c49005dbd6e93095799d6f3be745fae9f8fedd4"
+dependencies = [
+ "libc",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "strsim"
+version = "0.11.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7da8b5736845d9f2fcb837ea5d9e2628564b3b043a70948a3f0b778838c5fb4f"
+
+[[package]]
+name = "subtle"
+version = "2.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "13c2bddecc57b384dee18652358fb23172facb8a2c51ccc10d74c157bdea3292"
+
+[[package]]
+name = "syn"
+version = "2.0.119"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "872831b642d1a07999a962a351ed35b955ea2cfc8f3862091e2a240a84f17297"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "unicode-ident",
+]
+
+[[package]]
+name = "syn"
+version = "3.0.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "53e9bae58849f64dfa4f5d5ae372c8341f7305f82a3868709269343628b659a3"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "unicode-ident",
+]
+
+[[package]]
+name = "sync_wrapper"
+version = "1.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0bf256ce5efdfa370213c1dabab5935a12e49f2c58d15e9eac2870d3b4f27263"
+
+[[package]]
+name = "synstructure"
+version = "0.13.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "728a70f3dbaf5bab7f0c4b1ac8d7ae5ea60a4b5549c8a5914361c99147a709d2"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "tempfile"
+version = "3.27.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "32497e9a4c7b38532efcdebeef879707aa9f794296a4f0244f6f69e9bc8574bd"
+dependencies = [
+ "fastrand",
+ "getrandom 0.4.3",
+ "once_cell",
+ "rustix",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "thiserror"
+version = "2.0.20"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ec86235f5fcc2a73650310756d2ac5b138a5780bbbdfae3eeccec992c435ba4f"
+dependencies = [
+ "thiserror-impl",
+]
+
+[[package]]
+name = "thiserror-impl"
+version = "2.0.20"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bc04cd3e1236dd4a98afca4569f2deb3f120e5422a4023be2cb683f8486292af"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 3.0.3",
+]
+
+[[package]]
+name = "thread_local"
+version = "1.1.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1ad99c4c6d32803332c548b1af0540b357b3f5fc0be8f6c6bfe8b2e6ae784070"
+dependencies = [
+ "cfg-if",
+]
+
+[[package]]
+name = "time"
+version = "0.3.55"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cdb87b95ec50ddfa440816d227a17b2ccbdda963a316a727fda0fc4334f7d134"
+dependencies = [
+ "deranged",
+ "js-sys",
+ "num-conv",
+ "powerfmt",
+ "serde_core",
+ "time-core",
+ "time-macros",
+]
+
+[[package]]
+name = "time-core"
+version = "0.1.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9e1c906769ad99c88eaa54e728060edef082f8e358ff32030cb7c7d315e81109"
+
+[[package]]
+name = "time-macros"
+version = "0.2.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7e689342a48d2ea927c87ea50cabf8594854bf940e9310208848d680d668ed85"
+dependencies = [
+ "num-conv",
+ "time-core",
+]
+
+[[package]]
+name = "tokio"
+version = "1.53.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "202caea871b69668250d242070849eb495be178ed697a3e98aebce5bc81a0bed"
+dependencies = [
+ "bytes",
+ "libc",
+ "mio",
+ "pin-project-lite",
+ "socket2",
+ "tokio-macros",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "tokio-macros"
+version = "2.7.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "78773a2a397f451582ce068015985c33193cf6dea8b74d2a639fe457b2f07b0e"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 3.0.3",
+]
+
+[[package]]
+name = "tokio-rustls"
+version = "0.26.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1729aa945f29d91ba541258c8df89027d5792d85a8841fb65e8bf0f4ede4ef61"
+dependencies = [
+ "rustls",
+ "tokio",
+]
+
+[[package]]
+name = "tokio-util"
+version = "0.7.19"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "494815d09bf52b5548659851081238f0ca39ff638363907596da739561c62c52"
+dependencies = [
+ "bytes",
+ "futures-core",
+ "futures-sink",
+ "libc",
+ "pin-project-lite",
+ "tokio",
+]
+
+[[package]]
+name = "tower"
+version = "0.5.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ebe5ef63511595f1344e2d5cfa636d973292adc0eec1f0ad45fae9f0851ab1d4"
+dependencies = [
+ "futures-core",
+ "futures-util",
+ "pin-project-lite",
+ "sync_wrapper",
+ "tokio",
+ "tower-layer",
+ "tower-service",
+ "tracing",
+]
+
+[[package]]
+name = "tower-layer"
+version = "0.3.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "121c2a6cda46980bb0fcd1647ffaf6cd3fc79a013de288782836f6df9c48780e"
+
+[[package]]
+name = "tower-service"
+version = "0.3.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8df9b6e13f2d32c91b9bd719c00d1958837bc7dec474d94952798cc8e69eeec3"
+
+[[package]]
+name = "tracing"
+version = "0.1.44"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "63e71662fa4b2a2c3a26f570f037eb95bb1f85397f3cd8076caed2f026a6d100"
+dependencies = [
+ "log",
+ "pin-project-lite",
+ "tracing-attributes",
+ "tracing-core",
+]
+
+[[package]]
+name = "tracing-attributes"
+version = "0.1.31"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7490cfa5ec963746568740651ac6781f701c9c5ea257c58e057f3ba8cf69e8da"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "tracing-core"
+version = "0.1.36"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "db97caf9d906fbde555dd62fa95ddba9eecfd14cb388e4f491a66d74cd5fb79a"
+dependencies = [
+ "once_cell",
+ "valuable",
+]
+
+[[package]]
+name = "tracing-log"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ee855f1f400bd0e5c02d150ae5de3840039a3f54b025156404e34c23c03f47c3"
+dependencies = [
+ "log",
+ "once_cell",
+ "tracing-core",
+]
+
+[[package]]
+name = "tracing-subscriber"
+version = "0.3.23"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cb7f578e5945fb242538965c2d0b04418d38ec25c79d160cd279bf0731c8d319"
+dependencies = [
+ "matchers",
+ "nu-ansi-term",
+ "once_cell",
+ "regex-automata",
+ "sharded-slab",
+ "smallvec",
+ "thread_local",
+ "tracing",
+ "tracing-core",
+ "tracing-log",
+]
+
+[[package]]
+name = "typed-path"
+version = "0.12.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8e28f89b80c87b8fb0cf04ab448d5dd0dd0ade2f8891bae878de66a75a28600e"
+
+[[package]]
+name = "typeid"
+version = "1.0.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bc7d623258602320d5c55d1bc22793b57daff0ec7efc270ea7d55ce1d5f5471c"
+
+[[package]]
+name = "typenum"
+version = "1.20.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b6f5e870be6c3b371b77fe0ee0bafb859fa4964b4404c27de1d380043c4dda20"
+
+[[package]]
+name = "unicode-ident"
+version = "1.0.24"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e6e4313cd5fcd3dad5cafa179702e2b244f760991f45397d14d4ebf38247da75"
+
+[[package]]
+name = "untrusted"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8ecb6da28b8a351d773b68d5825ac39017e680750f980f3a1a85cd8dd28a47c1"
+
+[[package]]
+name = "utf8parse"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "06abde3611657adf66d383f00b093d7faecc7fa57071cce2578660c9f1010821"
+
+[[package]]
+name = "valuable"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ba73ea9cf16a25df0c8caa16c51acb937d5712a8429db78a3ee29d5dcacd3a65"
+
+[[package]]
+name = "wasi"
+version = "0.11.1+wasi-snapshot-preview1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ccf3ec651a847eb01de73ccad15eb7d99f80485de043efb2f370cd654f4ea44b"
+
+[[package]]
+name = "wasm-bindgen"
+version = "0.2.127"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1b70935747edd64d89de3efa29d73789b806c15798f8e7dca4d8ac356b50ce70"
+dependencies = [
+ "cfg-if",
+ "once_cell",
+ "rustversion",
+ "wasm-bindgen-macro",
+ "wasm-bindgen-shared",
+]
+
+[[package]]
+name = "wasm-bindgen-macro"
+version = "0.2.127"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "77775f8f3f7217702089053b94958f8f54061a3f663417df76e19cbdcca29bc1"
+dependencies = [
+ "quote",
+ "wasm-bindgen-macro-support",
+]
+
+[[package]]
+name = "wasm-bindgen-macro-support"
+version = "0.2.127"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e11d33f857dc2fb11b8bc75aee111aa9cbeb12cd9f25efd3d4c2a3dd4e235284"
+dependencies = [
+ "bumpalo",
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+ "wasm-bindgen-shared",
+]
+
+[[package]]
+name = "wasm-bindgen-shared"
+version = "0.2.127"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7ef64dbcc55df09c7e5a46182d181c2cfa3e925f3da937ea764728b4bbb9dcbf"
+dependencies = [
+ "unicode-ident",
+]
+
+[[package]]
+name = "wg-app-link"
+version = "0.1.0"
+dependencies = [
+ "anyhow",
+ "base64 0.23.1",
+ "if-addrs",
+ "qrcode",
+ "rand",
+ "rcgen",
+ "ron",
+ "serde",
+ "sha2",
+ "subtle",
+ "tracing",
+]
+
+[[package]]
+name = "windows-link"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f0805222e57f7521d6a62e36fa9163bc891acd422f971defe97d64e70d0a4fe5"
+
+[[package]]
+name = "windows-sys"
+version = "0.52.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "282be5f36a8ce781fad8c8ae18fa3f9beff57ec1b52cb3de0789201425d9a33d"
+dependencies = [
+ "windows-targets",
+]
+
+[[package]]
+name = "windows-sys"
+version = "0.61.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ae137229bcbd6cdf0f7b80a31df61766145077ddf49416a728b02cb3921ff3fc"
+dependencies = [
+ "windows-link",
+]
+
+[[package]]
+name = "windows-targets"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9b724f72796e036ab90c1021d4780d4d3d648aca59e491e6b98e725b84e99973"
+dependencies = [
+ "windows_aarch64_gnullvm",
+ "windows_aarch64_msvc",
+ "windows_i686_gnu",
+ "windows_i686_gnullvm",
+ "windows_i686_msvc",
+ "windows_x86_64_gnu",
+ "windows_x86_64_gnullvm",
+ "windows_x86_64_msvc",
+]
+
+[[package]]
+name = "windows_aarch64_gnullvm"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "32a4622180e7a0ec044bb555404c800bc9fd9ec262ec147edd5989ccd0c02cd3"
+
+[[package]]
+name = "windows_aarch64_msvc"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "09ec2a7bb152e2252b53fa7803150007879548bc709c039df7627cabbd05d469"
+
+[[package]]
+name = "windows_i686_gnu"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8e9b5ad5ab802e97eb8e295ac6720e509ee4c243f69d781394014ebfe8bbfa0b"
+
+[[package]]
+name = "windows_i686_gnullvm"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0eee52d38c090b3caa76c563b86c3a4bd71ef1a819287c19d586d7334ae8ed66"
+
+[[package]]
+name = "windows_i686_msvc"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "240948bc05c5e7c6dabba28bf89d89ffce3e303022809e73deaefe4f6ec56c66"
+
+[[package]]
+name = "windows_x86_64_gnu"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "147a5c80aabfbf0c7d901cb5895d1de30ef2907eb21fbbab29ca94c5b08b1a78"
+
+[[package]]
+name = "windows_x86_64_gnullvm"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "24d5b23dc417412679681396f2b49f3de8c1473deb516bd34410872eff51ed0d"
+
+[[package]]
+name = "windows_x86_64_msvc"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "589f6da84c646204747d1270a2a5661ea66ed1cced2631d546fdfb155959f9ec"
+
+[[package]]
+name = "x509-parser"
+version = "0.18.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d43b0f71ce057da06bc0851b23ee24f3f86190b07203dd8f567d0b706a185202"
+dependencies = [
+ "asn1-rs",
+ "data-encoding",
+ "der-parser",
+ "lazy_static",
+ "nom",
+ "oid-registry",
+ "ring",
+ "rusticata-macros",
+ "thiserror",
+ "time",
+]
+
+[[package]]
+name = "yasna"
+version = "0.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b5f6765e852b9b4dc8e2a76843e4d64d1cea8e79bcde0b6901aea8e7c7f08282"
+dependencies = [
+ "bit-vec",
+ "time",
+]
+
+[[package]]
+name = "zeroize"
+version = "1.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e13c156562582aa81c60cb29407084cdb54c4164760106ab78e6c5b0858cf64e"
+
+[[package]]
+name = "zip"
+version = "8.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2d04a6b5381502aa6087c94c669499eb1602eb9c5e8198e534de571f7154809b"
+dependencies = [
+ "aes",
+ "bzip2",
+ "constant_time_eq",
+ "crc32fast",
+ "deflate64",
+ "flate2",
+ "getrandom 0.4.3",
+ "hmac",
+ "indexmap",
+ "lzma-rust2",
+ "memchr",
+ "pbkdf2",
+ "ppmd-rust",
+ "sha1",
+ "time",
+ "typed-path",
+ "zeroize",
+ "zopfli",
+ "zstd",
+]
+
+[[package]]
+name = "zlib-rs"
+version = "0.6.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "34b31d188d9d685a4f9c7b46d6e36631b07058d2cfe190267adce54dc230bf12"
+
+[[package]]
+name = "zmij"
+version = "1.0.23"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "29666d0abbfad1e3dc4dcf6144730dd3a3ab225bbbdac83319345b1b44ccfc1b"
+
+[[package]]
+name = "zopfli"
+version = "0.8.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f05cd8797d63865425ff89b5c4a48804f35ba0ce8d125800027ad6017d2b5249"
+dependencies = [
+ "bumpalo",
+ "crc32fast",
+ "log",
+ "simd-adler32",
+]
+
+[[package]]
+name = "zstd"
+version = "0.13.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e91ee311a569c327171651566e07972200e76fcfe2242a4fa446149a3881c08a"
+dependencies = [
+ "zstd-safe",
+]
+
+[[package]]
+name = "zstd-safe"
+version = "7.2.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8f49c4d5f0abb602a93fb8736af2a4f4dd9512e36f7f570d66e65ff867ed3b9d"
+dependencies = [
+ "zstd-sys",
+]
+
+[[package]]
+name = "zstd-sys"
+version = "2.0.16+zstd.1.5.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "91e19ebc2adc8f83e43039e79776e3fda8ca919132d68a1fed6a5faca2683748"
+dependencies = [
+ "cc",
+ "pkg-config",
+]
diff --git a/server/Cargo.toml b/server/Cargo.toml
new file mode 100644
index 0000000..ed82502
--- /dev/null
+++ b/server/Cargo.toml
@@ -0,0 +1,43 @@
+[package]
+name = "dev-updater"
+version = "0.1.0"
+edition = "2024"
+
+[[bin]]
+name = "dev-updater"
+path = "src/main.rs"
+
+[dependencies]
+# The private link between a phone and a machine you run: the WireGuard
+# binding, the CA the app pins, QR enrollment, owner-only file creation and
+# the RON house rules. Shared with ai-app as a submodule rather than a
+# published crate, so the two cannot end up on versions of it that disagree
+# -- a pull that moves one moves the other.
+wg-app-link = { path = "../vendor/wg-app-link/server" }
+axum = { version = "0.8", features = ["json"] }
+axum-server = { version = "0.8", features = ["tls-rustls"] }
+tokio = { version = "1", features = ["rt-multi-thread", "macros", "net", "fs", "io-util"] }
+tokio-util = { version = "0.7", features = ["io"] }
+tracing = "0.1"
+tracing-subscriber = { version = "0.3", features = ["env-filter"] }
+serde = { version = "1", features = ["derive"] }
+clap = { version = "4", features = ["derive"] }
+anyhow = "1"
+thiserror = "2"
+zip = "8"
+serde_json = "1"
+tempfile = "3"
+# The format of both this server's own config and the file a project carries
+# to describe itself -- both read and edited by hand, where comments earn
+# their keep, and both describing things that are genuinely sums (a
+# component is an APK or a server, not a tagged bag of every field). TOML
+# can express the second only as a tag plus flat sibling keys, which nothing
+# checks until run time. serde_json is still here for the HTTP surface.
+ron = "0.12.2"
+
+[dev-dependencies]
+# ServiceExt::oneshot, to drive the auth middleware without a socket.
+tower = { version = "0.5", features = ["util"] }
+# Setting an explicit mtime is the only way to test "newest build wins"
+# deterministically -- files written in the same instant tie.
+filetime = "0.2"
diff --git a/server/src/apkinfo.rs b/server/src/apkinfo.rs
new file mode 100644
index 0000000..ee4db22
--- /dev/null
+++ b/server/src/apkinfo.rs
@@ -0,0 +1,82 @@
+//! Reading an APK's own identity -- package name and display label -- out of
+//! the built file, so adding an app needs nothing but a path.
+//!
+//! The package name is not cosmetic: it is what the updater app looks up
+//! with `PackageManager` to tell "already installed this build" apart from
+//! "update available", so an app whose package can't be read can't be
+//! served usefully and is rejected at add time rather than showing up as a
+//! permanently-out-of-date card.
+//!
+//! This shells out to `aapt2`, which costs a process spawn (tens of
+//! milliseconds), so it never runs on the manifest path. It runs when an
+//! app is added, and off the request path after a download, which is the
+//! one moment this server can notice that a local rebuild changed what the
+//! APK installs over. The answer is cached on the component in the config
+//! (`Component::Apk`'s `package`).
+
+use std::path::Path;
+use std::process::Command;
+
+use anyhow::{Context, Result, bail};
+
+use crate::sdk;
+
+pub struct ApkInfo {
+    pub package: String,
+    /// The APK's own `android:label`, when it has one -- what the user sees
+    /// on the device, so a better card title than the directory name.
+    pub label: Option<String>,
+}
+
+pub fn read(apk: &Path) -> Result<ApkInfo> {
+    let output = Command::new(sdk::aapt2_path()?)
+        .arg("dump")
+        .arg("badging")
+        .arg(apk)
+        .output()
+        .context("failed to spawn aapt2")?;
+    if !output.status.success() {
+        bail!(
+            "aapt2 couldn't read {} as an APK: {}",
+            apk.display(),
+            String::from_utf8_lossy(&output.stderr).trim(),
+        );
+    }
+    let badging = String::from_utf8_lossy(&output.stdout);
+
+    let package = badging
+        .lines()
+        .find_map(|line| line.strip_prefix("package:"))
+        .and_then(|rest| quoted_value(rest, "name="))
+        .with_context(|| format!("no package name in aapt2's output for {}", apk.display()))?;
+
+    // `application-label:'X'` is the default-locale label; `application:`
+    // carries the same thing plus the icon. Either is fine, and which one
+    // appears depends on the aapt2 version, so accept whichever is present.
+    let label = badging
+        .lines()
+        .find_map(|line| line.strip_prefix("application-label:"))
+        .and_then(|rest| {
+            rest.trim()
+                .strip_prefix('\'')
+                .and_then(|rest| rest.strip_suffix('\''))
+        })
+        .map(str::to_owned)
+        .or_else(|| {
+            badging
+                .lines()
+                .find_map(|line| line.strip_prefix("application:"))
+                .and_then(|rest| quoted_value(rest, "label="))
+        })
+        .filter(|label| !label.is_empty());
+
+    Ok(ApkInfo { package, label })
+}
+
+/// Pulls `key='value'` out of one of aapt2's space-separated badging lines.
+fn quoted_value(line: &str, key: &str) -> Option<String> {
+    let rest = line.split_once(key)?.1;
+    let rest = rest.strip_prefix('\'')?;
+    let (value, _) = rest.split_once('\'')?;
+    Some(value.to_owned())
+}
diff --git a/server/src/auth.rs b/server/src/auth.rs
new file mode 100644
index 0000000..06eb5f2
--- /dev/null
+++ b/server/src/auth.rs
@@ -0,0 +1,200 @@
+//! Bearer-token auth for the TLS listener's whole surface.
+//!
+//! Everything on that listener either is, or decides, what gets handed to
+//! `REQUEST_INSTALL_PACKAGES` next, and the management routes can repoint
+//! the scanner, add apps by path, and trigger a configured build command.
+//! Pinning authenticates this server to the phone but never the phone to
+//! this server, so the token supplies the other direction; binding the
+//! WireGuard interface narrows who can try at all, and this narrows it to
+//! who was enrolled.
+//!
+//! The middleware is applied once around the whole router (including the
+//! fallback) in `main.rs`, never per-route, so a new route can't forget
+//! it. The bootstrap listener is deliberately *not* wrapped: it exists for
+//! a browser that has nothing to authenticate with yet, and serves only
+//! this app's own APK.
+//!
+//! Nothing in this module -- and nothing anywhere else -- may log the
+//! Authorization header or the token; `token_is_never_logged` below holds a
+//! tripwire against a logging change silently starting to.
+
+use std::net::{IpAddr, SocketAddr};
+use std::sync::Arc;
+use std::time::Duration;
+
+use crate::registry::AppState;
+use axum::extract::{ConnectInfo, Request, State};
+use axum::http::{StatusCode, header};
+use axum::middleware::Next;
+use axum::response::{IntoResponse, Response};
+
+/// Applied to every rejection. Not against brute force -- infeasible at 256
+/// bits -- but so a scanner probing the port shows up as a slow, loggable
+/// drip rather than a fast one.
+const REJECT_DELAY: Duration = Duration::from_millis(300);
+
+/// The scheme the app registers for enrollment URIs.
+///
+/// The one product-specific thing about enrollment, which is why the
+/// shared implementation takes it as an argument rather than knowing it.
+const ENROLL_SCHEME: &str = "devupdater";
+
+/// Re-exported rather than wrapped: `main` and the routes both enroll, and
+/// a wrapper here would only be a second name for the same function.
+pub use wg_app_link::enroll::{generate_token, token_hash_hex};
+
+/// Prints the one-time enrollment QR: a `devupdater://enroll` URI carrying
+/// where to connect and the bearer token. The CA stays embedded in the APK,
+/// so this carries no trust material -- photographing the terminal leaks
+/// only the token, which is rotatable (`--rotate-token`).
+pub fn print_enrollment(host: IpAddr, port: u16, token: &str) -> anyhow::Result<()> {
+    wg_app_link::enroll::print_enrollment(ENROLL_SCHEME, host, port, token)
+}
+
+pub async fn require_token(
+    State(state): State<Arc<AppState>>,
+    request: Request,
+    next: Next,
+) -> Response {
+    let presented = request
+        .headers()
+        .get(header::AUTHORIZATION)
+        .and_then(|value| value.to_str().ok())
+        .and_then(|value| value.strip_prefix("Bearer "));
+    if let Some(token) = presented {
+        let hashes: Vec<String> = state
+            .tokens()
+            .into_iter()
+            .map(|entry| entry.sha256)
+            .collect();
+        if wg_app_link::enroll::token_matches(token, &hashes) {
+            return next.run(request).await;
+        }
+    }
+
+    // Peer address only -- never the header value. Absent when there is no
+    // real socket (tests driving the router directly).
+    let peer = request
+        .extensions()
+        .get::<ConnectInfo<SocketAddr>>()
+        .map(|ConnectInfo(addr)| addr.to_string())
+        .unwrap_or_else(|| "unknown peer".to_string());
+    tracing::warn!("rejected request from {peer}: missing or invalid bearer token");
+    tokio::time::sleep(REJECT_DELAY).await;
+    (StatusCode::UNAUTHORIZED, "missing or invalid bearer token").into_response()
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use std::sync::Mutex;
+
+    use axum::Router;
+    use axum::body::Body;
+    use axum::routing::get;
+    use tower::ServiceExt;
+
+    use crate::config::TokenEntry;
+
+    fn state_with_token(dir: &std::path::Path, token: &str) -> Arc<AppState> {
+        let state =
+            Arc::new(AppState::new(dir.join("config.ron"), dir.join("app")).expect("state"));
+        state
+            .set_tokens(vec![TokenEntry {
+                name: "phone".to_string(),
+                sha256: token_hash_hex(token),
+            }])
+            .expect("set token");
+        state
+    }
+
+    fn guarded_router(state: Arc<AppState>) -> Router {
+        Router::new()
+            .route("/probe", get(|| async { "ok" }))
+            .fallback(|| async { StatusCode::NOT_FOUND })
+            .layer(axum::middleware::from_fn_with_state(state, require_token))
+    }
+
+    fn request(path: &str, auth: Option<&str>) -> Request {
+        let mut builder = axum::http::Request::builder().uri(path);
+        if let Some(auth) = auth {
+            builder = builder.header(header::AUTHORIZATION, auth);
+        }
+        builder.body(Body::empty()).expect("request")
+    }
+
+    /// One test rather than separate gating and logging tests,
+    /// deliberately: tracing caches callsite interest process-wide, so a
+    /// test that hits the rejection path with no subscriber installed can
+    /// poison the interest cache for the one that captures logs. Keeping
+    /// every exercise of the middleware under the capturing subscriber
+    /// makes the log assertions deterministic.
+    #[tokio::test]
+    async fn gates_every_route_and_never_logs_the_token() {
+        #[derive(Clone, Default)]
+        struct Capture(Arc<Mutex<Vec<u8>>>);
+        impl std::io::Write for Capture {
+            fn write(&mut self, buf: &[u8]) -> std::io::Result<usize> {
+                self.0.lock().unwrap().extend_from_slice(buf);
+                Ok(buf.len())
+            }
+            fn flush(&mut self) -> std::io::Result<()> {
+                Ok(())
+            }
+        }
+        impl<'a> tracing_subscriber::fmt::MakeWriter<'a> for Capture {
+            type Writer = Capture;
+            fn make_writer(&'a self) -> Capture {
+                self.clone()
+            }
+        }
+
+        let capture = Capture::default();
+        let subscriber = tracing_subscriber::fmt()
+            .with_max_level(tracing::Level::TRACE)
+            .with_writer(capture.clone())
+            .finish();
+        let _guard = tracing::subscriber::set_default(subscriber);
+
+        let dir = tempfile::tempdir().expect("tempdir");
+        let token = generate_token();
+        let router = guarded_router(state_with_token(dir.path(), &token));
+
+        // No header, wrong token, wrong scheme: 401 everywhere, including
+        // paths that don't exist -- a scanner learns nothing.
+        for (path, auth) in [
+            ("/probe", None),
+            ("/probe", Some("Bearer wrong".to_string())),
+            ("/probe", Some(format!("Basic {token}"))),
+            ("/no-such-route", None),
+        ] {
+            let response = router
+                .clone()
+                .oneshot(request(path, auth.as_deref()))
+                .await
+                .expect("response");
+            assert_eq!(
+                response.status(),
+                StatusCode::UNAUTHORIZED,
+                "{path} {auth:?}"
+            );
+        }
+
+        let ok = router
+            .clone()
+            .oneshot(request("/probe", Some(&format!("Bearer {token}"))))
+            .await
+            .expect("response");
+        assert_eq!(ok.status(), StatusCode::OK);
+
+        // The tripwire that keeps a future logging change (e.g. logging
+        // request headers) from silently leaking credentials.
+        let logged = String::from_utf8_lossy(&capture.0.lock().unwrap()).into_owned();
+        assert!(
+            !logged.contains(&token),
+            "the bearer token leaked into the logs: {logged}"
+        );
+        // The rejections themselves do get logged (that's the point).
+        assert!(logged.contains("missing or invalid bearer token"));
+    }
+}
diff --git a/server/src/build-progress.sh b/server/src/build-progress.sh
new file mode 100755
index 0000000..90cbd59
--- /dev/null
+++ b/server/src/build-progress.sh
@@ -0,0 +1,83 @@
+#!/bin/sh
+# Runs a build command and reports its progress to Dev Updater, for the
+# build systems that cannot be asked for it directly.
+#
+#   <this> gradle ./gradlew :androidApp:assembleDebug
+#
+# Dev Updater draws a real bar from `@@progress done/total` lines on a
+# build's output, and ignores anything that is not exactly that shape. Most
+# tools can be made to report their own counts -- cargo does, once
+# `CARGO_TERM_PROGRESS_WHEN=always` is set, which the server sets for every
+# build it runs, so a cargo build needs nothing and must not be wrapped in
+# this. Gradle is the one that cannot, and this is why this file exists
+# rather than the knowledge being copied into each project's build script.
+#
+# The server writes this out and points `$DEV_UPDATER_PROGRESS` at it, so a
+# project's script uses it when it is being built by Dev Updater and runs
+# the command plainly when somebody is building by hand:
+#
+#   if [ -x "${DEV_UPDATER_PROGRESS:-}" ]; then
+#       "$DEV_UPDATER_PROGRESS" gradle ./gradlew :androidApp:assembleDebug
+#   else
+#       ./gradlew :androidApp:assembleDebug
+#   fi
+#
+# Exits with the build's own status, which is the thing that must not be
+# lost: a wrapper that reports a failed build as a success is worse than no
+# wrapper.
+set -eu
+
+FLAVOUR="${1:?usage: $0 <gradle> <command...>}"
+shift
+
+case "$FLAVOUR" in
+    gradle)
+        # Gradle cannot be asked for a count directly. An init script using
+        # taskGraph.afterTask is rejected outright by the configuration
+        # cache, and whenReady never fires on a cache hit. Its rich console
+        # does print a percentage, but only as a full-screen redraw --
+        # cursor movement, erases and IDLE lines -- which would make the
+        # output unreadable, and the output is the other half of what the
+        # card shows.
+        #
+        # --dry-run costs about a second, is cache-friendly, and prints one
+        # ":task SKIPPED" line per task the real build will run, which is
+        # exactly the total. The build then prints one "> Task :x" line per
+        # task as it goes, so counting those against it is the whole
+        # mechanism.
+        #
+        # Task count is not time -- compileDebugKotlin and dexBuilder are
+        # most of the wall clock -- so the bar moves unevenly. It is still
+        # counted work rather than a guess at how long last time took.
+        TASKS=$("$@" --dry-run --console=plain 2>/dev/null |
+            grep -c '^:[A-Za-z:]* SKIPPED' || true)
+        if [ "${TASKS:-0}" -le 0 ]; then
+            # No total, so no honest bar. The build still runs and still
+            # prints; the card shows a bar that only spins, which is what
+            # not knowing looks like.
+            exec "$@"
+        fi
+        echo "@@progress 0/$TASKS"
+        "$@" --console=plain 2>&1 | (
+            DONE=0
+            while IFS= read -r line; do
+                echo "$line"
+                case "$line" in
+                    "> Task "*)
+                        DONE=$((DONE + 1))
+                        echo "@@progress $DONE/$TASKS"
+                        ;;
+                esac
+            done
+        )
+        # The pipeline's status is the subshell's, not the build's, so ask
+        # again rather than reporting a failed build as a success. It is up
+        # to date by now, so this costs a second.
+        exec "$@" --console=plain >/dev/null
+        ;;
+    *)
+        echo "$0: unknown build system '$FLAVOUR'" >&2
+        echo "cargo reports its own progress and needs no wrapper." >&2
+        exit 2
+        ;;
+esac
diff --git a/server/src/build_state.rs b/server/src/build_state.rs
new file mode 100644
index 0000000..0b4535b
--- /dev/null
+++ b/server/src/build_state.rs
@@ -0,0 +1,1485 @@
+//! Runs an app's optional on-demand build step and tracks it, so the phone
+//! can be shown "building..." rather than silently downloading a stale APK.
+//!
+//! Nothing here knows what any particular build does: it is a command from
+//! the config plus a two-file staleness rule (see
+//! `crate::config::Component`). The build runs in the background and
+//! the routes answer immediately either way, so a multi-minute build never
+//! holds a request open past a phone's read timeout.
+
+use std::collections::{HashMap, VecDeque};
+use std::path::PathBuf;
+use std::process::Command;
+use std::sync::{Arc, Mutex};
+use std::time::Instant;
+
+use serde::Serialize;
+
+use crate::config::Component;
+
+/// What a build has got through, in whatever it counts in.
+#[derive(Clone, Copy, Serialize)]
+#[serde(rename_all = "camelCase")]
+pub struct Progress {
+    pub done: u64,
+    pub total: u64,
+}
+
+/// The marker a build prints to report progress, at the start of a line.
+///
+/// Recognised on every build's output rather than switched on by a config
+/// key: a build opts in by printing it, and one more `starts_with` per line
+/// is not worth a field, an acceptance, and a manifest flag to avoid.
+/// Nothing here knows what the numbers count -- Gradle tasks, files,
+/// anything -- only that the second is the whole of it.
+const PROGRESS_MARKER: &str = "@@progress ";
+
+/// What is known about whether a component's build is current.
+///
+/// Three states rather than a boolean, because "we cannot tell" must not
+/// share a value with either answer. A project this server has never
+/// built, one outside git, and one with uncommitted work in its directory
+/// are all *unknown* -- and an unknown drawn as `Current` would be the
+/// exact failure this was added to stop.
+#[derive(Clone, Copy, PartialEq, Eq, Debug, Serialize)]
+#[serde(rename_all = "camelCase")]
+pub enum Freshness {
+    /// Built from the commit its own directory is on.
+    Current,
+    /// Its directory has moved past the commit it was built from.
+    Behind,
+    /// Never built here, no checkout to compare against, or uncommitted
+    /// work in its directory.
+    Unknown,
+}
+
+/// How a finished component reports the commit it was built from.
+///
+/// A callback rather than a handle to the app list: `BuildState` lives
+/// *inside* that list, so holding it would be a cycle, and the single fact
+/// a build needs to report upward does not justify one. The route that
+/// starts a build has the list and supplies this.
+pub type RecordBuilt = Arc<dyn Fn(&str, String) + Send + Sync>;
+
+/// The handles a build shares with the rest of the server, as opposed to
+/// the project configuration it is built from.
+///
+/// Grouped because they travel together and because they are a different
+/// kind of thing from the rest of the arguments: everything else describes
+/// *this project*, while these two are the server's own state that a build
+/// happens to touch -- a pull marking a checkout current, and an exec
+/// waiting for a download.
+#[derive(Clone)]
+pub struct Shared {
+    pub remote_checks: crate::git::RemoteChecks,
+    pub downloads: Arc<crate::restart::Downloads>,
+}
+
+#[derive(Default)]
+struct Inner {
+    /// What each component was last built from, by component name.
+    ///
+    /// Seeded from the config at construction and updated as a run
+    /// records. Kept here rather than read back off `components` because
+    /// this state is deliberately *carried across* a config write -- see
+    /// [`BuildState::matches`] -- so its own copy of the components goes
+    /// stale the moment a build records against it.
+    built_from: HashMap<String, String>,
+    building: bool,
+    /// When the current run began, for the elapsed time shown while it is
+    /// still going.
+    started: Option<Instant>,
+    /// What the *project* is doing: fetching, pulling. Work belonging to
+    /// one component is in `runs` instead, because that is where the card
+    /// shows it -- a progress bar under the whole project could only ever
+    /// say that something, somewhere, was happening.
+    phase: Option<String>,
+    /// One entry per component the current run has reached, in the order
+    /// it reached them.
+    runs: Vec<ComponentRun>,
+    /// The failure from the last completed run, cleared when a new one
+    /// starts. Kept rather than logged-and-dropped because the phone is
+    /// where this is being driven from and usually has no access to the
+    /// server's log.
+    error: Option<String>,
+    /// The component whose step produced that failure.
+    ///
+    /// Kept beside the message so the card can open the right log without
+    /// guessing: a component that failed to build wants its build log,
+    /// while every other component still wants the runtime one.
+    failed: Option<String>,
+}
+
+/// What one component's part of the build is doing, or did.
+///
+/// Per component rather than one set of numbers for the whole project,
+/// because that is how it is read: a progress bar and the lines scrolling
+/// under it belong to the thing being built, and shown under the project
+/// they could only say that *something* was happening. It is also what
+/// lets two components build at once without their output interleaving
+/// into one stream.
+struct ComponentRun {
+    name: String,
+    /// What it is doing now -- building, installing, restarting -- or
+    /// `None` once it has finished.
+    step: Option<String>,
+    started: Instant,
+    /// Filled in when the component finishes, so the card can keep showing
+    /// how long it took.
+    took_ms: Option<u64>,
+    /// Steps done and steps total, when the running command reports them.
+    progress: Option<(u64, u64)>,
+    /// The tail of this component's output. Bounded because this is a
+    /// progress display, not a log file -- `crate::logs` has the whole of
+    /// it, per component, on disk.
+    log: VecDeque<String>,
+    error: Option<String>,
+}
+
+pub struct BuildState {
+    /// What this project produces, in the order it produces it. A run walks
+    /// them, and the phase names on the status are the component names, so
+    /// the card shows which one is being worked on without any new
+    /// machinery.
+    components: Vec<Component>,
+    /// Which app this is, for naming the log files a build writes. The
+    /// only thing here that needs the key; everything else is about the
+    /// project on disk.
+    key: String,
+    /// Whether the Pull button is offered. Per project rather than per
+    /// component: there is one checkout.
+    git_pull: bool,
+    project_path: PathBuf,
+    /// True for the entry that *is* this server.
+    ///
+    /// Only its `Server` component is delivered differently: that component
+    /// is this process, so restarting it means exec-ing the binary just
+    /// built (`crate::restart`) rather than asking the service script to
+    /// stop and start the code doing the asking -- which would kill the
+    /// walk partway through, with nobody left to report that it finished.
+    ///
+    /// Passed in rather than read from the declaration because no project
+    /// may claim it: a file that could would be a file that can make this
+    /// server exec an arbitrary binary.
+    is_self: bool,
+    /// Force git's remote commands onto IPv4, for the fetch a pull starts.
+    /// Beside `git_pull` and treated the same way, including in
+    /// [`Self::matches`] -- toggling it has to reach the next pull, and
+    /// the state is reused across config writes unless something says not
+    /// to.
+    git_ipv4: bool,
+    /// Shared with the list, so a pull can record that this checkout is
+    /// current instead of leaving a stale "new commits" on the card.
+    shared: Shared,
+    inner: Mutex<Inner>,
+}
+
+#[derive(Serialize)]
+#[serde(rename_all = "camelCase")]
+pub struct BuildStatus {
+    pub stale: bool,
+    pub building: bool,
+    pub error: Option<String>,
+    /// What the whole project is doing -- fetching, pulling -- absent
+    /// between runs and while the work belongs to a component instead.
+    pub phase: Option<String>,
+    /// Milliseconds since this run started.
+    pub elapsed_ms: u64,
+    /// Each component the run has reached, in the order it reached them.
+    /// The card draws each of these inside that component's own row.
+    pub components: Vec<ComponentStatus>,
+}
+
+/// One component's part of a build, as the phone sees it.
+#[derive(Serialize)]
+#[serde(rename_all = "camelCase")]
+pub struct ComponentStatus {
+    pub name: String,
+    /// What it is doing now, absent once it has finished.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub step: Option<String>,
+    /// How long it has been going, or took.
+    pub elapsed_ms: u64,
+    /// Steps done and steps total, when the running command reports them.
+    /// Absent for a command that says nothing, which is most of them --
+    /// the phone shows a bar that only spins rather than inventing a
+    /// number.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub progress: Option<Progress>,
+    /// The last few lines this component printed, oldest first.
+    pub log: Vec<String>,
+    /// Why this component's step failed, if it did.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub error: Option<String>,
+}
+
+/// Reads a progress report off a line of build output, in any of the
+/// shapes this understands.
+///
+/// Anything that isn't exactly that shape is output, not a report: a build
+/// that prints the marker with something unparseable after it has a bug
+/// worth seeing in its log rather than being silently swallowed.
+fn parse_progress(line: &str) -> Option<(u64, u64)> {
+    let line = line.trim();
+    if let Some(rest) = line.strip_prefix(PROGRESS_MARKER) {
+        let (done, total) = rest.trim().split_once('/')?;
+        return Some((done.trim().parse().ok()?, total.trim().parse().ok()?));
+    }
+    parse_cargo_progress(line)
+}
+
+/// Reads cargo's own counter: `Building [===>   ] 236/237: crate(bin)`.
+///
+/// Cargo's, not this server's arithmetic -- it is the number of units it
+/// has left to compile, which is exactly the thing a bar can honestly be
+/// drawn from. `spawn` is what makes cargo emit it into a pipe at all.
+///
+/// Anchored on the bracketed bar so that a line merely containing `12/34`
+/// is not read as progress: build output is full of numbers.
+fn parse_cargo_progress(line: &str) -> Option<(u64, u64)> {
+    let rest = line.strip_prefix("Building ")?;
+    let counts = rest.strip_prefix('[')?.split_once(']')?.1.trim();
+    // `236/237: dev-updater(bin)` -- the crate after the colon is what it
+    // is working on now, which the log line above it already said.
+    let counts = counts.split(':').next()?;
+    let (done, total) = counts.split_once('/')?;
+    Some((done.trim().parse().ok()?, total.trim().parse().ok()?))
+}
+
+/// How much command output is kept for the phone. Enough to see what a
+/// build is doing, far short of keeping a build log in memory.
+const LOG_LINES: usize = 40;
+
+/// Calls `emit` once per segment of a command's output, where a segment
+/// ends at a newline **or** a carriage return, and once more for anything
+/// left unterminated when the stream ends.
+///
+/// Both terminators, because a tool that redraws a counter in place ends
+/// its line with `\r` and no newline. Cargo does exactly this:
+///
+/// ```text
+///    Compiling dev-updater v0.1.0 (...)\n
+///     Building [=====> ] 236/237: dev-updater(bin)   \r    Finished `release` ...\n
+/// ```
+///
+/// `BufReader::lines()` splits on `\n` alone, so the count sat unread
+/// until whatever printed the next newline. On a build with many crates
+/// to compile that is the next `Compiling` line and the bar moved fine;
+/// on an incremental one -- a single dirty crate, which is what a pull
+/// produces -- it is the `Finished` line, arriving after the build is
+/// over. So the card showed nothing to measure for exactly the builds
+/// somebody watches, and it looked like a build system that could not
+/// report progress rather than a report being held.
+///
+/// A `\r\n` pair ends a segment and then opens an empty one, which the
+/// caller drops along with every other blank segment.
+fn read_segments(pipe: impl std::io::Read, mut emit: impl FnMut(&str)) {
+    use std::io::BufRead;
+
+    let mut reader = std::io::BufReader::new(pipe);
+    // Held across fills, because a terminator is what ends a segment and
+    // a read can stop anywhere -- including inside a multi-byte
+    // character, which is safe here only because both terminators are
+    // ASCII and so cannot appear inside one.
+    let mut pending: Vec<u8> = Vec::new();
+    loop {
+        // Copied out so the borrow of the reader ends before `consume`.
+        let chunk = match reader.fill_buf() {
+            Ok([]) => break,
+            Ok(bytes) => bytes.to_vec(),
+            // The process's exit status is what says whether the build
+            // worked; a pipe that cannot be read further is just the end
+            // of what there is to show.
+            Err(_) => break,
+        };
+        reader.consume(chunk.len());
+        for byte in chunk {
+            if byte == b'\n' || byte == b'\r' {
+                emit(&String::from_utf8_lossy(&pending));
+                pending.clear();
+            } else {
+                pending.push(byte);
+            }
+        }
+    }
+    if !pending.is_empty() {
+        emit(&String::from_utf8_lossy(&pending));
+    }
+}
+
+impl BuildState {
+    pub fn new(
+        key: String,
+        components: Vec<Component>,
+        git_pull: bool,
+        git_ipv4: bool,
+        project_path: PathBuf,
+        shared: Shared,
+        is_self: bool,
+    ) -> Arc<Self> {
+        let built_from = components
+            .iter()
+            .filter_map(|component| {
+                Some((
+                    component.name().to_string(),
+                    component.built_from()?.to_string(),
+                ))
+            })
+            .collect();
+        Arc::new(Self {
+            key,
+            inner: Mutex::new(Inner {
+                built_from,
+                ..Inner::default()
+            }),
+            components,
+            git_pull,
+            git_ipv4,
+            project_path,
+            shared,
+            is_self,
+        })
+    }
+
+    /// Whether this state was built from the same configuration, i.e.
+    /// whether it can be carried across a config reload -- see
+    /// `crate::registry::build_entries`.
+    /// Compared by *declaration*, not by full equality. Recording what a
+    /// build was made from writes the config, which rebuilds the entry
+    /// list -- and if that counted as a different configuration the state
+    /// would be replaced mid-walk, leaving the phone polling a fresh
+    /// `BuildState` that reports nothing is building. The same is true of
+    /// the package a download reads back.
+    pub fn matches(&self, components: &[Component], git_pull: bool, git_ipv4: bool) -> bool {
+        self.git_pull == git_pull
+            && self.git_ipv4 == git_ipv4
+            && self.components.len() == components.len()
+            && std::iter::zip(&self.components, components)
+                .all(|(mine, theirs)| mine.same_declaration(theirs))
+    }
+
+    /// Idempotent: kicks off the build in the background if this app is
+    /// stale and no build is already running, a no-op otherwise. Safe for
+    /// the phone to call on every download, which is exactly what it does.
+    pub fn trigger_if_needed(self: &Arc<Self>, record: RecordBuilt) {
+        // Before the lock, not inside it -- see `is_stale`.
+        if self.is_stale() {
+            self.build_now(record);
+        }
+    }
+
+    /// Builds whether or not anything looks stale, for somebody who asked.
+    ///
+    /// The staleness rules exist to keep a *download* from rebuilding the
+    /// world; they have no business overruling a person who pressed a
+    /// button. This is also what makes the freshness signal reachable at
+    /// all: the commit a build was made from is only recorded by a build
+    /// that runs here, so a project already current with its checkout
+    /// could never record one and would report unknown for ever.
+    ///
+    /// Still idempotent -- while one run is going, another does nothing.
+    pub fn build_now(self: &Arc<Self>, record: RecordBuilt) {
+        {
+            let mut inner = self.inner.lock().unwrap();
+            if inner.building {
+                return;
+            }
+            inner.building = true;
+            inner.error = None;
+            inner.failed = None;
+            inner.started = Some(Instant::now());
+            inner.runs.clear();
+        }
+
+        let this = Arc::clone(self);
+        tokio::task::spawn_blocking(move || {
+            this.run_build(&record);
+        });
+    }
+
+    /// Whether any component is behind. Per project, because a run is per
+    /// project: one component being stale is reason enough to walk the
+    /// whole list, and each component's own command is skipped if it has
+    /// nothing to do.
+    fn is_stale(&self) -> bool {
+        // Read once, here, and passed down. `component_is_stale` must not
+        // take this lock itself: it is reached from callers that already
+        // hold it, and a `std::sync::Mutex` is not reentrant, so doing so
+        // is a deadlock rather than a slow path.
+        let built_from = self.inner.lock().unwrap().built_from.clone();
+        self.components
+            .iter()
+            .any(|component| self.component_is_stale(component, &built_from))
+    }
+
+    /// What can be said about this component's build, for the card.
+    ///
+    /// Deliberately not the same question as [`Self::component_is_stale`],
+    /// which decides whether to *run* a build. Uncommitted work makes the
+    /// comparison unreliable, so it reports unknown -- but it must not
+    /// trigger a rebuild: somebody editing on the build machine is
+    /// building it themselves, and this server's job in that state is to
+    /// notice the new output rather than to produce one. Rebuilding
+    /// uncommitted work and sending it to a phone would also be a
+    /// surprising thing to do with work its author has not committed.
+    pub fn freshness(&self, component: &Component) -> Freshness {
+        let built = self
+            .inner
+            .lock()
+            .unwrap()
+            .built_from
+            .get(component.name())
+            .cloned();
+        let Some(built) = built else {
+            return Freshness::Unknown;
+        };
+        if crate::git::subtree_dirty(&self.project_path, component.cwd()) != Some(false) {
+            return Freshness::Unknown;
+        }
+        match crate::git::subtree_head(&self.project_path, component.cwd()) {
+            Some(current) if current == built => Freshness::Current,
+            Some(_) => Freshness::Behind,
+            None => Freshness::Unknown,
+        }
+    }
+
+    fn component_is_stale(
+        &self,
+        component: &Component,
+        built_from: &HashMap<String, String>,
+    ) -> bool {
+        if component.build().is_empty() {
+            return false;
+        }
+        // Nothing built at all is as far behind as an output gets, and it
+        // is checked before any rule rather than after: a `staleWhen`
+        // compares two files *inside* a build, so on a project that has
+        // never been built it reports not-stale and would leave the first
+        // build impossible to trigger -- which a project can be added
+        // before having done.
+        if crate::discover::find_apks(&self.project_path).is_empty() {
+            return true;
+        }
+        // Behind the checkout: this component was built from a commit
+        // that its own directory has since moved past. The case nothing
+        // used to catch -- a pull that fetched but did not build, because
+        // the declaration was waiting to be accepted or because the walk
+        // failed earlier -- left an output older than the commits it
+        // should have come from, and the card had no reason to doubt it.
+        //
+        // Both halves must be known. No recorded commit means this server
+        // has never built it, and an unreadable checkout means it cannot
+        // tell; neither is evidence of staleness, and announcing one would
+        // make every project built before this existed demand a rebuild.
+        if let Some(built) = built_from.get(component.name())
+            && crate::git::subtree_head(&self.project_path, component.cwd())
+                .is_some_and(|current| &current != built)
+        {
+            return true;
+        }
+        // Deliberately not the other way round: a matching commit does not
+        // prove currency, because a `staleWhen` rule compares two build
+        // outputs and can be behind for reasons no commit explains.
+        component
+            .stale_when()
+            .is_some_and(|rule| rule.is_stale(&self.project_path))
+    }
+
+    /// Fetches, fast-forwards if there is anything to take, and builds --
+    /// the Pull button, which acts on the build machine rather than the
+    /// phone. Idempotent in the same way as [`Self::trigger_if_needed`]:
+    /// while one is running, another does nothing.
+    ///
+    /// Building happens when the pull actually moved the branch, or when
+    /// the configured staleness rule says the output is behind anyway; a
+    /// pull that finds nothing new therefore costs nothing.
+    ///
+    /// `may_build` answers "may the project's command run?" -- false when
+    /// it is asking for a build step nobody has accepted (see
+    /// `AppEntry::pending_declaration`), in which case this pulls and
+    /// stops. The decision belongs to the caller because it is about the
+    /// project's config file, which is not this module's business -- here
+    /// it is simply "don't run the command".
+    ///
+    /// It is a closure rather than a bool because of *when* it has to be
+    /// asked: **after the fast-forward, not before it.** The declaration
+    /// lives in the checkout, so the pull is the one thing that changes
+    /// the answer, and a bool computed at the call site is necessarily the
+    /// answer for the commit being replaced. Passing one meant a pull
+    /// whose new commits changed the declaration built anyway -- the card
+    /// went off and updated the app instead of stopping to ask, which is
+    /// the single case this gate exists for.
+    pub fn pull_and_build(
+        self: &Arc<Self>,
+        may_build: impl Fn() -> bool + Send + 'static,
+        record: RecordBuilt,
+    ) {
+        {
+            let mut inner = self.inner.lock().unwrap();
+            if inner.building {
+                return;
+            }
+            inner.building = true;
+            inner.error = None;
+            inner.failed = None;
+            inner.started = Some(Instant::now());
+            inner.runs.clear();
+        }
+
+        let this = Arc::clone(self);
+        tokio::task::spawn_blocking(move || {
+            let outcome = this.pull();
+            match outcome {
+                Err(message) => {
+                    tracing::error!("pull failed: {message}");
+                    // No component: a pull fails before the walk starts.
+                    this.finish(Some(message), None);
+                }
+                Ok(pulled) => {
+                    // Nothing configured to build, or nothing allowed to:
+                    // the pull was the whole job, and reporting success is
+                    // all that is left.
+                    // `may_build()` is called here, with the pulled
+                    // declaration on disk, for the reason in the doc
+                    // comment above.
+                    if !may_build() || !this.has_command() || !(pulled || this.is_stale()) {
+                        this.finish(None, None);
+                    } else {
+                        this.run_build(&record);
+                    }
+                }
+            }
+        });
+    }
+
+    /// Fetches and fast-forwards, reporting whether anything arrived.
+    fn pull(&self) -> Result<bool, String> {
+        self.begin_project("fetching");
+        crate::git::fetch(&self.project_path, self.git_ipv4)?;
+        // Counted after the fetch, from refs now on disk: this is the one
+        // place that has the objects to count against.
+        let behind = crate::git::behind(&self.project_path);
+        if behind == 0 {
+            return Ok(false);
+        }
+        self.begin_project("pulling");
+        crate::git::pull(&self.project_path, self.git_ipv4)?;
+        tracing::info!(
+            "pulled {behind} commit(s) into {}",
+            self.project_path.display()
+        );
+        // The card should stop offering what was just taken, rather than
+        // waiting out the check interval to notice.
+        self.shared.remote_checks.mark_current(&self.project_path);
+        Ok(true)
+    }
+
+    /// Walks the components in declared order, stopping at the first
+    /// failure.
+    ///
+    /// Stopping is the point of the order: a project whose server must be
+    /// current before its APK is served declares them that way round, and a
+    /// failed server build must not be followed by an APK build that would
+    /// hand the phone half of a matched pair. What already succeeded stays
+    /// -- there is nothing to roll back a build to.
+    ///
+    /// Each component's name is the phase name, so the card says which one
+    /// is being worked on without needing anything new to carry it.
+    fn run_build(self: &Arc<Self>, record: &RecordBuilt) {
+        // Every component at once. They are independent -- a Rust build and
+        // a Gradle build share nothing but the machine -- and measured on
+        // this one, running them together takes about three quarters of the
+        // time running them in turn does. The saving only appears when more
+        // than one has work to do, which is the case a pull produces.
+        //
+        // What it costs is that a failure no longer stops the others. They
+        // are already running by the time it happens, so stopping them
+        // would mean killing work that is probably fine; the first failure
+        // in declaration order is the one reported, which is what a walk in
+        // that order would have said.
+        let mut running = Vec::new();
+        for (index, component) in self.components.iter().enumerate() {
+            if component.build().is_empty() {
+                continue;
+            }
+            let this = Arc::clone(self);
+            let record = Arc::clone(record);
+            running.push((
+                component.name().to_string(),
+                std::thread::spawn(move || this.build_indexed(index, &record)),
+            ));
+        }
+
+        let mut error = None;
+        // Which component's step ended the walk, so the card can open that
+        // component's *build* log rather than its runtime one.
+        let mut failed = None;
+        // Set by the component that is this process; acted on once every
+        // other component has finished and the whole run is reported. See
+        // `is_self`.
+        let mut restart_self = false;
+        for (name, handle) in running {
+            let outcome = match handle.join() {
+                Ok(outcome) => outcome,
+                // A panic in a build thread is this server's bug, not the
+                // project's, but the card still has to say something --
+                // silence would read as a build that simply did nothing.
+                Err(_) => Err(format!("building {name} panicked -- see this server's log")),
+            };
+            match outcome {
+                Ok(is_self) => restart_self |= is_self,
+                Err(message) if error.is_none() => {
+                    error = Some(message);
+                    failed = Some(name);
+                }
+                Err(_) => {}
+            }
+        }
+
+        let mut restart = error.is_none() && restart_self;
+        // A build with nothing to do leaves the binary alone, and exec-ing
+        // into the same file would drop the phone's connection to deliver
+        // the build it already had.
+        if restart && crate::restart::binary_unchanged() {
+            tracing::info!(
+                "the build left this server's binary untouched, so it is not restarting"
+            );
+            restart = false;
+        }
+        self.finish(error, failed);
+        if restart {
+            // Answered and finished first, so whatever happens next cannot
+            // take the report away from whoever asked for it.
+            crate::restart::deferred(self.handover(), Arc::clone(&self.shared.downloads));
+        }
+    }
+
+    /// Builds the component at `index`, and closes its entry whatever
+    /// happens.
+    ///
+    /// By index because the components belong to this state, which the
+    /// thread holds an `Arc` to -- borrowing one across a thread boundary
+    /// would tie the thread's lifetime to this call's.
+    ///
+    /// Answers whether that component is this server itself, which is the
+    /// one thing the caller has to act on after every thread is done.
+    fn build_indexed(self: &Arc<Self>, index: usize, record: &RecordBuilt) -> Result<bool, String> {
+        let component = &self.components[index];
+        let outcome = self.build_component(component, record);
+        // One place, so no exit from `build_component` can leave a
+        // component looking like it is still working.
+        self.finish_component(component.name(), outcome.as_ref().err().cloned());
+        outcome
+    }
+
+    /// Builds one component and delivers it, or says why it could not.
+    ///
+    /// One function rather than the walk's body inline, so that "the build
+    /// stopped here" is recorded in exactly one place -- every failure
+    /// leaves by the same return, and the caller names the component
+    /// without each site having to remember to.
+    fn build_component(
+        self: &Arc<Self>,
+        component: &Component,
+        record: &RecordBuilt,
+    ) -> Result<bool, String> {
+        self.begin_component(component.name(), "building");
+        if let Err(message) = self.run_streaming(component) {
+            tracing::error!("{} failed: {message}", component.name());
+            return Err(message);
+        }
+        // Recorded per component and only on success, so a walk that
+        // fails partway credits what actually built and nothing else:
+        // if the APK fails after the server succeeded, the server is
+        // current and the APK is not. Scoped to the component's own
+        // directory, so a commit touching only the app does not make
+        // the server look stale.
+        //
+        // A checkout that cannot be read records nothing, which reads
+        // as unknown rather than as current -- see `component_is_stale`.
+        if let Some(sha) = crate::git::subtree_head(&self.project_path, component.cwd()) {
+            self.inner
+                .lock()
+                .unwrap()
+                .built_from
+                .insert(component.name().to_string(), sha.clone());
+            record(component.name(), sha);
+        }
+
+        // Delivering a server is restarting it, so it happens here rather
+        // than at the end: a later component's failure should not leave a
+        // built-but-not-restarted server behind.
+        let Component::Server { name, .. } = component else {
+            return Ok(false);
+        };
+        let Some(service) = crate::service::driver(&self.key, component) else {
+            return Ok(false);
+        };
+        let service = &service;
+
+        // What the manager says decides both halves: whether the unit is
+        // worth refreshing, and whether anything should be restarted
+        // afterwards.
+        let installed = match crate::service::status(service, &self.project_path, component.cwd()) {
+            Ok(state) => Some(state),
+            // Not a build failure: the build worked, and whether the
+            // service came back is a separate thing the card reports on
+            // its own.
+            Err(err) => {
+                tracing::warn!("could not ask {name} how it is running: {err}");
+                None
+            }
+        };
+
+        // Refresh the unit whenever there is one, for either kind of
+        // server. It is generated from a script in the repository, so a
+        // pull can change how the service is *defined* and not only what
+        // it runs -- and that change has to land even when the build
+        // produced an identical binary, which is the ordinary case for a
+        // pull that only touched the service script. `start.sh` has
+        // always reinstalled every run for exactly this reason.
+        //
+        // Safe on a running service: writing the unit and reloading stops
+        // nothing.
+        if installed.is_some_and(|state| state != crate::service::ServiceState::NotInstalled) {
+            self.begin_component(name, "installing");
+            if let Err(message) =
+                self.run_streaming_command(name, service, component.cwd(), &["install"], None)
+            {
+                tracing::error!("installing {name} failed: {message}");
+                return Err(message);
+            }
+        }
+
+        if self.is_self {
+            // This one is the process doing the walking, so its restart
+            // waits until every other component is done and the result is
+            // reported. See the end of `run_build`.
+            return Ok(true);
+        }
+        if installed == Some(crate::service::ServiceState::Running) {
+            self.begin_component(name, "restarting");
+            if let Err(message) =
+                self.run_streaming_command(name, service, component.cwd(), &["restart"], None)
+            {
+                tracing::error!("restarting {name} failed: {message}");
+                return Err(message);
+            }
+        } else if let Some(state) = installed {
+            tracing::info!("{name} is {state:?}, so it was not started");
+        }
+        Ok(false)
+    }
+
+    /// How this server should be restarted, if it declares a way.
+    ///
+    /// Only ever asked for this server's own project, where exactly one
+    /// `Server` component is this process.
+    fn handover(&self) -> Option<crate::restart::Handover> {
+        let (component, script) = self.components.iter().find_map(|component| {
+            matches!(component, Component::Server { .. })
+                .then(|| crate::service::driver(&self.key, component))
+                .flatten()
+                .map(|script| (component, script))
+        })?;
+        Some(crate::restart::Handover {
+            script,
+            project: self.project_path.clone(),
+            cwd: component.cwd().map(std::path::Path::to_path_buf),
+        })
+    }
+
+    /// Runs the build command, recording its output as it arrives rather
+    /// than collecting it at the end.
+    ///
+    /// A build is the long part of a pull, and a phone showing nothing but
+    /// a spinner for a minute is indistinguishable from one that is stuck.
+    /// Reading the pipes as they fill also means a chatty build can't fill
+    /// a pipe buffer and block itself, which collecting output at the end
+    /// risks for anything verbose.
+    fn run_streaming(self: &Arc<Self>, component: &Component) -> Result<(), String> {
+        // Opened per component and rotated here, so a failed build is
+        // still readable after this server restarts -- the tail kept in
+        // memory for the progress display dies with the process, and a
+        // build that brought the server down is exactly the one somebody
+        // wants to read afterwards.
+        let log = crate::logs::open_build_log(&self.key, component.name())
+            .map(|file| Arc::new(Mutex::new(file)));
+        self.run_streaming_command(
+            component.name(),
+            component.build(),
+            component.cwd(),
+            &[],
+            log,
+        )
+    }
+
+    fn run_streaming_command(
+        self: &Arc<Self>,
+        component: &str,
+        command: &crate::config::Command,
+        cwd: Option<&std::path::Path>,
+        extra: &[&str],
+        log: Option<Arc<Mutex<std::fs::File>>>,
+    ) -> Result<(), String> {
+        let mut child = self
+            .spawn(command, cwd, extra)?
+            .stdout(std::process::Stdio::piped())
+            .stderr(std::process::Stdio::piped())
+            .spawn()
+            .map_err(|err| format!("failed to start the build: {err}"))?;
+
+        // Both pipes, on separate threads: whichever the build writes to,
+        // waiting on only one of them would deadlock when the other fills.
+        let mut readers = Vec::new();
+        for pipe in [
+            child
+                .stdout
+                .take()
+                .map(|out| Box::new(out) as Box<dyn std::io::Read + Send>),
+            child
+                .stderr
+                .take()
+                .map(|err| Box::new(err) as Box<dyn std::io::Read + Send>),
+        ]
+        .into_iter()
+        .flatten()
+        {
+            let state = Arc::clone(self);
+            let log = log.clone();
+            // Owned per reader thread, because the line it routes has to
+            // reach the component that printed it and the thread outlives
+            // this borrow.
+            let owned = component.to_string();
+            readers.push(std::thread::spawn(move || {
+                read_segments(pipe, |segment| {
+                    let segment = segment.trim_end();
+                    if segment.is_empty() {
+                        return;
+                    }
+                    // The file gets everything, including the progress
+                    // markers: it is the record of what the command
+                    // actually printed, not the display. One segment per
+                    // line, which is already what a wrapper emitting
+                    // `@@progress` produces, and what keeps a line from
+                    // one pipe out of the middle of a line from the other.
+                    if let Some(log) = &log {
+                        use std::io::Write;
+                        let _ = writeln!(log.lock().unwrap(), "{segment}");
+                    }
+                    match parse_progress(segment) {
+                        // Machinery, not output: it would only push the
+                        // build's own last line out of the display.
+                        Some(progress) => state.set_progress(&owned, progress),
+                        None => state.log_line(&owned, segment.to_string()),
+                    }
+                });
+            }));
+        }
+
+        let status = child
+            .wait()
+            .map_err(|err| format!("waiting on the build: {err}"))?;
+        for reader in readers {
+            let _ = reader.join();
+        }
+
+        if status.success() {
+            return Ok(());
+        }
+        // The tail is what a failing build explains itself in, and it is
+        // already here rather than needing to be collected separately.
+        let tail: Vec<String> = self
+            .inner
+            .lock()
+            .unwrap()
+            .runs
+            .iter()
+            .find(|run| run.name == component)
+            .map(|run| run.log.iter().cloned().collect())
+            .unwrap_or_default();
+        Err(format!(
+            "the build step failed ({status}):\n{}",
+            truncate_tail(&tail.join("\n"), 2000)
+        ))
+    }
+
+    /// The command to run, configured but not started.
+    fn spawn(
+        &self,
+        command: &crate::config::Command,
+        cwd: Option<&std::path::Path>,
+        extra: &[&str],
+    ) -> Result<Command, String> {
+        let mut process = command.to_process(&self.project_path, cwd, extra)?;
+        // Cargo hides its progress counter unless it is talking to a
+        // terminal, and it is talking to a pipe. Asked for it explicitly,
+        // it prints `Building [===>  ] 236/237: crate` -- counts it worked
+        // out itself, which is the only kind this shows. Set here rather
+        // than asked of each project, because a build that happens to be
+        // cargo should not have to know that it is being watched, and
+        // because a project could otherwise only offer this by
+        // reimplementing it.
+        //
+        // Harmless to anything that is not cargo: an unread variable.
+        // Width fixed so the bar is not sized against a terminal there
+        // isn't; nothing reads the bar itself, only the numbers after it.
+        process.env("CARGO_TERM_PROGRESS_WHEN", "always");
+        process.env("CARGO_TERM_PROGRESS_WIDTH", "100");
+        // For the build systems that cannot be asked, a wrapper this
+        // server ships. Handed over as a path rather than expected on
+        // PATH, and absent when a person runs the same script by hand --
+        // which is why a script tests for it rather than depending on it.
+        // See `crate::shipped`.
+        process.env("DEV_UPDATER_PROGRESS", crate::shipped::build_progress());
+        Ok(process)
+    }
+
+    /// Marks the start of a step, closing the previous one with its
+    /// duration so the phone can show where the time went.
+    /// Marks what the *project* is doing. Only fetching and pulling: the
+    /// rest belongs to a component.
+    fn begin_project(&self, name: &str) {
+        self.inner.lock().unwrap().phase = Some(name.to_string());
+    }
+
+    /// Marks one component as doing `step`, starting its entry if this is
+    /// the first thing it has done this run.
+    fn begin_component(&self, component: &str, step: &str) {
+        let mut inner = self.inner.lock().unwrap();
+        // The project-wide phase is over once a component is working;
+        // otherwise the card shows "pulling" under a build.
+        inner.phase = None;
+        match inner.runs.iter_mut().find(|run| run.name == component) {
+            Some(run) => {
+                run.step = Some(step.to_string());
+                // A count belongs to the step that printed it.
+                run.progress = None;
+            }
+            None => inner.runs.push(ComponentRun {
+                name: component.to_string(),
+                step: Some(step.to_string()),
+                started: Instant::now(),
+                took_ms: None,
+                progress: None,
+                log: VecDeque::new(),
+                error: None,
+            }),
+        }
+    }
+
+    /// Marks one component as done, with why it stopped if it failed.
+    fn finish_component(&self, component: &str, error: Option<String>) {
+        let mut inner = self.inner.lock().unwrap();
+        if let Some(run) = inner.runs.iter_mut().find(|run| run.name == component) {
+            run.took_ms = Some(run.started.elapsed().as_millis() as u64);
+            run.step = None;
+            run.error = error;
+        }
+    }
+
+    /// Closes the current step and ends the run.
+    fn finish(&self, error: Option<String>, failed: Option<String>) {
+        let mut inner = self.inner.lock().unwrap();
+        inner.phase = None;
+        inner.building = false;
+        // Cleared so the elapsed time belongs to a run in progress rather
+        // than counting up forever on an idle server.
+        inner.started = None;
+        inner.error = error;
+        inner.failed = failed;
+    }
+
+    /// Records how far the running command says it has got. Replaces the
+    /// previous count rather than accumulating: the command reports its
+    /// own total, and `begin` clears this so one component's count is
+    /// never shown against the next one's work.
+    fn set_progress(&self, component: &str, progress: (u64, u64)) {
+        let mut inner = self.inner.lock().unwrap();
+        if let Some(run) = inner.runs.iter_mut().find(|run| run.name == component) {
+            run.progress = Some(progress);
+        }
+    }
+
+    /// Records one line of a component's output for its progress display,
+    /// dropping the oldest once the window is full.
+    ///
+    /// Kept against the component that printed it rather than in one
+    /// stream, so two building at once do not interleave into something
+    /// neither of them said.
+    fn log_line(&self, component: &str, line: String) {
+        let mut inner = self.inner.lock().unwrap();
+        if let Some(run) = inner.runs.iter_mut().find(|run| run.name == component) {
+            if run.log.len() == LOG_LINES {
+                run.log.pop_front();
+            }
+            run.log.push_back(line);
+        }
+    }
+
+    /// Whether there is anything to run, as opposed to a checkout that
+    /// can only be pulled.
+    pub fn has_command(&self) -> bool {
+        crate::config::has_command(&self.components)
+    }
+
+    /// Whether the last completed build stopped at this component.
+    ///
+    /// The card asks so it can open that component's build log first. A
+    /// build that has not failed leaves every component answering false,
+    /// which is what makes the runtime log the ordinary default.
+    pub fn build_failed(&self, component: &str) -> bool {
+        let inner = self.inner.lock().unwrap();
+        inner.error.is_some() && inner.failed.as_deref() == Some(component)
+    }
+
+    pub fn status(&self) -> BuildStatus {
+        // Before the lock, not inside it -- see `is_stale`.
+        let stale = self.is_stale();
+        let inner = self.inner.lock().unwrap();
+        BuildStatus {
+            stale,
+            building: inner.building,
+            error: inner.error.clone(),
+            phase: inner.phase.clone(),
+            elapsed_ms: inner
+                .started
+                .map(|started| started.elapsed().as_millis() as u64)
+                .unwrap_or(0),
+            components: inner
+                .runs
+                .iter()
+                .map(|run| ComponentStatus {
+                    name: run.name.clone(),
+                    step: run.step.clone(),
+                    // Still going, or however long it took.
+                    elapsed_ms: run
+                        .took_ms
+                        .unwrap_or_else(|| run.started.elapsed().as_millis() as u64),
+                    progress: run
+                        .progress
+                        .filter(|(_, total)| *total > 0)
+                        .map(|(done, total)| Progress {
+                            done: done.min(total),
+                            total,
+                        }),
+                    log: run.log.iter().cloned().collect(),
+                    error: run.error.clone(),
+                })
+                .collect(),
+        }
+    }
+}
+
+fn truncate_tail(s: &str, max_chars: usize) -> String {
+    let char_count = s.chars().count();
+    if char_count <= max_chars {
+        s.to_string()
+    } else {
+        s.chars().skip(char_count - max_chars).collect()
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    /// Cargo's own counter, which `spawn` asks it to print into a pipe.
+    /// The numbers are cargo's; nothing here works them out.
+    #[test]
+    fn cargos_progress_counter_is_read_and_other_numbers_are_not() {
+        assert_eq!(
+            parse_progress("    Building [=====>   ] 236/237: dev-updater(bin)"),
+            Some((236, 237))
+        );
+        assert_eq!(parse_progress("   Building [] 0/12"), Some((0, 12)));
+
+        // Build output is full of numbers; only the bracketed bar means a
+        // count. A crate that happens to be called this must not move it.
+        assert_eq!(parse_progress("   Compiling foo v1.2.3 (12/34)"), None);
+        assert_eq!(parse_progress("warning: 3/4 of these are unused"), None);
+        assert_eq!(parse_progress("Building the thing 1/2"), None);
+    }
+
+    /// A project can still report its own, which is the only way a tool
+    /// with no counter of its own gets a bar.
+    #[test]
+    fn the_explicit_marker_still_wins() {
+        assert_eq!(parse_progress("@@progress 3/7"), Some((3, 7)));
+        assert_eq!(parse_progress("@@progress nonsense"), None);
+    }
+
+    use std::path::Path;
+
+    use super::*;
+
+    fn run(dir: &Path, args: &[&str]) {
+        let out = std::process::Command::new(args[0])
+            .args(&args[1..])
+            .current_dir(dir)
+            .output()
+            .expect("run");
+        assert!(
+            out.status.success(),
+            "{args:?}: {}",
+            String::from_utf8_lossy(&out.stderr)
+        );
+    }
+
+    /// One checkout producing two things, which is the shape both real
+    /// projects have: a server under `server/` and an app under `app/`.
+    fn two_component_checkout(root: &Path) -> Vec<Component> {
+        std::fs::create_dir_all(root.join("server")).expect("mkdir");
+        std::fs::create_dir_all(root.join("app/build/outputs/apk/debug")).expect("mkdir");
+        // Something for `find_apks` to see, so staleness is decided by the
+        // rules under test rather than by nothing being built.
+        std::fs::write(root.join("app/build/outputs/apk/debug/a.apk"), b"").expect("write");
+        std::fs::write(root.join("server/main.rs"), "one").expect("write");
+        std::fs::write(root.join("app/main.kt"), "one").expect("write");
+        for args in [
+            &["git", "init", "-q", "-b", "main"][..],
+            &["git", "config", "user.email", "t@example.com"],
+            &["git", "config", "user.name", "Test"],
+            &["git", "add", "-A"],
+            &["git", "commit", "-qm", "one"],
+        ] {
+            run(root, args);
+        }
+        vec![
+            Component::Server {
+                name: "backend".to_string(),
+                build: crate::config::Command::from_line("true"),
+                cwd: Some(PathBuf::from("server")),
+                stale_when: None,
+                service: None,
+                built_from: None,
+            },
+            Component::Apk {
+                name: "app".to_string(),
+                build: crate::config::Command::from_line("true"),
+                cwd: Some(PathBuf::from("app")),
+                stale_when: None,
+                strip: false,
+                package: None,
+                built_from: None,
+            },
+        ]
+    }
+
+    /// A pull that brings a changed declaration must stop, not build.
+    ///
+    /// The gate answers "may this project's command run?", and the
+    /// declaration it reads lives in the checkout -- so the pull is the
+    /// one thing that changes the answer. Asked before the fast-forward
+    /// it necessarily reports on the commit being replaced, which is how
+    /// a card went off and updated the app instead of stopping to ask.
+    /// Hence a closure: this holds the *moment* it is called.
+    #[tokio::test]
+    async fn a_pull_that_changes_the_declaration_does_not_build() {
+        let dir = tempfile::tempdir().expect("tempdir");
+        let origin = dir.path().join("origin");
+        std::fs::create_dir_all(&origin).expect("mkdir");
+        let declare =
+            |command: &str| format!("components: [Apk(name: \"app\", build: \"{command}\")],\n");
+        std::fs::write(
+            origin.join(crate::config::PROJECT_CONFIG_FILE),
+            declare("touch built-marker"),
+        )
+        .expect("write");
+        for args in [
+            &["git", "init", "-q", "-b", "main"][..],
+            &["git", "config", "user.email", "t@example.com"],
+            &["git", "config", "user.name", "Test"],
+            &["git", "add", "-A"],
+            &["git", "commit", "-qm", "one"],
+        ] {
+            run(&origin, args);
+        }
+        let clone = dir.path().join("clone");
+        run(
+            dir.path(),
+            &[
+                "git",
+                "clone",
+                "-q",
+                origin.to_str().unwrap(),
+                clone.to_str().unwrap(),
+            ],
+        );
+
+        // What this machine accepted, which is what the checkout asks for
+        // right now -- so the gate is open at the moment the button is
+        // pressed, and only the pull closes it.
+        let accepted = vec![Component::Apk {
+            name: "app".to_string(),
+            build: crate::config::Command::from_line("touch built-marker"),
+            cwd: None,
+            stale_when: None,
+            strip: false,
+            package: None,
+            built_from: None,
+        }];
+        let state = state_for(&clone, accepted.clone());
+
+        // The commit the pull is about to take, asking for a different
+        // command from the one that was accepted.
+        std::fs::write(
+            origin.join(crate::config::PROJECT_CONFIG_FILE),
+            declare("touch never-run"),
+        )
+        .expect("write");
+        run(&origin, &["git", "commit", "-qam", "two"]);
+
+        let project = clone.clone();
+        state.pull_and_build(
+            move || crate::config::project_config(&project).matches_accepted(&accepted, None),
+            Arc::new(|_: &str, _: String| {}),
+        );
+        while state.status().building {
+            tokio::time::sleep(std::time::Duration::from_millis(10)).await;
+        }
+
+        assert!(
+            clone.join(".dev-updater.ron").exists(),
+            "the pull itself still happens -- it is how the new request arrives to be read",
+        );
+        assert!(
+            !clone.join("built-marker").exists(),
+            "the declaration changed under the acceptance, so nothing may run",
+        );
+    }
+
+    fn state_for(root: &Path, components: Vec<Component>) -> Arc<BuildState> {
+        BuildState::new(
+            "test".to_string(),
+            components,
+            true,
+            false,
+            root.to_path_buf(),
+            Shared {
+                remote_checks: crate::git::RemoteChecks::default(),
+                downloads: Arc::new(crate::restart::Downloads::default()),
+            },
+            false,
+        )
+    }
+
+    fn stale(state: &BuildState, name: &str) -> bool {
+        let component = state
+            .components
+            .iter()
+            .find(|component| component.name() == name)
+            .expect("component");
+        state.component_is_stale(component, &state.inner.lock().unwrap().built_from.clone())
+    }
+
+    /// The shape of bug a unit test that only calls `component_is_stale`
+    /// cannot see: `status()` and `trigger_if_needed` hold the lock that
+    /// the staleness check also wants. Taking it twice on one thread is a
+    /// deadlock, and it hung every `/status` and `/prepare` for any
+    /// project that had a build on disk -- which is every real one.
+    ///
+    /// Run on a thread with a deadline so a regression fails in
+    /// milliseconds instead of hanging the suite.
+    #[test]
+    fn asking_for_status_does_not_deadlock() {
+        let dir = tempfile::tempdir().expect("tempdir");
+        let root = dir.path();
+        let components = two_component_checkout(root);
+        let state = state_for(root, components);
+
+        let (tx, rx) = std::sync::mpsc::channel();
+        std::thread::spawn(move || {
+            let _ = state.status();
+            let _ = tx.send(());
+        });
+        assert!(
+            rx.recv_timeout(std::time::Duration::from_secs(5)).is_ok(),
+            "status() deadlocked on its own lock",
+        );
+    }
+
+    /// A commit that touches one component's directory must not make the
+    /// other look behind. Without the scoping, every app-only change would
+    /// offer a pointless rebuild of the server -- in the one repository
+    /// shape this feature was asked for.
+    #[test]
+    fn a_commit_in_one_subtree_leaves_the_other_current() {
+        let dir = tempfile::tempdir().expect("tempdir");
+        let root = dir.path();
+        let components = two_component_checkout(root);
+        let state = state_for(root, components);
+
+        // Built now, from what is checked out now.
+        for name in ["backend", "app"] {
+            let cwd = PathBuf::from(if name == "backend" { "server" } else { "app" });
+            let sha = crate::git::subtree_head(root, Some(&cwd)).expect("a commit");
+            state
+                .inner
+                .lock()
+                .unwrap()
+                .built_from
+                .insert(name.to_string(), sha);
+        }
+        assert!(!stale(&state, "backend"), "just built");
+        assert!(!stale(&state, "app"), "just built");
+
+        // A change to the app only.
+        std::fs::write(root.join("app/main.kt"), "two").expect("write");
+        run(root, &["git", "commit", "-qam", "app only"]);
+
+        assert!(stale(&state, "app"), "the app moved and was not rebuilt");
+        assert!(
+            !stale(&state, "backend"),
+            "the server's directory did not change"
+        );
+    }
+
+    /// Nothing recorded is "we have never built this", not "this is out of
+    /// date" -- otherwise every project that existed before this feature
+    /// would demand a rebuild the moment it arrived.
+    #[test]
+    fn a_component_this_server_has_never_built_is_not_called_stale() {
+        let dir = tempfile::tempdir().expect("tempdir");
+        let root = dir.path();
+        let components = two_component_checkout(root);
+        let state = state_for(root, components);
+
+        assert!(
+            state.inner.lock().unwrap().built_from.is_empty(),
+            "nothing recorded"
+        );
+        assert!(!stale(&state, "backend"));
+        assert!(!stale(&state, "app"));
+    }
+
+    /// The same must hold where there is no checkout to compare against:
+    /// unreadable is not evidence of anything.
+    #[test]
+    fn a_project_outside_git_is_not_called_stale() {
+        let dir = tempfile::tempdir().expect("tempdir");
+        let root = dir.path();
+        std::fs::create_dir_all(root.join("app/build/outputs/apk/debug")).expect("mkdir");
+        std::fs::write(root.join("app/build/outputs/apk/debug/a.apk"), b"").expect("write");
+        let state = state_for(
+            root,
+            vec![Component::Apk {
+                name: "app".to_string(),
+                build: crate::config::Command::from_line("true"),
+                cwd: None,
+                stale_when: None,
+                strip: false,
+                package: None,
+                built_from: Some("0000000000000000000000000000000000000000".to_string()),
+            }],
+        );
+        assert!(!stale(&state, "app"), "no checkout means no opinion");
+    }
+
+    /// The marker is recognised only in exactly its shape; anything else on
+    /// a line is the build talking and belongs in the log, where a build
+    /// that prints a malformed report can be seen to have done so.
+    #[test]
+    fn progress_is_read_only_from_the_marker() {
+        assert_eq!(parse_progress("@@progress 12/43"), Some((12, 43)));
+        assert_eq!(parse_progress("  @@progress 0/1  "), Some((0, 1)));
+        assert_eq!(parse_progress("@@progress  7 / 9 "), Some((7, 9)));
+
+        assert_eq!(parse_progress("Building @@progress 1/2"), None);
+        assert_eq!(parse_progress("@@progress soon"), None);
+        assert_eq!(parse_progress("@@progress 1/"), None);
+        assert_eq!(parse_progress("> Task :app:compileDebugKotlin"), None);
+    }
+
+    /// Feeds `read_segments` one chunk per `read`, recording how many
+    /// segments had been emitted before each one was handed over.
+    struct Chunks {
+        chunks: std::vec::IntoIter<&'static [u8]>,
+        emitted: std::rc::Rc<std::cell::RefCell<Vec<String>>>,
+        before_each_read: std::rc::Rc<std::cell::RefCell<Vec<usize>>>,
+    }
+
+    impl std::io::Read for Chunks {
+        fn read(&mut self, buffer: &mut [u8]) -> std::io::Result<usize> {
+            self.before_each_read
+                .borrow_mut()
+                .push(self.emitted.borrow().len());
+            let Some(chunk) = self.chunks.next() else {
+                return Ok(0);
+            };
+            assert!(chunk.len() <= buffer.len(), "the test's chunks are small");
+            buffer[..chunk.len()].copy_from_slice(chunk);
+            Ok(chunk.len())
+        }
+    }
+
+    /// The defect this splitting exists for, and the half of it a batch
+    /// test cannot see: it is not whether the counter is *parsed* but
+    /// **when** it is delivered.
+    ///
+    /// Cargo ends its counter with a carriage return and no newline, so a
+    /// reader waiting for `\n` holds it until whatever prints the next
+    /// one. Here that is the `Finished` line, which on a real incremental
+    /// build arrives only when the build is over -- so the card had
+    /// nothing to measure for the whole compile, which is exactly what a
+    /// pull produces. The assertion is therefore about the count of
+    /// segments already emitted when the *second* chunk is asked for.
+    #[test]
+    fn a_carriage_return_delivers_its_segment_without_waiting_for_a_newline() {
+        // Byte for byte what `cargo build --release` printed with one
+        // dirty crate, shortened only in the bar and the path.
+        let chunks: Vec<&'static [u8]> = vec![
+            b"   Compiling dev-updater v0.1.0 (/p)\n    Building [==> ] 236/237: dev-updater(bin)   \r",
+            b"    Finished `release` profile [optimized] target(s) in 7.60s\n",
+        ];
+        let emitted = std::rc::Rc::new(std::cell::RefCell::new(Vec::new()));
+        let before_each_read = std::rc::Rc::new(std::cell::RefCell::new(Vec::new()));
+
+        let collected = std::rc::Rc::clone(&emitted);
+        read_segments(
+            Chunks {
+                chunks: chunks.into_iter(),
+                emitted: std::rc::Rc::clone(&emitted),
+                before_each_read: std::rc::Rc::clone(&before_each_read),
+            },
+            |segment| collected.borrow_mut().push(segment.to_string()),
+        );
+
+        assert_eq!(
+            before_each_read.borrow().as_slice(),
+            [0, 2, 3],
+            "the counter must be delivered with its own chunk, not held \
+             until the newline in the next one"
+        );
+        let emitted = emitted.borrow();
+        assert_eq!(emitted.len(), 3);
+        assert_eq!(
+            parse_progress(&emitted[1]),
+            Some((236, 237)),
+            "and it is still the cargo counter once split"
+        );
+    }
+
+    /// The case the fix was not written for: output that was already
+    /// arriving line by line must not change shape. A cold build is
+    /// mostly this, and it is where a wrapper's `@@progress` lines live
+    /// too.
+    #[test]
+    fn newline_terminated_output_is_unchanged_and_blank_segments_are_dropped() {
+        let mut segments = Vec::new();
+        read_segments(
+            &b"> Task :app:compileDebugKotlin\n@@progress 7/9\r\n\nlast, unterminated"[..],
+            |segment| segments.push(segment.to_string()),
+        );
+        assert_eq!(
+            segments,
+            [
+                "> Task :app:compileDebugKotlin",
+                "@@progress 7/9",
+                "",
+                "",
+                "last, unterminated"
+            ],
+            "a CRLF ends one segment and opens an empty one; the caller \
+             drops the blanks"
+        );
+    }
+}
diff --git a/server/src/checks.rs b/server/src/checks.rs
new file mode 100644
index 0000000..c873802
--- /dev/null
+++ b/server/src/checks.rs
@@ -0,0 +1,363 @@
+//! Asking something slow in the background, so the request path never
+//! waits for it.
+//!
+//! Two things here are asked about a project without being fast enough to
+//! ask while answering a request: whether a checkout's remote has commits
+//! it hasn't (a network round trip), and what a service is doing (a
+//! process spawn). `/manifest` is fetched on every open, resume and
+//! Refresh, so neither may happen inside it.
+//!
+//! The arrangement both need is the same one, and it was written twice
+//! before this module existed. An answer lands *after* the response that
+//! started the work, so a card shows "still finding out" until the next
+//! look; a second request must not start a second worker for the same
+//! thing; and a failure must not be able to masquerade as an answer --
+//! which is the part that had already gone wrong once. A remote check that
+//! failed left `new_commits` at `false`, and a card with no badge is how
+//! this says "asked, and there is nothing new". The failure read as good
+//! news. So an entry keeps the last answer *and* why the last attempt
+//! produced none, and whatever displays it can say both.
+//!
+//! Being one mechanism matters more than the lines it saves: the counting
+//! of what is still outstanding was once written against remote checks
+//! alone, and service checks -- added later, in the same shape -- were
+//! left out of it. The symptom was a component's buttons missing after a
+//! restart, on whichever cards lost the race, with nothing looking broken.
+
+use std::borrow::Borrow;
+use std::collections::HashMap;
+use std::hash::Hash;
+use std::sync::{Arc, Mutex};
+
+/// What one attempt learned.
+///
+/// Both halves are optional, and the combinations are all real: an answer
+/// with no error is success; an error with no answer is a failure that
+/// found out nothing; and *both* is a partial answer worth keeping
+/// alongside the reason it is not the whole one -- a service whose status
+/// could not be read while its logs could.
+pub struct Report<A> {
+    /// What is now known. `None` leaves whatever was known before, because
+    /// a failed attempt is a reason to keep showing the last answer rather
+    /// than to claim ignorance.
+    pub answer: Option<A>,
+    /// Why this attempt did not fully succeed. Cleared by an attempt that
+    /// did, so it never outlives the condition it describes.
+    pub error: Option<String>,
+}
+
+impl<A> Report<A> {
+    pub fn answered(answer: A) -> Self {
+        Self {
+            answer: Some(answer),
+            error: None,
+        }
+    }
+
+    pub fn failed(error: String) -> Self {
+        Self {
+            answer: None,
+            error: Some(error),
+        }
+    }
+}
+
+impl<A> From<Result<A, String>> for Report<A> {
+    fn from(result: Result<A, String>) -> Self {
+        match result {
+            Ok(answer) => Self::answered(answer),
+            Err(error) => Self::failed(error),
+        }
+    }
+}
+
+struct Entry<A> {
+    answer: Option<A>,
+    /// A worker is running for this key right now, so a second request
+    /// must not start another.
+    in_flight: bool,
+    error: Option<String>,
+}
+
+// Written out rather than derived: `#[derive(Default)]` would demand
+// `A: Default`, and an answer that has never been given is `None` whether
+// or not its type has a default.
+impl<A> Default for Entry<A> {
+    fn default() -> Self {
+        Self {
+            answer: None,
+            in_flight: false,
+            error: None,
+        }
+    }
+}
+
+/// Answers being worked out in the background, by key.
+///
+/// Held behind an `Arc` by whatever owns it, because a worker outlives the
+/// call that started it and has to be able to write its answer somewhere
+/// that still exists.
+pub struct Checks<K, A>(Mutex<HashMap<K, Entry<A>>>);
+
+impl<K, A> Default for Checks<K, A> {
+    fn default() -> Self {
+        Self(Mutex::new(HashMap::new()))
+    }
+}
+
+impl<K: Eq + Hash + Clone + Send + 'static, A: Clone + Send + 'static> Checks<K, A> {
+    /// The last answer, or `None` if there has never been one. Distinct
+    /// from an answer that happens to be falsy: never-asked and
+    /// asked-and-told-no are different things to show.
+    pub fn answer<Q>(&self, key: &Q) -> Option<A>
+    where
+        K: Borrow<Q>,
+        Q: Hash + Eq + ?Sized,
+    {
+        self.0
+            .lock()
+            .unwrap()
+            .get(key)
+            .and_then(|entry| entry.answer.clone())
+    }
+
+    /// Something is being worked out for this key right now.
+    pub fn is_checking<Q>(&self, key: &Q) -> bool
+    where
+        K: Borrow<Q>,
+        Q: Hash + Eq + ?Sized,
+    {
+        self.0
+            .lock()
+            .unwrap()
+            .get(key)
+            .is_some_and(|entry| entry.in_flight)
+    }
+
+    /// Why the last attempt produced no answer, if it produced none.
+    /// `None` both before anything has been asked and after an attempt
+    /// that worked, since neither is something to warn about.
+    pub fn error<Q>(&self, key: &Q) -> Option<String>
+    where
+        K: Borrow<Q>,
+        Q: Hash + Eq + ?Sized,
+    {
+        self.0
+            .lock()
+            .unwrap()
+            .get(key)
+            .and_then(|entry| entry.error.clone())
+    }
+
+    /// Records something this server just caused, so a display reflects an
+    /// action without waiting for the next background attempt.
+    ///
+    /// A change applied in place under one lock rather than a whole answer
+    /// handed in, because an answer can have more than one part and a
+    /// caller usually knows only the part it changed -- overwriting the
+    /// rest with a fresh default would throw away what was still true.
+    ///
+    /// Clears the error: what is recorded here is known, so nothing is
+    /// left for a previous failure to qualify.
+    ///
+    /// Deliberately leaves `in_flight` alone. Clearing it would let a
+    /// second worker start for something already being worked on, and the
+    /// running one would then write its now-stale answer over this.
+    pub fn update(&self, key: K, change: impl FnOnce(&mut A))
+    where
+        A: Default,
+    {
+        let mut map = self.0.lock().unwrap();
+        let entry = map.entry(key).or_default();
+        change(entry.answer.get_or_insert_with(A::default));
+        entry.error = None;
+    }
+
+    /// Forgets everything whose key `keep` rejects, for something being
+    /// removed.
+    pub fn retain(&self, keep: impl FnMut(&K) -> bool) {
+        let mut keep = keep;
+        self.0.lock().unwrap().retain(|key, _| keep(key));
+    }
+
+    /// Starts working one key out, unless it already is being. Returns at
+    /// once.
+    ///
+    /// `work` is handed the previous answer so it can build on it -- which
+    /// is what lets a partial failure keep the half it still knows rather
+    /// than having to choose between the whole answer and none of it.
+    ///
+    /// The lock is taken twice and held across neither the spawn nor the
+    /// work: once to claim the key, and once to record what came back.
+    pub fn start<W>(self: &Arc<Self>, key: K, work: W)
+    where
+        W: FnOnce(Option<A>) -> Report<A> + Send + 'static,
+    {
+        let previous = {
+            let mut map = self.0.lock().unwrap();
+            let entry = map.entry(key.clone()).or_default();
+            if entry.in_flight {
+                // Already being asked; nothing to add by asking twice.
+                return;
+            }
+            entry.in_flight = true;
+            entry.answer.clone()
+        };
+
+        let checks = Arc::clone(self);
+        std::thread::spawn(move || {
+            let report = work(previous);
+            let mut map = checks.0.lock().unwrap();
+            let entry = map.entry(key).or_default();
+            if let Some(answer) = report.answer {
+                entry.answer = Some(answer);
+            }
+            entry.error = report.error;
+            entry.in_flight = false;
+        });
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use std::time::{Duration, Instant};
+
+    use super::*;
+
+    fn settle<K: Eq + Hash + Clone + Send + 'static, A: Clone + Send + 'static>(
+        checks: &Arc<Checks<K, A>>,
+        key: &K,
+    ) {
+        let deadline = Instant::now() + Duration::from_secs(5);
+        while checks.is_checking(key) && Instant::now() < deadline {
+            std::thread::sleep(Duration::from_millis(5));
+        }
+        assert!(!checks.is_checking(key), "the worker never finished");
+    }
+
+    #[test]
+    fn an_answer_lands_after_the_call_that_asked_for_it() {
+        let checks: Arc<Checks<String, bool>> = Arc::default();
+        let key = "one".to_string();
+
+        // Nothing asked yet is not the same as an answer of false.
+        assert_eq!(checks.answer(key.as_str()), None);
+        assert!(!checks.is_checking(key.as_str()));
+
+        checks.start(key.clone(), |_| Report::answered(true));
+        settle(&checks, &key);
+        assert_eq!(checks.answer(key.as_str()), Some(true));
+        assert_eq!(checks.error(key.as_str()), None);
+    }
+
+    /// The failure this whole arrangement exists to make visible: a failed
+    /// attempt must keep the last answer *and* say that it is not current,
+    /// rather than silently reading as "asked, nothing to report".
+    #[test]
+    fn a_failure_keeps_the_last_answer_and_records_why() {
+        let checks: Arc<Checks<String, bool>> = Arc::default();
+        let key = "one".to_string();
+
+        checks.start(key.clone(), |_| Report::answered(true));
+        settle(&checks, &key);
+
+        checks.start(key.clone(), |_| Report::failed("unreachable".to_string()));
+        settle(&checks, &key);
+        assert_eq!(
+            checks.answer(key.as_str()),
+            Some(true),
+            "the last known answer is what to show"
+        );
+        assert_eq!(checks.error(key.as_str()), Some("unreachable".to_string()));
+
+        // And an attempt that works clears the qualification.
+        checks.start(key.clone(), |_| Report::answered(false));
+        settle(&checks, &key);
+        assert_eq!(checks.answer(key.as_str()), Some(false));
+        assert_eq!(checks.error(key.as_str()), None);
+    }
+
+    /// A worker can build on what was already known, which is what lets a
+    /// partial failure keep the half it still has.
+    #[test]
+    fn a_worker_is_handed_the_previous_answer() {
+        let checks: Arc<Checks<String, u32>> = Arc::default();
+        let key = "one".to_string();
+
+        checks.start(key.clone(), |previous| {
+            assert_eq!(previous, None);
+            Report::answered(1)
+        });
+        settle(&checks, &key);
+        checks.start(key.clone(), |previous| {
+            Report::answered(previous.expect("the first answer") + 1)
+        });
+        settle(&checks, &key);
+        assert_eq!(checks.answer(key.as_str()), Some(2));
+    }
+
+    /// Two requests arriving together must not produce two workers. The
+    /// second is dropped rather than queued: it would ask the same
+    /// question and the first is already asking it.
+    #[test]
+    fn a_second_request_does_not_start_a_second_worker() {
+        let checks: Arc<Checks<String, u32>> = Arc::default();
+        let key = "one".to_string();
+        let started = Arc::new(std::sync::atomic::AtomicUsize::new(0));
+        let release = Arc::new(std::sync::atomic::AtomicBool::new(false));
+
+        for _ in 0..5 {
+            let started = Arc::clone(&started);
+            let release = Arc::clone(&release);
+            checks.start(key.clone(), move |_| {
+                started.fetch_add(1, std::sync::atomic::Ordering::SeqCst);
+                while !release.load(std::sync::atomic::Ordering::SeqCst) {
+                    std::thread::sleep(Duration::from_millis(1));
+                }
+                Report::answered(1)
+            });
+        }
+        assert!(checks.is_checking(key.as_str()));
+        release.store(true, std::sync::atomic::Ordering::SeqCst);
+        settle(&checks, &key);
+        assert_eq!(started.load(std::sync::atomic::Ordering::SeqCst), 1);
+    }
+
+    /// Recording an answer must not clear the in-flight flag: doing so
+    /// would let a second worker start beside the running one, and the
+    /// running one would then overwrite this with something older.
+    #[test]
+    fn updating_an_answer_leaves_a_running_worker_claimed() {
+        let checks: Arc<Checks<String, u32>> = Arc::default();
+        let key = "one".to_string();
+        let release = Arc::new(std::sync::atomic::AtomicBool::new(false));
+
+        let held = Arc::clone(&release);
+        checks.start(key.clone(), move |_| {
+            while !held.load(std::sync::atomic::Ordering::SeqCst) {
+                std::thread::sleep(Duration::from_millis(1));
+            }
+            Report::answered(1)
+        });
+
+        checks.update(key.clone(), |answer| *answer = 99);
+        assert_eq!(checks.answer(key.as_str()), Some(99));
+        assert!(
+            checks.is_checking(key.as_str()),
+            "the worker is still running and must stay claimed"
+        );
+
+        release.store(true, std::sync::atomic::Ordering::SeqCst);
+        settle(&checks, &key);
+    }
+
+    #[test]
+    fn retain_forgets_what_it_rejects() {
+        let checks: Arc<Checks<String, u32>> = Arc::default();
+        checks.update("keep".to_string(), |answer| *answer = 1);
+        checks.update("drop".to_string(), |answer| *answer = 2);
+        checks.retain(|key| key != "drop");
+        assert_eq!(checks.answer("keep"), Some(1));
+        assert_eq!(checks.answer("drop"), None);
+    }
+}
diff --git a/server/src/config.rs b/server/src/config.rs
new file mode 100644
index 0000000..48f0ed7
--- /dev/null
+++ b/server/src/config.rs
@@ -0,0 +1,1127 @@
+//! The server's persistent state: which repo roots to scan for suggestions,
+//! and which apps have been added.
+//!
+//! Everything a user does from the phone -- adding an app, removing one,
+//! picking a different build variant, changing the repo roots -- is a write
+//! to this file, so a restart doesn't lose it. Written whole and atomically
+//! (temp file + rename) rather than appended to: it is small, and a
+//! half-written config would take the server down on next start with no
+//! obvious way to recover from a phone.
+//!
+//! A project's [`Component`]s can be written here by hand, but the better
+//! home for them is the project itself -- see [`Declaration`].
+
+use std::path::{Path, PathBuf};
+
+use anyhow::{Context, Result};
+use serde::{Deserialize, Serialize};
+
+/// Reading and writing the RON these files are in.
+///
+/// Two things are house rules rather than plain RON, and they are here
+/// together because they are inverses of each other -- change one and the
+/// other stops round-tripping.
+///
+/// **No outer parentheses.** A file *is* the body of the struct, so nothing
+/// in it is indented for the sake of a wrapper. RON has no implicit
+/// top-level struct (`de/mod.rs` requires the `(`), so [`wg_app_link::format::parse`]
+/// adds it and [`wg_app_link::format::render`] takes it back off. The opening paren is not followed by a
+/// newline, so a parse error's line number still points at the real line.
+///
+/// **`Some` is implicit.** Enabled on the deserializer rather than by a
+/// `#![enable(implicit_some)]` header every project file would have to
+/// remember, and matched on the writing side by `skip_serializing_if` so
+/// nothing writes back a `Some(...)` a person didn't type.
+
+#[derive(Debug, Clone, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase", default)]
+pub struct Config {
+    /// Directories to scan for addable projects. Anything outside these can
+    /// still be added by typing its path; these only drive suggestions.
+    pub repo_roots: Vec<PathBuf>,
+    /// Enrolled device tokens, hashes only -- a leaked config doesn't leak
+    /// the credential. A list so per-device tokens with individual
+    /// revocation are a config entry later, not a schema change.
+    pub tokens: Vec<TokenEntry>,
+    /// Every project this server serves, including this server's own --
+    /// see `registry::reconcile_self`, which keeps that one row derived
+    /// from the checkout rather than hand-written.
+    pub projects: Vec<ProjectConfig>,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct TokenEntry {
+    /// Which device this token belongs to, for the human rotating it.
+    pub name: String,
+    /// Hex SHA-256 of the token. A plain hash is enough: the token is 256
+    /// bits from the OS CSPRNG, so there is nothing to dictionary-attack
+    /// and no stretching needed.
+    pub sha256: String,
+}
+
+/// One project this server serves, as stored.
+///
+/// The unit in the list is a project -- a directory, in a checkout -- not
+/// an APK. What it produces is its [`Component`]s, which is why an entry
+/// can have both an app to install and a server to restart.
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct ProjectConfig {
+    /// Stable identifier, used in this project's routes and as the
+    /// download filename on the device. Derived from the project directory
+    /// name when it is added, and never changed afterwards -- renaming it
+    /// would orphan the device's existing download for it.
+    pub key: String,
+    pub label: String,
+    /// The project root, which is what the user actually chose. What is
+    /// built underneath it is rediscovered on every request rather than
+    /// stored, so a rebuild landing in a different variant directory is
+    /// picked up with no reconfiguration.
+    pub project_path: PathBuf,
+    /// Offer a Pull button: fetch, fast-forward the checked out branch,
+    /// and build. On by default, and effective only for a project actually
+    /// in a git repository -- false for a checkout that should never be
+    /// moved from a phone. Per project rather than per component, because
+    /// there is one checkout.
+    #[serde(default = "yes", skip_serializing_if = "std::ops::Not::not")]
+    pub git_pull: bool,
+    /// Pass `-4` to every git command that talks to a remote.
+    ///
+    /// For a network where the remote resolves to an AAAA record that
+    /// doesn't answer: git tries it first and waits out the connect
+    /// timeout on every fetch. Off by default, because forcing IPv4 is a
+    /// workaround for a broken path rather than a better way to reach a
+    /// working one.
+    ///
+    /// The one field here this machine chose rather than the project
+    /// declaring it, which is why an acceptance leaves it alone and why
+    /// `registry::reconcile_self` carries it across rebuilding the
+    /// built-in row.
+    #[serde(default, skip_serializing_if = "std::ops::Not::not")]
+    pub git_ipv4: bool,
+    /// What this project produces, in the order it is produced. A failure
+    /// stops the ones after it, so a project whose server must be current
+    /// before its APK is served declares them that way round.
+    #[serde(default)]
+    pub components: Vec<Component>,
+    /// The accepted copy of the project's [`Resources`] declaration.
+    ///
+    /// Accepted rather than read live for the same reason `build` is: the
+    /// `Script` variant runs a command on the build machine, so a pull
+    /// must not be able to introduce one without anybody seeing it. The
+    /// `Ron` and `Inline` variants could safely be read live, but gating
+    /// only the dangerous variant would mean the acceptance question
+    /// changes shape depending on which one a project picked.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub resources: Option<Resources>,
+}
+
+/// How a server component's service is driven.
+///
+/// Two variants rather than two optional fields, because a component
+/// picks one: with `script:` and `run:` beside each other, "both set" and
+/// "neither set" are states the file can express and nothing means, which
+/// then need a check to reject rather than being unsayable.
+///
+/// Whichever it is, what comes out the other side is the same thing -- a
+/// command run as `<command> <subcommand>`, answering the contract in
+/// `crate::service`. `Managed` is not a second mechanism; it is the
+/// built-in script filling the same role, which is why
+/// [`crate::service::driver`] can turn either into one command and
+/// everything downstream stays unaware of the difference.
+#[derive(Clone, PartialEq, Eq, Debug, Serialize, Deserialize)]
+pub enum Service {
+    /// The project carries its own script. For anything that needs to do
+    /// something the built-in one does not -- dev-updater's own service is
+    /// the example, since restarting it means restarting the process doing
+    /// the asking.
+    Script(Command),
+    /// dev-updater supervises this command with its built-in script, so a
+    /// project that just wants its binary kept running does not carry 150
+    /// lines of init-system detection to keep in step with everyone
+    /// else's copy.
+    Managed(Command),
+}
+
+/// Where a project's own resources are declared.
+///
+/// The file this points at is **the project's, not this server's.** It
+/// holds the things a project would otherwise have to write down in
+/// several places -- its name, where it keeps its data and config -- and
+/// the project's own code is expected to read the same file for the same
+/// values, which is the whole reason it is one file rather than more
+/// fields in `.dev-updater.ron`. This server reads the handful of keys it
+/// understands out of it and **ignores the rest**, because the rest is
+/// not addressed to it.
+///
+/// That last point is why [`ResourceFacts`] does not set
+/// `deny_unknown_fields`, where [`Declaration`] does: a typo in
+/// `.dev-updater.ron` is a mistake worth refusing, and an unrecognised key
+/// in a project's own resource file is somebody else's business.
+///
+/// Three variants because there are three genuinely different places the
+/// answer can come from, and no default: a project that says nothing has
+/// state this server cannot locate, which the Uninstall dialog reports as
+/// not knowing rather than filling in with a guess. Deriving it from the
+/// checkout's directory name is what this replaced -- right for every
+/// project here and still an inference presented as a fact.
+#[derive(Clone, PartialEq, Eq, Debug, Serialize, Deserialize)]
+pub enum Resources {
+    /// A RON file in the checkout, resolved against the project.
+    Ron(PathBuf),
+    /// A command that prints the same RON on stdout, for a project whose
+    /// values are computed rather than written down. Runs on the build
+    /// machine, so it is gated by acceptance exactly as `build` is -- see
+    /// [`Declaration`].
+    Script(Command),
+    /// Said here instead, for a project that has nowhere better to put it.
+    Inline(ResourceFacts),
+}
+
+/// The keys this server reads out of a project's resources.
+///
+/// Every one optional, and every one absent is a real state rather than a
+/// missing value to substitute for: a project may name itself without
+/// saying where its data goes, and the dialog then offers what it knows
+/// and says it does not know the rest.
+///
+/// Unknown fields are ignored on purpose. See [`Resources`].
+#[derive(Clone, PartialEq, Eq, Debug, Default, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase", default)]
+pub struct ResourceFacts {
+    /// What the project calls itself for the purpose of keeping state --
+    /// `ai-app`, `dev-updater`. Not the crate or package name, which is
+    /// chosen to satisfy a registry's namespace and has no business
+    /// deciding where a data directory lives; and not `label`, which is
+    /// what a person reads on a card.
+    ///
+    /// When it is here and the paths are not, the paths follow from it:
+    /// `$XDG_DATA_HOME/<name>` and `$XDG_CONFIG_HOME/<name>`, resolved by
+    /// the same `wg_app_link::xdg` both servers use for their own state.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub name: Option<String>,
+    /// Where the project keeps what it accumulates, if that is not
+    /// `$XDG_DATA_HOME/<name>`.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub data: Option<PathBuf>,
+    /// Where the project keeps what somebody configured, if that is not
+    /// `$XDG_CONFIG_HOME/<name>`.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub config: Option<PathBuf>,
+}
+
+/// One thing a project produces, and what delivering it means.
+///
+/// The variants are genuinely different downstream -- an APK is installed
+/// on the phone and is stale against `PackageInfo.lastUpdateTime`, a server
+/// runs on the build machine and is either current or not -- so they are a
+/// sum rather than one struct carrying both halves' fields. What they share
+/// is a name, a build step, and where to run it.
+///
+/// The common fields are declared per variant. That is two places to edit
+/// when one is added, which is the price of the file reading
+/// `Apk(name: "app", ...)` with nothing nested inside a `kind`. The
+/// accessors below are what keeps the sharing honest, and
+/// [`Self::same_declaration`] destructures exhaustively so adding a field
+/// anywhere fails to compile until someone has said which kind it is.
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all_fields = "camelCase", deny_unknown_fields)]
+pub enum Component {
+    /// An APK to install on the phone.
+    Apk {
+        name: String,
+        #[serde(default, skip_serializing_if = "Command::is_empty")]
+        build: Command,
+        #[serde(default, skip_serializing_if = "Option::is_none")]
+        cwd: Option<PathBuf>,
+        #[serde(default, skip_serializing_if = "Option::is_none")]
+        stale_when: Option<StaleRule>,
+        /// Serve a debug-symbol-stripped copy (see `crate::strip`).
+        ///
+        /// Declared rather than detected: whether the symbols are worth the
+        /// transfer is a judgement about this project, and guessing it from
+        /// the APK's contents was a guess that then needed an override
+        /// anyway. It stays this server's business rather than the build
+        /// script's because it is a property of *this* hop to a phone --
+        /// a project built without dev-updater has no reason to strip.
+        #[serde(default, skip_serializing_if = "std::ops::Not::not")]
+        strip: bool,
+        /// The installed package this replaces, read out of the APK by
+        /// `crate::apkinfo` and cached here so `aapt2` never runs on the
+        /// manifest path. Measured, not declared: absent until there has
+        /// been a build to read it from, and refreshed after every one, so
+        /// a project can be added before it has ever been built.
+        ///
+        /// Excluded from [`Self::same_declaration`] for exactly that
+        /// reason -- it is not something a project asked for, so it cannot
+        /// be something an acceptance is about.
+        #[serde(default, skip_serializing_if = "Option::is_none")]
+        package: Option<String>,
+        /// The commit this component was last successfully built from,
+        /// scoped to its own directory (see `git::subtree_head`).
+        ///
+        /// Measured, not declared, exactly as `package` is: recorded when
+        /// a build succeeds, and compared against the checkout to answer
+        /// "is what is on disk still current?". Absent until this server
+        /// has built it once, which reads as *unknown* rather than as
+        /// stale -- a project built by hand before this existed must not
+        /// announce that it needs rebuilding.
+        #[serde(default, skip_serializing_if = "Option::is_none")]
+        built_from: Option<String>,
+    },
+    /// A server on the build machine, delivered by restarting it.
+    Server {
+        name: String,
+        #[serde(default, skip_serializing_if = "Command::is_empty")]
+        build: Command,
+        #[serde(default, skip_serializing_if = "Option::is_none")]
+        cwd: Option<PathBuf>,
+        #[serde(default, skip_serializing_if = "Option::is_none")]
+        stale_when: Option<StaleRule>,
+        /// How this server's service is driven: with the project's own
+        /// script, or by dev-updater's built-in one. See [`Service`].
+        #[serde(default, skip_serializing_if = "Option::is_none")]
+        service: Option<Service>,
+        /// The commit this component was last successfully built from,
+        /// scoped to its own directory (see `git::subtree_head`).
+        ///
+        /// Measured, not declared, exactly as `package` is: recorded when
+        /// a build succeeds, and compared against the checkout to answer
+        /// "is what is on disk still current?". Absent until this server
+        /// has built it once, which reads as *unknown* rather than as
+        /// stale -- a project built by hand before this existed must not
+        /// announce that it needs rebuilding.
+        #[serde(default, skip_serializing_if = "Option::is_none")]
+        built_from: Option<String>,
+    },
+}
+
+impl Component {
+    pub fn name(&self) -> &str {
+        match self {
+            Self::Apk { name, .. } | Self::Server { name, .. } => name,
+        }
+    }
+
+    pub fn build(&self) -> &Command {
+        match self {
+            Self::Apk { build, .. } | Self::Server { build, .. } => build,
+        }
+    }
+
+    pub fn cwd(&self) -> Option<&Path> {
+        match self {
+            Self::Apk { cwd, .. } | Self::Server { cwd, .. } => cwd.as_deref(),
+        }
+    }
+
+    pub fn stale_when(&self) -> Option<&StaleRule> {
+        match self {
+            Self::Apk { stale_when, .. } | Self::Server { stale_when, .. } => stale_when.as_ref(),
+        }
+    }
+
+    /// Whether these two say the same thing about what to *do*, ignoring
+    /// what this server measured for itself.
+    ///
+    /// This is the acceptance comparison: a project's file against what was
+    /// accepted from it, so a pull that changes a command shows up as
+    /// needing acceptance again while a package read from a fresh build
+    /// does not.
+    ///
+    /// Destructured field by field with no `..` deliberately. Adding a
+    /// field to either variant stops this compiling until someone decides
+    /// whether it is something a project asked for -- which is a better
+    /// place to be reminded than a list of exclusions nobody re-reads.
+    pub fn same_declaration(&self, other: &Self) -> bool {
+        match (self, other) {
+            (
+                Self::Apk {
+                    name,
+                    build,
+                    cwd,
+                    stale_when,
+                    strip,
+                    package: _,
+                    built_from: _,
+                },
+                Self::Apk {
+                    name: other_name,
+                    build: other_build,
+                    cwd: other_cwd,
+                    stale_when: other_stale_when,
+                    strip: other_strip,
+                    package: _,
+                    built_from: _,
+                },
+            ) => {
+                name == other_name
+                    && build == other_build
+                    && cwd == other_cwd
+                    && stale_when == other_stale_when
+                    && strip == other_strip
+            }
+            (
+                Self::Server {
+                    name,
+                    build,
+                    cwd,
+                    stale_when,
+                    service,
+                    built_from: _,
+                },
+                Self::Server {
+                    name: other_name,
+                    build: other_build,
+                    cwd: other_cwd,
+                    stale_when: other_stale_when,
+                    service: other_service,
+                    built_from: _,
+                },
+            ) => {
+                name == other_name
+                    && build == other_build
+                    && cwd == other_cwd
+                    && stale_when == other_stale_when
+                    && service == other_service
+            }
+            _ => false,
+        }
+    }
+
+    /// How this component's service is driven, if it is a server that
+    /// declares one at all.
+    ///
+    /// A server with none is a real state rather than a mistake: it builds
+    /// something this machine runs by hand, and its card offers no service
+    /// controls.
+    pub fn service(&self) -> Option<&Service> {
+        match self {
+            Self::Server { service, .. } => service.as_ref(),
+            Self::Apk { .. } => None,
+        }
+    }
+
+    /// The measured package this APK installs, if it is an APK and one has
+    /// been read.
+    pub fn package(&self) -> Option<&str> {
+        match self {
+            Self::Apk { package, .. } => package.as_deref(),
+            Self::Server { .. } => None,
+        }
+    }
+
+    /// The commit this component was last built from, if this server has
+    /// built it.
+    pub fn built_from(&self) -> Option<&str> {
+        match self {
+            Self::Apk { built_from, .. } | Self::Server { built_from, .. } => built_from.as_deref(),
+        }
+    }
+
+    /// Records the commit a successful build was made from. Unlike
+    /// [`Self::set_package`] this applies to either kind, because either
+    /// kind can fall behind the checkout.
+    pub fn set_built_from(&mut self, sha: String) {
+        match self {
+            Self::Apk { built_from, .. } | Self::Server { built_from, .. } => {
+                *built_from = Some(sha);
+            }
+        }
+    }
+
+    /// Records what a build was measured to produce, leaving everything a
+    /// project declared alone. The inverse of [`Self::same_declaration`]'s
+    /// exclusion: exactly the fields that comparison ignores are the ones
+    /// this sets.
+    pub fn set_package(&mut self, measured: String) {
+        if let Self::Apk { package, .. } = self {
+            *package = Some(measured);
+        }
+    }
+}
+
+/// Whether any of these has something to run, as opposed to a checkout
+/// that can only be pulled.
+///
+/// Here rather than on either caller: the entry list asks it to decide
+/// whether a project gets build machinery at all, and the build state asks
+/// it to decide whether a pull has anything to do afterwards. Two copies
+/// of that is two answers to drift apart.
+pub fn has_command(components: &[Component]) -> bool {
+    components
+        .iter()
+        .any(|component| !component.build().is_empty())
+}
+
+/// A command, written either as the line you would type or as explicit
+/// arguments.
+///
+/// `"cargo build --release"` and `["cargo", "build", "--release"]` mean the
+/// same thing, and both end up as argv -- nothing is ever handed to a
+/// shell, so there are no quoting rules to get wrong and nothing in a path
+/// can be read as an operator. Accepting both is the boundary doing the
+/// converting once, rather than a second entry point differing only in
+/// argument type: most of these read better as a line, and the
+/// ones that don't are the ones with an argument containing a space.
+///
+/// Splitting is plain whitespace with no quoting, deliberately -- a
+/// half-implemented shell grammar is worse than an obvious limit. The array
+/// form is how an argument with a space is written, and it is what this
+/// writes back for one, so such a command survives a round trip.
+#[derive(Debug, Clone, PartialEq, Eq, Default)]
+pub struct Command(Vec<String>);
+
+impl Command {
+    /// Configured but not started, resolved against `project`.
+    ///
+    /// Here rather than in the build, because the service script needs the
+    /// same resolution and two copies of "what does `./x` mean" would be
+    /// one copy too many.
+    ///
+    /// Same rule a shell uses for the program: one named with a path
+    /// separator is a file, resolved against the project so `./build.sh`
+    /// means what it looks like; anything else is a PATH lookup. Nothing
+    /// is passed through a shell, so there are no quoting rules to get
+    /// wrong and nothing in a path can be read as an operator.
+    pub fn to_process(
+        &self,
+        project: &Path,
+        cwd: Option<&Path>,
+        extra: &[&str],
+    ) -> Result<std::process::Command, String> {
+        let (program, args) = self
+            .split_first()
+            .ok_or_else(|| "the command is empty".to_string())?;
+        // `join` on an absolute path yields that path, so a config may give
+        // either an absolute cwd or one relative to the project.
+        let cwd = match cwd {
+            Some(cwd) => project.join(cwd),
+            None => project.to_path_buf(),
+        };
+        let resolved = if program.contains('/') {
+            project.join(program)
+        } else {
+            PathBuf::from(program)
+        };
+        if !cwd.is_dir() {
+            return Err(format!("{} does not exist", cwd.display()));
+        }
+        let mut command = std::process::Command::new(&resolved);
+        command.args(args).args(extra).current_dir(&cwd);
+        Ok(command)
+    }
+
+    /// The line form, split. The deserializer's string case is this, so
+    /// there is one definition of where the argument boundaries are.
+    pub fn from_line(line: &str) -> Self {
+        Self(line.split_whitespace().map(str::to_string).collect())
+    }
+
+    pub fn is_empty(&self) -> bool {
+        self.0.is_empty()
+    }
+
+    /// The words as one line, which is how a command is written back and
+    /// how it is handed to something that takes a single argument.
+    ///
+    /// Lossy for an argument containing a space, exactly as the file
+    /// format is -- see this type's own note. Callers that must not lose
+    /// one take [`Self::split_first`] instead.
+    pub fn to_line(&self) -> String {
+        self.0.join(" ")
+    }
+
+    /// A command from words already separated, for one this server builds
+    /// itself rather than one somebody wrote.
+    pub fn from_words(words: Vec<String>) -> Self {
+        Self(words)
+    }
+
+    /// The program and its arguments, or `None` for an empty command --
+    /// which is a configuration that says "no build step", not an error.
+    pub fn split_first(&self) -> Option<(&String, &[String])> {
+        self.0.split_first()
+    }
+}
+
+impl<'de> Deserialize<'de> for Command {
+    fn deserialize<D: serde::Deserializer<'de>>(deserializer: D) -> Result<Self, D::Error> {
+        use serde::de;
+
+        struct Either;
+        impl<'de> de::Visitor<'de> for Either {
+            type Value = Command;
+            fn expecting(&self, f: &mut std::fmt::Formatter) -> std::fmt::Result {
+                f.write_str(r#"a command, as "prog arg" or ["prog", "arg"]"#)
+            }
+            fn visit_str<E: de::Error>(self, line: &str) -> Result<Command, E> {
+                Ok(Command::from_line(line))
+            }
+            fn visit_seq<A: de::SeqAccess<'de>>(self, seq: A) -> Result<Command, A::Error> {
+                Deserialize::deserialize(de::value::SeqAccessDeserializer::new(seq)).map(Command)
+            }
+        }
+        deserializer.deserialize_any(Either)
+    }
+}
+
+impl Serialize for Command {
+    /// Written back the way it reads best: the line, unless an argument
+    /// contains whitespace and the array is the only form that survives
+    /// being read again.
+    fn serialize<S: serde::Serializer>(&self, serializer: S) -> Result<S::Ok, S::Error> {
+        if self
+            .0
+            .iter()
+            .any(|arg| arg.chars().any(char::is_whitespace))
+        {
+            self.0.serialize(serializer)
+        } else {
+            serializer.serialize_str(&self.0.join(" "))
+        }
+    }
+}
+
+/// "`path` is out of date with respect to `older_than`" -- the whole
+/// staleness vocabulary, deliberately.
+///
+/// Comparing two build outputs against each other, rather than either
+/// against source, is what makes this cheap and reliable: it needs no
+/// knowledge of what the build reads. The consequence is that it only means
+/// anything once `older_than` has itself been built at least once; until
+/// then there is nothing to be behind, and the rule reports not-stale.
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct StaleRule {
+    /// The output that may be behind. Missing entirely counts as stale.
+    pub path: PathBuf,
+    /// The reference output it should be at least as new as.
+    pub older_than: PathBuf,
+}
+
+fn yes() -> bool {
+    true
+}
+
+/// The file a project carries to ask this server for a build step. A
+/// dotfile, because it is this tool's business rather than the project's.
+pub const PROJECT_CONFIG_FILE: &str = ".dev-updater.ron";
+
+/// What a project asks for, kept in the project rather than in this
+/// machine's config.
+///
+/// The build step is project knowledge -- the command, and which two
+/// outputs decide staleness -- so the project is where it belongs: adding
+/// the same project on a second machine shouldn't mean working it out
+/// again, and the person changing the build is the one who knows it
+/// changed.
+///
+/// What this deliberately is *not* is something that runs. A project file
+/// is a **request**, promoted into [`ProjectConfig::components`] only once
+/// a person has read it on the phone and accepted it (see
+/// `AppState::approve_declaration`). The reason is the asymmetry between
+/// the two halves of this server: an APK it serves is sandboxed by
+/// Android, while a component's `build` runs on the build machine as the
+/// user who started this server. Pulling a repository must not be able to
+/// change what that command is without anyone seeing it.
+///
+/// Approving is not a claim that the build *script* is safe -- its
+/// contents live in the repository and change freely with every pull,
+/// which is the same trust anyone building the project already extends.
+/// It is the narrower claim that this project runs a build step at all,
+/// and that this is the one.
+#[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase", default, deny_unknown_fields)]
+pub struct Declaration {
+    /// What to call this project before there is a build to read a label
+    /// from. A built APK wins: it is the authority on what will install.
+    pub label: Option<String>,
+    /// Offer a Pull button. See [`ProjectConfig::git_pull`].
+    #[serde(default = "yes")]
+    pub git_pull: bool,
+    /// What this project produces, in the order it should be produced.
+    pub components: Vec<Component>,
+    /// Where this project's own resources are declared. See
+    /// [`Resources`].
+    pub resources: Option<Resources>,
+}
+
+impl Declaration {
+    /// Whether an accepted set still says what this file says. The
+    /// acceptance gate, in one place: order matters, since it is the order
+    /// things are built in.
+    ///
+    /// `git_pull` is deliberately not part of it. The gate exists because a
+    /// pull must not be able to change what *runs* without anyone seeing
+    /// it; `gitPull` only decides whether a button is offered, and a
+    /// project that turns it off cannot thereby execute anything. Including
+    /// it would also mean comparing a declared value against an effective
+    /// one -- the entry's is false outside a checkout regardless of what
+    /// the file says -- so a project outside git would sit permanently
+    /// unaccepted.
+    pub fn matches_accepted(
+        &self,
+        accepted: &[Component],
+        accepted_resources: Option<&Resources>,
+    ) -> bool {
+        self.components.len() == accepted.len()
+            && std::iter::zip(&self.components, accepted)
+                .all(|(asked, accepted)| asked.same_declaration(accepted))
+            // Part of the gate because `Resources::Script` runs. Compared
+            // whole rather than by variant, so switching a project from a
+            // file to a script -- or changing which file -- is a change
+            // somebody is asked about.
+            && self.resources.as_ref() == accepted_resources
+    }
+}
+
+/// The components a project is asking for, as the RON a person reads on
+/// the phone before accepting them.
+///
+/// Just the components: rendering the whole [`Declaration`] would put a
+/// `label: None` and a `gitPull` nobody asked about in front of the thing
+/// actually being decided.
+pub fn render_request(components: &[Component]) -> Result<String, ron::Error> {
+    #[derive(Serialize)]
+    struct Request<'a> {
+        components: &'a [Component],
+    }
+    wg_app_link::format::render(&Request { components })
+}
+
+/// What `project` says about itself, or an empty declaration for a project
+/// that says nothing -- which is the normal case.
+///
+/// A file that doesn't parse is logged and treated as saying nothing
+/// rather than as an error: this runs while rebuilding the entry list, and
+/// one project's typo must not take the whole app list down with it.
+pub fn project_config(project: &Path) -> Declaration {
+    let path = project.join(PROJECT_CONFIG_FILE);
+    let Ok(text) = std::fs::read_to_string(&path) else {
+        return Declaration::default();
+    };
+    wg_app_link::format::parse(&text).unwrap_or_else(|err| {
+        tracing::warn!("ignoring {}: {err}", path.display());
+        Declaration::default()
+    })
+}
+
+/// The inverse of [`expand_tilde`], for paths shown on a phone.
+///
+/// A build machine's paths are long and the interesting part is at the
+/// end, so a card that reads `~/repos/ai-app/app` says more in the width
+/// available than one that spends a line on `/home/somebody`. Round-trips:
+/// what this prints is accepted back by [`expand_tilde`].
+pub fn contract_tilde(path: &Path) -> String {
+    let Some(home) = std::env::home_dir() else {
+        return path.display().to_string();
+    };
+    match path.strip_prefix(&home) {
+        Ok(rest) if rest.as_os_str().is_empty() => "~".to_string(),
+        Ok(rest) => format!("~/{}", rest.display()),
+        Err(_) => path.display().to_string(),
+    }
+}
+
+/// Expands a leading `~` against this user's home directory.
+///
+/// Paths arrive from a phone keyboard, where typing `/home/you/repos` in
+/// full is exactly the kind of thing a person gets wrong once and gives up
+/// on. Only a leading `~` or `~/` is expanded: `~otheruser` would need the
+/// password database to resolve, and silently treating it as a literal
+/// directory name is less surprising than half-supporting it.
+pub fn expand_tilde(path: &str) -> PathBuf {
+    let path = path.trim();
+    let Some(rest) = path.strip_prefix('~') else {
+        return PathBuf::from(path);
+    };
+    // `~user/...` is somebody else's home, which this doesn't resolve.
+    if !(rest.is_empty() || rest.starts_with('/')) {
+        return PathBuf::from(path);
+    }
+    let Some(home) = std::env::home_dir() else {
+        return PathBuf::from(path);
+    };
+    match rest.strip_prefix('/') {
+        Some(relative) => home.join(relative),
+        None => home,
+    }
+}
+
+impl Config {
+    pub fn load(path: &Path) -> Result<Self> {
+        match std::fs::read_to_string(path) {
+            Ok(text) => wg_app_link::format::parse(&text)
+                .with_context(|| format!("{} is not valid config RON", path.display())),
+            // A first run has no config, which is the normal starting
+            // state -- only the built-in self-update entry exists until an
+            // app is added from the phone.
+            Err(err) if err.kind() == std::io::ErrorKind::NotFound => Ok(Self::default()),
+            Err(err) => Err(err).with_context(|| format!("read {}", path.display())),
+        }
+    }
+
+    /// Writes the config, owner-readable only -- it is a list of what is
+    /// on this machine and where, which is nobody else's business, and it
+    /// now lives beside the CA's private key.
+    ///
+    /// The mode is set on the temporary file *before* the rename, so the
+    /// config is never briefly world-readable at its real path.
+    pub fn save(&self, path: &Path) -> Result<()> {
+        // Shared, because both projects wrote this identically and the
+        // reasoning is the part worth having in one place: the temp file
+        // is not always new -- a save killed partway leaves one behind --
+        // so opening it again keeps whatever mode it had, and that mode is
+        // then renamed over the file holding the enrolled token hashes.
+        wg_app_link::format::write(path, self)
+    }
+
+    /// A key not already taken, derived from `name`. Suffixed rather than
+    /// rejected so adding two projects that happen to share a directory
+    /// name (`android` under two different repos) just works.
+    pub fn unique_key(&self, name: &str, reserved: &str) -> String {
+        let base: String = name
+            .chars()
+            .map(|c| {
+                if c.is_ascii_alphanumeric() || c == '-' {
+                    c
+                } else {
+                    '-'
+                }
+            })
+            .collect();
+        let base = base.trim_matches('-').to_ascii_lowercase();
+        let base = if base.is_empty() {
+            "app".to_string()
+        } else {
+            base
+        };
+
+        let taken =
+            |key: &str| key == reserved || self.projects.iter().any(|project| project.key == key);
+        if !taken(&base) {
+            return base;
+        }
+        (2..)
+            .map(|n| format!("{base}-{n}"))
+            .find(|key| !taken(key))
+            .expect("unbounded search")
+    }
+}
+
+impl StaleRule {
+    /// True when the build step should run. A missing reference means the
+    /// project hasn't produced the thing to catch up to yet -- an ordinary
+    /// "not built" state, not staleness.
+    pub fn is_stale(&self, project_path: &Path) -> bool {
+        let resolve = |path: &Path| project_path.join(path);
+        let Some(reference) = mtime(&resolve(&self.older_than)) else {
+            return false;
+        };
+        match mtime(&resolve(&self.path)) {
+            Some(target) => target < reference,
+            None => true,
+        }
+    }
+}
+
+fn mtime(path: &Path) -> Option<std::time::SystemTime> {
+    std::fs::metadata(path).ok()?.modified().ok()
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    /// One component on its own, which `format::parse` cannot do -- it
+    /// wraps its input in the parentheses a whole file body needs.
+    fn component(text: &str) -> Result<Component, ron::error::SpannedError> {
+        ron::Options::default()
+            .with_default_extension(ron::extensions::Extensions::IMPLICIT_SOME)
+            .from_str(text)
+    }
+
+    #[test]
+    fn both_variants_round_trip() {
+        for (text, expected) in [
+            (
+                r#"service: Script("server/service")"#,
+                Service::Script(Command::from_line("server/service")),
+            ),
+            (
+                r#"service: Managed("target/release/ai-server --port 8080")"#,
+                Service::Managed(Command::from_line("target/release/ai-server --port 8080")),
+            ),
+        ] {
+            let parsed = component(&format!(r#"Server(name: "s", build: "b", {text})"#))
+                .unwrap_or_else(|err| panic!("{text} should parse: {err}"));
+            assert_eq!(parsed.service(), Some(&expected));
+            let written = wg_app_link::format::render(&parsed).expect("render");
+            assert!(written.contains(text), "{text} did not survive: {written}");
+        }
+    }
+
+    /// A server that declares no service at all is a real state -- it
+    /// builds something a person runs by hand -- and must not become an
+    /// error or a service with an empty command.
+    #[test]
+    fn a_server_may_have_no_service() {
+        let parsed = component(r#"Server(name: "s", build: "b")"#).expect("parse");
+        assert_eq!(parsed.service(), None);
+        let written = wg_app_link::format::render(&parsed).expect("render");
+        assert!(
+            !written.contains("service"),
+            "wrote a field nobody typed: {written}"
+        );
+    }
+
+    #[test]
+    fn an_unknown_variant_names_the_ones_that_exist() {
+        let err = component(r#"Server(name: "s", build: "b", service: Supervised("x"))"#)
+            .expect_err("Supervised is not a variant");
+        let message = err.to_string();
+        assert!(
+            message.contains("Script") && message.contains("Managed"),
+            "a failure should say what is allowed: {message}"
+        );
+    }
+
+    fn config_with(keys: &[&str]) -> Config {
+        Config {
+            tokens: Vec::new(),
+            repo_roots: Vec::new(),
+            projects: keys
+                .iter()
+                .map(|key| ProjectConfig {
+                    key: (*key).to_string(),
+                    label: String::new(),
+                    project_path: PathBuf::new(),
+                    git_pull: true,
+                    git_ipv4: false,
+                    components: Vec::new(),
+                    resources: None,
+                })
+                .collect(),
+        }
+    }
+
+    #[test]
+    fn derives_a_route_safe_key_from_a_project_name() {
+        let config = Config::default();
+        assert_eq!(config.unique_key("app-dioxus", "updater"), "app-dioxus");
+        assert_eq!(config.unique_key("My App!", "updater"), "my-app");
+        assert_eq!(config.unique_key("...", "updater"), "app");
+    }
+
+    #[test]
+    fn suffixes_a_key_that_is_taken() {
+        let config = config_with(&["android", "android-2"]);
+        assert_eq!(config.unique_key("android", "updater"), "android-3");
+    }
+
+    #[test]
+    fn will_not_shadow_the_reserved_self_key() {
+        assert_eq!(
+            Config::default().unique_key("updater", "updater"),
+            "updater-2"
+        );
+    }
+
+    #[test]
+    fn staleness_needs_a_reference_build_to_compare_against() {
+        let dir = tempfile::tempdir().expect("tempdir");
+        let rule = StaleRule {
+            path: PathBuf::from("arm.so"),
+            older_than: PathBuf::from("x86.so"),
+        };
+
+        // Neither built: nothing to be behind.
+        assert!(!rule.is_stale(dir.path()));
+
+        // Reference exists, target doesn't: stale.
+        std::fs::write(dir.path().join("x86.so"), b"").expect("write");
+        assert!(rule.is_stale(dir.path()));
+
+        // Target rebuilt afterwards: current.
+        let later = std::time::SystemTime::now() + std::time::Duration::from_secs(60);
+        std::fs::write(dir.path().join("arm.so"), b"").expect("write");
+        filetime::set_file_mtime(
+            dir.path().join("arm.so"),
+            filetime::FileTime::from_system_time(later),
+        )
+        .expect("set mtime");
+        assert!(!rule.is_stale(dir.path()));
+    }
+
+    #[test]
+    fn contracting_a_path_round_trips_back_through_expansion() {
+        let home = std::env::home_dir().expect("a home directory");
+        assert_eq!(contract_tilde(&home.join("repos/app")), "~/repos/app");
+        assert_eq!(contract_tilde(&home), "~");
+        // Outside home, nothing to shorten.
+        assert_eq!(contract_tilde(Path::new("/opt/thing")), "/opt/thing");
+        // What a phone is shown is what the server accepts back.
+        assert_eq!(
+            expand_tilde(&contract_tilde(&home.join("repos/app"))),
+            home.join("repos/app")
+        );
+    }
+
+    #[test]
+    fn expands_a_leading_tilde_and_leaves_everything_else_alone() {
+        let home = std::env::home_dir().expect("a home directory");
+        assert_eq!(expand_tilde("~"), home);
+        assert_eq!(expand_tilde("~/repos"), home.join("repos"));
+        assert_eq!(expand_tilde("  ~/repos  "), home.join("repos"));
+        // Absolute and relative paths are untouched.
+        assert_eq!(
+            expand_tilde("/home/someone/repos"),
+            PathBuf::from("/home/someone/repos")
+        );
+        assert_eq!(expand_tilde("repos"), PathBuf::from("repos"));
+        // Another user's home needs the password database; left literal
+        // rather than half-resolved.
+        assert_eq!(
+            expand_tilde("~someone/repos"),
+            PathBuf::from("~someone/repos")
+        );
+        // A tilde inside a path is a legitimate directory name.
+        assert_eq!(expand_tilde("/tmp/~backup"), PathBuf::from("/tmp/~backup"));
+    }
+
+    #[test]
+    fn reads_the_build_step_a_project_asks_for() {
+        let dir = tempfile::tempdir().expect("tempdir");
+        // The normal case: no file at all, which is not an error.
+        assert!(project_config(dir.path()).components.is_empty());
+
+        std::fs::write(
+            dir.path().join(PROJECT_CONFIG_FILE),
+            "// what this project wants built for the phone\n\
+             gitPull: false,\n\
+             components: [Apk(name: \"app\", build: \"./build-apk.sh\")],\n",
+        )
+        .expect("write");
+        let asked = project_config(dir.path());
+        assert!(!asked.git_pull);
+        let [component] = &asked.components[..] else {
+            panic!("one component")
+        };
+        assert_eq!(component.name(), "app");
+        assert_eq!(
+            component.build().split_first().expect("a program").0,
+            "./build-apk.sh"
+        );
+
+        // A typo in one project must not take the whole app list down, so
+        // it reads as "asks for nothing" rather than as an error.
+        std::fs::write(
+            dir.path().join(PROJECT_CONFIG_FILE),
+            "components: [Apk(name:",
+        )
+        .expect("write");
+        assert!(project_config(dir.path()).components.is_empty());
+    }
+
+    /// Both ways of writing a command mean the same argv, and the one with
+    /// an argument that could not survive being split is written back in
+    /// the form that survives.
+    #[test]
+    fn a_command_reads_as_a_line_or_as_arguments() {
+        #[derive(Serialize, Deserialize)]
+        struct Holder {
+            command: Command,
+        }
+        let argv = |text: &str| -> Vec<String> {
+            let holder: Holder = wg_app_link::format::parse(text).expect("parse");
+            let (program, args) = holder.command.split_first().expect("a program");
+            std::iter::once(program.clone())
+                .chain(args.iter().cloned())
+                .collect()
+        };
+
+        let expected = ["cargo", "build", "--release"];
+        assert_eq!(argv(r#"command: "cargo build --release","#), expected);
+        assert_eq!(
+            argv(r#"command: ["cargo", "build", "--release"],"#),
+            expected
+        );
+        // Runs of whitespace are one separator, so a line stays readable.
+        assert_eq!(argv("command: \"cargo   build\t--release\","), expected);
+
+        // An argument containing a space has no line form to go back to,
+        // so it must come back as arguments or the round trip loses it.
+        let spaced = r#"command: ["./build.sh", "--note", "two words"],"#;
+        let holder: Holder = wg_app_link::format::parse(spaced).expect("parse");
+        let written = wg_app_link::format::render(&holder).expect("render");
+        assert!(
+            written.starts_with("command: ["),
+            "an argument with a space must be written back as arguments, got {written}",
+        );
+        assert_eq!(argv(&written), ["./build.sh", "--note", "two words"]);
+
+        // And the ordinary case goes back to the line it was written as.
+        let plain: Holder =
+            wg_app_link::format::parse(r#"command: "cargo build --release","#).expect("parse");
+        assert_eq!(
+            wg_app_link::format::render(&plain).expect("render").trim(),
+            r#"command: "cargo build --release","#,
+        );
+    }
+
+    /// The half of the round trip that a `skip_serializing_if` can break
+    /// silently: the file still loads, it just quietly stops carrying the
+    /// setting. See this module's `format` doc.
+    ///
+    /// And the other half: a setting left at its default writes nothing,
+    /// so the file stays readable as "what this machine has actually
+    /// chosen" rather than listing every toggle that exists.
+    #[test]
+    fn a_setting_survives_the_file() {
+        let mut config = config_with(&["app"]);
+        let text = wg_app_link::format::render(&config).expect("render");
+        assert!(
+            !text.contains("gitIpv4"),
+            "the default is written by not writing it: {text}"
+        );
+
+        config.projects[0].git_ipv4 = true;
+        let text = wg_app_link::format::render(&config).expect("render");
+        assert!(text.contains("gitIpv4: true"), "not written: {text}");
+
+        let read: Config = wg_app_link::format::parse(&text).expect("parse");
+        assert!(read.projects[0].git_ipv4);
+    }
+
+    #[test]
+    fn round_trips_through_the_config_file() {
+        let dir = tempfile::tempdir().expect("tempdir");
+        let path = dir.path().join("config.ron");
+
+        // A missing file is the ordinary first-run state, not an error.
+        assert!(Config::load(&path).expect("load").projects.is_empty());
+
+        let mut config = config_with(&["demo"]);
+        config.repo_roots = vec![PathBuf::from("/repos")];
+        config.save(&path).expect("save");
+
+        let loaded = Config::load(&path).expect("reload");
+        assert_eq!(loaded.repo_roots, [PathBuf::from("/repos")]);
+        assert_eq!(loaded.projects[0].key, "demo");
+
+        // The house rule both halves of `format` depend on: what is written
+        // is the *body* of the struct, with no outer parentheses and
+        // nothing indented for them. This is asserted here rather than
+        // trusted because `render` strips what `parse` adds back -- if only
+        // one of the two ever changed, every file on disk would still load
+        // and only look wrong.
+        let text = std::fs::read_to_string(&path).expect("read back");
+        assert!(!text.trim_start().starts_with('('), "outer parens: {text}");
+        assert!(
+            text.starts_with("repoRoots: ["),
+            "top level should sit at column 0: {text}"
+        );
+    }
+}
diff --git a/server/src/discover.rs b/server/src/discover.rs
new file mode 100644
index 0000000..0920d52
--- /dev/null
+++ b/server/src/discover.rs
@@ -0,0 +1,446 @@
+//! Finding an app's built APKs given only the path to its *project*, and
+//! finding candidate projects given a repo root.
+//!
+//! # Why fixed path shapes rather than a general search
+//!
+//! A general recursive search is far too slow to sit behind an interactive
+//! "add an app" screen. Measured against one real 28 GB / 39k-file Rust +
+//! Android project, warm cache:
+//!
+//! | approach                                          | time   |
+//! |---------------------------------------------------|--------|
+//! | `find -name '*.apk'`                              | 406 ms |
+//! | the same, depth-limited to 8..16                  | 305 ms |
+//! | the same, pruning `.git`/`deps`/`.fingerprint`/... | 132 ms |
+//! | the patterns below                                |   6 ms |
+//!
+//! Depth limits buy nothing because the breadth is in shallow Cargo/Gradle
+//! output directories, and pruning by name still leaves an order of
+//! magnitude to make up -- on a warm cache, at that. So this matches the
+//! handful of shapes Android build tooling actually emits into.
+//!
+//! The patterns stay cheap because every literal segment is a `stat` rather
+//! than a directory listing: only a `*` costs a `read_dir`, and only ever of
+//! one level. Adding a pattern for a build system not covered here is the
+//! intended way to extend this -- see [`APK_PATTERNS`].
+
+use std::path::{Path, PathBuf};
+use std::time::SystemTime;
+
+/// Where Android build tooling puts APKs, relative to a project root. `*`
+/// matches one path segment.
+///
+/// Covers, in order: a single-module Gradle project; the usual one- and
+/// two-level module layouts (`app/`, `androidApp/`, `composeApp/`, and
+/// nested variants including React Native / Capacitor's `android/app/`);
+/// Flutter; and dioxus-cli's generated Android project under a Cargo
+/// `target/` directory.
+const APK_PATTERNS: &[&str] = &[
+    "build/outputs/apk/*/*.apk",
+    "*/build/outputs/apk/*/*.apk",
+    "*/*/build/outputs/apk/*/*.apk",
+    "build/app/outputs/flutter-apk/*.apk",
+    "target/dx/*/*/android/app/app/build/outputs/apk/*/*.apk",
+];
+
+/// Marker files that make a directory worth treating as an app project when
+/// scanning a repo root. Deliberately loose -- a false positive costs one
+/// wasted [`find_apks`] call (microseconds), while a false negative means
+/// the project never gets suggested at all.
+const PROJECT_MARKERS: &[&str] = &[
+    "settings.gradle",
+    "settings.gradle.kts",
+    "build.gradle",
+    "build.gradle.kts",
+    "Dioxus.toml",
+    "pubspec.yaml",
+];
+
+/// Directory names never worth expanding a `*` into. `node_modules` and
+/// `.git` are the expensive ones; hidden directories are skipped wholesale
+/// below since no build system emits APKs into one.
+const SKIP_DIRS: &[&str] = &["node_modules", "Pods", "vendor"];
+
+/// A built APK found under a project, with the mtime used both to pick a
+/// default among several and to tell the app whether the installed copy is
+/// behind (see `crate::routes`'s manifest).
+#[derive(Debug, Clone)]
+pub struct ApkCandidate {
+    pub path: PathBuf,
+    pub modified: SystemTime,
+    /// The build variant, taken from the containing directory name
+    /// (`debug`, `release`, `freeRelease`, ...) -- what the app shows when
+    /// offering a choice between several.
+    pub variant: String,
+}
+
+/// Every APK built under `project`, newest first.
+///
+/// Derived artifacts this server itself produced (`*.slim.apk`, see
+/// `crate::strip`) and unsigned intermediates are filtered out: neither is
+/// a build output a caller would ever mean to select, and offering the slim
+/// copy of an APK beside that APK would be two entries for one build.
+pub fn find_apks(project: &Path) -> Vec<ApkCandidate> {
+    let mut found = Vec::new();
+    for pattern in APK_PATTERNS {
+        for path in expand(project, pattern) {
+            let name = path.file_name().unwrap_or_default().to_string_lossy();
+            if name.ends_with(".slim.apk") || name.ends_with("-unsigned.apk") {
+                continue;
+            }
+            let Ok(modified) = std::fs::metadata(&path).and_then(|meta| meta.modified()) else {
+                continue;
+            };
+            let variant = path
+                .parent()
+                .and_then(|parent| parent.file_name())
+                .map(|name| name.to_string_lossy().into_owned())
+                .unwrap_or_default();
+            found.push(ApkCandidate {
+                path,
+                modified,
+                variant,
+            });
+        }
+    }
+    // A project can match more than one pattern (a Gradle project whose
+    // root is also a module), so the same file can be found twice.
+    found.sort_by(|a, b| a.path.cmp(&b.path));
+    found.dedup_by(|a, b| a.path == b.path);
+    found.sort_by_key(|apk| std::cmp::Reverse(apk.modified));
+    found
+}
+
+/// A project directory found under a configured repo root that the "add an
+/// app" screen can offer: one with a build under it, or one carrying a
+/// declaration of its own, which can be added before its first build.
+#[derive(Debug, Clone)]
+pub struct ProjectSuggestion {
+    pub path: PathBuf,
+    /// Display name: the project's path relative to the root it was found
+    /// under. Not just the directory's own name, because the interesting
+    /// ones are routinely generic -- two repos each with an `app/` produce
+    /// two suggestions indistinguishable by name alone, where `foo/app` and
+    /// `bar/app` are not. The real label is read out of the APK once the
+    /// project is actually added (`crate::apkinfo`), which costs a
+    /// subprocess per APK and so isn't done for every suggestion.
+    pub name: String,
+    pub apk_count: usize,
+    pub newest: SystemTime,
+}
+
+/// Every project under `roots` worth offering, newest first -- by build
+/// where there is one, and by when the project declared itself where there
+/// isn't.
+///
+/// Descends two levels below each root, which covers both a root holding
+/// projects directly and one holding multi-project repositories (a repo
+/// with `app/` and `app-dioxus/` side by side). Deeper than that costs
+/// fanout for a layout nobody uses, and a project nested further can always
+/// be added by typing its path.
+pub fn scan_roots(roots: &[PathBuf]) -> Vec<ProjectSuggestion> {
+    let mut suggestions = Vec::new();
+    let mut seen = std::collections::HashSet::new();
+
+    for root in roots {
+        for depth1 in child_dirs(root) {
+            consider(&depth1, root, &mut suggestions, &mut seen);
+            // A declaration ends the descent: it says "this directory is
+            // the project", so whatever is underneath is that project's
+            // own layout rather than another project to offer. Without
+            // this, a repository declaring itself at the root and building
+            // through a Gradle module underneath came back twice -- the
+            // root matched through the one-level APK pattern, the module
+            // through its own marker and the same build, and the two are
+            // different directories so nothing deduplicated them.
+            //
+            // A genuinely separate project nested inside a declared one
+            // can still be added by typing its path, which is the escape
+            // hatch for every layout this scan does not cover.
+            if declaration_of(&depth1).is_some() {
+                continue;
+            }
+            for depth2 in child_dirs(&depth1) {
+                consider(&depth2, root, &mut suggestions, &mut seen);
+            }
+        }
+    }
+
+    suggestions.sort_by_key(|item| std::cmp::Reverse(item.newest));
+    suggestions
+}
+
+/// The declaration this directory carries, if it carries one.
+///
+/// The path rather than a bare yes, because a project offered before its
+/// first build is sorted by when it said so and there is nothing else to
+/// date it by.
+fn declaration_of(dir: &Path) -> Option<PathBuf> {
+    let path = dir.join(crate::config::PROJECT_CONFIG_FILE);
+    path.is_file().then_some(path)
+}
+
+fn consider(
+    dir: &Path,
+    root: &Path,
+    suggestions: &mut Vec<ProjectSuggestion>,
+    seen: &mut std::collections::HashSet<PathBuf>,
+) {
+    // A project carrying this server's own config file has said outright
+    // that it is one, which is a stronger claim than any build-system
+    // marker guessed at below.
+    let declaration = declaration_of(dir);
+    let declared = declaration.is_some();
+    if !declared
+        && !PROJECT_MARKERS
+            .iter()
+            .any(|marker| dir.join(marker).is_file())
+    {
+        return;
+    }
+
+    let apks = find_apks(dir);
+    let newest = match apks.first() {
+        Some(apk) => apk.modified,
+        // Offered with nothing built, because a project that declares
+        // itself usually declares a build step too -- and that step is
+        // frequently the thing that produces the first APK, so requiring
+        // one first is a chicken-and-egg. Sorted by when it said so, which
+        // keeps a freshly declared project among the recent ones instead
+        // of at the bottom forever.
+        None => match &declaration {
+            Some(path) => std::fs::metadata(path)
+                .and_then(|meta| meta.modified())
+                .unwrap_or(SystemTime::UNIX_EPOCH),
+            None => return,
+        },
+    };
+    if !seen.insert(dir.to_path_buf()) {
+        return;
+    }
+    suggestions.push(ProjectSuggestion {
+        path: dir.to_path_buf(),
+        name: dir
+            .strip_prefix(root)
+            .unwrap_or(dir)
+            .to_string_lossy()
+            .into_owned(),
+        apk_count: apks.len(),
+        newest,
+    });
+}
+
+/// Immediate subdirectories of `dir`, minus hidden ones and the known-huge
+/// names in [`SKIP_DIRS`]. Symlinks are not followed -- a repo root full of
+/// symlinks into each other would otherwise turn a bounded scan unbounded.
+fn child_dirs(dir: &Path) -> Vec<PathBuf> {
+    let Ok(entries) = std::fs::read_dir(dir) else {
+        return Vec::new();
+    };
+    entries
+        .filter_map(|entry| entry.ok())
+        .filter(|entry| entry.file_type().is_ok_and(|kind| kind.is_dir()))
+        .map(|entry| entry.path())
+        .filter(|path| !is_skipped(path))
+        .collect()
+}
+
+fn is_skipped(path: &Path) -> bool {
+    let Some(name) = path.file_name().map(|name| name.to_string_lossy()) else {
+        return true;
+    };
+    name.starts_with('.') || SKIP_DIRS.contains(&name.as_ref())
+}
+
+/// Expands a `/`-separated pattern against `base`, one segment at a time.
+/// A literal segment is appended without touching the filesystem; only `*`
+/// and `*.apk`-style segments read a directory, and only that one level.
+/// The final existence check happens in [`find_apks`]'s `metadata` call, so
+/// a literal-only pattern costs nothing until then.
+fn expand(base: &Path, pattern: &str) -> Vec<PathBuf> {
+    let mut current = vec![base.to_path_buf()];
+    for segment in pattern.split('/') {
+        let mut next = Vec::new();
+        if let Some(suffix) = segment.strip_prefix('*') {
+            for dir in &current {
+                let Ok(entries) = std::fs::read_dir(dir) else {
+                    continue;
+                };
+                for entry in entries.filter_map(|entry| entry.ok()) {
+                    let path = entry.path();
+                    if is_skipped(&path) {
+                        continue;
+                    }
+                    if suffix.is_empty() || path.to_string_lossy().ends_with(suffix) {
+                        next.push(path);
+                    }
+                }
+            }
+        } else {
+            next.extend(current.iter().map(|dir| dir.join(segment)));
+        }
+        if next.is_empty() {
+            return Vec::new();
+        }
+        current = next;
+    }
+    current
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    /// Builds a tree of empty files from `/`-separated relative paths.
+    fn tree(paths: &[&str]) -> tempfile::TempDir {
+        let dir = tempfile::tempdir().expect("tempdir");
+        for path in paths {
+            let full = dir.path().join(path);
+            std::fs::create_dir_all(full.parent().expect("has a parent")).expect("mkdir");
+            std::fs::write(&full, b"").expect("write");
+        }
+        dir
+    }
+
+    fn names(apks: &[ApkCandidate]) -> Vec<String> {
+        apks.iter()
+            .map(|apk| apk.path.file_name().unwrap().to_string_lossy().into_owned())
+            .collect()
+    }
+
+    #[test]
+    fn finds_apks_across_the_supported_module_layouts() {
+        let root = tree(&[
+            "build/outputs/apk/debug/root-debug.apk",
+            "app/build/outputs/apk/debug/one-level.apk",
+            "androidApp/nested/build/outputs/apk/debug/two-level.apk",
+            "build/app/outputs/flutter-apk/app-debug.apk",
+            "target/dx/demo/debug/android/app/app/build/outputs/apk/debug/dx.apk",
+        ]);
+        let mut found = names(&find_apks(root.path()));
+        found.sort();
+        assert_eq!(
+            found,
+            [
+                "app-debug.apk",
+                "dx.apk",
+                "one-level.apk",
+                "root-debug.apk",
+                "two-level.apk"
+            ]
+        );
+    }
+
+    #[test]
+    fn ignores_this_servers_own_derived_artifacts() {
+        // The slim copy sits beside the APK it was derived from; offering
+        // both would be two entries for one build.
+        let root = tree(&[
+            "app/build/outputs/apk/debug/app-debug.apk",
+            "app/build/outputs/apk/debug/app-debug.apk.slim.apk",
+            "app/build/outputs/apk/release/app-release-unsigned.apk",
+        ]);
+        assert_eq!(names(&find_apks(root.path())), ["app-debug.apk"]);
+    }
+
+    #[test]
+    fn reports_the_variant_directory_and_orders_newest_first() {
+        let root = tree(&[
+            "app/build/outputs/apk/debug/app-debug.apk",
+            "app/build/outputs/apk/freeRelease/app-freeRelease.apk",
+        ]);
+        // mtimes from a single `tree` call are too close together to order
+        // reliably, so make the intended winner explicitly newer.
+        let newer = root
+            .path()
+            .join("app/build/outputs/apk/freeRelease/app-freeRelease.apk");
+        let stamp = std::time::SystemTime::now() + std::time::Duration::from_secs(60);
+        filetime::set_file_mtime(&newer, filetime::FileTime::from_system_time(stamp))
+            .expect("set mtime");
+
+        let found = find_apks(root.path());
+        assert_eq!(found[0].variant, "freeRelease");
+        assert_eq!(found[1].variant, "debug");
+    }
+
+    #[test]
+    fn skips_directories_that_are_never_worth_walking() {
+        let root = tree(&[
+            "node_modules/pkg/build/outputs/apk/debug/vendored.apk",
+            ".git/build/outputs/apk/debug/hidden.apk",
+        ]);
+        assert!(find_apks(root.path()).is_empty());
+    }
+
+    #[test]
+    fn suggests_only_marked_projects_that_have_actually_been_built() {
+        let root = tree(&[
+            // Two levels down, the layout a multi-project repo has.
+            "repo/built/settings.gradle.kts",
+            "repo/built/app/build/outputs/apk/debug/built.apk",
+            // Marked, but nothing built yet.
+            "repo/unbuilt/settings.gradle.kts",
+            // Built, but not recognizable as a project root.
+            "repo/unmarked/app/build/outputs/apk/debug/stray.apk",
+        ]);
+        let found = scan_roots(&[root.path().to_path_buf()]);
+        assert_eq!(found.len(), 1, "{found:?}");
+        assert_eq!(found[0].name, "repo/built");
+        assert_eq!(found[0].apk_count, 1);
+    }
+
+    #[test]
+    fn suggests_a_project_sitting_directly_under_a_root() {
+        let root = tree(&[
+            "solo/build.gradle.kts",
+            "solo/build/outputs/apk/debug/solo.apk",
+        ]);
+        let found = scan_roots(&[root.path().to_path_buf()]);
+        assert_eq!(found.len(), 1);
+        assert_eq!(found[0].name, "solo");
+    }
+
+    /// The chicken-and-egg case: a project whose build step is what
+    /// produces the first APK has to be addable before there is one, so
+    /// declaring itself is enough to be offered.
+    #[test]
+    fn a_project_that_declares_itself_is_offered_before_its_first_build() {
+        let root = tree(&[
+            "repo/declared/.dev-updater.ron",
+            // No marker file and nothing built -- the declaration is the
+            // only reason this is a project at all.
+            "repo/silent/src/main.rs",
+        ]);
+        let found = scan_roots(&[root.path().to_path_buf()]);
+        assert_eq!(found.len(), 1, "{found:?}");
+        assert_eq!(found[0].name, "repo/declared");
+        assert_eq!(found[0].apk_count, 0);
+    }
+
+    /// A project that declares itself is *the* project, and must be
+    /// offered once. Before this, a repository with a declaration at its
+    /// root and a Gradle module underneath produced two suggestions for
+    /// one app: the root matched through the one-level APK pattern, the
+    /// module matched through its own marker and its own build, and
+    /// nothing deduplicated them because they are different directories.
+    #[test]
+    fn a_declared_project_is_not_offered_again_through_its_module() {
+        let root = tree(&[
+            "repo/.dev-updater.ron",
+            "repo/app/build.gradle.kts",
+            "repo/app/build/outputs/apk/debug/app-debug.apk",
+        ]);
+        let found = scan_roots(&[root.path().to_path_buf()]);
+        assert_eq!(found.len(), 1, "one app, one suggestion: {found:?}");
+        assert_eq!(found[0].name, "repo", "the declaration names the project");
+        assert_eq!(
+            found[0].apk_count, 1,
+            "and it still finds the build below it"
+        );
+    }
+
+    #[test]
+    fn a_missing_root_is_not_an_error() {
+        assert!(scan_roots(&[PathBuf::from("/definitely/not/here")]).is_empty());
+    }
+}
diff --git a/server/src/git.rs b/server/src/git.rs
new file mode 100644
index 0000000..bef464b
--- /dev/null
+++ b/server/src/git.rs
@@ -0,0 +1,810 @@
+//! What the checkout under a project looks like, and bringing it up to
+//! date.
+//!
+//! Uses the `git` binary rather than a Rust git library: it is already on
+//! any machine that produced these projects, it reads the same config,
+//! credentials, and remotes the person uses by hand, and there is no
+//! second implementation of "what does this repo consider upstream" to
+//! disagree with the one they debug with -- which is what prefers what
+//! is already here over a new dependency.
+//!
+//! The split that matters here is network versus not. [`status`] only
+//! reads what is already on disk, so it is cheap enough to answer on every
+//! manifest request; it reports the branch as of the last fetch, which is
+//! exactly what "3 commits behind" means everywhere else in git. [`fetch`]
+//! is the one call that talks to a remote, and happens only when a person
+//! asks for an update.
+
+use std::path::{Path, PathBuf};
+use std::process::Command;
+use std::sync::Arc;
+use std::time::{Duration, Instant};
+
+/// A project's checkout, as of the last fetch.
+#[derive(Debug, Clone, PartialEq, Eq, serde::Serialize)]
+#[serde(rename_all = "camelCase")]
+pub struct GitStatus {
+    /// The checked-out branch, or `HEAD` when detached.
+    pub branch: String,
+    /// Uncommitted changes, which make pulling something this shouldn't
+    /// decide on its own.
+    pub dirty: bool,
+    /// `origin/main` and the like; absent for a branch that tracks
+    /// nothing, in which case there is nothing to pull.
+    pub upstream: Option<String>,
+    /// The top of the checkout. What gets pulled, and what a person calls
+    /// the project -- a card showing `~/repos/thing/app` is naming the
+    /// directory this server watches, not the repository it lives in.
+    ///
+    /// Contracted for display here rather than at the one place that shows
+    /// it, because that is the only thing it is for; nothing on this side
+    /// opens it.
+    pub root: String,
+}
+
+/// Reads `project`'s checkout without touching the network. `None` when
+/// it isn't in a git repository at all, which is not an error -- a project
+/// can perfectly well be a directory somebody builds by hand.
+pub fn status(project: &Path) -> Option<GitStatus> {
+    // Doubles as the "is this a repo at all" question, which is why it is
+    // first and why its failure is a plain `None`.
+    let toplevel = git(project, &["rev-parse", "--show-toplevel"]).ok()?;
+    let root = crate::config::contract_tilde(Path::new(&toplevel));
+
+    let branch = git(project, &["rev-parse", "--abbrev-ref", "HEAD"]).ok()?;
+    let upstream = git(project, &["rev-parse", "--abbrev-ref", "@{u}"]).ok();
+    let dirty = git(project, &["status", "--porcelain"])
+        .map(|out| !out.is_empty())
+        .unwrap_or(false);
+
+    Some(GitStatus {
+        branch,
+        dirty,
+        upstream,
+        root,
+    })
+}
+
+/// Whether anything under `within` is edited or untracked, relative to
+/// `project`. `None` when the checkout cannot be read.
+///
+/// Scoped for the same reason `subtree_head` is: a whole-checkout answer
+/// would put every component of a one-checkout-two-things project into the
+/// same state on any edit, which is the daily annoyance the scoping exists
+/// to avoid. An edit under `app/` is about the app.
+///
+/// Untracked files count. A new source file genuinely changes what a build
+/// produces, and `.gitignore` has already filtered out the editor noise
+/// and the build outputs, so what is left is real. This also answers the
+/// submodule case correctly and without a special case: a submodule whose
+/// working tree has moved shows as a modified path, so whichever component
+/// contains it goes unknown and the others do not.
+pub fn subtree_dirty(project: &Path, within: Option<&Path>) -> Option<bool> {
+    let mut args = vec!["status", "--porcelain", "--"];
+    let within = within.map(|path| path.to_string_lossy().into_owned());
+    args.push(within.as_deref().unwrap_or("."));
+    git(project, &args).ok().map(|out| !out.trim().is_empty())
+}
+
+/// The newest commit touching `within` (a path relative to `project`), or
+/// the whole checkout when `within` is `None`.
+///
+/// This is what a build is recorded against, and the scoping is the point.
+/// One checkout routinely produces several things -- a backend under
+/// `server/` and an APK under `app/` -- and comparing both against `HEAD`
+/// would mark the backend stale for a commit that only touched the app,
+/// offering a pointless rebuild on every app-only change. Asking what last
+/// touched the component's own directory makes "out of date" mean what a
+/// person reading the card expects it to.
+///
+/// `None` when the checkout cannot be read, which is "we cannot tell"
+/// rather than an answer; see `BuildState::freshness`.
+pub fn subtree_head(project: &Path, within: Option<&Path>) -> Option<String> {
+    let mut args = vec!["log", "-1", "--format=%H"];
+    let within = within.map(|path| path.to_string_lossy().into_owned());
+    if let Some(path) = within.as_deref() {
+        args.push("--");
+        args.push(path);
+    }
+    let sha = git(project, &args).ok()?;
+    (!sha.is_empty()).then_some(sha)
+}
+
+/// Commits the upstream branch has that this one doesn't, counted from
+/// refs already on disk. Only meaningful right after a fetch, which is why
+/// the only caller is the pull itself.
+pub fn behind(project: &Path) -> usize {
+    git(project, &["rev-list", "--count", "HEAD..@{u}"])
+        .ok()
+        .and_then(|count| count.parse().ok())
+        .unwrap_or(0)
+}
+
+/// Whether pulling this checkout would actually move it.
+///
+/// Read-only: `ls-remote` asks the remote what it has without writing
+/// anything into the checkout, so this can run on a timer behind every
+/// manifest request. Fetching would be the mutating half, and that is
+/// `pull`'s job.
+///
+/// The question is asked as "would a fast-forward move HEAD?", i.e. is
+/// the remote's commit already an ancestor of what is checked out. The
+/// obvious comparison -- remote tip against the remote-tracking ref --
+/// answers a different question and gets two cases wrong: a checkout that
+/// has fetched but not merged looks current when a pull would move it,
+/// and a checkout carrying local commits looks behind when a pull would
+/// do nothing.
+///
+/// A remote commit that isn't in the object store yet makes
+/// `--is-ancestor` fail, which is the right answer for the right reason:
+/// a commit we don't have is by definition new.
+pub fn has_new_commits(project: &Path, ipv4: bool) -> Result<bool, String> {
+    let upstream = git(project, &["rev-parse", "--abbrev-ref", "@{u}"])
+        .map_err(|_| "branch tracks no upstream".to_string())?;
+    let (remote, branch) = upstream
+        .split_once('/')
+        .ok_or_else(|| format!("cannot tell a remote from a branch in {upstream}"))?;
+
+    let listed = run_bounded(
+        project,
+        ipv4,
+        &["ls-remote", remote, &format!("refs/heads/{branch}")],
+    )?;
+    // "<sha>\trefs/heads/<branch>"; empty when the branch is gone.
+    let Some(remote_sha) = listed.split_whitespace().next() else {
+        return Err(format!("{remote} has no branch {branch}"));
+    };
+
+    Ok(git(
+        project,
+        &["merge-base", "--is-ancestor", remote_sha, "HEAD"],
+    )
+    .is_err())
+}
+
+/// Updates the remote-tracking refs. The one call here that uses the
+/// network, and therefore the one that can hang: a black-holed host makes
+/// a bare `git fetch` sit for minutes, which is long enough to be
+/// indistinguishable from the server being down.
+///
+/// Bounded twice over. `ConnectTimeout` caps the part that actually
+/// hangs, and `BatchMode` makes a key that wants a passphrase fail rather
+/// than wait for a person who isn't there. Then the whole thing is killed
+/// at [`REMOTE_HARD_TIMEOUT`] regardless, so nothing accumulates when a
+/// remote is merely very slow.
+pub fn fetch(project: &Path, ipv4: bool) -> Result<(), String> {
+    // `fetch` is one of the few git subcommands that takes the flag
+    // itself, and that is what carries the preference to an https remote.
+    // An ssh remote is covered by `ssh_command` either way.
+    let mut args = vec!["fetch", "--quiet"];
+    if ipv4 {
+        args.insert(1, "-4");
+    }
+    run_bounded(project, ipv4, &args).map(|_| ())
+}
+
+/// How git should invoke ssh: the two bounds every remote command needs,
+/// and IPv4 only when this project asked for it.
+///
+/// The address family is set *here* rather than on the git subcommand
+/// because most subcommands have no such option. `git fetch` takes `-4`;
+/// `git ls-remote` does not, and rejects it with "unknown switch" -- and
+/// `ls-remote` is what the new-commits check runs, so a flag spliced onto
+/// every command would have broken exactly the thing the card reports.
+/// The ssh invocation covers every remote command uniformly, which is what
+/// a setting called "force IPv4" has to do to be worth having.
+fn ssh_command(ipv4: bool) -> String {
+    let family = if ipv4 { " -4" } else { "" };
+    format!("ssh{family} -o ConnectTimeout=5 -o BatchMode=yes")
+}
+
+/// Runs a git command that talks to a remote, with the two bounds such a
+/// command needs: `ConnectTimeout` for a host that never answers,
+/// `BatchMode` so a key wanting a passphrase fails instead of waiting for
+/// somebody who isn't there, and a hard stop for a remote that connects
+/// and then stalls.
+fn run_bounded(project: &Path, ipv4: bool, args: &[&str]) -> Result<String, String> {
+    let mut child = Command::new("git")
+        .arg("-C")
+        .arg(project)
+        .args(args)
+        .env("GIT_TERMINAL_PROMPT", "0")
+        // Appended rather than replaced by git, so a custom ssh setup in
+        // the user's config still applies.
+        .env("GIT_SSH_COMMAND", ssh_command(ipv4))
+        .stdout(std::process::Stdio::piped())
+        .stderr(std::process::Stdio::piped())
+        .spawn()
+        .map_err(|err| format!("failed to run git {}: {err}", args[0]))?;
+
+    let deadline = Instant::now() + REMOTE_HARD_TIMEOUT;
+    loop {
+        match child.try_wait() {
+            Ok(Some(_)) => {
+                let output = child
+                    .wait_with_output()
+                    .map_err(|err| format!("reading git output: {err}"))?;
+                return if output.status.success() {
+                    Ok(String::from_utf8_lossy(&output.stdout).trim().to_string())
+                } else {
+                    let stderr = String::from_utf8_lossy(&output.stderr);
+                    Err(remote_failure(project, args[0], stderr.trim()))
+                };
+            }
+            Ok(None) if Instant::now() >= deadline => {
+                let _ = child.kill();
+                let _ = child.wait();
+                return Err(format!(
+                    "git {} took longer than {}s and was stopped",
+                    args[0],
+                    REMOTE_HARD_TIMEOUT.as_secs()
+                ));
+            }
+            Ok(None) => std::thread::sleep(Duration::from_millis(50)),
+            Err(err) => return Err(format!("waiting on git {}: {err}", args[0])),
+        }
+    }
+}
+
+/// Fast-forwards the current branch onto its upstream.
+///
+/// `--ff-only` deliberately: a merge or a rebase can conflict, and
+/// resolving a conflict is not something to start from a phone with no way
+/// to finish it. Refusing to touch a dirty tree is the same reasoning --
+/// the failure is reported and the working tree is left exactly as it was.
+pub fn pull(project: &Path, ipv4: bool) -> Result<(), String> {
+    let status = status(project).ok_or_else(|| "not a git repository".to_string())?;
+    if status.upstream.is_none() {
+        return Err(format!(
+            "branch {} tracks no upstream, so there is nothing to pull",
+            status.branch
+        ));
+    }
+    if status.dirty {
+        return Err(format!(
+            "{} has uncommitted changes -- refusing to pull over them. Commit or stash on the \
+             build machine first.",
+            project.display()
+        ));
+    }
+    git(project, &["merge", "--ff-only", "@{u}"])?;
+
+    // A merge moves the *pointer* a submodule is recorded at without
+    // touching its working tree, so a pull that updated one leaves the
+    // build compiling the old contents -- which is precisely the drift a
+    // submodule is here to prevent, arriving quietly. `git pull
+    // --recurse-submodules` would cover it, but this fetches and merges
+    // separately so that the two failures can be told apart, and `merge`
+    // has no such flag.
+    //
+    // A no-op in a repository with no submodules, which is most of them,
+    // and not fatal in one where it fails: the merge already landed, so
+    // reporting the whole pull as failed would be worse than saying the
+    // submodule is behind.
+    //
+    // Through `run_bounded` rather than `git`, because this one talks to a
+    // remote: it needs the address-family preference in `GIT_SSH_COMMAND`
+    // -- `git submodule` has no `-4` of its own to splice on -- and it
+    // needs the timeout, since a clone that hangs on an unreachable
+    // address would otherwise hang the request behind it with no way to
+    // tell what it was waiting for.
+    if let Err(message) = run_bounded(
+        project,
+        ipv4,
+        &["submodule", "update", "--init", "--recursive"],
+    ) {
+        tracing::warn!("pulled, but updating submodules failed: {message}");
+    }
+    Ok(())
+}
+
+/// The phone-sized version of a failed remote command: the first line git
+/// printed, plus what this process can see of the ssh agent when what
+/// failed was authentication.
+///
+/// Shortened here rather than at each place that displays it, so there is
+/// one rule for what a remote failure looks like instead of one per
+/// caller. Git's remote failures run to a paragraph of advice about access
+/// rights and whether the repository exists -- true, generic, and several
+/// lines longer than a card on a phone should carry. The whole of it goes
+/// to the log, which is where someone standing at the build machine can
+/// read it.
+fn remote_failure(project: &Path, command: &str, stderr: &str) -> String {
+    tracing::warn!("git {command} in {} failed: {stderr}", project.display());
+    let headline = stderr
+        .lines()
+        .map(str::trim)
+        .find(|line| !line.is_empty())
+        .unwrap_or(stderr)
+        .to_string();
+    match agent_note(stderr) {
+        Some(note) => format!("{headline}\n\n{note}"),
+        None => headline,
+    }
+}
+
+/// What this process can see of the ssh agent, for a remote command the
+/// far end refused.
+///
+/// This is the whole difference between "it works when I run it myself"
+/// and "it fails from the service": an agent is reached through
+/// `SSH_AUTH_SOCK`, which is inherited, and a daemon started by an init
+/// system is not a child of the login shell that started the agent. That
+/// is invisible from a phone, and it is the first thing anyone would check
+/// at a terminal, so the answer travels with the failure.
+///
+/// Measured rather than guessed. The agent is asked and what it says is
+/// what is reported, so the note can say the agent is fine -- which is the
+/// answer that stops this being blamed for a key the remote simply doesn't
+/// accept. `ssh-add` is a process spawn, so this is reached only from a
+/// failure that has already paid for a network round trip; nothing on the
+/// manifest path runs it.
+fn agent_note(stderr: &str) -> Option<String> {
+    if !stderr.contains("Permission denied") && !stderr.contains("publickey") {
+        return None;
+    }
+    let Ok(socket) = std::env::var("SSH_AUTH_SOCK") else {
+        return Some(
+            "This server has no SSH_AUTH_SOCK, so ssh had no agent to ask. A service started \
+             by an init system doesn't inherit the agent a login shell starts -- it has to be \
+             given the path to one."
+                .to_string(),
+        );
+    };
+    // ssh-add's exit status is the whole answer: 0 having listed
+    // identities, 1 having reached an agent that holds none, 2 having
+    // failed to reach one at all.
+    match Command::new("ssh-add").arg("-l").output() {
+        Err(err) => Some(format!(
+            "SSH_AUTH_SOCK is {socket}, but ssh-add wouldn't run to check it: {err}"
+        )),
+        Ok(output) => Some(match output.status.code() {
+            Some(0) => {
+                let keys = String::from_utf8_lossy(&output.stdout).lines().count();
+                format!(
+                    "The agent at {socket} answered and holds {keys} {}, so this is not the \
+                     agent being missing -- the remote refused the keys it was offered.",
+                    if keys == 1 { "key" } else { "keys" }
+                )
+            }
+            Some(1) => format!(
+                "The agent at {socket} answered but holds no keys. Nothing has been added to \
+                 it since it started."
+            ),
+            _ => format!(
+                "Nothing is answering on SSH_AUTH_SOCK ({socket}), so ssh had no agent to ask."
+            ),
+        }),
+    }
+}
+
+/// When a command talking to a remote is given up on entirely. Only
+/// reached by a host that accepts a connection and then stalls; an
+/// unreachable one fails at `ConnectTimeout` long before this.
+const REMOTE_HARD_TIMEOUT: Duration = Duration::from_secs(30);
+
+/// A checkout to ask about, and how to ask about it.
+///
+/// Carried together because the two are decided in different places -- the
+/// path by the project, the flag by whoever toggled it on this machine --
+/// and `refresh` needs both for each checkout it starts a thread for.
+#[derive(Debug, Clone)]
+pub struct Checkout {
+    pub path: PathBuf,
+    /// Pass `-4` to the commands that talk to a remote.
+    pub ipv4: bool,
+}
+
+/// Remembers what each checkout's remote last said, and refreshes those
+/// answers **off the request path**.
+///
+/// Asking a remote costs a round trip, and the answer is decoration: the
+/// list is about which apps have builds and whether the phone has them.
+/// Making the list wait for it meant every reopen paid for it -- so a
+/// check runs in the background and the answer lands on the next look.
+///
+/// There is no time-based throttle. A check is a single `ls-remote`, which
+/// costs a fraction of a second, and the thing it guards against -- the
+/// list being asked for repeatedly -- only happens when a person opens,
+/// resumes or refreshes the app. Rationing the answer to once per interval
+/// bought little and meant a push made just after a check went unnoticed
+/// for the rest of it. The one rule left is that a checkout never has two
+/// checks running at once, and asking for a check is separated from asking
+/// whether one is outstanding ([`Self::is_checking`]) so that polling for
+/// an answer cannot itself keep starting new work.
+/// Answers kept by [`crate::checks`], which is the whole of the
+/// mechanism: this is the typed face of it for remotes.
+#[derive(Default, Clone)]
+pub struct RemoteChecks(Arc<crate::checks::Checks<PathBuf, bool>>);
+
+impl RemoteChecks {
+    /// Whether this checkout's remote was last seen to have commits it
+    /// doesn't. `false` before anything has been asked, which is the same
+    /// as a card with no badge -- see [`Self::error`] for why that is safe
+    /// to conflate here and nowhere else: a failed check is qualified by
+    /// the error rather than by this.
+    pub fn new_commits(&self, project: &Path) -> bool {
+        self.0.answer(project).unwrap_or(false)
+    }
+
+    /// A check for this checkout is outstanding, so what
+    /// [`Self::new_commits`] says is provisional.
+    pub fn is_checking(&self, project: &Path) -> bool {
+        self.0.is_checking(project)
+    }
+
+    /// Why the last check produced no answer, if it produced none.
+    pub fn error(&self, project: &Path) -> Option<String> {
+        self.0.error(project)
+    }
+
+    /// Records that this checkout is level with its remote, for a pull
+    /// this server just did -- so the card stops offering one without
+    /// waiting for the next check to confirm what it already knows.
+    pub fn mark_current(&self, project: &Path) {
+        self.0
+            .update(project.to_path_buf(), |new_commits| *new_commits = false);
+    }
+
+    /// Asks every checkout that isn't already being asked. Returns at once.
+    pub fn refresh(&self, projects: &[Checkout]) {
+        for checkout in projects {
+            let (project, ipv4) = (checkout.path.clone(), checkout.ipv4);
+            self.0.start(project.clone(), move |_| {
+                has_new_commits(&project, ipv4).into()
+            });
+        }
+    }
+}
+
+/// Runs one git command in `project`, returning trimmed stdout, or
+/// stderr as the error so a failure says what git said.
+fn git(project: &Path, args: &[&str]) -> Result<String, String> {
+    let output = Command::new("git")
+        .arg("-C")
+        .arg(project)
+        .args(args)
+        // Never stop for credentials: this runs with nobody at the
+        // terminal, and a prompt would hang the request instead of
+        // failing it.
+        .env("GIT_TERMINAL_PROMPT", "0")
+        .output()
+        .map_err(|err| format!("failed to run git: {err}"))?;
+    if !output.status.success() {
+        return Err(String::from_utf8_lossy(&output.stderr).trim().to_string());
+    }
+    Ok(String::from_utf8_lossy(&output.stdout).trim().to_string())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn run(dir: &Path, args: &[&str]) {
+        let output = Command::new(args[0])
+            .args(&args[1..])
+            .current_dir(dir)
+            .output()
+            .expect("run command");
+        assert!(
+            output.status.success(),
+            "{args:?}: {}",
+            String::from_utf8_lossy(&output.stderr)
+        );
+    }
+
+    /// An origin repo with one commit, and a clone of it.
+    fn origin_and_clone(root: &Path) -> (PathBuf, PathBuf) {
+        let origin = root.join("origin");
+        std::fs::create_dir_all(&origin).expect("mkdir");
+        run(&origin, &["git", "init", "-q", "-b", "main"]);
+        run(&origin, &["git", "config", "user.email", "t@example.com"]);
+        run(&origin, &["git", "config", "user.name", "Test"]);
+        std::fs::write(origin.join("file"), "one").expect("write");
+        run(&origin, &["git", "add", "."]);
+        run(&origin, &["git", "commit", "-qm", "one"]);
+
+        let clone = root.join("clone");
+        run(
+            root,
+            &[
+                "git",
+                "clone",
+                "-q",
+                origin.to_str().unwrap(),
+                clone.to_str().unwrap(),
+            ],
+        );
+        run(&clone, &["git", "config", "user.email", "t@example.com"]);
+        run(&clone, &["git", "config", "user.name", "Test"]);
+        (origin, clone)
+    }
+
+    #[test]
+    fn reports_nothing_for_a_directory_outside_any_repository() {
+        let dir = tempfile::tempdir().expect("tempdir");
+        assert_eq!(status(dir.path()), None);
+    }
+
+    #[test]
+    fn status_reports_the_checkout_without_touching_the_network() {
+        let dir = tempfile::tempdir().expect("tempdir");
+        let (origin, clone) = origin_and_clone(dir.path());
+
+        let fresh = status(&clone).expect("a repository");
+        assert_eq!(fresh.branch, "main");
+        assert!(!fresh.dirty);
+        assert_eq!(fresh.upstream.as_deref(), Some("origin/main"));
+
+        std::fs::write(origin.join("file"), "two").expect("write");
+        run(&origin, &["git", "commit", "-qam", "two"]);
+        // Unchanged: status only reads what is already here.
+        assert_eq!(status(&clone).expect("status").branch, "main");
+        assert_eq!(behind(&clone), 0);
+    }
+
+    /// The bug this shape of the setting exists to avoid: `-4` spliced
+    /// onto every git subcommand makes `git ls-remote` fail with "unknown
+    /// switch", and `ls-remote` is what the check runs -- so forcing IPv4
+    /// would have turned every card's commit count into an error.
+    #[test]
+    fn forcing_ipv4_does_not_break_the_check() {
+        let dir = tempfile::tempdir().expect("tempdir");
+        let (origin, clone) = origin_and_clone(dir.path());
+        assert!(!has_new_commits(&clone, true).expect("check with ipv4 forced"));
+
+        std::fs::write(origin.join("file"), "two").expect("write");
+        run(&origin, &["git", "commit", "-qam", "two"]);
+        assert!(has_new_commits(&clone, true).expect("check with ipv4 forced"));
+    }
+
+    /// The sibling of the test above, and the reason it exists: the
+    /// address-family preference governs *every* git command that reaches a
+    /// remote, and it was applied to the check while the pull's submodule
+    /// step was left out -- which hung, because `git submodule` has no `-4`
+    /// to splice on and nothing bounded how long it waited.
+    #[test]
+    fn forcing_ipv4_does_not_break_the_pull() {
+        let dir = tempfile::tempdir().expect("tempdir");
+        let (origin, clone) = origin_and_clone(dir.path());
+        std::fs::write(origin.join("file"), "two").expect("write");
+        run(&origin, &["git", "commit", "-qam", "two"]);
+
+        fetch(&clone, true).expect("fetch with ipv4 forced");
+        pull(&clone, true).expect("pull with ipv4 forced");
+        assert!(!has_new_commits(&clone, true).expect("check"));
+    }
+
+    #[test]
+    fn the_ssh_command_carries_the_address_family_only_when_asked() {
+        assert!(!ssh_command(false).contains("-4"));
+        assert!(ssh_command(true).starts_with("ssh -4 "));
+        // The bounds are not optional; forcing a family must not drop them.
+        for command in [ssh_command(false), ssh_command(true)] {
+            assert!(command.contains("ConnectTimeout=5"), "{command}");
+            assert!(command.contains("BatchMode=yes"), "{command}");
+        }
+    }
+
+    /// The property the list depends on: it can tell there is something to
+    /// pull without downloading it or disturbing the repository.
+    #[test]
+    fn a_check_sees_new_commits_and_changes_nothing() {
+        let dir = tempfile::tempdir().expect("tempdir");
+        let (origin, clone) = origin_and_clone(dir.path());
+        assert!(!has_new_commits(&clone, false).expect("check"));
+
+        std::fs::write(origin.join("file"), "two").expect("write");
+        run(&origin, &["git", "commit", "-qam", "two"]);
+
+        // Read through git rather than off disk: a fresh clone packs its
+        // refs, so there is no loose file to compare.
+        let before = git(&clone, &["rev-parse", "origin/main"]).expect("tracking ref");
+        assert!(
+            has_new_commits(&clone, false).expect("check"),
+            "should see the new commit"
+        );
+
+        // Nothing was downloaded and no ref moved -- which is what makes
+        // showing the list a read rather than a mutation.
+        let after = git(&clone, &["rev-parse", "origin/main"]).expect("tracking ref");
+        assert_eq!(before, after, "the check must not move the tracking ref");
+        assert!(
+            !clone.join(".git/FETCH_HEAD").exists(),
+            "the check must not fetch"
+        );
+        assert_eq!(
+            behind(&clone),
+            0,
+            "no objects were downloaded to count against"
+        );
+
+        // Pull is what actually takes them.
+        fetch(&clone, false).expect("fetch");
+        assert_eq!(behind(&clone), 1);
+        pull(&clone, false).expect("pull");
+        assert!(!has_new_commits(&clone, false).expect("check"));
+    }
+
+    /// Only an authentication failure gets the agent note -- an
+    /// unreachable host is a different problem, and answering it with
+    /// "your agent is fine" would send someone the wrong way.
+    #[test]
+    fn only_a_refused_key_is_explained_by_the_agent() {
+        assert!(
+            agent_note("fatal: unable to access: Could not resolve host: example.invalid")
+                .is_none()
+        );
+        assert!(agent_note("git@host: Permission denied (publickey).").is_some());
+    }
+
+    /// The two cases a remote-tip-vs-tracking-ref comparison gets wrong:
+    /// having already fetched doesn't mean the commits have been taken,
+    /// and having local commits of your own doesn't mean you are behind.
+    #[test]
+    fn the_question_is_whether_a_pull_would_move_head() {
+        let dir = tempfile::tempdir().expect("tempdir");
+        let (origin, clone) = origin_and_clone(dir.path());
+
+        std::fs::write(origin.join("file"), "two").expect("write");
+        run(&origin, &["git", "commit", "-qam", "two"]);
+        fetch(&clone, false).expect("fetch");
+        assert!(
+            has_new_commits(&clone, false).expect("check"),
+            "fetched but not merged is still something to pull",
+        );
+
+        pull(&clone, false).expect("pull");
+        run(
+            &clone,
+            &["git", "commit", "-q", "--allow-empty", "-m", "local"],
+        );
+        assert!(
+            !has_new_commits(&clone, false).expect("check"),
+            "a commit of one's own is not the remote being ahead",
+        );
+    }
+
+    /// The list must never wait on a remote. This is the whole reason the
+    /// checks moved off the request path: reopening the app was stalling
+    /// behind a round trip whose answer is decoration.
+    #[test]
+    fn refreshing_returns_at_once_and_the_answer_lands_after() {
+        let dir = tempfile::tempdir().expect("tempdir");
+        let (origin, clone) = origin_and_clone(dir.path());
+        let checks = Arc::new(RemoteChecks::default());
+        let projects = vec![Checkout {
+            path: clone.clone(),
+            ipv4: false,
+        }];
+
+        std::fs::write(origin.join("file"), "two").expect("write");
+        run(&origin, &["git", "commit", "-qam", "two"]);
+
+        let started = Instant::now();
+        checks.refresh(&projects);
+        assert!(
+            started.elapsed() < Duration::from_millis(100),
+            "refresh waited for the check instead of starting it",
+        );
+        assert!(
+            checks.is_checking(&clone),
+            "a first look has an answer outstanding"
+        );
+        // Not known yet, and said so rather than guessed at.
+        assert!(!checks.new_commits(&clone));
+
+        // A second look while the first is still running must not pile on.
+        checks.refresh(&projects);
+
+        settle(&checks, &projects);
+        assert!(
+            checks.new_commits(&clone),
+            "the answer should have landed by now"
+        );
+    }
+
+    /// A push made moments after a check is seen on the very next look.
+    ///
+    /// There is no interval over which the previous answer is reused. That
+    /// used to be thirty seconds, which was exactly long enough for a push
+    /// you had just made to look like nothing had happened.
+    #[test]
+    fn a_push_right_after_a_check_is_seen_on_the_next_look() {
+        let dir = tempfile::tempdir().expect("tempdir");
+        let (origin, clone) = origin_and_clone(dir.path());
+        let checks = Arc::new(RemoteChecks::default());
+        let projects = vec![Checkout {
+            path: clone.clone(),
+            ipv4: false,
+        }];
+
+        checks.refresh(&projects);
+        settle(&checks, &projects);
+        assert!(!checks.new_commits(&clone), "nothing pushed yet");
+
+        std::fs::write(origin.join("file"), "two").expect("write");
+        run(&origin, &["git", "commit", "-qam", "two"]);
+
+        // Straight away, with no waiting out a window.
+        checks.refresh(&projects);
+        settle(&checks, &projects);
+        assert!(
+            checks.new_commits(&clone),
+            "the push should be visible on the next look"
+        );
+    }
+
+    /// Waiting for a running check, the way a poll does: with
+    /// `is_checking`, never `refresh`. Polling with `refresh` would start
+    /// another check each time and so always find one outstanding.
+    fn settle(checks: &Arc<RemoteChecks>, projects: &[Checkout]) {
+        let busy = || {
+            projects
+                .iter()
+                .any(|checkout| checks.is_checking(&checkout.path))
+        };
+        let deadline = Instant::now() + Duration::from_secs(10);
+        while Instant::now() < deadline && busy() {
+            std::thread::sleep(Duration::from_millis(20));
+        }
+        assert!(!busy(), "a check did not finish in time");
+    }
+
+    #[test]
+    fn pulling_fast_forwards_and_clears_being_behind() {
+        let dir = tempfile::tempdir().expect("tempdir");
+        let (origin, clone) = origin_and_clone(dir.path());
+        std::fs::write(origin.join("file"), "two").expect("write");
+        run(&origin, &["git", "commit", "-qam", "two"]);
+        fetch(&clone, false).expect("fetch");
+
+        pull(&clone, false).expect("pull");
+        assert_eq!(behind(&clone), 0);
+        assert_eq!(
+            std::fs::read_to_string(clone.join("file")).expect("read"),
+            "two"
+        );
+    }
+
+    /// The working tree is the person's, and a pull that clobbered it
+    /// would be discovered long after the phone tap that caused it.
+    #[test]
+    fn refuses_to_pull_over_uncommitted_changes() {
+        let dir = tempfile::tempdir().expect("tempdir");
+        let (origin, clone) = origin_and_clone(dir.path());
+        std::fs::write(origin.join("file"), "two").expect("write");
+        run(&origin, &["git", "commit", "-qam", "two"]);
+        fetch(&clone, false).expect("fetch");
+
+        std::fs::write(clone.join("file"), "local edit").expect("write");
+        assert!(status(&clone).expect("status").dirty);
+
+        let err = pull(&clone, false).expect_err("should refuse");
+        assert!(err.contains("uncommitted changes"), "{err}");
+        // Left exactly as it was.
+        assert_eq!(
+            std::fs::read_to_string(clone.join("file")).expect("read"),
+            "local edit"
+        );
+    }
+
+    #[test]
+    fn a_branch_tracking_nothing_has_nothing_to_pull() {
+        let dir = tempfile::tempdir().expect("tempdir");
+        let (_origin, clone) = origin_and_clone(dir.path());
+        run(&clone, &["git", "checkout", "-qb", "detached-work"]);
+
+        let status = status(&clone).expect("status");
+        assert_eq!(status.branch, "detached-work");
+        assert_eq!(status.upstream, None);
+        assert!(
+            pull(&clone, false)
+                .expect_err("no upstream")
+                .contains("no upstream")
+        );
+        // Nothing to compare against, so the list is told plainly rather
+        // than being handed a misleading "up to date".
+        assert!(has_new_commits(&clone, false).is_err());
+    }
+}
diff --git a/server/src/logs.rs b/server/src/logs.rs
new file mode 100644
index 0000000..7c58c74
--- /dev/null
+++ b/server/src/logs.rs
@@ -0,0 +1,243 @@
+//! Reading the tail of a log file.
+//!
+//! Logs are read from the *end*, in chunks, rather than by loading the
+//! file and taking the last lines of it. A service that has been up for a
+//! week can have a log far larger than anything worth holding in memory,
+//! and the interesting part is always the end.
+
+use std::io::{Read, Seek, SeekFrom};
+use std::path::{Path, PathBuf};
+
+use anyhow::{Context, Result};
+
+/// How much of a log will ever be read, however many lines were asked
+/// for.
+///
+/// Asking for "all lines" is a legitimate request and the answer still has
+/// to fit in memory and in a response, so this bounds it -- and when it
+/// bites, the reader is told rather than handed a silently shortened log.
+const MAX_BYTES: u64 = 4 * 1024 * 1024;
+
+/// How much is read at a time when walking backwards.
+const CHUNK: u64 = 64 * 1024;
+
+/// The tail of a log, and whether it is the whole of it.
+pub struct Tail {
+    pub text: String,
+    /// The file was longer than what is here, either because more lines
+    /// exist or because [`MAX_BYTES`] cut it off. The distinction the
+    /// reader needs is only "is this everything?", and this answers it.
+    pub truncated: bool,
+}
+
+/// The last `lines` lines of `path`, or as much as [`MAX_BYTES`] allows
+/// when `lines` is 0.
+///
+/// Reads backwards from the end until it has enough newlines, so the cost
+/// is proportional to what was asked for rather than to the file.
+pub fn tail(path: &Path, lines: usize) -> Result<Tail> {
+    let mut file = std::fs::File::open(path).with_context(|| format!("open {}", path.display()))?;
+    let size = file.metadata().context("stat the log")?.len();
+
+    let mut from = size;
+    let mut buffer: Vec<u8> = Vec::new();
+    loop {
+        if from == 0 || buffer.len() as u64 >= MAX_BYTES {
+            break;
+        }
+        let step = CHUNK.min(from);
+        from -= step;
+        let mut chunk = vec![0u8; step as usize];
+        file.seek(SeekFrom::Start(from)).context("seek the log")?;
+        file.read_exact(&mut chunk).context("read the log")?;
+        chunk.extend_from_slice(&buffer);
+        buffer = chunk;
+        // One more than asked for, so the first line in the buffer can be
+        // dropped as the partial one this chunk started in the middle of.
+        if lines > 0 && buffer.iter().filter(|byte| **byte == b'\n').count() > lines {
+            break;
+        }
+    }
+
+    // Lossy on purpose: a log is whatever the process wrote, and a stray
+    // non-UTF-8 byte must not turn the whole thing into an error at the
+    // moment somebody is trying to read why it died.
+    let text = String::from_utf8_lossy(&buffer).into_owned();
+    let mut kept: Vec<&str> = text.lines().collect();
+    let mut truncated = from > 0;
+    if truncated && !kept.is_empty() {
+        // The first line is whatever the chunk boundary bisected.
+        kept.remove(0);
+    }
+    if lines > 0 && kept.len() > lines {
+        kept.drain(..kept.len() - lines);
+        truncated = true;
+    }
+    Ok(Tail {
+        text: kept.join("\n"),
+        truncated,
+    })
+}
+
+/// Where this server keeps the output of builds it runs.
+///
+/// Generated data, so `$XDG_DATA_HOME` rather than beside the config --
+/// the same split the service scripts follow for their own logs, so both
+/// kinds end up somewhere a person expects to find a log.
+fn build_log_dir() -> PathBuf {
+    data_dir().join("builds")
+}
+
+/// Everything this server generates for itself, under `$XDG_DATA_HOME`.
+///
+/// One answer to "where does generated state go", so the build logs and
+/// the built-in service script cannot end up under two different
+/// interpretations of the same rule -- and the rule itself is the shared
+/// one, so this server and ai-app resolve it identically.
+pub fn data_dir() -> PathBuf {
+    wg_app_link::xdg::data_home(crate::PRODUCT)
+}
+
+/// The log files for one component's builds, newest first.
+///
+/// The same shape a service script reports, so the route that serves them
+/// does not care which kind it was handed.
+/// Which of a component's two logs is wanted.
+///
+/// Two kinds rather than one list, because they answer different
+/// questions: the build log is what this server captured while building
+/// the component, and the runtime log is what the component itself wrote
+/// while running. Flattening them into a single sequence -- which is how
+/// this was first written -- meant the generation index had to carry both
+/// "which kind" and "how far back", and since build logs came first the
+/// runtime ones sat at an index nothing ever asked for. They were
+/// unreachable from the phone, and nothing said so.
+#[derive(Clone, Copy, PartialEq, Eq, Debug, serde::Deserialize)]
+#[serde(rename_all = "lowercase")]
+pub enum LogKind {
+    /// Written by this server while building the component.
+    Build,
+    /// Written by the component itself while running, reported by its
+    /// service script. Never present for an APK, which does not run here.
+    Runtime,
+}
+
+pub fn build_logs(key: &str, component: &str) -> Vec<PathBuf> {
+    let current = build_log_path(key, component);
+    let previous = previous_of(&current);
+    [current, previous]
+        .into_iter()
+        .filter(|path| path.is_file())
+        .collect()
+}
+
+fn build_log_path(key: &str, component: &str) -> PathBuf {
+    // Both are already route-safe identifiers, but a component name comes
+    // from a project's own file, so anything that could climb out of the
+    // directory is flattened rather than trusted.
+    let safe = |text: &str| -> String {
+        text.chars()
+            .map(|c| {
+                if c.is_ascii_alphanumeric() || c == '-' || c == '_' {
+                    c
+                } else {
+                    '-'
+                }
+            })
+            .collect()
+    };
+    build_log_dir().join(format!("{}-{}.log", safe(key), safe(component)))
+}
+
+fn previous_of(path: &Path) -> PathBuf {
+    let mut name = path.as_os_str().to_owned();
+    name.push(".1");
+    PathBuf::from(name)
+}
+
+/// Opens this component's build log for a run that is starting, rotating
+/// the previous one aside.
+///
+/// One generation, rotated at the start of a run, for the same reason a
+/// service script rotates on start: the split lands where a reader wants
+/// it -- this build and the one before -- which after a failure and a
+/// retry is the pair worth having.
+///
+/// A failure to open is not a reason to fail the build. The build is the
+/// point; the log is how you read about it afterwards, and losing it
+/// leaves the tail on the card exactly as before.
+pub fn open_build_log(key: &str, component: &str) -> Option<std::fs::File> {
+    let path = build_log_path(key, component);
+    if let Some(parent) = path.parent()
+        && let Err(err) = wg_app_link::private::create_dir(parent)
+    {
+        tracing::warn!("no build log for {key}'s {component}: {err:#}");
+        return None;
+    }
+    if path.is_file() {
+        let _ = std::fs::rename(&path, previous_of(&path));
+    }
+    match wg_app_link::private::create_file(&path) {
+        Ok(file) => Some(file),
+        Err(err) => {
+            tracing::warn!("no build log for {key}'s {component}: {err:#}");
+            None
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn write(dir: &Path, name: &str, contents: &str) -> std::path::PathBuf {
+        let path = dir.join(name);
+        std::fs::write(&path, contents).expect("write");
+        path
+    }
+
+    #[test]
+    fn a_short_log_comes_back_whole() {
+        let dir = tempfile::tempdir().expect("tempdir");
+        let path = write(dir.path(), "a.log", "one\ntwo\nthree\n");
+        let tail = tail(&path, 100).expect("tail");
+        assert_eq!(tail.text, "one\ntwo\nthree");
+        assert!(!tail.truncated, "nothing was cut off");
+    }
+
+    #[test]
+    fn asking_for_fewer_lines_takes_them_from_the_end() {
+        let dir = tempfile::tempdir().expect("tempdir");
+        let path = write(dir.path(), "a.log", "one\ntwo\nthree\nfour\n");
+        let tail = tail(&path, 2).expect("tail");
+        assert_eq!(tail.text, "three\nfour", "the end is the interesting part");
+        assert!(tail.truncated, "and the reader is told there was more");
+    }
+
+    /// The case the backwards read exists for: more than one chunk, so the
+    /// boundary lands in the middle of a line and the partial one has to
+    /// be dropped rather than shown as though it were a whole line.
+    #[test]
+    fn a_log_larger_than_one_chunk_reads_from_the_end_without_a_partial_line() {
+        let dir = tempfile::tempdir().expect("tempdir");
+        let body: String = (0..40_000).map(|n| format!("line {n}\n")).collect();
+        let path = write(dir.path(), "big.log", &body);
+        assert!(
+            std::fs::metadata(&path).expect("stat").len() > CHUNK * 2,
+            "spans chunks"
+        );
+
+        let tail = tail(&path, 3).expect("tail");
+        assert_eq!(tail.text, "line 39997\nline 39998\nline 39999");
+        assert!(tail.truncated);
+    }
+
+    #[test]
+    fn zero_means_everything_it_is_allowed_to_read() {
+        let dir = tempfile::tempdir().expect("tempdir");
+        let path = write(dir.path(), "a.log", "one\ntwo\n");
+        let tail = tail(&path, 0).expect("tail");
+        assert_eq!(tail.text, "one\ntwo");
+        assert!(!tail.truncated);
+    }
+}
diff --git a/server/src/main.rs b/server/src/main.rs
new file mode 100644
index 0000000..00f5630
--- /dev/null
+++ b/server/src/main.rs
@@ -0,0 +1,460 @@
+//! Serves locally-built debug APKs so a phone -- or the `updater` app
+//! itself -- can install them, without a browser and without leaving files
+//! in the Downloads folder. See the repo README for the whole picture; this
+//! is the entry point and the two listeners it runs.
+//!
+//! Which apps get served is not compiled in: an app is a *project path*
+//! added at runtime from the phone (`POST /apps`), and the APK underneath
+//! it is rediscovered per request. See `discover` for how that stays fast
+//! enough to sit behind an interactive screen, and `config` for what
+//! persists.
+//!
+//! Runs up to two listeners:
+//!
+//!   - `--port` (default 8090), always on, TLS pinned against the CA
+//!     `certs` generates. The whole API surface the `updater` app itself
+//!     ever talks to -- see `routes` for the table. Pinned because
+//!     everything on it either is, or decides, what gets handed to
+//!     `REQUEST_INSTALL_PACKAGES` next.
+//!   - `--download` (off by default; pass alone for port 8091, or
+//!     with a value for another port), plain HTTP, serving only the
+//!     updater app's own APK at a bare `/` -- for a human's browser,
+//!     bootstrapping `updater` onto a fresh phone. Plain HTTP because a
+//!     stock browser has nothing to pin against before that first install.
+//!
+//! Both bind the WireGuard interface and nothing else (see `wg_address`),
+//! so neither is reachable from the LAN. That is the outer of two gates:
+//! the tunnel decides who can try, and the bearer token every TLS request
+//! carries (see `auth`) decides who is answered. It also means the
+//! bootstrap port's plain HTTP travels inside the tunnel's encryption.
+
+mod apkinfo;
+mod auth;
+mod build_state;
+mod checks;
+mod config;
+mod discover;
+mod git;
+mod logs;
+mod purge;
+mod registry;
+mod resources;
+mod restart;
+mod routes;
+mod sdk;
+mod service;
+mod shipped;
+mod strip;
+
+use std::net::{IpAddr, SocketAddr};
+use std::path::{Path, PathBuf};
+use std::sync::Arc;
+use std::time::SystemTime;
+
+use anyhow::{Context, Result};
+use clap::Parser;
+
+use config::TokenEntry;
+use registry::AppState;
+
+const DEFAULT_PORT: u16 = 8090;
+/// A `&str` rather than a `u16` because clap's `default_missing_value` takes
+/// one, and this is only otherwise printed -- so the flag's default and the
+/// port named in the "not passed" log line below can't drift apart.
+const DEFAULT_BOOTSTRAP_PORT: &str = "8091";
+
+/// `$XDG_CONFIG_HOME/dev-updater`, or `~/.config/dev-updater`. Holds
+/// `config.ron` and `certs/`.
+///
+/// Per machine, deliberately, and not in the repo. This repo is shared
+/// between a machine and a VM over virtiofs at *different* absolute paths,
+/// so one shared `config.ron` means project paths that resolve on only
+/// one side -- which showed up as every app reading "not built" on the
+/// other. It also keeps the CA's private key off a mount the VM can read,
+/// which is what stops a compromised VM from signing a certificate the
+/// pinned app would accept.
+/// What this binary is called, where a shared function needs to name it.
+///
+/// The link crate is generic over the two servers using it, so anything it
+/// says to a person -- a failure telling somebody to bring the tunnel up,
+/// the directory its state lives in -- takes the name from here rather
+/// than guessing. One constant so the two cannot disagree.
+const PRODUCT: &str = "dev-updater";
+
+/// This server's *own* project: the checkout whose APK it serves as the
+/// built-in self entry, and which that card pulls. Config and certificates
+/// live outside the repo; see `wg_app_link::xdg`.
+///
+/// The working directory itself, i.e. this server expects to be run from
+/// the root of its own checkout. That is what the service unit sets, and
+/// it is where the rest of this project is driven from anyway
+/// (`./run-tests.sh`, `./app/build-apk.sh`, `./server/target/*/dev-updater`).
+/// The components say where they live from there, exactly as any other
+/// project's do -- there is nothing special about this one's layout.
+///
+/// It used to be `CARGO_MANIFEST_DIR`, which is fixed when the binary is
+/// *compiled*: a re-clone, a moved repo, or a binary built in one checkout
+/// and run against another left it naming a directory nobody pulls, and the
+/// card then quietly lost its branch line and its Pull button while
+/// otherwise working. Asking where the process was started is a question
+/// with one answer that is true right now, rather than one baked in months
+/// ago -- and being wrong about it is loud (see the warning at startup)
+/// rather than silent.
+fn self_project() -> PathBuf {
+    let project = std::env::current_dir().unwrap_or_else(|_| PathBuf::from("."));
+    // Canonical because this path is *compared* -- `add_app` refuses a
+    // project already in the list, and `/suggestions` marks one as added,
+    // both by path equality against exactly this value. Those go through
+    // `canonicalize`, so a symlink anywhere above the checkout would make
+    // the same directory look like two and let this server's own project
+    // be added a second time.
+    //
+    // Left as-is when it does not resolve: there is nothing to compare
+    // against then, and the warning below wants to name the path that was
+    // actually looked for.
+    project.canonicalize().unwrap_or(project)
+}
+
+/// Serves locally-built debug APKs to phones and the updater app.
+#[derive(Parser)]
+struct Args {
+    /// TLS port for the manifest, app payloads, and the management routes.
+    #[arg(long, default_value_t = DEFAULT_PORT)]
+    port: u16,
+
+    /// Address to bind instead of the wg0 interface's. `0.0.0.0` restores
+    /// the old LAN-wide behaviour, putting the management routes in reach
+    /// of anything on the network -- still behind the bearer token, but
+    /// with nothing in front of it. For recovering when the tunnel is
+    /// down, not for everyday use.
+    #[arg(long)]
+    bind: Option<IpAddr>,
+
+    /// Invalidate every enrolled token, generate a fresh one, and print
+    /// its enrollment QR -- the whole lost-phone story.
+    #[arg(long)]
+    rotate_token: bool,
+
+    /// Also serve the updater app's own APK over plain HTTP at "/", for a
+    /// bare browser link. Optionally takes a port (default 8091).
+    #[arg(short, long, num_args = 0..=1, default_missing_value = DEFAULT_BOOTSTRAP_PORT)]
+    download: Option<u16>,
+
+    /// Drive this server's own service, and exit: `install`, `uninstall`,
+    /// `start`, `stop`, `restart`, `status` or `logs`.
+    ///
+    /// The same command the running server would use for its own `Server`
+    /// component, so a script bootstrapping this machine does not have to
+    /// know how a service is named or invoked -- it asks the binary that
+    /// decides both. `start.sh` is the caller.
+    #[arg(long, value_name = "SUBCOMMAND")]
+    service: Option<String>,
+
+    /// Where the added-apps list and repo roots live. Defaults to
+    /// `$XDG_CONFIG_HOME/dev-updater/config.ron`.
+    #[arg(long)]
+    config: Option<PathBuf>,
+
+    /// Directory holding the TLS certificates, generated here on first
+    /// start. Defaults to `$XDG_CONFIG_HOME/dev-updater/certs`.
+    #[arg(long)]
+    certs: Option<PathBuf>,
+}
+
+/// Runs one service subcommand against this server's own `Server`
+/// component and exits with its result.
+///
+/// Exists so that nothing outside this binary has to know the name of this
+/// service or how its script is invoked. Both are derived here, by the
+/// same `service::driver` the running server uses, from the same
+/// declaration -- so a bootstrap script cannot drift out of step with them
+/// the way a second copy of the arguments would.
+fn drive_own_service(self_project: &Path, subcommand: &str) -> Result<()> {
+    let declaration = config::project_config(self_project);
+    let component = declaration
+        .components
+        .iter()
+        .find(|component| service::driver(registry::SELF_KEY, component).is_some())
+        .with_context(|| {
+            format!(
+                "{} declares no server component with a service, so there is nothing to \
+                 {subcommand}",
+                config::PROJECT_CONFIG_FILE
+            )
+        })?;
+    let script = service::driver(registry::SELF_KEY, component).expect("just found one");
+
+    // Written out first: `install` is the step that needs it, and it is
+    // also the step a fresh machine runs before any server has started.
+    shipped::install().context("write this server's shipped scripts")?;
+
+    let output = service::run(&script, self_project, component.cwd(), subcommand)
+        .map_err(|message| anyhow::anyhow!("{subcommand} failed: {message}"))?;
+    if !output.is_empty() {
+        println!("{output}");
+    }
+    Ok(())
+}
+
+#[tokio::main]
+async fn main() -> Result<()> {
+    tracing_subscriber::fmt().with_env_filter("info").init();
+    // Before anything else can rebuild this binary: once a build replaces
+    // the file, the running process can no longer name where it came from.
+    restart::remember_executable();
+    // Before anything can be asked about a service: a component declaring
+    // `Managed` is driven through this file, and a stale copy of it would
+    // be the shared default drifting in the one way it was meant to stop.
+    if let Err(err) = shipped::install() {
+        tracing::warn!(
+            "could not write this server's shipped scripts to {} ({err}) -- a component \
+             declaring Managed, and a build asking for a progress bar, will not work until \
+             this succeeds",
+            crate::logs::data_dir().display()
+        );
+    }
+    let args = Args::parse();
+
+    // Printed once the bind address is known, so the QR carries the
+    // address the phone should actually dial.
+    let mut pending_enrollment: Option<String> = None;
+
+    let config_path = args
+        .config
+        .unwrap_or_else(|| wg_app_link::xdg::config_home(PRODUCT).join("config.ron"));
+    // The updater app's own Gradle project, not the repo root: it is the
+    // path a suggestion for this repo would carry, and matching it is what
+    // stops the built-in self entry from also being offered as something to
+    // add.
+    let self_project = self_project();
+    // Said out loud because the alternative is finding out from a card that
+    // looks fine and never updates: with no checkout there is no branch,
+    // no Pull and no commit count, which reads exactly like a project that
+    // simply has no news.
+    if git::status(&self_project).is_none() {
+        tracing::warn!(
+            "no checkout at {}, so the {} card can't show commits or offer Pull. This \
+             server takes its own project from the working directory: start it from the \
+             root of the checkout you pull, as the service unit does.",
+            self_project.display(),
+            registry::SELF_LABEL,
+        );
+    } else if !self_project.join(config::PROJECT_CONFIG_FILE).is_file() {
+        // In a checkout, but not one of *this* project: same broken card,
+        // different cause, so it gets its own sentence rather than being
+        // folded into the one above.
+        tracing::warn!(
+            "{} has no {}, so the {} card has nothing to build. This server takes its own \
+             project from the working directory: start it from the root of the checkout \
+             you pull.",
+            self_project.display(),
+            config::PROJECT_CONFIG_FILE,
+            registry::SELF_LABEL,
+        );
+    }
+    // Before the state, the certificates and the listeners: this mode
+    // installs or reports on the service and exits, and doing any of that
+    // first would mean generating a CA in order to run `status`.
+    if let Some(subcommand) = args.service.as_deref() {
+        return drive_own_service(&self_project, subcommand);
+    }
+
+    let state = Arc::new(
+        AppState::new(config_path.clone(), self_project)
+            .with_context(|| format!("failed to load {}", config_path.display()))?,
+    );
+    // Asked on this server's own behalf, before any phone asks. What a
+    // component is doing is known only from the first answer of *this
+    // process's* life, and a row whose state is unknown is drawn with no
+    // buttons at all -- so a restart is otherwise visible on the phone as
+    // every server row losing its controls until a check it started
+    // catches up. Restarting is the ordinary way this server is updated,
+    // which makes that the moment it is most likely to be looked at.
+    //
+    // Free, near enough: it is the work the first `/manifest` would start
+    // anyway, off the request path either way, and it returns at once.
+    routes::refresh_checkouts(&state, &state.entries());
+
+    let certs_dir = args
+        .certs
+        .unwrap_or_else(|| wg_app_link::xdg::config_home(PRODUCT).join("certs"));
+    let certificates =
+        wg_app_link::certs::ensure(PRODUCT, &certs_dir, &wg_app_link::netif::local_addresses())
+            .with_context(|| {
+                format!("failed to prepare certificates in {}", certs_dir.display())
+            })?;
+    if certificates.ca_is_new {
+        tracing::warn!(
+            "a new CA was generated in {} -- any installed updater app pins the previous one \
+             and can no longer reach this server. Rebuild it (app/build-apk.sh, which embeds \
+             this CA) and reinstall over the bootstrap port: --download",
+            certs_dir.display(),
+        );
+    }
+    let tls_config = axum_server::tls_rustls::RustlsConfig::from_pem_file(
+        &certificates.leaf_cert,
+        &certificates.leaf_key,
+    )
+    .await
+    .context("failed to load TLS cert/key")?;
+
+    // Token bootstrap: first run generates one; --rotate-token replaces
+    // whatever exists. Either way the plaintext appears exactly once, in
+    // the QR printed here.
+    if args.rotate_token || state.tokens().is_empty() {
+        let rotating = args.rotate_token && !state.tokens().is_empty();
+        let token = auth::generate_token();
+        state.set_tokens(vec![TokenEntry {
+            name: "phone".to_string(),
+            sha256: auth::token_hash_hex(&token),
+        }])?;
+        if rotating {
+            tracing::info!("rotated the enrolled token; the previous one is now invalid");
+        }
+        pending_enrollment = Some(token);
+    }
+
+    let bind_ip = match args.bind {
+        Some(ip) => {
+            tracing::warn!(
+                "binding {ip} by explicit --bind override -- anything that can reach this \
+                 address can now reach the management routes, with only the bearer token in \
+                 front of them"
+            );
+            ip
+        }
+        None => wg_app_link::netif::wg_address(PRODUCT)?,
+    };
+
+    if let Some(bootstrap_port) = args.download {
+        // The bootstrap listener serves exactly one thing: this app's own
+        // APK. Saying so up front, with the address to open and whether
+        // there is anything behind it, because the alternative is finding
+        // out from a bare 404 in a phone browser -- which is where this
+        // flag is used and where there is least to go on.
+        let self_entry = state.entry(registry::SELF_KEY);
+        match self_entry
+            .as_ref()
+            .and_then(|entry| entry.resolve_apk(None))
+        {
+            // The age is here because this listener serves the file already
+            // on disk and builds nothing, so an old APK installs in silence.
+            // That one is unusually expensive to land on: a fresh install is
+            // not enrolled, and everything that would replace it -- Update,
+            // and the QR scan that gets a device enrolled at all -- lives in
+            // the copy being installed. Ship a stale one and the way out of
+            // it is another trip through this flag.
+            Some(apk) => tracing::info!(
+                "bootstrap link: open http://{bind_ip}:{bootstrap_port} in the phone's browser \
+                 to install {} ({} build from {}). Run ./app/build-apk.sh first if that is \
+                 older than the checkout.",
+                self_entry
+                    .map(|entry| entry.label.clone())
+                    .unwrap_or_default(),
+                apk.variant,
+                describe_age(apk.modified),
+            ),
+            None => tracing::warn!(
+                "--download is on, but there is no APK to serve: nothing is built under \
+                 {}. http://{bind_ip}:{bootstrap_port} will answer 404 until you build it -- \
+                 run ./app/build-apk.sh on this machine.",
+                self_entry
+                    .map(|entry| entry.project_path.display().to_string())
+                    .unwrap_or_default(),
+            ),
+        }
+        tokio::spawn(run_bootstrap_listener(
+            Arc::clone(&state),
+            bind_ip,
+            bootstrap_port,
+        ));
+    } else {
+        tracing::info!(
+            "--download not passed -- port {DEFAULT_BOOTSTRAP_PORT} (updater bootstrap link) won't be served",
+        );
+    }
+
+    tracing::info!("config: {}", config_path.display());
+    let roots = state.repo_roots();
+    if roots.is_empty() {
+        tracing::info!(
+            "no repo roots configured yet -- set one from the app's Add screen to get \
+             project suggestions",
+        );
+    } else {
+        for root in &roots {
+            tracing::info!("scanning for projects under {}", root.display());
+        }
+    }
+    for entry in state.entries() {
+        match entry.resolve_apk(None) {
+            Some(apk) => tracing::info!("  {} -> {}", entry.key, apk.path.display()),
+            None => tracing::warn!(
+                "  {} -> no build found under {} (it will show as not built)",
+                entry.key,
+                entry.project_path.display(),
+            ),
+        }
+    }
+
+    if let Some(token) = pending_enrollment {
+        auth::print_enrollment(bind_ip, args.port, &token)?;
+    }
+
+    let addr = SocketAddr::new(bind_ip, args.port);
+    tracing::info!("serving https://{addr}");
+    let app = routes::tls_router(Arc::clone(&state)).layer(axum::middleware::from_fn_with_state(
+        state,
+        auth::require_token,
+    ));
+    axum_server::bind_rustls(addr, tls_config)
+        .serve(app.into_make_service_with_connect_info::<SocketAddr>())
+        .await
+        .context("TLS listener failed")?;
+
+    Ok(())
+}
+
+/// How long ago `when` was, in the largest whole unit that fits.
+///
+/// Rounded down and never more precise than the unit it names, because the
+/// only question being answered is "is this the build I just made, or one
+/// from last week?".
+fn describe_age(when: SystemTime) -> String {
+    let Ok(elapsed) = when.elapsed() else {
+        // An mtime in the future is a clock that moved, not an age.
+        return "a timestamp in the future".to_string();
+    };
+    let seconds = elapsed.as_secs();
+    let (count, unit) = match seconds {
+        ..60 => return "under a minute ago".to_string(),
+        60..3600 => (seconds / 60, "minute"),
+        3600..86400 => (seconds / 3600, "hour"),
+        _ => (seconds / 86400, "day"),
+    };
+    let plural = if count == 1 { "" } else { "s" };
+    format!("{count} {unit}{plural} ago")
+}
+
+async fn run_bootstrap_listener(state: Arc<AppState>, bind_ip: IpAddr, port: u16) {
+    // Same address as the TLS listener: inside the tunnel, so this port's
+    // plain HTTP is carried encrypted anyway, and a phone that can reach
+    // the server can reach its bootstrap link too.
+    let addr = SocketAddr::new(bind_ip, port);
+    let listener = match tokio::net::TcpListener::bind(addr).await {
+        Ok(listener) => listener,
+        Err(err) => {
+            tracing::error!("failed to bind bootstrap listener on port {port}: {err:#}");
+            return;
+        }
+    };
+    tracing::info!("serving http://{addr} (updater bootstrap link)");
+    if let Err(err) = axum::serve(
+        listener,
+        routes::bootstrap_router(state).into_make_service(),
+    )
+    .await
+    {
+        tracing::error!("bootstrap listener failed: {err:#}");
+    }
+}
diff --git a/server/src/purge.rs b/server/src/purge.rs
new file mode 100644
index 0000000..126a309
--- /dev/null
+++ b/server/src/purge.rs
@@ -0,0 +1,315 @@
+//! What a component leaves on the build machine, and taking it away when
+//! the service goes.
+//!
+//! Uninstalling used to remove the service and stop there, which is the
+//! right default -- the built files stay, and so does whatever the thing
+//! accumulated while it ran. But there is no other way to reach any of it
+//! from a phone, so "uninstall and then clean up by hand at the machine"
+//! is a capability withheld rather than a decision offered. The Uninstall
+//! dialog therefore asks about three things separately, and this module is
+//! what it asks.
+//!
+//! The three are deliberately not one switch. They differ in what losing
+//! them costs: logs are a record of what already happened, data is what
+//! the thing produced, and config is what somebody typed. Only the first
+//! is on by default.
+//!
+//! **Nothing here is recoverable, and nothing here is guarded by path.**
+//! A `data:` or `config:` the project declared is removed wherever it
+//! points -- Iris's call, on 2026-08-29, over the alternative of refusing
+//! anything outside the XDG directories. What stands in for that guard is
+//! the dialog: the resolved path is shown, per toggle, before the button
+//! can be pressed, so the phone never asks for a path nobody saw. Any
+//! change that stops the path being displayed removes the only check
+//! there is.
+
+use std::path::{Path, PathBuf};
+
+use crate::config::ResourceFacts;
+
+/// Where a project keeps the state that outlives a build.
+///
+/// `None` is "this project has not said", which is a different thing from
+/// a path that is there and empty, and the dialog draws it differently:
+/// one greys the toggle out saying nothing is there, the other says it
+/// cannot tell. A path that *is* known is resolved whether or not it
+/// exists, because absent from the display is how "we did not look" and
+/// "there is nothing" become the same thing.
+#[derive(Default)]
+pub struct StatePaths {
+    pub data: Option<PathBuf>,
+    pub config: Option<PathBuf>,
+}
+
+/// Turns what a project said about itself into the two directories.
+///
+/// An explicit `data:`/`config:` wins. Otherwise they follow from the
+/// project's `name:` -- `$XDG_DATA_HOME/<name>` and
+/// `$XDG_CONFIG_HOME/<name>`, through the same `wg_app_link::xdg` both
+/// servers use for their own state rather than a second reading of the
+/// same rule. A project that says neither gets neither, and nothing is
+/// invented from the checkout's directory name, the config key, or a
+/// crate name: those are all facts that happen to be true rather than
+/// things the project asserted, and a guess that lands on a directory
+/// which does not exist reads exactly like a directory that is empty.
+///
+/// A path may start with `~`, and a relative one is resolved against the
+/// project -- the rule `cwd` already follows, so a project's file has one
+/// meaning of "relative" rather than two.
+pub fn paths(facts: &ResourceFacts, project: &Path) -> StatePaths {
+    StatePaths {
+        data: resolve(facts.data.as_deref(), project)
+            .or_else(|| facts.name.as_deref().map(wg_app_link::xdg::data_home)),
+        config: resolve(facts.config.as_deref(), project)
+            .or_else(|| facts.name.as_deref().map(wg_app_link::xdg::config_home)),
+    }
+}
+
+fn resolve(declared: Option<&Path>, project: &Path) -> Option<PathBuf> {
+    let declared = declared?;
+    // The same expansion a path typed on a phone gets, so `~` means one
+    // thing across the whole server rather than one thing per reader.
+    let expanded = declared
+        .to_str()
+        .map(crate::config::expand_tilde)
+        .unwrap_or_else(|| declared.to_path_buf());
+    Some(if expanded.is_absolute() {
+        expanded
+    } else {
+        project.join(expanded)
+    })
+}
+
+/// Which of the three the phone asked to take away.
+///
+/// A struct rather than three arguments so a caller cannot transpose two
+/// booleans, which is the one mistake here that deletes the wrong thing
+/// without failing.
+#[derive(Clone, Copy, Debug, Default, PartialEq, Eq)]
+pub struct Wanted {
+    pub logs: bool,
+    pub data: bool,
+    pub config: bool,
+}
+
+impl Wanted {
+    /// Nothing beyond removing the service itself.
+    pub fn nothing(&self) -> bool {
+        !self.logs && !self.data && !self.config
+    }
+
+    /// Removing the data implies removing the logs.
+    ///
+    /// Applied here rather than trusted from the request, because the
+    /// dialog forces the same pairing and the two must not be able to
+    /// disagree -- a project whose service script writes its log inside
+    /// its own data directory would otherwise have the log deleted by a
+    /// request that said to keep it, and be told the opposite.
+    pub fn normalized(self) -> Self {
+        Self {
+            logs: self.logs || self.data,
+            ..self
+        }
+    }
+}
+
+/// Removes what was asked for, and says what could not be removed.
+///
+/// Returns one line per failure, in the order the three are listed in the
+/// dialog. An empty result is a clean sweep. Failures do not stop the
+/// rest: the service is already gone by the time this runs, so stopping
+/// half way would leave a component that is uninstalled, partly cleaned,
+/// and reported as failed -- three states to reason about instead of one.
+///
+/// `log_files` is collected by the caller *before* the service is
+/// uninstalled, because the script that reports where its log lives is
+/// the thing being removed.
+pub fn remove(paths: &StatePaths, log_files: &[PathBuf], wanted: Wanted) -> Vec<String> {
+    let wanted = wanted.normalized();
+    let mut problems = Vec::new();
+
+    if wanted.logs {
+        for file in log_files {
+            if let Err(err) = remove_file(file) {
+                problems.push(format!(
+                    "could not remove the log {}: {err}",
+                    file.display()
+                ));
+            }
+        }
+        // The directories those files were the only contents of. Removed
+        // only when empty, so this can never take away more than the logs
+        // it was pointed at -- and a component's log directory is one this
+        // server made, so leaving it behind is leaving the same kind of
+        // orphan the logs themselves were.
+        for parent in log_files.iter().filter_map(|file| file.parent()) {
+            let _ = std::fs::remove_dir(parent);
+        }
+    }
+    // Nothing to remove when the project never said where it is. The
+    // dialog does not offer the toggle in that state, so this is the
+    // belt to its braces rather than a case anyone reaches by hand.
+    for (asked, what, path) in [
+        (wanted.data, "data", paths.data.as_deref()),
+        (wanted.config, "config", paths.config.as_deref()),
+    ] {
+        let Some(path) = path.filter(|_| asked) else {
+            continue;
+        };
+        if let Err(err) = remove_tree(path) {
+            problems.push(format!(
+                "could not remove the {what} at {}: {err}",
+                path.display()
+            ));
+        }
+    }
+    problems
+}
+
+/// Already gone is the outcome that was asked for, not a failure --
+/// otherwise pressing Uninstall twice reports a problem the second time.
+fn remove_file(path: &Path) -> std::io::Result<()> {
+    match std::fs::remove_file(path) {
+        Err(err) if err.kind() == std::io::ErrorKind::NotFound => Ok(()),
+        other => other,
+    }
+}
+
+fn remove_tree(path: &Path) -> std::io::Result<()> {
+    match std::fs::remove_dir_all(path) {
+        Err(err) if err.kind() == std::io::ErrorKind::NotFound => Ok(()),
+        other => other,
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn facts(name: Option<&str>, data: Option<&str>) -> ResourceFacts {
+        ResourceFacts {
+            name: name.map(str::to_string),
+            data: data.map(PathBuf::from),
+            config: None,
+        }
+    }
+
+    /// A project that names itself gets both directories from that name,
+    /// resolved the way both servers resolve their own.
+    #[test]
+    fn a_name_is_enough_to_place_both_directories() {
+        let paths = paths(&facts(Some("ai-app"), None), Path::new("/repos/ai-app"));
+        assert!(paths.data.as_ref().unwrap().ends_with("ai-app"));
+        assert!(paths.config.as_ref().unwrap().ends_with("ai-app"));
+        assert_ne!(paths.data, paths.config);
+    }
+
+    /// The correction that produced this module: nothing is invented from
+    /// the checkout's directory, the config key, or anything else that
+    /// merely happens to be true. Not said is not knowing.
+    #[test]
+    fn a_project_that_says_nothing_places_nothing() {
+        let paths = paths(&ResourceFacts::default(), Path::new("/repos/ai-app"));
+        assert_eq!(paths.data, None);
+        assert_eq!(paths.config, None);
+    }
+
+    #[test]
+    fn an_explicit_path_wins_over_the_name() {
+        let paths = paths(
+            &facts(Some("ai-app"), Some("/srv/sessions")),
+            Path::new("/repos/ai-app"),
+        );
+        assert_eq!(paths.data.as_deref(), Some(Path::new("/srv/sessions")));
+        assert!(paths.config.as_ref().unwrap().ends_with("ai-app"));
+    }
+
+    #[test]
+    fn a_relative_path_is_read_against_the_project() {
+        let paths = paths(&facts(None, Some("state")), Path::new("/repos/ai-app"));
+        assert_eq!(
+            paths.data.as_deref(),
+            Some(Path::new("/repos/ai-app/state"))
+        );
+    }
+
+    /// The pairing the dialog also enforces. Stated in both places on
+    /// purpose, and asserted here because this is the half that deletes.
+    #[test]
+    fn asking_for_the_data_asks_for_the_logs_too() {
+        let asked = Wanted {
+            logs: false,
+            data: true,
+            config: false,
+        };
+        assert!(asked.normalized().logs);
+        // And not the other way: logs are the cheap one.
+        let logs_only = Wanted {
+            logs: true,
+            ..Default::default()
+        };
+        assert!(!logs_only.normalized().data);
+    }
+
+    #[test]
+    fn removing_what_is_already_gone_is_not_a_failure() {
+        let dir = std::env::temp_dir().join(format!("purge-test-{}", std::process::id()));
+        let paths = StatePaths {
+            data: Some(dir.join("data")),
+            config: Some(dir.join("config")),
+        };
+        let problems = remove(
+            &paths,
+            &[dir.join("nothing.log")],
+            Wanted {
+                logs: true,
+                data: true,
+                config: true,
+            },
+        );
+        assert!(problems.is_empty(), "{problems:?}");
+    }
+
+    /// Asked to remove something the project never located, there is
+    /// nothing to remove and nothing to complain about.
+    #[test]
+    fn a_path_that_was_never_known_removes_nothing() {
+        let problems = remove(
+            &StatePaths::default(),
+            &[],
+            Wanted {
+                logs: false,
+                data: true,
+                config: true,
+            },
+        );
+        assert!(problems.is_empty(), "{problems:?}");
+    }
+
+    #[test]
+    fn what_was_asked_for_goes_and_the_rest_stays() {
+        let dir = std::env::temp_dir().join(format!("purge-keep-{}", std::process::id()));
+        let _ = std::fs::remove_dir_all(&dir);
+        let paths = StatePaths {
+            data: Some(dir.join("data")),
+            config: Some(dir.join("config")),
+        };
+        std::fs::create_dir_all(paths.data.as_ref().unwrap()).unwrap();
+        std::fs::create_dir_all(paths.config.as_ref().unwrap()).unwrap();
+        std::fs::write(paths.data.as_ref().unwrap().join("session"), "x").unwrap();
+
+        let problems = remove(
+            &paths,
+            &[],
+            Wanted {
+                logs: false,
+                data: true,
+                config: false,
+            },
+        );
+        assert!(problems.is_empty(), "{problems:?}");
+        assert!(!paths.data.as_ref().unwrap().exists(), "asked for");
+        assert!(paths.config.as_ref().unwrap().exists(), "not asked for");
+        let _ = std::fs::remove_dir_all(&dir);
+    }
+}
diff --git a/server/src/registry.rs b/server/src/registry.rs
new file mode 100644
index 0000000..bdb370b
--- /dev/null
+++ b/server/src/registry.rs
@@ -0,0 +1,1187 @@
+//! The set of apps this server currently serves, and the mutations the
+//! updater app can make to it.
+//!
+//! An entry is the *project*, not a file: the APK underneath it is
+//! rediscovered per request (`crate::discover`, microseconds) so a rebuild
+//! is picked up with no bookkeeping, and so an entry whose build hasn't
+//! happened yet simply reports as not-built instead of erroring.
+//!
+//! One entry is not configurable: this server's own updater app. It has to
+//! exist unconditionally, because it is the only route by which the copy on
+//! a phone can ever be replaced -- an updater that can be removed from its
+//! own list can strand itself.
+
+use std::collections::HashMap;
+use std::path::{Path, PathBuf};
+use std::sync::{Arc, Mutex, RwLock};
+
+use anyhow::{Context, Result, bail};
+
+use crate::build_state::BuildState;
+use crate::config::{Component, Config, ProjectConfig, TokenEntry};
+use crate::discover::{self, ApkCandidate};
+
+/// The key of the built-in self-update entry. Reserved, so a project that
+/// happens to be named `updater` gets `updater-2` rather than silently
+/// shadowing it. Not read from anywhere, because it is this server's own
+/// route and the phone's stored download name for it.
+pub const SELF_KEY: &str = "updater";
+
+/// What to call the self entry, and what it replaces, when there is no
+/// checkout to read `.dev-updater.ron` out of -- an installed binary
+/// still has to offer itself, and still has to name the package it is.
+const SELF_PACKAGE: &str = "com.example.devupdater";
+pub(crate) const SELF_LABEL: &str = "Dev Updater";
+
+/// One servable app, resolved from config (or built in, for the self
+/// entry). Cheap to clone-by-`Arc` and handed to request handlers whole.
+pub struct AppEntry {
+    pub key: String,
+    pub label: String,
+    pub project_path: PathBuf,
+    /// What this project produces. Ordinarily one `Apk`; a project that
+    /// also runs a server on the build machine declares that too.
+    pub components: Vec<Component>,
+    /// Present only for an entry with a configured build step. An entry
+    /// without one reports `needsBuild: false` and its prepare/status
+    /// routes answer 404, so the app never polls them.
+    pub build: Option<Arc<BuildState>>,
+    /// True for the self entry, which the app renders without a Remove
+    /// button -- see this module's own doc comment.
+    pub built_in: bool,
+    /// Whether this app opted in to being pulled (`gitPull`).
+    pub git_pull: bool,
+    /// Force git's remote commands onto IPv4 -- this machine's choice
+    /// about this project, not something the project declares.
+    pub git_ipv4: bool,
+    /// The accepted `resources:` declaration, if this project makes one.
+    /// Where the project says its name and its state directories are; see
+    /// `crate::config::Resources`.
+    pub resources: Option<crate::config::Resources>,
+}
+
+impl AppEntry {
+    /// The APK component this entry serves, if it has one.
+    ///
+    /// One for now, and the first wins if a project ever declares two: the
+    /// download route serves a project, and which of two APKs it meant
+    /// would need saying. That is a question for whoever adds the second.
+    fn apk_component(&self) -> Option<&Component> {
+        self.components
+            .iter()
+            .find(|component| matches!(component, Component::Apk { .. }))
+    }
+
+    /// The package this project's APK installs over, once a build has been
+    /// read. `None` until there has been one -- a project can be added
+    /// before it has ever been built.
+    pub fn package(&self) -> Option<&str> {
+        self.apk_component().and_then(Component::package)
+    }
+
+    /// Whether to serve a stripped copy. Declared, not detected.
+    pub fn strip(&self) -> bool {
+        matches!(
+            self.apk_component(),
+            Some(Component::Apk { strip: true, .. })
+        )
+    }
+
+    /// The APK to serve: `requested` if it is still one of this project's
+    /// builds, else the newest one found under it.
+    ///
+    /// Which variant a phone wants is that phone's preference, so it
+    /// arrives with the request rather than being stored here -- two
+    /// devices enrolled against one server would otherwise change what the
+    /// other one gets. Checked against the discovered builds, never taken
+    /// on trust: an arbitrary path would let a phone name any file on disk
+    /// to be served.
+    ///
+    /// A request for something that has since been deleted falls back
+    /// rather than failing -- a `./gradlew clean` shouldn't take an app out
+    /// of the list, and the fallback is the answer this would have given
+    /// before any variant was chosen.
+    pub fn resolve_apk(&self, requested: Option<&Path>) -> Option<ApkCandidate> {
+        let variants = self.variants();
+        if let Some(requested) = requested
+            && let Some(found) = variants
+                .iter()
+                .find(|candidate| candidate.path == requested)
+        {
+            return Some(found.clone());
+        }
+        variants.into_iter().next()
+    }
+
+    /// Every build found under this project, newest first -- what the app
+    /// offers when letting the user switch variants.
+    pub fn variants(&self) -> Vec<ApkCandidate> {
+        discover::find_apks(&self.project_path)
+    }
+
+    /// The build step this project is asking for that nobody has accepted
+    /// -- what the phone shows before offering to accept it, and the
+    /// answer to "may this app's command run right now?".
+    ///
+    /// Read from the project on every call rather than settled when the
+    /// entry was built, because the file changes on a **pull**, and a pull
+    /// writes no config and so rebuilds no entries. Caching it meant a
+    /// pull could swap the command out from under a previous acceptance
+    /// and nothing would notice until an unrelated config write happened.
+    ///
+    /// Cheap enough for the manifest path: one small read per app, beside
+    /// the `git status` that path already runs for each of them.
+    pub fn pending_declaration(&self) -> Option<Vec<Component>> {
+        // This server's own project is accepted by construction (see
+        // `reconcile_self`), and the row saying so is only re-derived at
+        // startup -- so between a pull that changes the declaration and the
+        // restart that follows it, the two can differ without that meaning
+        // anything is waiting to be accepted.
+        if self.built_in {
+            return None;
+        }
+        let declared = crate::config::project_config(&self.project_path);
+        if declared.components.is_empty()
+            || declared.matches_accepted(&self.components, self.resources.as_ref())
+        {
+            return None;
+        }
+        Some(declared.components)
+    }
+
+    /// This project's resources, as something to read, when it declares
+    /// any. `None` is a project that says nothing about itself, which is
+    /// an answer rather than a reason to go looking.
+    pub fn resource_target(&self) -> Option<crate::resources::Target> {
+        Some(crate::resources::Target {
+            key: self.key.clone(),
+            project: self.project_path.clone(),
+            declaration: self.resources.clone()?,
+        })
+    }
+
+    /// Every server component of this project, as something to ask about.
+    pub fn service_targets(&self) -> Vec<crate::service::Target> {
+        self.components
+            .iter()
+            .filter_map(|component| {
+                let script = crate::service::driver(&self.key, component)?;
+                Some(crate::service::Target {
+                    key: self.key.clone(),
+                    component: component.name().to_string(),
+                    project: self.project_path.clone(),
+                    cwd: component.cwd().map(Path::to_path_buf),
+                    script,
+                })
+            })
+            .collect()
+    }
+
+    /// Everything readable about one component, newest first: what its
+    /// build wrote, then what its service script reports.
+    ///
+    /// Both kinds in one list because the phone asks one question -- "what
+    /// can I read about this?" -- and the route that answers it should not
+    /// care which produced the file. Build logs come first because a
+    /// component that has just failed to build is the one being looked at.
+    ///
+    /// The service half is read from the cached background answer by the
+    /// caller; this only assembles what a direct ask returns, which is why
+    /// it is used by the log route rather than by the manifest.
+    /// Where one kind of this component's logs are, newest first.
+    ///
+    /// Asked one kind at a time rather than returning both, because the
+    /// caller always knows which it wants and a combined list has to be
+    /// indexed by something that means two things at once.
+    pub fn component_logs(&self, name: &str, kind: crate::logs::LogKind) -> Vec<PathBuf> {
+        let Some(component) = self.component(name) else {
+            return Vec::new();
+        };
+        match kind {
+            crate::logs::LogKind::Build => crate::logs::build_logs(&self.key, name),
+            crate::logs::LogKind::Runtime => crate::service::driver(&self.key, component)
+                .map(|script| crate::service::logs(&script, &self.project_path, component.cwd()))
+                .unwrap_or_default(),
+        }
+    }
+
+    /// This project's component of that name, for a route that addresses
+    /// one directly.
+    pub fn component(&self, name: &str) -> Option<&Component> {
+        self.components
+            .iter()
+            .find(|component| component.name() == name)
+    }
+
+    /// The name the download is offered under. Prefixed with the key
+    /// because build outputs are generically named (`app-debug.apk`,
+    /// `androidApp-debug.apk`) and several apps would otherwise collide in
+    /// the device's download directory.
+    pub fn filename(&self, apk: &Path) -> String {
+        let name = apk.file_name().unwrap_or_default().to_string_lossy();
+        format!("{}-{name}", self.key)
+    }
+}
+
+/// The packages already read for each component, by name -- what an
+/// acceptance has to carry across.
+fn measured_packages(components: &[Component]) -> HashMap<String, String> {
+    components
+        .iter()
+        .filter_map(|component| {
+            Some((
+                component.name().to_string(),
+                component.package()?.to_string(),
+            ))
+        })
+        .collect()
+}
+
+/// Records a freshly read package on whichever component is the APK.
+fn set_measured_package(components: &mut [Component], package: String) {
+    if let Some(component) = components
+        .iter_mut()
+        .find(|component| matches!(component, Component::Apk { .. }))
+    {
+        component.set_package(package);
+    }
+}
+
+/// The live app list plus the config it was built from, behind one lock.
+///
+/// Held together rather than separately because every mutation changes both
+/// and they must not be observed disagreeing: a request that saw a new
+/// config but the old entries would 404 an app the phone was just told
+/// exists.
+pub struct Registry {
+    config: Config,
+    entries: Vec<Arc<AppEntry>>,
+}
+
+pub struct AppState {
+    /// What each checkout's remote last reported, so showing the list
+    /// costs at most one round trip per repository per half minute.
+    pub remote_checks: crate::git::RemoteChecks,
+    /// APK downloads in flight, so a restart of this server waits for
+    /// them rather than cutting them off. Shared with every `BuildState`,
+    /// because a build of this project ends in one.
+    pub downloads: Arc<crate::restart::Downloads>,
+    /// What each server component was last found to be doing. Beside the
+    /// remote checks and for the same reason -- asking costs a process
+    /// spawn, so the manifest reads a cached answer and the refresh that
+    /// fills it runs off the request.
+    pub service_checks: crate::service::ServiceChecks,
+    /// What each project last said about itself -- its name and where its
+    /// state lives. Beside the other two checks and for the same reason:
+    /// the `Script` variant spawns a process, so the manifest reads a
+    /// cached answer and the refresh that fills it runs off the request.
+    pub resource_checks: crate::resources::ResourceChecks,
+    /// What a project's APK used to install over, for the ones whose
+    /// package name has changed under it. Keyed by project key.
+    ///
+    /// In memory and not in the config, deliberately. Android treats a
+    /// renamed `applicationId` as an unrelated app, so the old one stays
+    /// installed and orphaned -- and this exists only so the card can
+    /// offer to remove it. That is a job with a short life, done once
+    /// after a rename; carrying it on disk would mean a file remembering
+    /// names of apps nobody has any more. A restart between the rename and
+    /// the removal loses the offer, and the orphan is then removed by hand
+    /// like any other app.
+    ///
+    /// It needs no clearing protocol: the phone knows what is installed,
+    /// so it only shows the offer while the old package is actually there.
+    /// Dropped when the project is, so this can't outlive it.
+    previous_packages: Mutex<HashMap<String, String>>,
+    config_path: PathBuf,
+    registry: RwLock<Registry>,
+}
+
+impl AppState {
+    /// Loads the config and settles the built-in row against
+    /// `self_project` before anything reads it, which is why nothing after
+    /// this has to be told which project is this server's own -- the list
+    /// says so.
+    pub fn new(config_path: PathBuf, self_project: PathBuf) -> Result<Self> {
+        let mut config = Config::load(&config_path)?;
+        // Startup is the only moment the working directory is known, and
+        // so the only moment a re-clone or a moved repo can be noticed.
+        if reconcile_self(&mut config, &self_project) {
+            config.save(&config_path)?;
+        }
+        let remote_checks = crate::git::RemoteChecks::default();
+        let downloads = Arc::new(crate::restart::Downloads::default());
+        let entries = build_entries(&config, &[], &remote_checks, &downloads);
+        Ok(Self {
+            downloads,
+            remote_checks,
+            service_checks: crate::service::ServiceChecks::default(),
+            resource_checks: crate::resources::ResourceChecks::default(),
+            previous_packages: Mutex::new(HashMap::new()),
+            config_path,
+            registry: RwLock::new(Registry { config, entries }),
+        })
+    }
+
+    pub fn entries(&self) -> Vec<Arc<AppEntry>> {
+        self.registry.read().unwrap().entries.clone()
+    }
+
+    pub fn entry(&self, key: &str) -> Option<Arc<AppEntry>> {
+        self.registry
+            .read()
+            .unwrap()
+            .entries
+            .iter()
+            .find(|entry| entry.key == key)
+            .cloned()
+    }
+
+    /// What this project's APK used to install over, if it has been
+    /// renamed since this server started. See [`Self::previous_packages`].
+    pub fn previous_package(&self, key: &str) -> Option<String> {
+        self.previous_packages.lock().unwrap().get(key).cloned()
+    }
+
+    /// Re-reads what `apk` installs over and records it if it has changed.
+    ///
+    /// Called from the download, which is the only place that can notice:
+    /// `aapt2` must never run on the manifest path, and a local rebuild
+    /// with a changed `applicationId` tells this server nothing until the
+    /// bytes are asked for. Runs off the request so the download is not
+    /// held up by a process spawn -- the answer is wanted by the *next*
+    /// manifest, not this one.
+    pub fn refresh_package(self: &Arc<Self>, key: &str, apk: PathBuf) {
+        let state = Arc::clone(self);
+        let key = key.to_string();
+        tokio::task::spawn_blocking(move || {
+            let Ok(info) = crate::apkinfo::read(&apk) else {
+                return;
+            };
+            let Some(entry) = state.entry(&key) else {
+                return;
+            };
+            if entry.package() == Some(info.package.as_str()) {
+                return;
+            }
+            if let Some(previous) = entry.package() {
+                tracing::info!(
+                    "{} now installs {} rather than {previous}",
+                    entry.label,
+                    info.package,
+                );
+                state
+                    .previous_packages
+                    .lock()
+                    .unwrap()
+                    .insert(key.clone(), previous.to_string());
+            }
+            let update = state.update(|config| {
+                if let Some(project) = config.projects.iter_mut().find(|p| p.key == key) {
+                    set_measured_package(&mut project.components, info.package);
+                }
+                Ok(())
+            });
+            if let Err(err) = update {
+                tracing::warn!("could not record {key}'s package: {err}");
+            }
+        });
+    }
+
+    /// Records the commit a component was successfully built from.
+    ///
+    /// Called from a running build through the callback `routes` hands it,
+    /// which is why this takes names rather than a handle: the build lives
+    /// inside this list and must not hold it.
+    ///
+    /// A failure to write is logged and dropped rather than failing the
+    /// build. The build genuinely succeeded; all that is lost is knowing
+    /// what it was built from, which reads as unknown -- the same state a
+    /// project has before this server has ever built it.
+    pub fn record_built(&self, key: &str, component: &str, sha: String) {
+        let written = self.update(|config| {
+            if let Some(project) = config.projects.iter_mut().find(|p| p.key == key)
+                && let Some(built) = project
+                    .components
+                    .iter_mut()
+                    .find(|candidate| candidate.name() == component)
+            {
+                built.set_built_from(sha);
+            }
+            Ok(())
+        });
+        if let Err(err) = written {
+            tracing::warn!("could not record what {key}'s {component} was built from: {err}");
+        }
+    }
+
+    pub fn tokens(&self) -> Vec<TokenEntry> {
+        self.registry.read().unwrap().config.tokens.clone()
+    }
+
+    /// Replaces the enrolled token list. With one device this is rotation:
+    /// the old hash is invalidated the moment the new config is saved.
+    pub fn set_tokens(&self, tokens: Vec<TokenEntry>) -> Result<()> {
+        self.update(|config| {
+            config.tokens = tokens;
+            Ok(())
+        })
+    }
+
+    pub fn repo_roots(&self) -> Vec<PathBuf> {
+        self.registry.read().unwrap().config.repo_roots.clone()
+    }
+
+    /// Applies `mutate` to the config, then persists it and rebuilds the
+    /// entry list from it. Every mutation goes through here so that
+    /// "changed in memory" and "written to disk" can't come apart -- a
+    /// failed write leaves the previous state intact and reports the error
+    /// to the phone rather than silently diverging from the file.
+    fn update<T>(&self, mutate: impl FnOnce(&mut Config) -> Result<T>) -> Result<T> {
+        let mut registry = self.registry.write().unwrap();
+        let mut candidate = registry.config.clone();
+        let result = mutate(&mut candidate)?;
+        candidate.save(&self.config_path)?;
+        // Carry existing build state across, so an in-flight build isn't
+        // forgotten by an unrelated edit to another app.
+        registry.entries = build_entries(
+            &candidate,
+            &registry.entries,
+            &self.remote_checks,
+            &self.downloads,
+        );
+        registry.config = candidate;
+        Ok(result)
+    }
+
+    /// Adds the project at `path`, reading its identity out of its newest
+    /// build. Fails if there's nothing built there yet -- with the path it
+    /// looked under, since "I pointed it at my repo root instead of the app
+    /// directory" is the likely mistake and the message should let that be
+    /// spotted without a log.
+    pub fn add_app(&self, path: &Path) -> Result<Arc<AppEntry>> {
+        let project = path
+            .canonicalize()
+            .with_context(|| format!("no such directory: {}", path.display()))?;
+        if !project.is_dir() {
+            bail!("{} is not a directory", project.display());
+        }
+        if let Some(existing) = self
+            .entries()
+            .iter()
+            .find(|entry| entry.project_path == project)
+        {
+            bail!(
+                "{} is already added, as \"{}\"",
+                project.display(),
+                existing.label
+            );
+        }
+
+        let name = project
+            .file_name()
+            .map(|name| name.to_string_lossy().into_owned())
+            .unwrap_or_else(|| "app".to_string());
+
+        // Identity comes out of the built APK whenever there is one: it is
+        // the authority on what will actually be installed. Without one the
+        // project is still added -- there is simply nothing installed for
+        // it yet, which is the honest answer and is what lets a project be
+        // added in order to run the build that produces its first APK.
+        let declared = crate::config::project_config(&project);
+        let (label, package) = match discover::find_apks(&project).into_iter().next() {
+            Some(apk) => {
+                let info = crate::apkinfo::read(&apk.path)?;
+                (
+                    info.label.unwrap_or_else(|| name.clone()),
+                    Some(info.package),
+                )
+            }
+            None => (declared.label.unwrap_or_else(|| name.clone()), None),
+        };
+
+        let key = self.update(|config| {
+            let key = config.unique_key(&name, SELF_KEY);
+            config.projects.push(ProjectConfig {
+                key: key.clone(),
+                label,
+                project_path: project.clone(),
+                git_pull: true,
+                // Nothing this machine has said about it yet.
+                git_ipv4: false,
+                // Nothing accepted yet either, including where the project
+                // says it keeps its state -- that arrives as a request
+                // alongside the components.
+                resources: None,
+                // One component, nothing to run. Whatever the project's own
+                // file declares arrives as a request to be accepted, the
+                // same as it always did -- adding a project must not be a
+                // way to start running its commands.
+                components: vec![Component::Apk {
+                    name: "app".to_string(),
+                    build: crate::config::Command::default(),
+                    cwd: None,
+                    stale_when: None,
+                    strip: false,
+                    package,
+                    built_from: None,
+                }],
+            });
+            Ok(key)
+        })?;
+
+        Ok(self
+            .entry(&key)
+            .expect("just-added app is in the rebuilt entry list"))
+    }
+
+    pub fn remove_app(&self, key: &str) -> Result<()> {
+        if key == SELF_KEY {
+            bail!("{SELF_KEY} is this server's own app and can't be removed");
+        }
+        self.update(|config| {
+            let before = config.projects.len();
+            config.projects.retain(|app| app.key != key);
+            if config.projects.len() == before {
+                bail!("no app named {key}");
+            }
+            Ok(())
+        })?;
+        // Nothing left for either to be about.
+        self.previous_packages.lock().unwrap().remove(key);
+        self.service_checks.forget(key);
+        self.resource_checks.forget(key);
+        Ok(())
+    }
+
+    /// Records this machine's preferences for one project.
+    ///
+    /// Onto that project's own row, including the built-in one, which is
+    /// what having a row for this server's own project buys: there is one
+    /// place a preference lives and no card it silently does nothing on.
+    /// `reconcile_self` carries it across the row being rebuilt.
+    pub fn set_project_settings(&self, key: &str, git_ipv4: bool) -> Result<()> {
+        self.update(|config| {
+            let project = config
+                .projects
+                .iter_mut()
+                .find(|project| project.key == key)
+                .with_context(|| format!("no app named {key}"))?;
+            project.git_ipv4 = git_ipv4;
+            Ok(())
+        })
+    }
+
+    /// Accepts what this project asks to have run, after a person has read
+    /// it on the phone. From here on those components are ordinary
+    /// configuration, indistinguishable from hand-written ones.
+    ///
+    /// Re-read from the project file rather than taken from the request:
+    /// what gets stored is what the project actually asks for, so there is
+    /// no route by which the phone can name a command of its own. The only
+    /// thing that rewrites that file is a pull the same person just
+    /// performed.
+    ///
+    /// Measured values are carried across rather than reset. A declaration
+    /// says nothing about the package a build produces -- that is read from
+    /// the APK -- so accepting one must not throw away what was already
+    /// read, or every acceptance would blank the installed-version check
+    /// until the next build.
+    pub fn approve_declaration(&self, key: &str) -> Result<()> {
+        let entry = self
+            .entry(key)
+            .with_context(|| format!("no app named {key}"))?;
+        let declared = crate::config::project_config(&entry.project_path);
+        if declared.components.is_empty() {
+            bail!(
+                "{} no longer asks for anything -- its {} is gone or unreadable",
+                entry.label,
+                crate::config::PROJECT_CONFIG_FILE,
+            );
+        }
+        self.update(|config| {
+            let project = config
+                .projects
+                .iter_mut()
+                .find(|project| project.key == key)
+                .with_context(|| format!("{key} is built in and has nothing to accept"))?;
+            let measured = measured_packages(&project.components);
+            project.git_pull = declared.git_pull;
+            // Everything `matches_accepted` compares has to be written
+            // here, or accepting cannot clear the gate. `resources` joined
+            // that comparison and this did not, which left any project
+            // declaring one permanently pending: the write succeeded, the
+            // card refreshed, and it still asked. Nothing failed, because
+            // there is no error to report -- the button simply did
+            // nothing. Add a field to the gate and add it here.
+            project.resources = declared.resources;
+            project.components = declared.components;
+            for component in &mut project.components {
+                if let Some(package) = measured.get(component.name()) {
+                    component.set_package(package.clone());
+                }
+            }
+            Ok(())
+        })
+    }
+
+    pub fn set_repo_roots(&self, roots: Vec<PathBuf>) -> Result<()> {
+        self.update(|config| {
+            config.repo_roots = roots;
+            Ok(())
+        })
+    }
+}
+
+/// Brings the built-in row up to date with what this server actually is,
+/// creating it the first time, and reports whether anything changed -- so
+/// a start with nothing to say doesn't rewrite the file.
+///
+/// This project is a row like any other so that everything about a project
+/// has one home, this machine's `gitIpv4` included; before it had one,
+/// such a setting had to be keyed separately and the one card that is
+/// always in the list was the one card it could not be a field on.
+///
+/// What is *in* the row is still derived, and re-derived here rather than
+/// trusted: the path is where this process was started (see main.rs's
+/// `self_project`), and the label and components come from the checkout's
+/// own declaration. That is what keeps a re-clone or a moved repo fixing
+/// itself at the next start instead of leaving the row naming a directory
+/// nobody pulls. Only `git_ipv4` is carried across, because it is the one
+/// thing here somebody chose rather than something this server measured.
+///
+/// The declaration is taken as accepted by construction, deliberately not
+/// subject to the gate the other entries have. Gating would protect
+/// nothing: pulling this repository replaces the binary that would be
+/// doing the gating, so whatever arrives is already trusted by the time it
+/// could run.
+fn reconcile_self(config: &mut Config, self_project: &Path) -> bool {
+    let declared = crate::config::project_config(self_project);
+    // Asked of the project itself, not of its parent. `git status` answers
+    // from any subdirectory, so the two agree whenever `app/` is really
+    // there -- and differ in the one case that matters: a working directory
+    // that is inside this repo but is not its root (`server/`, say) makes
+    // the parent test say yes about a project directory that does not
+    // exist, and the row then claims components from a declaration that is
+    // not there.
+    let in_checkout = crate::git::status(self_project).is_some();
+    // Always has an APK component, and always knows its package. This is
+    // the one project whose package this server can state without reading
+    // an APK -- it is this program -- and it has to: an installed binary
+    // with no checkout has no declaration to read and still has to tell
+    // the phone what it would be replacing.
+    let mut components = if in_checkout {
+        declared.components
+    } else {
+        Vec::new()
+    };
+    if !components
+        .iter()
+        .any(|component| matches!(component, Component::Apk { .. }))
+    {
+        components.push(Component::Apk {
+            name: "app".to_string(),
+            build: crate::config::Command::default(),
+            cwd: None,
+            stale_when: None,
+            strip: false,
+            package: None,
+            built_from: None,
+        });
+    }
+    set_measured_package(&mut components, SELF_PACKAGE.to_string());
+    let existing = config
+        .projects
+        .iter_mut()
+        .find(|project| project.key == SELF_KEY);
+    let derived = ProjectConfig {
+        key: SELF_KEY.to_string(),
+        label: declared.label.unwrap_or_else(|| SELF_LABEL.to_string()),
+        project_path: self_project.to_path_buf(),
+        git_pull: declared.git_pull,
+        git_ipv4: existing.as_ref().is_some_and(|project| project.git_ipv4),
+        components,
+        // Re-derived like everything else in this row: accepted by
+        // construction, because this server's own declaration is not
+        // something it has to be asked about.
+        resources: declared.resources,
+    };
+    match existing {
+        Some(existing) if *existing == derived => false,
+        Some(existing) => {
+            *existing = derived;
+            true
+        }
+        // First in the file and first in the list: this is the entry that
+        // is always there, and the one an installed copy is replaced
+        // through.
+        None => {
+            config.projects.insert(0, derived);
+            true
+        }
+    }
+}
+
+/// Rebuilds the entry list from `config`, reusing any `BuildState` from
+/// `previous` whose app still has the same prepare configuration -- so an
+/// unrelated edit doesn't drop a running build's status on the floor.
+fn build_entries(
+    config: &Config,
+    previous: &[Arc<AppEntry>],
+    remote_checks: &crate::git::RemoteChecks,
+    downloads: &Arc<crate::restart::Downloads>,
+) -> Vec<Arc<AppEntry>> {
+    // Where this server's own project is, according to the row
+    // `reconcile_self` keeps -- only for the warning below, since
+    // everything else about that project is read from the row like any
+    // other's.
+    let self_project = config
+        .projects
+        .iter()
+        .find(|project| project.key == SELF_KEY)
+        .map(|project| project.project_path.as_path());
+    let mut entries = Vec::with_capacity(config.projects.len());
+    for project in &config.projects {
+        // The one project whose build this server does know how to run: it
+        // is this repository. Given a checkout it gets the same
+        // pull-and-build machinery as anything else, plus a restart --
+        // pulling rebuilds the binary too, and the point is to end up
+        // running it.
+        let is_self = project.key == SELF_KEY;
+        // Said out loud rather than hidden or dropped. `add_app` refuses a
+        // path already in the list, and this server's own project is in
+        // that list, so this can only be left over from when it resolved
+        // somewhere else (see main.rs's `self_project`). It is worth
+        // naming because the duplicate is not merely redundant: it is not
+        // the built-in row, so a build through it would run this project's
+        // service script and restart *this server* partway through its own
+        // build, instead of the exec that waits until the build is
+        // reported.
+        //
+        // The card is left alone so it keeps its Remove button, which is
+        // the only way anyone can act on this from the phone -- and is what
+        // tells the two cards apart, since the built-in one has none.
+        if !is_self && Some(project.project_path.as_path()) == self_project {
+            tracing::warn!(
+                "{} is this server's own project and is always in the list as the built-in \
+                 {SELF_LABEL} entry, so \"{}\" is a second card for it. Remove that one from \
+                 the app -- it is the one with a Remove button.",
+                project.project_path.display(),
+                project.label,
+            );
+        }
+        // A project in a checkout gets pull machinery even with nothing
+        // configured -- there is somewhere to pull from, which is all a
+        // Pull button needs. Without a command it pulls and stops; how to
+        // build is still never guessed.
+        let in_checkout = crate::git::status(&project.project_path).is_some();
+        let git_pull = project.git_pull && in_checkout;
+        // A command can be run wherever it is; a checkout can be pulled
+        // even with nothing configured. Either is reason enough to have
+        // build machinery -- without a command it pulls and stops.
+        //
+        // Except for this server itself, which is not offered a Pull it has
+        // nothing to build with: pulling this repository without rebuilding
+        // leaves the new binary on disk and the old one serving.
+        let has_command = crate::config::has_command(&project.components);
+        let build = (has_command || (in_checkout && !is_self)).then(|| {
+            let components = &project.components;
+            reuse_build_state(
+                previous,
+                &project.key,
+                components,
+                git_pull,
+                project.git_ipv4,
+            )
+            .unwrap_or_else(|| {
+                // For this server's own project the Server component is
+                // delivered by exec-ing what it just built, which is
+                // what `is_self` says -- see BuildState::is_self.
+                BuildState::new(
+                    project.key.clone(),
+                    project.components.clone(),
+                    git_pull,
+                    project.git_ipv4,
+                    project.project_path.clone(),
+                    crate::build_state::Shared {
+                        remote_checks: remote_checks.clone(),
+                        downloads: Arc::clone(downloads),
+                    },
+                    is_self,
+                )
+            })
+        });
+        entries.push(Arc::new(AppEntry {
+            git_pull,
+            git_ipv4: project.git_ipv4,
+            resources: project.resources.clone(),
+            key: project.key.clone(),
+            label: project.label.clone(),
+            project_path: project.project_path.clone(),
+            components: project.components.clone(),
+            build,
+            built_in: is_self,
+        }));
+    }
+    entries
+}
+
+fn reuse_build_state(
+    previous: &[Arc<AppEntry>],
+    key: &str,
+    components: &[crate::config::Component],
+    git_pull: bool,
+    git_ipv4: bool,
+) -> Option<Arc<BuildState>> {
+    previous
+        .iter()
+        .find(|entry| entry.key == key)?
+        .build
+        .as_ref()
+        .filter(|state| state.matches(components, git_pull, git_ipv4))
+        .cloned()
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn asking_for(command: &str) -> Vec<Component> {
+        vec![Component::Apk {
+            name: "app".to_string(),
+            build: crate::config::Command::from_line(command),
+            cwd: None,
+            stale_when: None,
+            strip: false,
+            package: None,
+            built_from: None,
+        }]
+    }
+
+    fn write_request(project: &Path, command: &str) {
+        std::fs::write(
+            project.join(crate::config::PROJECT_CONFIG_FILE),
+            format!("components: [Apk(name: \"app\", build: \"{command}\")],\n"),
+        )
+        .expect("write");
+    }
+
+    /// A live `AppState` holding one configured app pointed at `project`,
+    /// with nothing accepted yet.
+    ///
+    /// Built rather than modelled on purpose: what "accepted" means is
+    /// whatever [`AppState::approve_declaration`] writes, and a test that
+    /// assembles the accepted config itself asserts a *copy* of that rule.
+    /// The copy is what let `resources` join the acceptance comparison
+    /// without joining the write, so accepting a project that declared one
+    /// could never clear the gate and no test noticed.
+    fn state_with(project: &Path) -> (tempfile::TempDir, Arc<AppState>) {
+        let home = tempfile::tempdir().expect("tempdir");
+        let config_path = home.path().join("config.ron");
+        Config {
+            projects: vec![ProjectConfig {
+                key: "demo".to_string(),
+                label: "Demo".to_string(),
+                project_path: project.to_path_buf(),
+                git_pull: true,
+                git_ipv4: false,
+                components: Vec::new(),
+                resources: None,
+            }],
+            ..Config::default()
+        }
+        .save(&config_path)
+        .expect("save");
+        // Self project pointed at an empty directory: this is about a
+        // configured app, and the built-in row has nothing to accept.
+        let state = AppState::new(config_path, home.path().join("self")).expect("state");
+        (home, Arc::new(state))
+    }
+
+    /// The entry list for one app pointed at `project`, with `accepted`
+    /// standing for whatever is already in this machine's config.
+    fn entry_for(project: &Path, accepted: Vec<Component>) -> Arc<AppEntry> {
+        let config = Config {
+            projects: vec![ProjectConfig {
+                key: "demo".to_string(),
+                label: "Demo".to_string(),
+                project_path: project.to_path_buf(),
+                git_pull: true,
+                git_ipv4: false,
+                components: accepted,
+                resources: None,
+            }],
+            ..Config::default()
+        };
+        // No built-in row: this is about a configured app, and leaving it
+        // out keeps the entry list to the one being asked about.
+        build_entries(
+            &config,
+            &[],
+            &crate::git::RemoteChecks::default(),
+            &Arc::new(crate::restart::Downloads::default()),
+        )
+        .into_iter()
+        .find(|entry| entry.key == "demo")
+        .expect("the configured app")
+    }
+
+    /// The point of the whole mechanism: a project asking for a command
+    /// does not thereby get to run one.
+    #[test]
+    fn a_build_step_a_project_asks_for_waits_until_it_is_accepted() {
+        let dir = tempfile::tempdir().expect("tempdir");
+        write_request(dir.path(), "./build.sh");
+
+        let pending = entry_for(dir.path(), Vec::new());
+        assert_eq!(
+            pending.pending_declaration(),
+            Some(asking_for("./build.sh"))
+        );
+
+        // Accepted is exactly "the config now says what the project says",
+        // which is what approve_declaration writes.
+        let accepted = entry_for(dir.path(), asking_for("./build.sh"));
+        assert_eq!(accepted.pending_declaration(), None);
+        assert!(
+            accepted
+                .build
+                .as_ref()
+                .is_some_and(|build| build.has_command())
+        );
+    }
+
+    /// Accepting has to clear the gate -- for every project, including
+    /// one that declares `resources:`.
+    ///
+    /// The bug this holds shut: `matches_accepted` compares the components
+    /// *and* the resources declaration, while `approve_declaration` wrote
+    /// only the components. Accepting therefore stored half of what was
+    /// being compared, the card came back still asking, and the phone had
+    /// nothing to show for the press -- the write had succeeded, so there
+    /// was no error either. It went through the whole of ai-app's card
+    /// before anybody could accept anything.
+    #[test]
+    fn accepting_clears_the_gate_including_the_resources_declaration() {
+        let dir = tempfile::tempdir().expect("tempdir");
+        std::fs::write(
+            dir.path().join(crate::config::PROJECT_CONFIG_FILE),
+            "resources: Ron(\"resources.ron\"),\n             components: [Apk(name: \"app\", build: \"./build.sh\")],\n",
+        )
+        .expect("write");
+
+        let (_home, state) = state_with(dir.path());
+        assert!(
+            state
+                .entry("demo")
+                .expect("entry")
+                .pending_declaration()
+                .is_some(),
+            "nothing accepted yet",
+        );
+
+        state.approve_declaration("demo").expect("approve");
+        let entry = state.entry("demo").expect("entry");
+        assert_eq!(
+            entry.pending_declaration(),
+            None,
+            "accepting must clear the gate, not half of it",
+        );
+        assert_eq!(
+            entry.resources,
+            Some(crate::config::Resources::Ron(PathBuf::from(
+                "resources.ron"
+            ))),
+            "the accepted copy is what a later comparison reads",
+        );
+    }
+
+    /// The case the gate exists for, and the one a cached answer got
+    /// wrong: the project file changes on a *pull*, which writes no config
+    /// and so rebuilds no entries. An entry built while the request
+    /// matched must still notice when it stops matching.
+    #[test]
+    fn a_request_that_changes_under_a_built_entry_withdraws_the_acceptance() {
+        let dir = tempfile::tempdir().expect("tempdir");
+        write_request(dir.path(), "./build.sh");
+
+        let entry = entry_for(dir.path(), asking_for("./build.sh"));
+        assert_eq!(entry.pending_declaration(), None, "accepted to begin with");
+
+        // What a pull bringing a changed .dev-updater.ron does. The entry
+        // is not rebuilt -- nothing wrote the config -- so this is read
+        // through the same entry that was just current.
+        write_request(dir.path(), "./something-else.sh");
+        assert_eq!(
+            entry.pending_declaration(),
+            Some(asking_for("./something-else.sh")),
+            "a changed request must stop counting as accepted",
+        );
+    }
+
+    /// A checkout laid out the way this repository is: `<repo>/app` is the
+    /// self entry's project, and `<repo>` is what gets pulled.
+    fn self_checkout(root: &Path) -> PathBuf {
+        let app = root.join("app");
+        std::fs::create_dir_all(&app).expect("mkdir");
+        // Committed, not merely initialised: reading a checkout's branch
+        // is what tells this apart from an installed binary, and a
+        // repository with no commits has no branch to report.
+        for args in [
+            &["init", "-q"][..],
+            &["config", "user.email", "t@example.com"],
+            &["config", "user.name", "Test"],
+            &["commit", "-q", "--allow-empty", "-m", "one"],
+        ] {
+            let status = std::process::Command::new("git")
+                .args(args)
+                .current_dir(root)
+                .status()
+                .expect("run git");
+            assert!(status.success(), "git {args:?}");
+        }
+        app
+    }
+
+    /// The built-in entry as it comes out of a config `reconcile_self`
+    /// has settled -- which is what startup does before anything reads the
+    /// list.
+    fn self_entry(app: &Path) -> Arc<AppEntry> {
+        let mut config = Config::default();
+        assert!(
+            reconcile_self(&mut config, app),
+            "the row has to be written the first time"
+        );
+        assert!(
+            !reconcile_self(&mut config, app),
+            "and not rewritten with nothing to say"
+        );
+        build_entries(
+            &config,
+            &[],
+            &crate::git::RemoteChecks::default(),
+            &Arc::new(crate::restart::Downloads::default()),
+        )
+        .into_iter()
+        .find(|entry| entry.key == SELF_KEY)
+        .expect("the self entry always exists")
+    }
+
+    /// The updater describes itself with the same file any other project
+    /// carries. Describing it twice is how the two descriptions come to
+    /// disagree.
+    #[test]
+    fn the_self_entry_reads_its_own_declaration() {
+        let dir = tempfile::tempdir().expect("tempdir");
+        let app = self_checkout(dir.path());
+        std::fs::write(
+            app.join(crate::config::PROJECT_CONFIG_FILE),
+            "label: \"Declared Name\",\n\
+             components: [\n\
+                 Server(\n\
+                     name: \"server\",\n\
+                     build: \"cargo build --release\",\n\
+                     service: Script(\"../server/service\"),\n\
+                 ),\n\
+                 Apk(name: \"app\", build: \"./build-apk.sh\"),\n\
+             ],\n",
+        )
+        .expect("write");
+
+        let entry = self_entry(&app);
+        assert_eq!(entry.label, "Declared Name");
+        // Its own package is this server's, not something a file may
+        // claim -- it is the one entry that is this program.
+        assert_eq!(entry.package(), Some(SELF_PACKAGE));
+        assert!(
+            entry
+                .build
+                .as_ref()
+                .is_some_and(|build| build.has_command())
+        );
+        assert!(entry.git_pull);
+        // Never waiting to be accepted: pulling this repository replaces
+        // the binary that would be doing the gating.
+        assert_eq!(entry.pending_declaration(), None);
+    }
+
+    /// An installed binary has no checkout to read, and still has to offer
+    /// itself -- it is the only route by which the phone's copy is ever
+    /// replaced.
+    #[test]
+    fn the_self_entry_survives_having_nothing_to_read() {
+        let dir = tempfile::tempdir().expect("tempdir");
+        let app = self_checkout(dir.path());
+
+        let entry = self_entry(&app);
+        assert_eq!(entry.label, SELF_LABEL);
+        assert_eq!(entry.package(), Some(SELF_PACKAGE));
+        assert!(entry.built_in);
+        // Nothing declares how to build it, so nothing is guessed.
+        assert!(entry.build.is_none());
+    }
+
+    /// The point of the built-in project having a row at all: a setting
+    /// somebody chose from the phone belongs to it like any other
+    /// project's, and re-deriving the row every start must not take it
+    /// back off.
+    #[test]
+    fn what_this_machine_chose_survives_the_built_in_row_being_re_derived() {
+        let dir = tempfile::tempdir().expect("tempdir");
+        let app = self_checkout(dir.path());
+        let mut config = Config::default();
+        reconcile_self(&mut config, &app);
+
+        config.projects[0].git_ipv4 = true;
+        assert!(
+            !reconcile_self(&mut config, &app),
+            "a setting is not a reason to rewrite"
+        );
+        assert!(
+            config.projects[0].git_ipv4,
+            "kept: nothing else here is somebody's choice"
+        );
+
+        // And the entry the phone is shown says so.
+        let entries = build_entries(
+            &config,
+            &[],
+            &crate::git::RemoteChecks::default(),
+            &Arc::new(crate::restart::Downloads::default()),
+        );
+        assert!(entries[0].git_ipv4);
+    }
+
+    /// What is derived stays derived. The symptom this prevents is the one
+    /// the path being compiled in used to cause: a row naming a directory
+    /// nobody pulls, on a card that otherwise works.
+    #[test]
+    fn a_moved_checkout_repoints_the_built_in_row() {
+        let dir = tempfile::tempdir().expect("tempdir");
+        let app = self_checkout(dir.path());
+        let mut config = Config::default();
+        reconcile_self(&mut config, Path::new("/nonexistent/app"));
+        config.projects[0].git_ipv4 = true;
+
+        assert!(
+            reconcile_self(&mut config, &app),
+            "the path it was started in wins"
+        );
+        assert_eq!(config.projects[0].project_path, app);
+        assert!(config.projects[0].git_ipv4, "and the choice comes with it");
+    }
+
+    /// The ordinary case, which must keep working untouched: a project
+    /// that asks for nothing is configured entirely from this machine.
+    #[test]
+    fn a_project_that_asks_for_nothing_is_left_to_the_local_config() {
+        let dir = tempfile::tempdir().expect("tempdir");
+        let entry = entry_for(dir.path(), asking_for("./build.sh"));
+        assert_eq!(entry.pending_declaration(), None);
+        assert!(
+            entry
+                .build
+                .as_ref()
+                .is_some_and(|build| build.has_command())
+        );
+    }
+}
diff --git a/server/src/resources.rs b/server/src/resources.rs
new file mode 100644
index 0000000..d2c6527
--- /dev/null
+++ b/server/src/resources.rs
@@ -0,0 +1,266 @@
+//! Reading what a project says about itself.
+//!
+//! A project's `resources:` declaration points at values the project
+//! keeps for its own use -- its name, where its data and config live --
+//! and this reads the few of them this server needs. The file belongs to
+//! the project: its own code is expected to read the same one, which is
+//! why unrecognised keys are ignored rather than refused.
+//!
+//! **Off the request path, like every other slow answer here.** The
+//! `Script` variant spawns a process, and `/manifest` is fetched on every
+//! open, resume and Refresh -- the one thing that path must not do. So
+//! this goes through [`crate::checks`] beside the git and service checks,
+//! answers arriving after the response that started them, and the phone
+//! waiting on all three through the same outstanding count.
+//!
+//! Not knowing is a first-class answer. A project that declares nothing,
+//! a file that will not parse, a script that fails: each leaves the
+//! Uninstall dialog saying it cannot tell where the data lives, rather
+//! than filling in a directory that looks plausible. The version of this
+//! that guessed -- first from the config key, then from the checkout's
+//! directory name -- was wrong in a way nothing could see, because a path
+//! that is not there reads as "this component keeps nothing here".
+
+use std::path::{Path, PathBuf};
+use std::sync::Arc;
+
+use crate::checks::{Checks, Report};
+use crate::config::{ResourceFacts, Resources};
+
+/// How long a resources script is given before it is treated as having
+/// failed.
+///
+/// It prints three values; anything that takes longer than this is stuck
+/// rather than slow, and a check that never finishes holds the key
+/// claimed forever -- so the card would sit on "still finding out" with
+/// nothing ever arriving.
+const SCRIPT_TIMEOUT: std::time::Duration = std::time::Duration::from_secs(10);
+
+/// Reads a project's resources, or says why it could not.
+///
+/// The error is what the card shows, so it names the file or the command
+/// rather than only the underlying complaint -- "no such file" without a
+/// path is not something a person can act on.
+pub fn read(project: &Path, declaration: &Resources) -> Result<ResourceFacts, String> {
+    match declaration {
+        Resources::Inline(facts) => Ok(facts.clone()),
+        Resources::Ron(path) => {
+            // `~` expanded the same way it is for a path typed on a
+            // phone; `join` on an absolute path yields that path, so a
+            // resources file may live outside the checkout.
+            let path = project.join(
+                path.to_str()
+                    .map(crate::config::expand_tilde)
+                    .unwrap_or_else(|| path.clone()),
+            );
+            let text = std::fs::read_to_string(&path)
+                .map_err(|err| format!("reading {}: {err}", path.display()))?;
+            parse(&text).map_err(|err| format!("in {}: {err}", path.display()))
+        }
+        Resources::Script(command) => {
+            let text = run(project, command)?;
+            parse(&text).map_err(|err| format!("in the output of {}: {err}", command.to_line()))
+        }
+    }
+}
+
+/// The project's own house rules, which are this server's: the file is the
+/// *body* of the struct, and an optional value is written bare.
+///
+/// Shared with `wg_app_link::format` rather than reimplemented, because
+/// the project's own code parses the same file and the two must agree
+/// about whether it has outer parentheses.
+fn parse(text: &str) -> Result<ResourceFacts, String> {
+    wg_app_link::format::parse(text).map_err(|err| err.to_string())
+}
+
+fn run(project: &Path, command: &crate::config::Command) -> Result<String, String> {
+    use std::io::Read;
+
+    let mut child = command
+        .to_process(project, None, &[])?
+        // Closed, because a script that asks a question would otherwise
+        // wait for an answer nobody is there to give -- the same rule the
+        // service scripts run under.
+        .stdin(std::process::Stdio::null())
+        .stdout(std::process::Stdio::piped())
+        .stderr(std::process::Stdio::piped())
+        .spawn()
+        .map_err(|err| format!("starting {}: {err}", command.to_line()))?;
+
+    let deadline = std::time::Instant::now() + SCRIPT_TIMEOUT;
+    loop {
+        match child.try_wait() {
+            Err(err) => return Err(format!("waiting on {}: {err}", command.to_line())),
+            Ok(Some(status)) => {
+                let mut out = String::new();
+                if let Some(mut pipe) = child.stdout.take() {
+                    let _ = pipe.read_to_string(&mut out);
+                }
+                if status.success() {
+                    return Ok(out);
+                }
+                let mut err = String::new();
+                if let Some(mut pipe) = child.stderr.take() {
+                    let _ = pipe.read_to_string(&mut err);
+                }
+                return Err(format!(
+                    "{} failed ({status}): {}",
+                    command.to_line(),
+                    err.lines().next().unwrap_or("no output").trim()
+                ));
+            }
+            Ok(None) if std::time::Instant::now() >= deadline => {
+                let _ = child.kill();
+                return Err(format!(
+                    "{} did not answer within {}s",
+                    command.to_line(),
+                    SCRIPT_TIMEOUT.as_secs()
+                ));
+            }
+            Ok(None) => std::thread::sleep(std::time::Duration::from_millis(20)),
+        }
+    }
+}
+
+/// One project to read, and where from.
+pub struct Target {
+    pub key: String,
+    pub project: PathBuf,
+    pub declaration: Resources,
+}
+
+/// The resources this server has read, by project key.
+///
+/// A facade over [`Checks`] in the same shape as `git::RemoteChecks` and
+/// `service::ServiceChecks`, so all three are started, counted and
+/// reported the same way.
+#[derive(Default, Clone)]
+pub struct ResourceChecks(Arc<Checks<String, ResourceFacts>>);
+
+impl ResourceChecks {
+    /// What this project last said about itself. `None` before anything
+    /// has been read, which is not the same as a project that declares
+    /// nothing -- the caller knows which by whether there is a
+    /// declaration at all.
+    pub fn facts(&self, key: &str) -> Option<ResourceFacts> {
+        self.0.answer(key)
+    }
+
+    pub fn is_checking(&self, key: &str) -> bool {
+        self.0.is_checking(key)
+    }
+
+    pub fn error(&self, key: &str) -> Option<String> {
+        self.0.error(key)
+    }
+
+    /// Reads every target that isn't already being read. Returns at once.
+    pub fn refresh(&self, targets: Vec<Target>) {
+        for target in targets {
+            let Target {
+                key,
+                project,
+                declaration,
+            } = target;
+            self.0
+                .start(key, move |_| Report::from(read(&project, &declaration)));
+        }
+    }
+
+    /// Forgets a project being removed, so its key cannot be answered
+    /// after nothing points at it.
+    pub fn forget(&self, key: &str) {
+        self.0.retain(|held| held != key);
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn a_file_is_read_as_the_body_of_the_struct() {
+        let dir = std::env::temp_dir().join(format!("resources-ron-{}", std::process::id()));
+        std::fs::create_dir_all(&dir).unwrap();
+        std::fs::write(
+            dir.join("resources.ron"),
+            "// what this project calls itself\nname: \"ai-app\",\n",
+        )
+        .unwrap();
+
+        let facts = read(&dir, &Resources::Ron(PathBuf::from("resources.ron"))).unwrap();
+        assert_eq!(facts.name.as_deref(), Some("ai-app"));
+        assert_eq!(facts.data, None, "not said is not a value to invent");
+        let _ = std::fs::remove_dir_all(&dir);
+    }
+
+    /// The project's file, so what this server does not recognise is
+    /// somebody else's business rather than an error.
+    #[test]
+    fn keys_this_server_does_not_know_are_ignored() {
+        let dir = std::env::temp_dir().join(format!("resources-extra-{}", std::process::id()));
+        std::fs::create_dir_all(&dir).unwrap();
+        std::fs::write(
+            dir.join("r.ron"),
+            "name: \"ai-app\",\nmodelCache: \"~/models\",\nport: 8443,\n",
+        )
+        .unwrap();
+
+        let facts = read(&dir, &Resources::Ron(PathBuf::from("r.ron"))).unwrap();
+        assert_eq!(facts.name.as_deref(), Some("ai-app"));
+        let _ = std::fs::remove_dir_all(&dir);
+    }
+
+    #[test]
+    fn a_missing_file_says_which_file() {
+        let err = read(
+            Path::new("/nowhere-at-all"),
+            &Resources::Ron(PathBuf::from("r.ron")),
+        )
+        .unwrap_err();
+        assert!(err.contains("r.ron"), "{err}");
+    }
+
+    #[test]
+    fn a_script_is_read_from_its_output() {
+        let dir = std::env::temp_dir().join(format!("resources-script-{}", std::process::id()));
+        std::fs::create_dir_all(&dir).unwrap();
+        let script = dir.join("say.sh");
+        std::fs::write(&script, "#!/bin/sh\necho 'name: \"computed\",'\n").unwrap();
+        {
+            use std::os::unix::fs::PermissionsExt;
+            std::fs::set_permissions(&script, std::fs::Permissions::from_mode(0o700)).unwrap();
+        }
+
+        let facts = read(
+            &dir,
+            &Resources::Script(crate::config::Command::from_line("./say.sh")),
+        )
+        .unwrap();
+        assert_eq!(facts.name.as_deref(), Some("computed"));
+        let _ = std::fs::remove_dir_all(&dir);
+    }
+
+    /// A failing script is a state the card has a word for, not something
+    /// to fall back from.
+    #[test]
+    fn a_failing_script_reports_rather_than_answering() {
+        let dir = std::env::temp_dir().join(format!("resources-fail-{}", std::process::id()));
+        std::fs::create_dir_all(&dir).unwrap();
+        let script = dir.join("no.sh");
+        std::fs::write(&script, "#!/bin/sh\necho 'nope' >&2\nexit 3\n").unwrap();
+        {
+            use std::os::unix::fs::PermissionsExt;
+            std::fs::set_permissions(&script, std::fs::Permissions::from_mode(0o700)).unwrap();
+        }
+
+        let err = read(
+            &dir,
+            &Resources::Script(crate::config::Command::from_line("./no.sh")),
+        )
+        .unwrap_err();
+        assert!(err.contains("nope"), "{err}");
+        let _ = std::fs::remove_dir_all(&dir);
+    }
+}
diff --git a/server/src/restart.rs b/server/src/restart.rs
new file mode 100644
index 0000000..7f2226e
--- /dev/null
+++ b/server/src/restart.rs
@@ -0,0 +1,367 @@
+//! Restarting this server in place, after it has rebuilt itself.
+//!
+//! Only the self-update path uses this: pulling this repository rebuilds
+//! the binary, and a new binary sitting on disk while the old process
+//! keeps serving is not an update.
+
+use std::path::{Path, PathBuf};
+use std::sync::atomic::{AtomicUsize, Ordering};
+use std::sync::{Arc, OnceLock};
+use std::time::{Duration, Instant, SystemTime};
+
+use crate::config::Command;
+
+/// APK downloads currently being sent, so a restart can wait for them
+/// instead of cutting them off.
+///
+/// A build of this server's own project ends in an exec, and the thing
+/// that most often happens *immediately* after such a build is the phone
+/// downloading the APK it just produced. Those two raced: the exec was on
+/// a fixed two-second timer, the phone learned the build had finished up
+/// to a poll interval late, and an APK takes longer than the remainder to
+/// transfer. The download died with the socket and the card reported that
+/// the server could not be reached -- in the middle of the update that was
+/// working.
+///
+/// Counting them is the honest fix. A timer longer than "most" downloads
+/// would be a guess about a number this can simply know.
+#[derive(Default)]
+pub struct Downloads(AtomicUsize);
+
+impl Downloads {
+    /// Counts one download until the returned guard is dropped, which
+    /// happens when the response body is finished or the client goes away
+    /// -- either way, when this server is no longer sending.
+    pub fn start(self: &Arc<Self>) -> DownloadGuard {
+        self.0.fetch_add(1, Ordering::SeqCst);
+        DownloadGuard(Arc::clone(self))
+    }
+
+    fn in_flight(&self) -> usize {
+        self.0.load(Ordering::SeqCst)
+    }
+}
+
+pub struct DownloadGuard(Arc<Downloads>);
+
+impl Drop for DownloadGuard {
+    fn drop(&mut self) {
+        self.0.0.fetch_sub(1, Ordering::SeqCst);
+    }
+}
+
+/// How long a restart will wait for downloads to finish before going
+/// anyway.
+///
+/// Bounded because a stalled client must not be able to keep this server
+/// on an old binary indefinitely -- at that point the update not landing
+/// is the worse failure. Generous enough for a large APK over a phone's
+/// connection.
+const DOWNLOAD_GRACE: Duration = Duration::from_secs(120);
+
+/// How long to give a service manager to actually stop this process after
+/// being asked to, before concluding it will not and restarting without it.
+///
+/// Generous, because being restarted twice is a second's interruption
+/// while restarting *early* would race the manager's own start and could
+/// leave two of this server, or none. Bounded, because the phone reaches
+/// this machine only through this process: a restart that quietly never
+/// happens is the failure that ends with somebody at a keyboard.
+const HANDOVER: Duration = Duration::from_secs(30);
+
+/// Where this process was started from, captured before anything can
+/// rebuild it.
+///
+/// A process-wide value rather than something passed down, because it is
+/// process identity: there is exactly one answer, it never changes, and
+/// the one thing that *would* change it is the rebuild this module exists
+/// to survive. Reading it late is precisely the bug -- see below.
+static EXECUTABLE: OnceLock<PathBuf> = OnceLock::new();
+
+/// What that file looked like at startup, so a later build can be asked
+/// whether it actually replaced it. `None` if it couldn't be read.
+static ORIGINAL: OnceLock<Option<Identity>> = OnceLock::new();
+
+/// Enough of a file to tell "untouched" from "something wrote here".
+///
+/// Deliberately `stat` rather than a hash of the contents. The question is
+/// whether the build replaced the binary, and cargo replaces it by
+/// renaming a new file over the old -- which changes the inode, and almost
+/// always the length and mtime too. Reading tens of megabytes to answer
+/// what three numbers already answer would cost more than the restart it
+/// is trying to avoid.
+#[derive(Debug, PartialEq, Eq)]
+struct Identity {
+    inode: u64,
+    len: u64,
+    modified: Option<SystemTime>,
+}
+
+fn identity(path: &Path) -> Option<Identity> {
+    use std::os::unix::fs::MetadataExt;
+
+    let meta = std::fs::metadata(path).ok()?;
+    Some(Identity {
+        inode: meta.ino(),
+        len: meta.len(),
+        modified: meta.modified().ok(),
+    })
+}
+
+/// Whether the binary on disk is still the one this process is running.
+///
+/// A build that finds nothing to do leaves the file alone, and exec-ing
+/// into a byte-identical binary drops every open connection to achieve
+/// nothing -- so the self-update path asks this before restarting.
+///
+/// Answers `false` whenever it cannot tell, which is the behaviour there
+/// was before this check existed: a restart that wasn't needed is a
+/// second's interruption, while a skipped one leaves the old build serving
+/// and looks like the update silently failing.
+pub fn binary_unchanged() -> bool {
+    let (Some(exe), Some(Some(original))) = (EXECUTABLE.get(), ORIGINAL.get()) else {
+        return false;
+    };
+    identity(exe).is_some_and(|now| now == *original)
+}
+
+/// Records the running binary's path. Call once, at startup.
+///
+/// This has to happen before a rebuild replaces the file. Cargo installs a
+/// new binary by renaming over the old one, which unlinks the inode this
+/// process is running from; from that moment Linux reports the path as
+/// `/path/to/binary (deleted)`, and `current_exe` hands that string back
+/// verbatim. Exec'ing it fails with "no such file or directory" -- the
+/// restart failing at the one moment it was needed.
+pub fn remember_executable() {
+    match std::env::current_exe() {
+        Ok(path) => {
+            let _ = ORIGINAL.set(identity(&path));
+            let _ = EXECUTABLE.set(path);
+        }
+        Err(err) => tracing::warn!(
+            "cannot determine this binary's path, so restarting after a \
+                                    self-update won't work: {err}"
+        ),
+    }
+}
+
+/// How long to wait before exec-ing, so whatever asked for the restart is
+/// answered first.
+///
+/// Both callers need it for the same reason: a reply that dies with the
+/// socket looks like a failure, whether it was a build reporting success
+/// or a Restart button asking for exactly this.
+const DELAY: Duration = Duration::from_secs(2);
+
+/// Replaces this process with the binary now on disk, shortly.
+///
+/// `exec` rather than spawn-and-exit so the process keeps its PID:
+/// whatever supervises this server sees one continuous process rather than
+/// one vanishing and another appearing, so nothing has to be configured to
+/// restart it. Where there is no supervisor, the exec *is* the restart.
+///
+/// Returns at once; the exec happens on its own thread after [`DELAY`],
+/// and after any download in flight has finished -- see [`Downloads`].
+/// Waits until replacing this process would not interrupt anything: the
+/// reply is out, and no APK is still going down the wire.
+///
+/// Split out so the two ways of restarting -- exec-ing in place, and
+/// asking a service manager to do it -- wait the same way rather than one
+/// of them being remembered to.
+pub fn settle(downloads: &Downloads) {
+    std::thread::sleep(DELAY);
+    // The reply is out by now; what may not be out is an APK. Waiting here
+    // rather than lengthening DELAY because the question is not "how long
+    // is long enough", which nobody can answer, but "is this server still
+    // sending", which it knows.
+    let deadline = Instant::now() + DOWNLOAD_GRACE;
+    while downloads.in_flight() > 0 && Instant::now() < deadline {
+        std::thread::sleep(Duration::from_millis(200));
+    }
+    if downloads.in_flight() > 0 {
+        tracing::warn!(
+            "restarting with {} download(s) still open -- they were given {}s",
+            downloads.in_flight(),
+            DOWNLOAD_GRACE.as_secs(),
+        );
+    }
+}
+
+/// Replaces this process with the binary on disk, now.
+///
+/// Only returns on failure; on success this process is gone. The caller
+/// is expected to have called [`settle`] first.
+pub fn exec_now() {
+    use std::os::unix::process::CommandExt;
+
+    let Some(exe) = EXECUTABLE.get().cloned() else {
+        tracing::error!("no remembered binary path, so not restarting");
+        return;
+    };
+    if !exe.is_file() {
+        tracing::error!(
+            "{} is gone, so not restarting -- the old binary keeps serving",
+            exe.display()
+        );
+        return;
+    }
+    let args: Vec<String> = std::env::args().skip(1).collect();
+    tracing::info!("restarting into {}", exe.display());
+    let err = std::process::Command::new(&exe).args(&args).exec();
+    tracing::error!("restart failed, carrying on with the old binary: {err}");
+}
+
+/// What this server needs in order to ask its supervisor to restart it:
+/// the same three things any other server component is driven with.
+///
+/// Carried as owned values because the restart outlives the request that
+/// asked for it -- it happens on its own thread, after the reply.
+pub struct Handover {
+    pub script: Command,
+    pub project: PathBuf,
+    pub cwd: Option<PathBuf>,
+}
+
+/// Restarts this server once nothing is left to interrupt: through its
+/// supervisor when one is holding it, and by exec-ing the binary on disk
+/// when nothing is.
+///
+/// Returns at once. Every restart of this server goes through here --
+/// the Restart button and the end of a self-build alike -- so that the
+/// two cannot come to mean different things. They did once: the button
+/// exec'd unconditionally on the grounds that exec keeps the PID, which
+/// meant it was the one restart a refreshed unit did not apply to.
+///
+/// `handover` is `None` only when this project declares no server script
+/// at all, which leaves the exec as the only restart there is.
+pub fn deferred(handover: Option<Handover>, downloads: Arc<Downloads>) {
+    std::thread::spawn(move || {
+        settle(&downloads);
+        if handover.is_some_and(|handover| through_service(&handover)) {
+            return;
+        }
+        exec_now();
+    });
+}
+
+/// Asks the service manager to restart this server, reporting whether it
+/// got that far.
+///
+/// This is the answer to "can't it just stop itself and start again?". It
+/// cannot -- a process that stops itself has nothing left to start it --
+/// but its *supervisor* can, and that is the whole difference.
+///
+/// Going through the manager is also the only way a rewritten unit takes
+/// effect: `install` writes the file, and only a manager-driven start
+/// reads it. An exec cannot, because it inherits the file descriptors of
+/// the process it replaces -- so a newly declared `StandardOutput=` would
+/// go on writing wherever the old one did.
+///
+/// Answers false when no manager is holding this server -- run by hand, or
+/// never installed -- because then asking a script to stop it would stop it
+/// for good, and exec-ing is the only restart available. That is why the
+/// state is *asked* rather than assumed.
+fn through_service(handover: &Handover) -> bool {
+    let Handover {
+        script,
+        project,
+        cwd,
+    } = handover;
+    match crate::service::status(script, project, cwd.as_deref()) {
+        Ok(crate::service::ServiceState::Running) => {}
+        Ok(state) => {
+            tracing::info!("this server is {state:?} to its manager, so exec-ing instead");
+            return false;
+        }
+        Err(err) => {
+            tracing::warn!("could not ask how this server is run ({err}), so exec-ing");
+            return false;
+        }
+    }
+    tracing::info!("restarting through the service manager, so a refreshed unit applies");
+    if let Err(message) = crate::service::spawn_detached(script, project, cwd.as_deref(), "restart")
+    {
+        // The script could not even be started, which it did without
+        // stopping us -- so exec-ing is still available, and still better
+        // than not restarting at all.
+        tracing::error!("could not ask the service manager to restart this server: {message}");
+        return false;
+    }
+
+    // Nothing is waited on: what was asked for is this process ending, so
+    // the answer arrives as a signal rather than as an exit status. If it
+    // does not arrive, the manager did not do it -- the script failed, or
+    // it restarted something that is not us -- and this server is still
+    // the old binary with the update undelivered. Falling back to the exec
+    // then costs a redundant restart at worst, where trusting the manager
+    // and waiting forever costs the phone its only way back in.
+    std::thread::sleep(HANDOVER);
+    tracing::warn!(
+        "still running {}s after asking the service manager to restart -- exec-ing instead",
+        HANDOVER.as_secs()
+    );
+    false
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn a_rewritten_file_is_not_the_file_it_was() {
+        let dir = tempfile::tempdir().unwrap();
+        let path = dir.path().join("binary");
+        std::fs::write(&path, b"one").unwrap();
+        let before = identity(&path).unwrap();
+
+        assert_eq!(
+            identity(&path).unwrap(),
+            before,
+            "reading twice must not look like a change"
+        );
+
+        // How cargo installs a new binary, and the reason inode is part of
+        // the identity at all: the old file is unlinked, not overwritten.
+        let replacement = dir.path().join("new");
+        std::fs::write(&replacement, b"two").unwrap();
+        std::fs::rename(&replacement, &path).unwrap();
+        assert_ne!(identity(&path).unwrap(), before);
+    }
+
+    /// The whole predicate, against a real binary that nothing rebuilt:
+    /// this test's own. `remember_executable` is what the server calls at
+    /// startup, so this is the same pair of calls the self-update path
+    /// makes, with the build in between doing nothing -- which is exactly
+    /// the case that must not restart.
+    #[test]
+    fn a_binary_nothing_rebuilt_reports_unchanged() {
+        remember_executable();
+        assert!(binary_unchanged());
+    }
+
+    /// The count has to fall to zero on its own, including when a client
+    /// disappears rather than finishing -- which is a drop either way.
+    #[test]
+    fn a_download_is_counted_only_while_it_is_being_sent() {
+        let downloads = Arc::new(Downloads::default());
+        assert_eq!(downloads.in_flight(), 0, "nothing is being sent yet");
+
+        let first = downloads.start();
+        let second = downloads.start();
+        assert_eq!(downloads.in_flight(), 2, "two phones at once");
+
+        drop(first);
+        assert_eq!(downloads.in_flight(), 1, "one finished");
+
+        // Dropped without finishing, which is what a client going away
+        // looks like from here.
+        drop(second);
+        assert_eq!(downloads.in_flight(), 0, "a restart may now proceed");
+    }
+
+    #[test]
+    fn a_missing_file_has_no_identity() {
+        assert!(identity(Path::new("/nonexistent/dev-updater")).is_none());
+    }
+}
diff --git a/server/src/routes.rs b/server/src/routes.rs
new file mode 100644
index 0000000..8b0b9a4
--- /dev/null
+++ b/server/src/routes.rs
@@ -0,0 +1,1409 @@
+//! The HTTP surface. Everything except the bootstrap route below is served
+//! over the pinned-TLS listener, because every one of these either is, or
+//! decides, the bytes that get handed to `REQUEST_INSTALL_PACKAGES` next.
+//!
+//! ```text
+//! GET    /manifest[?recheck=false] every app, its newest build, its variants
+//! GET    /apps/{key}               one of them, for a card that just
+//!                                   acted and wants only itself back
+//! GET    /suggestions              projects found under the configured roots
+//! POST   /apps       {path}        add the project at that path
+//! DELETE /apps/{key}               remove it again
+//! PUT    /roots      {roots}       set the directories /suggestions scans
+//! GET    /apps/{key}/apk[?variant=] the payload itself (ranged)
+//! POST   /apps/{key}/pull          fetch, fast-forward, and build
+//! POST   /apps/{key}/prepare       run the on-demand build step, if any
+//! POST   /apps/{key}/build         run it whether or not it looks stale
+//! POST   /apps/{key}/approve       accept the build step it asks for
+//! POST   /apps/{key}/recheck       ask that one project's remote and
+//!                                   services again
+//! PUT    /apps/{key}/settings {gitIpv4}
+//!                                   this machine's preferences for it
+//! GET    /apps/{key}/components/{name}/logs[?lines=&generation=]
+//!                                   what that component wrote
+//! POST   /apps/{key}/components/{name}/{action}
+//!                                   install|uninstall|start|stop|restart
+//!                                   a server component, on the *build
+//!                                   machine*
+//! GET    /apps/{key}/status        poll that build
+//! GET    /self                     is there a newer build of the app
+//!                                   itself -- the frozen rescue contract
+//! GET    /self/apk                 that build's bytes (ranged)
+//! ```
+//!
+//! # The rescue contract
+//!
+//! `/self` and `/self/apk` are how the app updates *itself*, and they are
+//! deliberately the smallest thing that can do it. Everything else here
+//! is free to change shape; these two are not.
+//!
+//! The reason is that every other route is reachable only by an app new
+//! enough to understand it. When this server changes what `/manifest`
+//! says, an older app can fail to read the list -- and the list is where
+//! the button that would replace that app lives. The way out is then a
+//! reinstall over the plain-HTTP bootstrap port, by hand, on the machine.
+//! So the path that fetches a newer app must not depend on anything this
+//! server is likely to change: two fields, no nesting, no variants, no
+//! query parameters.
+//!
+//! What it does not survive is a change to the CA, the port, or the
+//! bearer token, since those break the connection before any route is
+//! reached. Those remain one-way doors and the bootstrap port remains
+//! their answer.
+//!
+//! **So: add fields here at your peril, and never remove or rename one.**
+//! Anything richer belongs on a new route that an old app never calls.
+//!
+//! Apps are addressed by `{key}` rather than each getting its own route,
+//! because the set is now mutable at runtime -- there is no fixed table to
+//! register at startup.
+
+use std::path::PathBuf;
+use std::sync::Arc;
+use std::time::{SystemTime, UNIX_EPOCH};
+
+use anyhow::Context;
+use axum::body::Body;
+use axum::extract::{Path as UrlPath, Query, State};
+use axum::http::{HeaderMap, HeaderValue, Method, StatusCode, header};
+use axum::response::{IntoResponse, Response};
+use axum::routing::{get, post, put};
+use axum::{Json, Router};
+use serde::{Deserialize, Serialize};
+use tokio::io::{AsyncReadExt, AsyncSeekExt};
+use tokio_util::io::ReaderStream;
+
+use crate::build_state::BuildStatus;
+use crate::discover;
+use crate::registry::{AppEntry, AppState};
+use crate::strip::resolve_serveable_path;
+
+pub fn tls_router(state: Arc<AppState>) -> Router {
+    Router::new()
+        .route("/manifest", get(manifest))
+        .route("/suggestions", get(suggestions))
+        .route("/apps", post(add_app))
+        .route("/apps/{key}", get(app).delete(remove_app))
+        .route("/apps/{key}/apk", get(serve_apk))
+        .route("/apps/{key}/pull", post(build_pull))
+        .route("/apps/{key}/prepare", post(build_prepare))
+        .route("/apps/{key}/build", post(build_now))
+        .route("/apps/{key}/approve", post(approve_declaration))
+        .route("/apps/{key}/recheck", post(recheck_app))
+        .route("/apps/{key}/settings", put(set_settings))
+        // Before the {action} route, so `logs` is not swallowed as an
+        // action -- axum matches a literal segment ahead of a capture,
+        // but declaring it first says so to a reader too.
+        .route("/apps/{key}/components/{name}/logs", get(component_logs))
+        .route(
+            "/apps/{key}/components/{name}/{action}",
+            post(service_action),
+        )
+        .route("/apps/{key}/status", get(build_status))
+        // The rescue contract; see this module's own note. `serve_apk`
+        // with no key already means the built-in entry -- the same
+        // handler the bootstrap port uses -- so the download half needs
+        // nothing of its own, including its ranges and the guard that
+        // keeps a restart from cutting it off.
+        .route("/self", get(self_build))
+        .route("/self/apk", get(serve_apk))
+        .route("/roots", put(set_roots))
+        .with_state(state)
+}
+
+/// The one thing a human ever hits on the plain-HTTP bootstrap port: the
+/// updater app's own APK, at a bare `/`. Deliberately not the whole API --
+/// nothing unauthenticated and unpinned should be able to change what this
+/// server serves. Having no `{key}` in its path is what makes `serve_apk`
+/// resolve it to the self entry; see `lookup`.
+pub fn bootstrap_router(state: Arc<AppState>) -> Router {
+    Router::new().route("/", get(serve_apk)).with_state(state)
+}
+
+#[derive(Debug, thiserror::Error)]
+enum ApiError {
+    #[error("no app named {0}")]
+    UnknownApp(String),
+    #[error("{0} has no build yet")]
+    NotBuilt(String),
+    #[error("{0} has no on-demand build step configured")]
+    NoBuildStep(String),
+    #[error("{0}")]
+    BadRequest(String),
+    #[error("range not satisfiable")]
+    RangeNotSatisfiable,
+    #[error(transparent)]
+    Internal(#[from] anyhow::Error),
+}
+
+impl IntoResponse for ApiError {
+    fn into_response(self) -> Response {
+        let status = match self {
+            Self::UnknownApp(_) | Self::NotBuilt(_) | Self::NoBuildStep(_) => StatusCode::NOT_FOUND,
+            Self::BadRequest(_) => StatusCode::BAD_REQUEST,
+            Self::RangeNotSatisfiable => StatusCode::RANGE_NOT_SATISFIABLE,
+            Self::Internal(err) => {
+                // The only variant whose real cause isn't safe to hand back
+                // verbatim, and the only one worth a log line.
+                tracing::error!("{err:#}");
+                return StatusCode::INTERNAL_SERVER_ERROR.into_response();
+            }
+        };
+        (status, self.to_string()).into_response()
+    }
+}
+
+/// An `anyhow` error from a user-driven action (adding an app, picking a
+/// variant) is a message written *for* the phone -- "no built APK found
+/// under ...", "already added" -- not an internal fault, so it comes back
+/// as a 400 with that message rather than a 500 and a log line.
+fn bad_request(err: anyhow::Error) -> ApiError {
+    ApiError::BadRequest(format!("{err:#}"))
+}
+
+/// One component, as the card needs it: what it is called and which kind
+/// it is. Nothing else -- what it *does* is the build step, which is not
+/// the phone's business, and how far along it is arrives on the status.
+#[derive(Serialize)]
+#[serde(rename_all = "camelCase")]
+struct ManifestComponent {
+    name: String,
+    kind: &'static str,
+    /// For a server component, what its script last said it was doing.
+    /// Absent for an APK, and absent for a server nobody has managed to
+    /// ask yet.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    state: Option<crate::service::ServiceState>,
+    /// Its script is being asked right now, so `state` is the previous
+    /// answer.
+    #[serde(skip_serializing_if = "std::ops::Not::not")]
+    checking: bool,
+    /// Why the last ask produced no answer, when it produced none. The
+    /// script's own words: it knows why it could not say, and this does
+    /// not.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    error: Option<String>,
+    /// There is at least one log of either kind, so the card can show the
+    /// button that opens them. The OR of the two below, sent rather than
+    /// left for the phone to work out because it is the one question the
+    /// card itself asks.
+    has_logs: bool,
+    /// This server wrote a build log for this component. A component that
+    /// has never been built here has none, which is not the same as a
+    /// build that produced no output.
+    has_build_logs: bool,
+    /// This component's script reports a runtime log. False for an APK,
+    /// which does not run here, and false for a script that does not
+    /// implement `logs` -- which every script written before it existed
+    /// does not, and which is a first-class answer rather than a failure.
+    /// The phone shows the tab either way and says which of the two it
+    /// is, since "no log yet" and "this service offers none" are
+    /// different things to be told.
+    has_runtime_logs: bool,
+    /// The last build stopped at this component, so its build log is the
+    /// one worth opening first. False on every component of a build that
+    /// succeeded, which is what makes the runtime log the ordinary
+    /// default.
+    build_failed: bool,
+    /// Whether what is built is current with the checkout.
+    ///
+    /// Sent for every component, including the unknown case, because
+    /// unknown is an answer the card has to draw differently from either
+    /// of the others rather than fall back to.
+    freshness: crate::build_state::Freshness,
+    /// Where Uninstall's "remove data" and "remove config" would delete,
+    /// from what the project said about itself, and whether anything is
+    /// there.
+    ///
+    /// Sent so the dialog can show the path beside each toggle. That
+    /// display is not decoration: a path is removed wherever it points,
+    /// with no containment check, so showing it before the button can be
+    /// pressed is the whole of what stands between an accepted
+    /// declaration and the wrong directory.
+    ///
+    /// `None` has three causes and the phone is told which, because they
+    /// are different things to do about it: still being read
+    /// ([`Self::resources_checking`]), could not be read
+    /// ([`Self::resources_error`]), or the project simply does not say --
+    /// which is the ordinary case and not a fault. Nothing is filled in
+    /// from the checkout's directory name or the config key; that guess
+    /// is what this replaced.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    data_path: Option<String>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    config_path: Option<String>,
+    /// Whether that path exists right now. A `stat`, which the manifest
+    /// path can afford where a spawn would not be -- and the answer is
+    /// what greys the toggle out rather than hiding it, so "there is
+    /// nothing to remove" is something the dialog says rather than
+    /// something it leaves the reader to infer from a missing control.
+    data_present: bool,
+    config_present: bool,
+    /// The project's resources are being read right now.
+    resources_checking: bool,
+    /// Why they could not be read. A failed read must not look like a
+    /// project that keeps nothing.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    resources_error: Option<String>,
+}
+
+impl ManifestComponent {
+    fn read(
+        state: &AppState,
+        key: &str,
+        entry: &AppEntry,
+        component: &crate::config::Component,
+    ) -> Self {
+        let name = component.name().to_string();
+        let is_server = matches!(component, crate::config::Component::Server { .. });
+        // A build log is a file this server wrote, so its existence is a
+        // stat rather than a spawn and can be checked here. The runtime
+        // half comes from the cached background answer, because asking a
+        // script costs a process and this path is fetched on every open,
+        // resume and Refresh.
+        let has_build_logs = !crate::logs::build_logs(key, &name).is_empty();
+        let has_runtime_logs = is_server && !state.service_checks.logs(key, &name).is_empty();
+        // Only a server keeps anything on this machine, and only a
+        // project that says where. Both halves have to be true before
+        // there is a path to show.
+        let state_paths = is_server
+            .then(|| state.resource_checks.facts(key))
+            .flatten()
+            .map(|facts| crate::purge::paths(&facts, &entry.project_path));
+        Self {
+            kind: if is_server { "server" } else { "apk" },
+            state: is_server
+                .then(|| state.service_checks.state(key, &name))
+                .flatten(),
+            // Read after the state, so a check landing between the two
+            // reports its answer rather than that one is still coming.
+            checking: is_server && state.service_checks.is_checking(key, &name),
+            error: is_server
+                .then(|| state.service_checks.error(key, &name))
+                .flatten(),
+            // Unknown for a project with no build machinery at all:
+            // nothing could have recorded a commit, which is not the same
+            // as being up to date.
+            has_logs: has_build_logs || has_runtime_logs,
+            has_build_logs,
+            has_runtime_logs,
+            build_failed: entry
+                .build
+                .as_ref()
+                .is_some_and(|build| build.build_failed(&name)),
+            freshness: entry
+                .build
+                .as_ref()
+                .map(|build| build.freshness(component))
+                .unwrap_or(crate::build_state::Freshness::Unknown),
+            data_path: state_paths
+                .as_ref()
+                .and_then(|paths| paths.data.as_deref())
+                .map(|path| path.display().to_string()),
+            config_path: state_paths
+                .as_ref()
+                .and_then(|paths| paths.config.as_deref())
+                .map(|path| path.display().to_string()),
+            data_present: state_paths
+                .as_ref()
+                .and_then(|paths| paths.data.as_deref())
+                .is_some_and(std::path::Path::exists),
+            config_present: state_paths
+                .as_ref()
+                .and_then(|paths| paths.config.as_deref())
+                .is_some_and(std::path::Path::exists),
+            resources_checking: is_server && state.resource_checks.is_checking(key),
+            resources_error: is_server
+                .then(|| state.resource_checks.error(key))
+                .flatten(),
+            name,
+        }
+    }
+}
+
+#[derive(Serialize)]
+#[serde(rename_all = "camelCase")]
+struct ManifestResponse {
+    apps: Vec<ManifestApp>,
+    /// Echoed back so the app's "add" screen can show and edit them without
+    /// a second request.
+    repo_roots: Vec<String>,
+    /// A check is still running somewhere in this list -- a remote, or a
+    /// service being asked what it is doing -- so `newCommits` or a
+    /// component's `state` may change shortly. The phone's cue to look
+    /// again, rather than this response having waited for the answer.
+    checks_pending: bool,
+}
+
+#[derive(Serialize)]
+#[serde(rename_all = "camelCase")]
+struct ManifestApp {
+    key: String,
+    label: String,
+    filename: String,
+    route: String,
+    /// Absent until a build has been read for it -- a project can be added
+    /// before it has ever been built, and claiming a package before then
+    /// would be inventing one.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    package: Option<String>,
+    /// What this project's APK used to install over, when it has been
+    /// renamed since this server started.
+    ///
+    /// Android treats a renamed `applicationId` as an unrelated app, so
+    /// the old one is still installed and nothing will ever replace it.
+    /// The phone offers to remove it -- and knows whether it is still
+    /// there, which is why nothing here has to be cleared.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    previous_package: Option<String>,
+    project_path: String,
+    /// Epoch seconds of the raw build's mtime. Always the *raw* build's,
+    /// even when a stripped copy is what's served: that's the number that
+    /// actually moves when something is rebuilt, which is what the app
+    /// compares against the installed copy.
+    mtime: f64,
+    /// Of the file that would be served as things stand -- the slim copy
+    /// where one has already been produced. Close to the bytes about to be
+    /// downloaded rather than exactly them, because finding out exactly
+    /// would mean running the strip pipeline here; see
+    /// `strip::serveable_now`.
+    size: u64,
+    needs_build: bool,
+    /// This machine's preferences for the project, so the card's settings
+    /// can show what is currently set rather than a guess at it.
+    git_ipv4: bool,
+    /// True for this server's own app, which has no Remove button.
+    built_in: bool,
+    /// False when the project has no APK yet (never built, or cleaned).
+    /// Such an app is still listed -- it was added deliberately, and a card
+    /// saying so is a better answer than one that silently vanished -- with
+    /// `mtime`/`size` at zero and nothing to download.
+    built: bool,
+    /// Present when the project is in a git repository at all: the branch,
+    /// how far behind it is as of the last fetch, and whether the tree is
+    /// dirty. Absent for a project nobody keeps in git.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    git: Option<crate::git::GitStatus>,
+    /// Whether this app offers a Pull button (`gitPull`).
+    can_pull: bool,
+    /// Whether the remote has something this checkout doesn't, as of the
+    /// last check. Not a count: answering "how many" needs the objects,
+    /// and downloading them is what Pull is for.
+    new_commits: bool,
+    /// This checkout's remote is being asked right now, so `newCommits`
+    /// above is the previous answer and may change. Per app rather than
+    /// one flag for the list, so a card says whether *it* is the one still
+    /// being worked out.
+    check_pending: bool,
+    /// What this project produces, in the order it is built. One entry is
+    /// the ordinary case and the card shows it inline; more than one is
+    /// what the phone draws as a nested list.
+    components: Vec<ManifestComponent>,
+    /// Why the last check produced no answer, when it produced none.
+    /// Absent in the ordinary case, including before anything has been
+    /// asked.
+    ///
+    /// Sent rather than only logged because `newCommits: false` is
+    /// indistinguishable from "asked, nothing there" on the phone, and the
+    /// phone is where this is being read -- whoever is looking at the card
+    /// has no access to this server's log.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    check_error: Option<String>,
+    /// The build step this project asks for that nobody has accepted yet,
+    /// as RON for the phone to show verbatim -- the same form it was
+    /// written in. Present only while something is waiting to be read, and
+    /// while it is, this app runs no build step at all.
+    ///
+    /// Re-serialized from what would actually be stored rather than passed
+    /// through as the file's own bytes, so what a person reads is what
+    /// would run -- a stray key this server ignores can't sit in the
+    /// display looking meaningful, and neither can a comment claiming
+    /// something the keys don't say.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pending_declaration: Option<String>,
+    variants: Vec<ManifestVariant>,
+}
+
+/// One build found under a project. Which of them a device wants is that
+/// device's business, so nothing here says which is chosen -- the phone
+/// marks its own and sends it with the download.
+#[derive(Serialize)]
+#[serde(rename_all = "camelCase")]
+struct ManifestVariant {
+    path: String,
+    variant: String,
+    mtime: f64,
+}
+
+fn epoch_secs(time: SystemTime) -> f64 {
+    time.duration_since(UNIX_EPOCH)
+        .unwrap_or_default()
+        .as_secs_f64()
+}
+
+#[derive(Deserialize)]
+struct ManifestQuery {
+    /// Ask the remotes again before answering. On by default, so a plain
+    /// `GET /manifest` -- a person opening, resuming or refreshing the
+    /// list -- gets a fresh answer. The phone passes `false` when it is
+    /// only looking to see whether an outstanding answer has landed; see
+    /// [`refresh_checkouts`].
+    ///
+    /// That flag is what stops the looking-again from being endless: a
+    /// poll that started a fresh check would find one outstanding every
+    /// time, forever.
+    recheck: Option<bool>,
+}
+
+async fn manifest(
+    State(state): State<Arc<AppState>>,
+    Query(query): Query<ManifestQuery>,
+) -> Result<Json<ManifestResponse>, ApiError> {
+    if query.recheck.unwrap_or(true) {
+        refresh_checkouts(&state, &state.entries());
+    }
+
+    let mut apps = Vec::new();
+    for entry in state.entries() {
+        apps.push(describe(&state, &entry).await?);
+    }
+    Ok(Json(ManifestResponse {
+        // Derived from the apps rather than tracked alongside them, so the
+        // list-level flag and the per-card ones cannot disagree about
+        // whether anything is still outstanding.
+        //
+        // Services count as well as remotes. This is what the phone looks
+        // again on, and a service whose answer lands after the phone has
+        // stopped looking leaves that component with no state -- which is
+        // drawn as a row with no buttons at all, since which buttons to
+        // offer is exactly what the answer decides. Remote checks
+        // ordinarily outlast service ones and hid this; a list where
+        // nothing can be pulled has no remote check to hide behind.
+        checks_pending: apps.iter().any(|app| {
+            app.check_pending
+                || app
+                    .components
+                    .iter()
+                    .any(|c| c.checking || c.resources_checking)
+        }),
+        apps,
+        repo_roots: state
+            .repo_roots()
+            .iter()
+            .map(|root| crate::config::contract_tilde(root))
+            .collect(),
+    }))
+}
+
+/// One app, for a phone that acted on one card and wants only that card
+/// back.
+///
+/// Never rechecks. Asking a remote is what `/apps/{key}/recheck` is for,
+/// and a card that just had something done to it is asking what happened,
+/// not for its checkout to be looked at again.
+async fn app(
+    State(state): State<Arc<AppState>>,
+    UrlPath(key): UrlPath<String>,
+) -> Result<Json<ManifestApp>, ApiError> {
+    let entry = state.entry(&key).ok_or(ApiError::UnknownApp(key))?;
+    Ok(Json(describe(&state, &entry).await?))
+}
+
+/// One entry as the phone needs it. The only place a card is built, so the
+/// whole list and a single card cannot come to describe the same app
+/// differently.
+async fn describe(state: &Arc<AppState>, entry: &AppEntry) -> Result<ManifestApp, ApiError> {
+    let apk = entry.resolve_apk(None);
+    // Whatever is on disk right now, never a strip run to find out --
+    // see `strip::serveable_now`. This path is fetched on every open,
+    // resume and Refresh.
+    let size = match &apk {
+        Some(apk) => tokio::fs::metadata(crate::strip::serveable_now(&apk.path, entry.strip()))
+            .await
+            .context("stat the apk to be served")?
+            .len(),
+        None => 0,
+    };
+
+    let variants = entry
+        .variants()
+        .into_iter()
+        .map(|candidate| ManifestVariant {
+            path: candidate.path.to_string_lossy().into_owned(),
+            variant: candidate.variant,
+            mtime: epoch_secs(candidate.modified),
+        })
+        .collect();
+
+    let git = crate::git::status(&entry.project_path);
+    // An upstream is part of it: a branch that tracks nothing has nothing
+    // to be pulled from, so `pull` refuses and asking a remote about it is
+    // asking about a remote it doesn't have. Without this the card said so
+    // twice -- "no upstream" on the branch line, and the check's own
+    // complaint about the same thing underneath it.
+    let can_pull = entry.git_pull && git.as_ref().is_some_and(|git| git.upstream.is_some());
+    let pending = entry.pending_declaration();
+    Ok(ManifestApp {
+        // Read from the cache a refresh populated, rather than asking here.
+        new_commits: can_pull && state.remote_checks.new_commits(&entry.project_path),
+        // Read after `new_commits`, so a check that lands between the
+        // two reports its answer rather than that it is still coming.
+        check_pending: can_pull && state.remote_checks.is_checking(&entry.project_path),
+        components: entry
+            .components
+            .iter()
+            .map(|component| ManifestComponent::read(state, &entry.key, entry, component))
+            .collect(),
+        check_error: can_pull
+            .then(|| state.remote_checks.error(&entry.project_path))
+            .flatten(),
+        can_pull,
+        git,
+        route: format!("/apps/{}/apk", entry.key),
+        filename: apk
+            .as_ref()
+            .map(|apk| entry.filename(&apk.path))
+            .unwrap_or_else(|| format!("{}.apk", entry.key)),
+        key: entry.key.clone(),
+        label: entry.label.clone(),
+        package: entry.package().map(str::to_string),
+        previous_package: state.previous_package(&entry.key),
+        // Shown on a phone, where the home prefix is the least
+        // interesting part of a long path. expand_tilde accepts this
+        // form back, so it stays copy-pasteable into "add by path".
+        project_path: crate::config::contract_tilde(&entry.project_path),
+        mtime: apk
+            .as_ref()
+            .map(|apk| epoch_secs(apk.modified))
+            .unwrap_or(0.0),
+        size,
+        // False while something is waiting to be accepted: the command
+        // won't run until it is, so offering to build would be a
+        // button that does nothing.
+        needs_build: pending.is_none()
+            && entry
+                .build
+                .as_ref()
+                .is_some_and(|build| build.has_command()),
+        git_ipv4: entry.git_ipv4,
+        built_in: entry.built_in,
+        built: apk.is_some(),
+        pending_declaration: pending
+            .as_ref()
+            .and_then(|components| crate::config::render_request(components).ok()),
+        variants,
+    })
+}
+
+/// Starts the off-request checks for `entries`: the remote of every app
+/// that offers a Pull button, and every server component's script.
+///
+/// Returns at once -- the answers land in the background and each app's
+/// `checkPending`, or each component's `checking`, says whose is still
+/// outstanding. Never waits: the manifest is about which apps have builds
+/// and whether this phone has them, all of it local and fast, and making
+/// it wait on a round trip to a git host meant every reopen of the app
+/// stalled behind one.
+///
+/// Takes the entries rather than reading them from `state`, so that one
+/// card's Refresh and the whole list's are the same code with a different
+/// slice -- there is no second path that could drift from this one, or
+/// start a check the other doesn't.
+pub(crate) fn refresh_checkouts(state: &Arc<AppState>, entries: &[Arc<AppEntry>]) {
+    let projects: Vec<crate::git::Checkout> = entries
+        .iter()
+        .filter(|entry| entry.git_pull)
+        .map(|entry| crate::git::Checkout {
+            path: entry.project_path.clone(),
+            ipv4: entry.git_ipv4,
+        })
+        .collect();
+    state.remote_checks.refresh(&projects);
+
+    // Same trip, same reasoning: asking a service manager costs a process
+    // spawn, so it happens here off the request rather than while the
+    // manifest is being built.
+    let services: Vec<crate::service::Target> = entries
+        .iter()
+        .flat_map(|entry| entry.service_targets())
+        .collect();
+    state.service_checks.refresh(services);
+
+    // And the same for what each project says about itself: a `Script`
+    // resources declaration is a process spawn, which is the thing this
+    // path exists to keep out of the manifest.
+    let resources: Vec<crate::resources::Target> = entries
+        .iter()
+        .filter_map(|entry| entry.resource_target())
+        .collect();
+    state.resource_checks.refresh(resources);
+}
+
+/// Re-check one project, for a card's own Refresh.
+///
+/// Answers as soon as the checks are *started*, like the manifest's own
+/// refresh does -- they run off the request path, and the phone collects
+/// what they found through a later `/manifest`.
+async fn recheck_app(
+    State(state): State<Arc<AppState>>,
+    UrlPath(key): UrlPath<String>,
+) -> Result<StatusCode, ApiError> {
+    let entries = state.entries();
+    let entry = entries
+        .iter()
+        .find(|entry| entry.key == key)
+        .ok_or(ApiError::UnknownApp(key))?;
+    refresh_checkouts(&state, std::slice::from_ref(entry));
+    Ok(StatusCode::NO_CONTENT)
+}
+
+#[derive(Serialize)]
+#[serde(rename_all = "camelCase")]
+struct SuggestionsResponse {
+    roots: Vec<String>,
+    suggestions: Vec<Suggestion>,
+}
+
+#[derive(Serialize)]
+#[serde(rename_all = "camelCase")]
+struct Suggestion {
+    path: String,
+    name: String,
+    apk_count: usize,
+    mtime: f64,
+    /// True when this project is already in the app list, so the add screen
+    /// can show it as such instead of offering a duplicate.
+    added: bool,
+}
+
+/// Scans the configured roots fresh on every call rather than caching:
+/// it's a few milliseconds (see `crate::discover`), and a cache would be
+/// wrong precisely when it matters -- right after a first build of the
+/// project someone is trying to add.
+async fn suggestions(
+    State(state): State<Arc<AppState>>,
+) -> Result<Json<SuggestionsResponse>, ApiError> {
+    let roots = state.repo_roots();
+    let added: Vec<PathBuf> = state
+        .entries()
+        .iter()
+        .map(|entry| entry.project_path.clone())
+        .collect();
+
+    let scanned = roots.clone();
+    let found = tokio::task::spawn_blocking(move || discover::scan_roots(&scanned))
+        .await
+        .context("suggestion scan panicked")?;
+
+    Ok(Json(SuggestionsResponse {
+        roots: roots
+            .iter()
+            .map(|root| crate::config::contract_tilde(root))
+            .collect(),
+        suggestions: found
+            .into_iter()
+            .map(|item| Suggestion {
+                added: added.contains(&item.path),
+                path: crate::config::contract_tilde(&item.path),
+                name: item.name,
+                apk_count: item.apk_count,
+                mtime: epoch_secs(item.newest),
+            })
+            .collect(),
+    }))
+}
+
+#[derive(Deserialize)]
+struct PathBody {
+    path: String,
+}
+
+#[derive(Serialize)]
+struct AddedResponse {
+    key: String,
+    label: String,
+}
+
+/// Every config mutation runs here rather than inline: each one writes the
+/// config file, and adding or re-pointing an app also spawns `aapt2`, none
+/// of which belongs on an async worker thread.
+async fn mutate<T: Send + 'static>(
+    state: Arc<AppState>,
+    action: impl FnOnce(&AppState) -> anyhow::Result<T> + Send + 'static,
+) -> Result<T, ApiError> {
+    tokio::task::spawn_blocking(move || action(&state))
+        .await
+        .context("config mutation panicked")?
+        .map_err(bad_request)
+}
+
+async fn add_app(
+    State(state): State<Arc<AppState>>,
+    Json(body): Json<PathBody>,
+) -> Result<Json<AddedResponse>, ApiError> {
+    let path = crate::config::expand_tilde(&body.path);
+    let entry = mutate(state, move |state| state.add_app(&path)).await?;
+    tracing::info!(
+        "added {} ({}) from {}",
+        entry.key,
+        entry.package().unwrap_or("package not read yet"),
+        entry.project_path.display()
+    );
+    Ok(Json(AddedResponse {
+        key: entry.key.clone(),
+        label: entry.label.clone(),
+    }))
+}
+
+async fn remove_app(
+    State(state): State<Arc<AppState>>,
+    UrlPath(key): UrlPath<String>,
+) -> Result<StatusCode, ApiError> {
+    mutate(state, move |state| {
+        state.remove_app(&key)?;
+        tracing::info!("removed {key}");
+        Ok(())
+    })
+    .await?;
+    Ok(StatusCode::NO_CONTENT)
+}
+
+/// The actions a server component's script is driven through.
+///
+/// A closed set, checked here rather than passed through: the subcommand
+/// becomes an argument to a script running on the build machine, so the
+/// phone naming one of its own is exactly what must not be possible.
+const ACTIONS: [&str; 5] = ["install", "uninstall", "start", "stop", "restart"];
+
+/// Runs one of them, and reports what the component is doing afterwards.
+///
+/// Synchronous, unlike a build: these are quick, and the answer the phone
+/// wants is the state that resulted -- which is worth having in the reply
+/// rather than after the next background check.
+async fn service_action(
+    State(state): State<Arc<AppState>>,
+    UrlPath((key, name, action)): UrlPath<(String, String, String)>,
+    Query(purge): Query<PurgeQuery>,
+) -> Result<Json<ServiceActionResponse>, ApiError> {
+    let entry = state
+        .entry(&key)
+        .ok_or_else(|| ApiError::UnknownApp(key.clone()))?;
+    if !ACTIONS.contains(&action.as_str()) {
+        return Err(ApiError::BadRequest(format!(
+            "{action} is not something a service can be asked to do"
+        )));
+    }
+    // Nothing runs for a project whose declaration is still waiting to be
+    // read: `service` is a command from that same file, and the gate is
+    // about commands rather than about which field they sit in.
+    if entry.pending_declaration().is_some() {
+        return Err(ApiError::BadRequest(format!(
+            "{}'s build step hasn't been accepted yet",
+            entry.label
+        )));
+    }
+    let component = entry
+        .component(&name)
+        .ok_or_else(|| ApiError::BadRequest(format!("{} has no component {name}", entry.label)))?;
+    let script = crate::service::driver(&key, component)
+        .ok_or_else(|| ApiError::BadRequest(format!("{name} is not a server")))?;
+    let project = entry.project_path.clone();
+    let cwd = component.cwd().map(std::path::Path::to_path_buf);
+
+    let wanted = crate::purge::Wanted {
+        logs: purge.logs,
+        data: purge.data,
+        config: purge.config,
+    };
+    if !wanted.nothing() && action != "uninstall" {
+        return Err(ApiError::BadRequest(format!(
+            "{action} removes nothing; only uninstall does"
+        )));
+    }
+    // From the same answer the dialog was drawn from, so what is removed
+    // is what was shown. A project whose resources could not be read has
+    // no paths, and the two toggles that need them are not offered.
+    let purging = (!wanted.nothing())
+        .then(|| state.resource_checks.facts(&key))
+        .flatten()
+        .map(|facts| crate::purge::paths(&facts, &entry.project_path))
+        // Logs are this server's own files and need nothing from the
+        // project, so a project that says nothing can still have them
+        // removed.
+        .or_else(|| (!wanted.nothing()).then(crate::purge::StatePaths::default));
+
+    // Restarting *this* server is deferred rather than run inline: the
+    // script would kill this process before it could reply, so a restart
+    // that worked would reach the phone as a failed request. Answered
+    // first, restarted after -- the same order, and by way of the same
+    // function, the build path uses. Which of the two restarts it turns
+    // into is `restart::deferred`'s to decide, so the button and a
+    // self-build cannot come to behave differently.
+    //
+    // The state reported is still the script's: whether a service manager
+    // has this server is its question, not this process's.
+    if entry.built_in && action == "restart" {
+        let asked = (script.clone(), project.clone(), cwd.clone());
+        let resulting = tokio::task::spawn_blocking(move || {
+            let (script, project, cwd) = asked;
+            crate::service::status(&script, &project, cwd.as_deref())
+        })
+        .await
+        .context("service status task")?
+        .map_err(ApiError::BadRequest)?;
+        state.service_checks.mark(&key, &name, resulting);
+        crate::restart::deferred(
+            Some(crate::restart::Handover {
+                script,
+                project,
+                cwd,
+            }),
+            Arc::clone(&state.downloads),
+        );
+        return Ok(Json(ServiceActionResponse {
+            state: resulting,
+            left_behind: Vec::new(),
+        }));
+    }
+
+    let asked = (key.clone(), name.clone());
+    let ran = tokio::task::spawn_blocking(move || {
+        let (key, name) = asked;
+        // Asked before the uninstall, because the script that reports
+        // where a service's log lives is the thing about to be removed.
+        // The build log is this server's own file and would survive
+        // either way, but both kinds are "the logs" to whoever ticked the
+        // box, so they are collected as one list.
+        let log_files = purging
+            .as_ref()
+            .map(|_| {
+                let mut files = crate::logs::build_logs(&key, &name);
+                files.extend(crate::service::logs(&script, &project, cwd.as_deref()));
+                files
+            })
+            .unwrap_or_default();
+        crate::service::run(&script, &project, cwd.as_deref(), &action)?;
+        let left_behind = match &purging {
+            Some(paths) => crate::purge::remove(paths, &log_files, wanted),
+            None => Vec::new(),
+        };
+        crate::service::status(&script, &project, cwd.as_deref())
+            .map(|resulting| (resulting, left_behind))
+    })
+    .await
+    .context("service action task")?;
+
+    match ran {
+        Ok((resulting, left_behind)) => {
+            state.service_checks.mark(&key, &name, resulting);
+            for problem in &left_behind {
+                tracing::warn!("uninstalling {key}'s {name}: {problem}");
+            }
+            Ok(Json(ServiceActionResponse {
+                state: resulting,
+                left_behind,
+            }))
+        }
+        // The script's own words, which is what the card shows.
+        Err(message) => Err(ApiError::BadRequest(message)),
+    }
+}
+
+/// Which log, and how much of it.
+#[derive(Deserialize)]
+struct LogQuery {
+    /// Lines from the end. Absent is 100; zero means as much as the
+    /// server is willing to read, which it says when it stops.
+    lines: Option<usize>,
+    /// 0 is the current log, 1 the one before it. An index rather than a
+    /// "previous" flag, because the script reports a list and the phone
+    /// should not have to assume how long it is. Counted within a kind:
+    /// the build log's previous generation is not the runtime log's.
+    generation: Option<usize>,
+    /// Which log. Absent means the build log, which is what the one
+    /// combined list used to answer with at generation 0 -- so a phone
+    /// built before this existed keeps getting exactly what it got
+    /// before rather than something new.
+    kind: Option<crate::logs::LogKind>,
+}
+
+#[derive(Serialize)]
+#[serde(rename_all = "camelCase")]
+struct LogResponse {
+    /// Where this came from, so a person at the build machine can open
+    /// the whole thing rather than the tail.
+    path: String,
+    text: String,
+    /// There is more than what is here. Said rather than implied: a
+    /// silently shortened log reads as a complete one that simply does
+    /// not explain the crash.
+    truncated: bool,
+    /// How many generations exist, so the phone knows whether to offer a
+    /// previous one at all.
+    generations: usize,
+}
+
+/// The tail of one component's log.
+///
+/// Reading is this server's job rather than the script's: the script says
+/// where, and how much of it a phone wants is a question the phone
+/// answers. It is also why this is a GET -- nothing here changes anything.
+async fn component_logs(
+    State(state): State<Arc<AppState>>,
+    UrlPath((key, name)): UrlPath<(String, String)>,
+    Query(query): Query<LogQuery>,
+) -> Result<Json<LogResponse>, ApiError> {
+    let entry = state
+        .entry(&key)
+        .ok_or_else(|| ApiError::UnknownApp(key.clone()))?;
+    let paths = tokio::task::spawn_blocking({
+        let entry = Arc::clone(&entry);
+        let name = name.clone();
+        let kind = query.kind.unwrap_or(crate::logs::LogKind::Build);
+        move || entry.component_logs(&name, kind)
+    })
+    .await
+    .context("asking for log paths")?;
+
+    let generation = query.generation.unwrap_or(0);
+    let path = paths.get(generation).ok_or_else(|| {
+        ApiError::BadRequest(format!(
+            "{}'s {name} has no {} log to show yet",
+            entry.label,
+            match query.kind.unwrap_or(crate::logs::LogKind::Build) {
+                crate::logs::LogKind::Build => "build",
+                crate::logs::LogKind::Runtime => "runtime",
+            }
+        ))
+    })?;
+    let lines = query.lines.unwrap_or(100);
+    let read = {
+        let path = path.clone();
+        tokio::task::spawn_blocking(move || crate::logs::tail(&path, lines))
+            .await
+            .context("reading the log")?
+    };
+    let tail = read.map_err(bad_request)?;
+    Ok(Json(LogResponse {
+        path: crate::config::contract_tilde(path),
+        text: tail.text,
+        truncated: tail.truncated,
+        generations: paths.len(),
+    }))
+}
+
+#[derive(Serialize)]
+#[serde(rename_all = "camelCase")]
+struct ServiceActionResponse {
+    state: crate::service::ServiceState,
+    /// What Uninstall was asked to take away and could not, one line
+    /// each, empty on every other action.
+    ///
+    /// Not an error: the service itself is gone by then, so failing the
+    /// request would report a successful uninstall as a failure. The card
+    /// says what is still on disk instead, which is the thing the person
+    /// would otherwise have to go and find.
+    #[serde(skip_serializing_if = "Vec::is_empty")]
+    left_behind: Vec<String>,
+}
+
+/// What Uninstall should take away besides the service.
+///
+/// Each defaults to false, so a phone that says nothing gets what
+/// uninstalling has always done. Only `uninstall` accepts them, and
+/// naming them on anything else is refused rather than ignored -- a flag
+/// that silently does nothing is how somebody comes to believe they
+/// cleaned up.
+#[derive(Deserialize, Default)]
+struct PurgeQuery {
+    #[serde(default)]
+    logs: bool,
+    #[serde(default)]
+    data: bool,
+    #[serde(default)]
+    config: bool,
+}
+
+/// Which build a download wants. Absent means the newest, which is what
+/// every phone gets until it says otherwise.
+#[derive(Deserialize)]
+struct VariantQuery {
+    variant: Option<String>,
+}
+
+#[derive(Deserialize)]
+struct RootsBody {
+    roots: Vec<String>,
+}
+
+/// Accepts the build step an app's project asks for. Until this is
+/// pressed, that app runs nothing -- see `crate::config::ProjectConfig`
+/// for why a project can't simply hand this server a command to run.
+async fn approve_declaration(
+    State(state): State<Arc<AppState>>,
+    UrlPath(key): UrlPath<String>,
+) -> Result<StatusCode, ApiError> {
+    mutate(state, move |state| {
+        state.approve_declaration(&key)?;
+        tracing::info!("accepted the build step {key} asks for");
+        Ok(())
+    })
+    .await?;
+    Ok(StatusCode::NO_CONTENT)
+}
+
+/// What the card's settings can change. One field so far; the shape is a
+/// body rather than a query so the next one is a field here rather than a
+/// second route.
+#[derive(Deserialize)]
+#[serde(rename_all = "camelCase")]
+struct SettingsBody {
+    git_ipv4: bool,
+}
+
+/// Replaces this machine's preferences for one project.
+///
+/// A whole-object PUT rather than a patch per field: the phone has just
+/// shown the person every setting there is, so what it sends back is the
+/// complete answer, and a partial update would need a rule for what a
+/// missing field means.
+async fn set_settings(
+    State(state): State<Arc<AppState>>,
+    UrlPath(key): UrlPath<String>,
+    Json(body): Json<SettingsBody>,
+) -> Result<StatusCode, ApiError> {
+    mutate(state, move |state| {
+        state.set_project_settings(&key, body.git_ipv4)?;
+        Ok(())
+    })
+    .await?;
+    Ok(StatusCode::NO_CONTENT)
+}
+
+async fn set_roots(
+    State(state): State<Arc<AppState>>,
+    Json(body): Json<RootsBody>,
+) -> Result<StatusCode, ApiError> {
+    // Blank entries are what an emptied text field sends; dropping them
+    // here keeps a stray "" out of the config and out of every later scan.
+    let roots = body
+        .roots
+        .iter()
+        .map(|root| root.trim())
+        .filter(|root| !root.is_empty())
+        .map(crate::config::expand_tilde)
+        .collect();
+    mutate(state, move |state| state.set_repo_roots(roots)).await?;
+    Ok(StatusCode::NO_CONTENT)
+}
+
+/// Resolves the app a request is about: the `{key}` in the path, or the
+/// self entry on the bootstrap listener, which has no key in its path.
+fn lookup(state: &AppState, key: Option<UrlPath<String>>) -> Result<Arc<AppEntry>, ApiError> {
+    let key = key
+        .map(|UrlPath(key)| key)
+        .unwrap_or_else(|| crate::registry::SELF_KEY.to_string());
+    state.entry(&key).ok_or(ApiError::UnknownApp(key))
+}
+
+/// The callback a build reports each finished component through.
+///
+/// Made here because this is where both halves are in scope: the app list
+/// to write to, and the key of the app being built. The `Arc` it captures
+/// is held only for the life of the build task, so nothing in the list
+/// ends up pointing back at the list.
+fn records_builds(state: &Arc<AppState>, key: &str) -> crate::build_state::RecordBuilt {
+    let state = Arc::clone(state);
+    let key = key.to_string();
+    Arc::new(move |component: &str, sha: String| state.record_built(&key, component, sha))
+}
+
+async fn build_prepare(
+    State(state): State<Arc<AppState>>,
+    key: UrlPath<String>,
+) -> Result<Json<BuildStatus>, ApiError> {
+    let entry = lookup(&state, Some(key))?;
+    // Checked here rather than trusted from the entry's build state: the
+    // project's file can have changed since that state was made, and this
+    // is the moment its command would actually run.
+    if entry.pending_declaration().is_some() {
+        return Err(ApiError::BadRequest(format!(
+            "{} is asking to run a build step that hasn't been accepted yet -- read it on the \
+             app's card and accept it first",
+            entry.label,
+        )));
+    }
+    let build = entry
+        .build
+        .as_ref()
+        .ok_or_else(|| ApiError::NoBuildStep(entry.label.clone()))?;
+    build.trigger_if_needed(records_builds(&state, &entry.key));
+    Ok(Json(build.status()))
+}
+
+/// Builds because somebody asked, not because anything looked stale.
+///
+/// Separate from `prepare` rather than a flag on it: `prepare` runs before
+/// a download and must stay cheap when there is nothing to do, while this
+/// is a person pressing a button and should do what it says every time.
+///
+/// Gated on acceptance like every other path that runs a project's
+/// command -- the button is not an authorisation.
+async fn build_now(
+    State(state): State<Arc<AppState>>,
+    key: UrlPath<String>,
+) -> Result<Json<BuildStatus>, ApiError> {
+    let entry = lookup(&state, Some(key))?;
+    if entry.pending_declaration().is_some() {
+        return Err(ApiError::BadRequest(format!(
+            "{} is asking to run a build step that hasn't been accepted yet -- read it on the \
+             app's card and accept it first",
+            entry.label,
+        )));
+    }
+    let build = entry
+        .build
+        .as_ref()
+        .ok_or_else(|| ApiError::NoBuildStep(entry.label.clone()))?;
+    build.build_now(records_builds(&state, &entry.key));
+    Ok(Json(build.status()))
+}
+
+/// Fetches, fast-forwards, and builds -- reported through the same status
+/// the phone already polls for a build, so one progress path covers both.
+///
+/// Pulling stays available while a project's build step is waiting to be
+/// accepted, and stops after the fast-forward: taking commits runs git,
+/// not the project's command, and refusing would leave a project whose
+/// request you haven't accepted impossible to update at all. It is also
+/// how the newest version of that request arrives to be read.
+async fn build_pull(
+    State(state): State<Arc<AppState>>,
+    key: UrlPath<String>,
+) -> Result<Json<BuildStatus>, ApiError> {
+    let entry = lookup(&state, Some(key))?;
+    let build = entry
+        .build
+        .as_ref()
+        .ok_or_else(|| ApiError::NoBuildStep(entry.label.clone()))?;
+    // Asked after the fast-forward, not now: the declaration the gate
+    // reads is the one the pull is about to rewrite, so the answer from
+    // here is the answer for the commit being replaced.
+    let gate = Arc::clone(&entry);
+    build.pull_and_build(
+        move || gate.pending_declaration().is_none(),
+        records_builds(&state, &entry.key),
+    );
+    Ok(Json(build.status()))
+}
+
+async fn build_status(
+    State(state): State<Arc<AppState>>,
+    key: UrlPath<String>,
+) -> Result<Json<BuildStatus>, ApiError> {
+    let entry = lookup(&state, Some(key))?;
+    let build = entry
+        .build
+        .as_ref()
+        .ok_or_else(|| ApiError::NoBuildStep(entry.label.clone()))?;
+    Ok(Json(build.status()))
+}
+
+/// A reader that keeps its download counted for as long as it is being
+/// read.
+///
+/// The count has to end when the *body* does, not when the handler
+/// returns -- the handler returns as soon as the stream is handed to
+/// axum, with the bytes still to go. Wrapping the reader means the guard
+/// is dropped exactly when the body is finished or the client goes away,
+/// which is when this server has genuinely stopped sending.
+///
+/// An `AsyncRead` wrapper rather than a `Stream` one so this needs no
+/// dependency that is not already here.
+struct Counted<R> {
+    inner: R,
+    _guard: crate::restart::DownloadGuard,
+}
+
+impl<R: tokio::io::AsyncRead + Unpin> tokio::io::AsyncRead for Counted<R> {
+    fn poll_read(
+        mut self: std::pin::Pin<&mut Self>,
+        cx: &mut std::task::Context<'_>,
+        buf: &mut tokio::io::ReadBuf<'_>,
+    ) -> std::task::Poll<std::io::Result<()>> {
+        std::pin::Pin::new(&mut self.inner).poll_read(cx, buf)
+    }
+}
+
+struct ByteRange {
+    start: u64,
+    end: u64,
+    is_partial: bool,
+}
+
+/// Parses a `Range: bytes=...` header, clamped to `size`. Anything that
+/// isn't a well-formed single byte-range -- including a missing header --
+/// falls back to the full file; only a range that's present, well-formed,
+/// and unsatisfiable (`start > end`) is an error.
+fn parse_range(header: Option<&HeaderValue>, size: u64) -> Result<ByteRange, ApiError> {
+    let full = ByteRange {
+        start: 0,
+        end: size.saturating_sub(1),
+        is_partial: false,
+    };
+
+    let Some(spec) = header
+        .and_then(|h| h.to_str().ok())
+        .and_then(|h| h.strip_prefix("bytes="))
+    else {
+        return Ok(full);
+    };
+    let Some((start_s, end_s)) = spec.split_once('-') else {
+        return Ok(full);
+    };
+    if start_s.is_empty() && end_s.is_empty() {
+        return Ok(full);
+    }
+
+    let (start, end) = if !start_s.is_empty() {
+        let Ok(start) = start_s.parse::<u64>() else {
+            return Ok(full);
+        };
+        let end = if end_s.is_empty() {
+            size.saturating_sub(1)
+        } else {
+            match end_s.parse::<u64>() {
+                Ok(end) => end,
+                Err(_) => return Ok(full),
+            }
+        };
+        (start, end)
+    } else {
+        // Suffix range: last N bytes.
+        let Ok(suffix) = end_s.parse::<u64>() else {
+            return Ok(full);
+        };
+        (size.saturating_sub(suffix), size.saturating_sub(1))
+    };
+
+    let end = end.min(size.saturating_sub(1));
+    if start > end {
+        return Err(ApiError::RangeNotSatisfiable);
+    }
+    Ok(ByteRange {
+        start,
+        end,
+        is_partial: true,
+    })
+}
+
+/// What the app needs to know about the newer copy of itself, and
+/// nothing else. **This shape is frozen** -- see the module note.
+#[derive(Serialize)]
+#[serde(rename_all = "camelCase")]
+struct SelfBuild {
+    /// When the APK on disk was built, in seconds since the epoch. The
+    /// phone compares it against its own `PackageInfo.lastUpdateTime`,
+    /// which is the same freshness rule the list uses: these are ad hoc
+    /// rebuilds with nothing bumping a version code.
+    mtime: f64,
+    /// Bytes, so a download can show progress rather than a spinner.
+    size: u64,
+}
+
+/// Is there a build of the updater app here, and how new is it.
+///
+/// Deliberately does not go through `describe`: that is where a card is
+/// built, and a card is exactly the thing whose shape changes. This reads
+/// the file and answers two numbers.
+async fn self_build(State(state): State<Arc<AppState>>) -> Result<Json<SelfBuild>, ApiError> {
+    let entry = lookup(&state, None)?;
+    let apk = entry
+        .resolve_apk(None)
+        .ok_or_else(|| ApiError::NotBuilt(entry.label.clone()))?;
+    let size = tokio::fs::metadata(&apk.path)
+        .await
+        .context("stat the updater's own apk")?
+        .len();
+    Ok(Json(SelfBuild {
+        mtime: epoch_secs(apk.modified),
+        size,
+    }))
+}
+
+async fn serve_apk(
+    State(state): State<Arc<AppState>>,
+    key: Option<UrlPath<String>>,
+    method: Method,
+    headers: HeaderMap,
+    Query(query): Query<VariantQuery>,
+) -> Result<Response, ApiError> {
+    let entry = lookup(&state, key)?;
+    // Which build this device wants, if it has a preference. Its own
+    // preference, travelling with the request: two phones enrolled against
+    // one server must not change what the other gets.
+    let requested = query.variant.map(PathBuf::from);
+    let apk = entry
+        .resolve_apk(requested.as_deref())
+        .ok_or_else(|| ApiError::NotBuilt(entry.label.clone()))?;
+    // A fresh download, not a range continuation: the one moment this
+    // server can notice that a local rebuild changed what the APK installs
+    // over. Off the request, so it costs the download nothing.
+    if headers.get(header::RANGE).is_none() {
+        state.refresh_package(&entry.key, apk.path.clone());
+    }
+    let resolved = resolve_serveable_path(&apk.path, entry.strip()).await?;
+    let size = tokio::fs::metadata(&resolved)
+        .await
+        .context("stat resolved apk")?
+        .len();
+
+    let range = parse_range(headers.get(header::RANGE), size)?;
+    let length = range.end - range.start + 1;
+
+    let mut response = Response::builder()
+        .status(if range.is_partial {
+            StatusCode::PARTIAL_CONTENT
+        } else {
+            StatusCode::OK
+        })
+        .header(
+            header::CONTENT_TYPE,
+            "application/vnd.android.package-archive",
+        )
+        .header(
+            header::CONTENT_DISPOSITION,
+            format!("attachment; filename=\"{}\"", entry.filename(&apk.path)),
+        )
+        .header(header::ACCEPT_RANGES, "bytes")
+        .header(header::CONTENT_LENGTH, length);
+    if range.is_partial {
+        response = response.header(
+            header::CONTENT_RANGE,
+            format!("bytes {}-{}/{size}", range.start, range.end),
+        );
+    }
+
+    if method == Method::HEAD {
+        return Ok(response
+            .body(Body::empty())
+            .expect("response with an empty body is valid"));
+    }
+
+    let mut file = tokio::fs::File::open(&resolved)
+        .await
+        .context("open resolved apk")?;
+    file.seek(std::io::SeekFrom::Start(range.start))
+        .await
+        .context("seek resolved apk")?;
+    // Counted from here rather than at the top of the handler: a HEAD, a
+    // 404 or an unsatisfiable range sends no bytes and must not hold a
+    // restart back.
+    let stream = ReaderStream::new(Counted {
+        inner: file.take(length),
+        _guard: state.downloads.start(),
+    });
+    Ok(response
+        .body(Body::from_stream(stream))
+        .expect("response with a streaming body is valid"))
+}
diff --git a/server/src/sdk.rs b/server/src/sdk.rs
new file mode 100644
index 0000000..99dde2b
--- /dev/null
+++ b/server/src/sdk.rs
@@ -0,0 +1,151 @@
+//! Locating the Android SDK/NDK tools this server shells out to: `aapt2`
+//! (reading a discovered APK's package name and label), and
+//! `llvm-strip`/`zipalign`/`apksigner` (the slim-APK pipeline in
+//! `crate::strip`).
+//!
+//! Each lookup is resolved lazily and cached, since a miss is a
+//! configuration problem worth reporting with the path it looked at rather
+//! than a bare "command not found" from the failed spawn.
+
+use std::path::{Path, PathBuf};
+use std::sync::OnceLock;
+
+use anyhow::{Context, Result, bail};
+
+/// This user's home directory, or an empty path when there is none.
+///
+/// Not a panic: every use of this is a path that is then checked for
+/// existence and reported with the path it looked at, so a machine with no
+/// `HOME` gets "debug keystore not found at ..." rather than a crash at
+/// startup. Uses the same `std::env::home_dir` the rest of the crate does,
+/// so there is one answer to where home is.
+fn home_dir() -> PathBuf {
+    std::env::home_dir().unwrap_or_default()
+}
+
+/// Honors `$ANDROID_HOME`/`$ANDROID_SDK_ROOT` before falling back to
+/// Android Studio's default location on Linux, so this works on a machine
+/// that keeps its SDK somewhere else without needing a flag.
+fn sdk_root() -> PathBuf {
+    std::env::var_os("ANDROID_HOME")
+        .or_else(|| std::env::var_os("ANDROID_SDK_ROOT"))
+        .map(PathBuf::from)
+        .unwrap_or_else(|| home_dir().join("Android/Sdk"))
+}
+
+/// Highest-versioned entry directly under `dir`, by plain name sort --
+/// good enough for SDK/NDK release directories, which sort correctly as
+/// strings within a single major version scheme.
+fn newest_child(dir: &Path) -> Option<PathBuf> {
+    let mut children: Vec<PathBuf> = std::fs::read_dir(dir)
+        .ok()?
+        .filter_map(|entry| entry.ok())
+        .map(|entry| entry.path())
+        .filter(|path| path.is_dir())
+        .collect();
+    children.sort();
+    children.pop()
+}
+
+/// The newest installed `build-tools/<version>/` directory, which is where
+/// `aapt2`, `zipalign` and `apksigner` live.
+pub fn build_tools_dir() -> Result<&'static Path> {
+    static DIR: OnceLock<Result<PathBuf, String>> = OnceLock::new();
+    match DIR.get_or_init(|| {
+        let base = sdk_root().join("build-tools");
+        newest_child(&base).ok_or_else(|| {
+            format!(
+                "no Android SDK build-tools found under {} -- install one \
+                 (`android sdk install build-tools/37.0.0`, or source \
+                 ../app/android-env.sh, which does it for you)",
+                base.display(),
+            )
+        })
+    }) {
+        Ok(dir) => Ok(dir),
+        Err(message) => bail!("{message}"),
+    }
+}
+
+pub fn aapt2_path() -> Result<PathBuf> {
+    let path = build_tools_dir()?.join("aapt2");
+    if !path.is_file() {
+        bail!("aapt2 not found at {}", path.display());
+    }
+    Ok(path)
+}
+
+/// `llvm-strip` ships with the NDK, not the SDK, so this looks in the two
+/// places an NDK is normally installed on top of an explicit
+/// `$ANDROID_NDK_HOME`. Only the slim-APK pipeline needs it -- an app with
+/// no native libraries never reaches this.
+pub fn llvm_strip_path() -> Result<PathBuf> {
+    static PATH: OnceLock<Result<PathBuf, String>> = OnceLock::new();
+    match PATH.get_or_init(|| {
+        let roots: Vec<PathBuf> = std::env::var_os("ANDROID_NDK_HOME")
+            .map(PathBuf::from)
+            .into_iter()
+            .chain(newest_child(&sdk_root().join("ndk")))
+            .chain(newest_child(&home_dir().join("Android")).filter(|path| {
+                path.file_name()
+                    .is_some_and(|name| name.to_string_lossy().starts_with("android-ndk-"))
+            }))
+            .collect();
+
+        for root in &roots {
+            let path = root.join("toolchains/llvm/prebuilt/linux-x86_64/bin/llvm-strip");
+            if path.is_file() {
+                return Ok(path);
+            }
+        }
+        Err(format!(
+            "llvm-strip not found -- looked under {}. Install an NDK, or point \
+             $ANDROID_NDK_HOME at one. Only apps with native libraries need it.",
+            if roots.is_empty() {
+                "no NDK install (checked $ANDROID_NDK_HOME, $ANDROID_HOME/ndk, ~/Android)"
+                    .to_string()
+            } else {
+                roots
+                    .iter()
+                    .map(|root| root.display().to_string())
+                    .collect::<Vec<_>>()
+                    .join(", ")
+            },
+        ))
+    }) {
+        Ok(path) => Ok(path.clone()),
+        Err(message) => bail!("{message}"),
+    }
+}
+
+/// The debug keystore every locally-built debug APK is already signed with,
+/// reused to re-sign a stripped copy so it still installs over the original.
+pub fn debug_keystore_path() -> Result<PathBuf> {
+    let path = home_dir().join(".android/debug.keystore");
+    if !path.is_file() {
+        bail!(
+            "debug keystore not found at {} -- build any Android app once to have \
+             Gradle create it",
+            path.display(),
+        );
+    }
+    Ok(path)
+}
+
+/// Runs `cmd`, turning a nonzero exit into an error naming the program and
+/// its stderr rather than leaving it to be discovered as a corrupt output
+/// file later.
+pub fn run_checked(cmd: &mut std::process::Command) -> Result<()> {
+    let program = cmd.get_program().to_string_lossy().into_owned();
+    let output = cmd
+        .output()
+        .with_context(|| format!("failed to spawn {program}"))?;
+    if !output.status.success() {
+        bail!(
+            "{program} failed ({}): {}",
+            output.status,
+            String::from_utf8_lossy(&output.stderr),
+        );
+    }
+    Ok(())
+}
diff --git a/server/src/service-default.sh b/server/src/service-default.sh
new file mode 100755
index 0000000..d4f61e4
--- /dev/null
+++ b/server/src/service-default.sh
@@ -0,0 +1,258 @@
+#!/bin/sh
+# The service script dev-updater uses for a component that declares
+# `service: Managed("...")` instead of carrying one of its own.
+#
+#   <this> --name NAME --exec "COMMAND ARGS" <subcommand>
+#
+# Installed by dev-updater into its own data directory and run exactly like
+# a project's own script, so nothing downstream can tell the two apart:
+# same subcommands, same four status words, same `logs` contract. This file
+# is not special, it is just the copy nobody has to maintain.
+#
+# It runs with its working directory already set to the component's -- the
+# same resolution a project's own script gets -- so `pwd` is the directory
+# the service should run in and COMMAND is resolved against it. That is why
+# there is no --dir.
+#
+# dev-updater's own `server/service` is a wrapper over this, so there is
+# one implementation of the init-system half rather than two that drift --
+# which they had, four functions byte-identical and half the rest the same.
+# It follows that a change here changes how *this server's own service* is
+# defined, and that the OpenRC branch nobody can test from the development
+# VM now has one place to be wrong instead of two.
+set -eu
+
+NAME=
+EXEC=
+while [ $# -gt 1 ]; do
+    case "$1" in
+        --name) NAME=$2; shift 2 ;;
+        --exec) EXEC=$2; shift 2 ;;
+        *) echo "unknown option $1" >&2; exit 2 ;;
+    esac
+done
+SUBCOMMAND="${1:-}"
+
+[ -n "$NAME" ] || { echo "--name is required" >&2; exit 2; }
+[ -n "$EXEC" ] || { echo "--exec is required" >&2; exit 2; }
+
+# The directory this was run in, which is the component's own. Captured
+# before anything can change it, and absolute because a unit file cannot
+# hold a relative path.
+DIRECTORY=$(pwd)
+
+# Resolved the same way a shell resolves a program name: one written with a
+# path separator is a file here, anything else is found on PATH. Split on
+# whitespace deliberately -- the same limit the config format has, and for
+# the same reason.
+# shellcheck disable=SC2086 # word splitting is what turns EXEC into argv
+set -- $EXEC
+PROGRAM=$1
+shift
+# Kept as one string because both managers want it that way; the
+# `${VAR:+ }` at the use sites is what stops a service with no arguments
+# getting a trailing space welded onto its ExecStart.
+ARGUMENTS=$*
+case "$PROGRAM" in
+    */*) PROGRAM="$DIRECTORY/${PROGRAM#./}" ;;
+esac
+
+detect() {
+    if command -v systemctl >/dev/null 2>&1 &&
+        systemctl --user show-environment >/dev/null 2>&1; then
+        echo systemd
+    elif command -v rc-service >/dev/null 2>&1; then
+        # `rc-service --user --help` is the real probe for whether this
+        # OpenRC has user services at all, but it *fails when
+        # XDG_RUNTIME_DIR is unset* -- so probing first reports "no service
+        # manager here" for a machine that has one and is merely missing a
+        # variable, sending the reader to look for something that is
+        # installed. Only trust the probe once the variable is set; without
+        # it, say openrc and let the check below name the real problem.
+        if [ -n "${XDG_RUNTIME_DIR:-}" ] && ! rc-service --user --help >/dev/null 2>&1; then
+            echo none
+        else
+            echo openrc
+        fi
+    else
+        echo none
+    fi
+}
+
+MANAGER=$(detect)
+if [ "$MANAGER" = none ]; then
+    echo "No user-service manager here: this needs systemd with a user bus," >&2
+    echo "or OpenRC 0.60+ (older ones have no --user). Run $NAME by hand." >&2
+    exit 1
+fi
+
+if [ "$MANAGER" = openrc ] && [ -z "${XDG_RUNTIME_DIR:-}" ]; then
+    echo "XDG_RUNTIME_DIR is unset, and OpenRC stores user-service state in it." >&2
+    echo "Set it at login (elogind or pam_xdg) and try again." >&2
+    exit 1
+fi
+
+SYSTEMD_UNIT="${XDG_CONFIG_HOME:-$HOME/.config}/systemd/user/$NAME.service"
+OPENRC_UNIT="${XDG_CONFIG_HOME:-$HOME/.config}/rc/init.d/$NAME"
+
+LOG_DIR="${XDG_DATA_HOME:-$HOME/.local/share}/dev-updater/services/$NAME"
+LOG="$LOG_DIR/$NAME.log"
+PREVIOUS_LOG="$LOG.1"
+
+rotate_log() {
+    mkdir -p "$LOG_DIR"
+    [ -f "$LOG" ] && mv -f "$LOG" "$PREVIOUS_LOG"
+    : > "$LOG"
+}
+
+installed() {
+    case "$MANAGER" in
+        systemd) [ -f "$SYSTEMD_UNIT" ] ;;
+        openrc) [ -f "$OPENRC_UNIT" ] ;;
+    esac
+}
+
+do_install() {
+    if [ ! -x "$PROGRAM" ] && ! command -v "$PROGRAM" >/dev/null 2>&1; then
+        echo "No built program at $PROGRAM -- build it first." >&2
+        exit 1
+    fi
+    mkdir -p "$LOG_DIR"
+    case "$MANAGER" in
+        systemd)
+            mkdir -p "$(dirname "$SYSTEMD_UNIT")"
+            cat > "$SYSTEMD_UNIT" <<UNIT
+[Unit]
+Description=$NAME (installed by dev-updater)
+
+[Service]
+ExecStart=$PROGRAM${ARGUMENTS:+ $ARGUMENTS}
+Restart=on-failure
+WorkingDirectory=$DIRECTORY
+StandardOutput=append:$LOG
+StandardError=append:$LOG
+
+[Install]
+WantedBy=default.target
+UNIT
+            systemctl --user daemon-reload
+            systemctl --user enable "$NAME" >/dev/null
+            ;;
+        openrc)
+            mkdir -p "$(dirname "$OPENRC_UNIT")"
+            cat > "$OPENRC_UNIT" <<UNIT
+#!/sbin/openrc-run
+name="$NAME"
+description="$NAME (installed by dev-updater)"
+command="$PROGRAM"
+command_args="$ARGUMENTS"
+command_background=true
+directory="$DIRECTORY"
+pidfile="\${XDG_RUNTIME_DIR}/$NAME.pid"
+output_log="$LOG"
+error_log="$LOG"
+UNIT
+            chmod +x "$OPENRC_UNIT"
+            rc-update --user add "$NAME" >/dev/null 2>&1 || true
+            ;;
+    esac
+}
+
+do_uninstall() {
+    installed || return 0
+    case "$MANAGER" in
+        systemd)
+            systemctl --user disable --now "$NAME" >/dev/null 2>&1 || true
+            rm -f "$SYSTEMD_UNIT"
+            systemctl --user daemon-reload
+            ;;
+        openrc)
+            rc-service --user "$NAME" stop >/dev/null 2>&1 || true
+            rc-update --user del "$NAME" >/dev/null 2>&1 || true
+            rm -f "$OPENRC_UNIT"
+            ;;
+    esac
+}
+
+control() {
+    installed || { echo "$NAME is not installed" >&2; exit 1; }
+    case "$MANAGER" in
+        systemd) systemctl --user "$1" "$NAME" ;;
+        openrc) rc-service --user "$NAME" "$1" ;;
+    esac
+}
+
+case "$SUBCOMMAND" in
+    install) do_install ;;
+    uninstall) do_uninstall ;;
+    start | restart)
+        rotate_log
+        control "$SUBCOMMAND"
+        ;;
+    stop) control "$SUBCOMMAND" ;;
+    logs)
+        [ -f "$LOG" ] && echo "$LOG"
+        [ -f "$PREVIOUS_LOG" ] && echo "$PREVIOUS_LOG"
+        exit 0
+        ;;
+    status)
+        if ! installed; then
+            echo not-installed
+            exit 0
+        fi
+        case "$MANAGER" in
+            systemd)
+                if systemctl --user --quiet is-active "$NAME"; then
+                    echo running
+                elif systemctl --user --quiet is-failed "$NAME"; then
+                    echo failed
+                else
+                    echo stopped
+                fi
+                ;;
+            openrc)
+                # The exit code, not the text. `rc-service status` prints
+                # its status line to *stderr*, so the obvious check --
+                # discard stderr, grep stdout for "crashed" -- throws away
+                # the very word it is looking for, matches nothing, and
+                # reports a service that fell over as `stopped`. That is
+                # precisely the lie the `failed` state was added to
+                # prevent, and it was measured on OpenRC 0.63.3 rather
+                # than reasoned about.
+                #
+                # The codes also distinguish "could not find out", which
+                # no amount of reading the text can: an uninitialised user
+                # softlevel makes every call fail, and that is not a state
+                # the service is in.
+                #
+                # Assigned through `|| code=$?` because `set -e` would
+                # otherwise kill this script before it could read a code:
+                # every answer except "running" is a non-zero exit.
+                code=0
+                rc-service --user "$NAME" status >/dev/null 2>&1 || code=$?
+                case "$code" in
+                    0) echo running ;;
+                    3) echo stopped ;;
+                    32) echo failed ;;
+                    *)
+                        if [ ! -f "${XDG_RUNTIME_DIR:-}/openrc/softlevel" ]; then
+                            echo "OpenRC has no user softlevel at" \
+                                "${XDG_RUNTIME_DIR:-\$XDG_RUNTIME_DIR}/openrc/softlevel," \
+                                "so rc-service --user cannot answer for $NAME." >&2
+                        else
+                            echo "rc-service could not report on $NAME (exit $code)." >&2
+                        fi
+                        # Non-zero, and no status word: this server shows
+                        # "couldn't check", which is the truth. Printing a
+                        # state here would be inventing one.
+                        exit 1
+                        ;;
+                esac
+                ;;
+        esac
+        ;;
+    *)
+        echo "usage: $0 --name N --exec C install|uninstall|start|stop|restart|status|logs" >&2
+        exit 2
+        ;;
+esac
diff --git a/server/src/service.rs b/server/src/service.rs
new file mode 100644
index 0000000..f4fedc7
--- /dev/null
+++ b/server/src/service.rs
@@ -0,0 +1,541 @@
+//! Driving a project's long-running server through the script it carries.
+//!
+//! This server knows nothing about systemd or OpenRC and deliberately
+//! never will: which init system is present, and how a unit gets written
+//! into it, is knowledge that belongs where the service does. A project
+//! declares one script and this runs `<script> <subcommand>` -- `install`,
+//! `uninstall`, `start`, `stop`, `restart`, `status`, `logs`.
+//!
+//! `status` is the one with a contract, because five answers have to be
+//! told apart and three of them are not failures: see [`ServiceState`].
+//!
+//! Nothing here ever runs on the manifest path. Asking a service manager
+//! costs a process spawn, and the manifest is fetched on every open,
+//! resume and Refresh -- so the answer is fetched in the background and
+//! read from [`ServiceChecks`], exactly as `git::RemoteChecks` does for
+//! remotes.
+
+use std::os::unix::process::CommandExt;
+use std::path::{Path, PathBuf};
+use std::sync::Arc;
+
+use serde::Serialize;
+
+use crate::config::{Command, Component, Service};
+
+/// What a service script says about its service.
+///
+/// Four states rather than a boolean, because each is a different thing
+/// to offer and a different thing to say. "Not installed" gets an Install
+/// button and no controls; "stopped" gets Start; "failed" gets Start too,
+/// but must not be *described* as stopped.
+///
+/// `Failed` exists because its absence made the card lie. A service that
+/// fell over is not stopped -- stopped is a state somebody chose, and
+/// reading "stopped" about a crash sends you looking for who stopped it.
+/// The only alternative a script had was to exit non-zero, which reads as
+/// "couldn't check" and is equally wrong: it found out perfectly well, it
+/// just had no word for the answer.
+///
+/// A fifth answer, "the script could not tell us", is still the `Err`
+/// case rather than a variant: that one is not a state the service is in,
+/// it is this server failing to find out.
+#[derive(Clone, Copy, PartialEq, Eq, Debug, Serialize)]
+#[serde(rename_all = "camelCase")]
+pub enum ServiceState {
+    Running,
+    Stopped,
+    /// Installed, not running, and not because anybody asked -- it exited
+    /// non-zero or was killed.
+    Failed,
+    NotInstalled,
+}
+
+impl ServiceState {
+    /// The word a script prints on stdout. Deliberately words rather than
+    /// exit codes: a script that returns 3 has to be read against a table
+    /// nobody remembers, and the exit status is wanted for the separate
+    /// question of whether the script worked at all.
+    fn parse(output: &str) -> Option<Self> {
+        match output.trim() {
+            "running" => Some(Self::Running),
+            "stopped" => Some(Self::Stopped),
+            "failed" => Some(Self::Failed),
+            "not-installed" => Some(Self::NotInstalled),
+            _ => None,
+        }
+    }
+}
+
+/// The command that drives this component's service, whichever way it
+/// declared one.
+///
+/// The single place the two variants of [`Service`] become the same thing.
+/// Everything downstream takes a command and runs `<command> <subcommand>`,
+/// so nothing but this function knows that a built-in script exists -- and
+/// a component that switches from its own script to the built-in one
+/// changes nothing anywhere else.
+///
+/// `None` covers both a component that is not a server and one that
+/// declares no service, which are the same thing to every caller: there
+/// is nothing to drive.
+pub fn driver(key: &str, component: &Component) -> Option<Command> {
+    match component.service()? {
+        Service::Script(script) if !script.is_empty() => Some(script.clone()),
+        Service::Managed(run) if !run.is_empty() => Some(Command::from_words(vec![
+            crate::shipped::service_default()
+                .to_string_lossy()
+                .into_owned(),
+            "--name".to_string(),
+            unit_name(key, component.name()),
+            "--exec".to_string(),
+            run.to_line(),
+        ])),
+        // Declared empty, which says the same as not declaring it.
+        Service::Script(_) | Service::Managed(_) => None,
+    }
+}
+
+/// What a managed service is called to its service manager.
+///
+/// The project key and the component, because a service manager's names
+/// are one flat namespace across every project on the machine and
+/// "backend" is not a name two projects can share. A project that wants to
+/// choose its own name carries its own script, which is one of the things
+/// that is for.
+fn unit_name(key: &str, component: &str) -> String {
+    format!("{key}-{component}")
+}
+
+/// How long a service command is given before it is given up on.
+///
+/// Same reasoning as the git remote timeout: a script that hangs -- on a
+/// password prompt it should never have shown, most likely -- must not
+/// hold a slot forever. Longer than a status check needs, because
+/// `install` may be writing units and enabling them.
+const TIMEOUT: std::time::Duration = std::time::Duration::from_secs(60);
+
+/// Runs one subcommand of `script`, returning its stdout.
+///
+/// Stdin is closed rather than inherited. A script that prompts for a
+/// password gets end-of-file and fails, instead of hanging until the
+/// timeout with a card stuck on "installing" -- the same bargain git's
+/// `BatchMode` makes.
+pub fn run(
+    script: &Command,
+    project: &Path,
+    cwd: Option<&Path>,
+    subcommand: &str,
+) -> Result<String, String> {
+    let mut child = script
+        .to_process(project, cwd, &[subcommand])?
+        .stdin(std::process::Stdio::null())
+        .stdout(std::process::Stdio::piped())
+        .stderr(std::process::Stdio::piped())
+        .spawn()
+        .map_err(|err| format!("failed to run the service script: {err}"))?;
+
+    let deadline = std::time::Instant::now() + TIMEOUT;
+    loop {
+        match child.try_wait() {
+            Ok(Some(_)) => {
+                let output = child
+                    .wait_with_output()
+                    .map_err(|err| format!("reading the service script's output: {err}"))?;
+                return if output.status.success() {
+                    Ok(String::from_utf8_lossy(&output.stdout).trim().to_string())
+                } else {
+                    // The script's own words, which is what the card shows
+                    // -- it knows why it could not do the thing and this
+                    // does not.
+                    let stderr = String::from_utf8_lossy(&output.stderr).trim().to_string();
+                    Err(if stderr.is_empty() {
+                        format!("{subcommand} failed ({})", output.status)
+                    } else {
+                        first_line(&stderr)
+                    })
+                };
+            }
+            Ok(None) if std::time::Instant::now() >= deadline => {
+                let _ = child.kill();
+                let _ = child.wait();
+                return Err(format!(
+                    "{subcommand} took longer than {}s and was stopped -- a service script must \
+                     never wait for input",
+                    TIMEOUT.as_secs()
+                ));
+            }
+            Ok(None) => std::thread::sleep(std::time::Duration::from_millis(50)),
+            Err(err) => return Err(format!("waiting on the service script: {err}")),
+        }
+    }
+}
+
+/// Runs one subcommand and does **not** wait for it, in its own process
+/// group.
+///
+/// For the one case where the caller is the target: this server asking its
+/// own manager to restart it. Both halves matter.
+///
+/// *Not waiting*, because the thing being waited for is a restart of this
+/// process -- there is no result to collect, and blocking a thread on it
+/// only creates something for the stop to interrupt.
+///
+/// *Its own process group*, because on OpenRC `restart` is a shell script
+/// doing stop-then-start, run as a child of the very process it is
+/// stopping. Waiting on it deadlocks: this server's shutdown waits for its
+/// children, and the restart's stop phase waits for this server to exit.
+/// Neither moves, `start-stop-daemon` gives up with "1 process refused to
+/// stop", and the restart aborts *before* the start ever runs -- which is
+/// what left one service parked in `stopping` with the phone unable to
+/// reach anything.
+///
+/// Reproduced on OpenRC 0.63.3, and the reproduction is worth knowing:
+/// **it only bites a server that shuts down gracefully.** A test process
+/// that dies instantly on SIGTERM passes -- the restart child is orphaned
+/// and finishes the job -- so the toy version of this test says everything
+/// is fine. Anything that drains its work first, which is every real
+/// server, deadlocks.
+///
+/// systemd does not have the problem at all, because there a restart is a
+/// job the daemon owns and the client is free to die. That difference is
+/// precisely why this was not caught here.
+pub fn spawn_detached(
+    script: &Command,
+    project: &Path,
+    cwd: Option<&Path>,
+    subcommand: &str,
+) -> Result<(), String> {
+    script
+        .to_process(project, cwd, &[subcommand])?
+        .stdin(std::process::Stdio::null())
+        // Inherited, so whatever the script says about a failed restart
+        // lands in this server's log -- the one place it can still be read
+        // afterwards.
+        .process_group(0)
+        .spawn()
+        .map(|_| ())
+        .map_err(|err| format!("failed to run the service script: {err}"))
+}
+
+/// Asks `script` what state its service is in.
+pub fn status(
+    script: &Command,
+    project: &Path,
+    cwd: Option<&Path>,
+) -> Result<ServiceState, String> {
+    let output = run(script, project, cwd, "status")?;
+    ServiceState::parse(&output).ok_or_else(|| {
+        format!("status printed {output:?}, not running, stopped, failed or not-installed")
+    })
+}
+
+/// Where a component's own log files are, newest first.
+///
+/// The script both arranges the logging and reports it: neither service
+/// manager writes a file by default -- systemd goes to the journal,
+/// OpenRC's backgrounded output goes nowhere -- so a unit has to be
+/// written to redirect, and only the script knows how. That is the whole
+/// point of asking it: this server needs no service-manager-specific code
+/// at all, it just gets paths.
+///
+/// **Not supporting logs is a first-class answer.** A script that prints
+/// nothing, or exits non-zero, means "no logs from me" and the card
+/// simply offers no button. An older script that has never heard of
+/// `logs` falls through to its usage case and exits non-zero, which lands
+/// in the same place -- so this is additive and no script has to change
+/// before the server does.
+///
+/// The paths are reported rather than the contents. What to do with a log
+/// -- how much of it, which generation -- is this server's business and a
+/// phone's, not the script's.
+pub fn logs(script: &Command, project: &Path, cwd: Option<&Path>) -> Vec<PathBuf> {
+    let Ok(output) = run(script, project, cwd, "logs") else {
+        return Vec::new();
+    };
+    output
+        .lines()
+        .map(str::trim)
+        .filter(|line| !line.is_empty())
+        .map(|line| {
+            // Relative paths resolve against the project, the same rule
+            // the script's own command follows.
+            let path = Path::new(line);
+            if path.is_absolute() {
+                path.to_path_buf()
+            } else {
+                project.join(path)
+            }
+        })
+        .collect()
+}
+
+/// A script's failures run to a paragraph; a card gets a line. The rest is
+/// in this server's log.
+fn first_line(text: &str) -> String {
+    text.lines()
+        .map(str::trim)
+        .find(|line| !line.is_empty())
+        .unwrap_or(text)
+        .to_string()
+}
+
+/// What each server component was last found to be doing, refreshed off
+/// the request path.
+///
+/// The typed face of [`crate::checks`], which is where the mechanism
+/// lives: the list must not wait on a process spawn, so the answer lands
+/// on the next look and the card says it is still being worked out until
+/// it does. Keyed by project key and component name, because the actions
+/// are per component.
+#[derive(Default, Clone)]
+pub struct ServiceChecks(Arc<crate::checks::Checks<(String, String), Answer>>);
+
+/// What is known about one component, as one value.
+///
+/// Both parts come from the same trip, because both cost the same process
+/// spawn and the manifest must not pay it per request. They are kept
+/// together rather than as two checks so that a status that failed cannot
+/// leave the logs looking like they belong to a different moment.
+#[derive(Default, Clone)]
+pub struct Answer {
+    state: Option<ServiceState>,
+    /// The log files this component's script reported, newest first. The
+    /// card only needs to know *whether* there are logs; reading one is an
+    /// explicit tap and can pay for its own ask.
+    logs: Vec<PathBuf>,
+}
+
+/// One component to ask about: which project it belongs to, where that
+/// project is, and the script.
+pub struct Target {
+    pub key: String,
+    pub component: String,
+    pub project: PathBuf,
+    pub cwd: Option<PathBuf>,
+    pub script: Command,
+}
+
+impl ServiceChecks {
+    pub fn state(&self, key: &str, component: &str) -> Option<ServiceState> {
+        self.0.answer(&id(key, component)).and_then(|it| it.state)
+    }
+
+    pub fn is_checking(&self, key: &str, component: &str) -> bool {
+        self.0.is_checking(&id(key, component))
+    }
+
+    /// The log files last reported for this component. Empty before
+    /// anything has been asked, and for a script that offers none.
+    pub fn logs(&self, key: &str, component: &str) -> Vec<PathBuf> {
+        self.0
+            .answer(&id(key, component))
+            .map(|it| it.logs)
+            .unwrap_or_default()
+    }
+
+    pub fn error(&self, key: &str, component: &str) -> Option<String> {
+        self.0.error(&id(key, component))
+    }
+
+    /// Asks every target that isn't already being asked. Returns at once.
+    pub fn refresh(&self, targets: Vec<Target>) {
+        for target in targets {
+            let id = id(&target.key, &target.component);
+            self.0.start(id, move |previous| {
+                let state = status(&target.script, &target.project, target.cwd.as_deref());
+                // Same trip, because it is the same spawn cost.
+                let logs = logs(&target.script, &target.project, target.cwd.as_deref());
+                if let Err(err) = &state {
+                    tracing::warn!("asking {}'s {} failed: {err}", target.key, target.component);
+                }
+                // A failed status keeps the previous one and records why,
+                // so the card can qualify what it shows rather than
+                // passing a stale state off as current -- while the logs,
+                // which were found, are kept either way.
+                crate::checks::Report {
+                    answer: Some(Answer {
+                        state: state
+                            .as_ref()
+                            .ok()
+                            .copied()
+                            .or_else(|| previous.and_then(|previous: Answer| previous.state)),
+                        logs,
+                    }),
+                    error: state.err(),
+                }
+            });
+        }
+    }
+
+    /// Records a state this server just caused, so the card reflects an
+    /// action without waiting for the next background check. Leaves the
+    /// logs alone: they are still the ones that were found.
+    pub fn mark(&self, key: &str, component: &str, state: ServiceState) {
+        self.0
+            .update(id(key, component), |answer| answer.state = Some(state));
+    }
+
+    /// Forgets a project's components, for one being removed.
+    pub fn forget(&self, key: &str) {
+        self.0.retain(|(project, _)| project != key);
+    }
+}
+
+fn id(key: &str, component: &str) -> (String, String) {
+    (key.to_string(), component.to_string())
+}
+
+#[cfg(test)]
+mod tests {
+    use std::os::unix::fs::PermissionsExt;
+
+    use super::*;
+
+    fn server(service: Option<Service>) -> Component {
+        Component::Server {
+            name: "backend".to_string(),
+            build: Command::default(),
+            cwd: None,
+            stale_when: None,
+            service,
+            built_from: None,
+        }
+    }
+
+    /// The one place the two variants become the same thing, so this is
+    /// where it is worth pinning down what each turns into.
+    #[test]
+    fn both_variants_resolve_to_one_command_to_run() {
+        // A project's own script is passed through untouched -- it is
+        // already the thing the contract describes.
+        let own = Command::from_line("server/service");
+        assert_eq!(
+            driver("app", &server(Some(Service::Script(own.clone())))),
+            Some(own)
+        );
+
+        // Managed becomes the built-in script with the component's
+        // identity and command as arguments, so the subcommand the caller
+        // appends still lands last.
+        let managed = driver(
+            "app",
+            &server(Some(Service::Managed(Command::from_line(
+                "target/release/ai-server --port 8080",
+            )))),
+        )
+        .expect("a managed component has a driver");
+        let (program, arguments) = managed.split_first().expect("a program");
+        assert_eq!(
+            program,
+            &crate::shipped::service_default()
+                .to_string_lossy()
+                .into_owned()
+        );
+        assert_eq!(
+            arguments,
+            [
+                "--name",
+                // The key as well as the component: a service manager's
+                // names are one namespace across every project here.
+                "app-backend",
+                "--exec",
+                "target/release/ai-server --port 8080",
+            ]
+        );
+    }
+
+    /// A server with no service, and one whose declaration is empty, are
+    /// the same answer to every caller: there is nothing to drive.
+    #[test]
+    fn nothing_to_drive_is_none_however_it_was_said() {
+        assert_eq!(driver("app", &server(None)), None);
+        assert_eq!(
+            driver("app", &server(Some(Service::Script(Command::default())))),
+            None
+        );
+        assert_eq!(
+            driver("app", &server(Some(Service::Managed(Command::default())))),
+            None
+        );
+    }
+
+    /// The property the OpenRC failure turned on: the script this server
+    /// asks to restart it must not be something this server then waits on,
+    /// or the two wait for each other and the start never happens. Its own
+    /// process group is what makes that structurally true rather than
+    /// remembered.
+    ///
+    /// Tested by having the child report its own group, because that is
+    /// the thing that decides whether a group-directed signal reaches it.
+    /// Nothing here can test OpenRC itself -- this machine has systemd --
+    /// so this pins the mechanism rather than the outcome.
+    #[test]
+    fn a_detached_child_is_outside_this_process_group() {
+        let dir = tempfile::tempdir().expect("tempdir");
+        let script = dir.path().join("report");
+        std::fs::write(
+            &script,
+            "#!/bin/sh\nps -o pgid= -p $$ | tr -d ' ' > \"$(dirname \"$0\")/pgid\"\n",
+        )
+        .expect("write");
+        std::fs::set_permissions(&script, std::fs::Permissions::from_mode(0o700)).expect("chmod");
+
+        spawn_detached(
+            &Command::from_line(&script.to_string_lossy()),
+            dir.path(),
+            None,
+            "restart",
+        )
+        .expect("spawn");
+
+        let reported = dir.path().join("pgid");
+        let mut waited = 0;
+        while !reported.is_file() && waited < 100 {
+            std::thread::sleep(std::time::Duration::from_millis(50));
+            waited += 1;
+        }
+        let child_group: i32 = std::fs::read_to_string(&reported)
+            .expect("the detached child should have reported its group")
+            .trim()
+            .parse()
+            .expect("a process group id");
+
+        // Read the same way the child reported its own, so the two
+        // numbers are comparable and nothing new is depended on for it.
+        let ours: i32 = String::from_utf8_lossy(
+            &std::process::Command::new("ps")
+                .args(["-o", "pgid=", "-p", &std::process::id().to_string()])
+                .output()
+                .expect("ps")
+                .stdout,
+        )
+        .trim()
+        .parse()
+        .expect("our own process group id");
+        assert_ne!(
+            child_group, ours,
+            "a child in our own group is one the stop would kill with us"
+        );
+    }
+
+    /// The three words and nothing else. A script printing something else
+    /// has a bug, and saying so beats picking whichever state is nearest.
+    #[test]
+    fn only_the_three_words_are_states() {
+        assert_eq!(ServiceState::parse("running"), Some(ServiceState::Running));
+        assert_eq!(
+            ServiceState::parse(" stopped\n"),
+            Some(ServiceState::Stopped)
+        );
+        assert_eq!(ServiceState::parse("failed"), Some(ServiceState::Failed));
+        assert_eq!(
+            ServiceState::parse("not-installed"),
+            Some(ServiceState::NotInstalled)
+        );
+
+        assert_eq!(ServiceState::parse("active"), None);
+        assert_eq!(ServiceState::parse("Running"), None);
+        assert_eq!(ServiceState::parse(""), None);
+    }
+}
diff --git a/server/src/shipped.rs b/server/src/shipped.rs
new file mode 100644
index 0000000..e971a4d
--- /dev/null
+++ b/server/src/shipped.rs
@@ -0,0 +1,75 @@
+//! Shell scripts compiled into this binary and written out at startup.
+//!
+//! Two of them so far: the service script a component gets when it
+//! declares `Managed`, and the wrapper that reports a Gradle build's
+//! progress. They are here for the same reason — the knowledge in them is
+//! shared by every project this server builds, so it belongs in the server
+//! rather than copied into each project's own scripts, where it drifts.
+//!
+//! Shipped as *scripts* rather than implemented in Rust because both do
+//! things a shell is the right tool for and because both must be runnable
+//! by hand: debugging a service script by running it is how the OpenRC
+//! branch of it was ever tested at all.
+//!
+//! Written out at every start rather than when missing. The file is a copy
+//! of what is compiled in, so the only question worth asking is whether it
+//! matches *this* binary, and rewriting answers it without having to ask —
+//! which is the whole point of shipping them, since a stale copy is the
+//! drift they exist to prevent, arriving by a slower route.
+
+use std::path::PathBuf;
+
+/// Drives a service for a component declaring `Managed`; see
+/// `crate::service`.
+const SERVICE_DEFAULT: &str = include_str!("service-default.sh");
+
+/// Wraps a build command that cannot report its own progress; see the
+/// script's own header for which can and which cannot.
+const BUILD_PROGRESS: &str = include_str!("build-progress.sh");
+
+/// Where a shipped script is written.
+///
+/// Generated output rather than configuration, so under `XDG_DATA_HOME`
+/// beside the logs, on the same reasoning `crate::logs` uses.
+pub fn path(name: &str) -> PathBuf {
+    crate::logs::data_dir().join(name)
+}
+
+/// The service script's path, named once so callers do not repeat the
+/// string.
+pub fn service_default() -> PathBuf {
+    path("service-default")
+}
+
+/// The build-progress wrapper's path, which is handed to build commands as
+/// `DEV_UPDATER_PROGRESS`.
+pub fn build_progress() -> PathBuf {
+    path("build-progress")
+}
+
+/// Writes every shipped script out, executable. Call once at startup.
+pub fn install() -> std::io::Result<()> {
+    write(&service_default(), SERVICE_DEFAULT)?;
+    write(&build_progress(), BUILD_PROGRESS)
+}
+
+fn write(path: &std::path::Path, contents: &str) -> std::io::Result<()> {
+    use std::io::Write;
+    use std::os::unix::fs::{OpenOptionsExt, PermissionsExt};
+
+    if let Some(parent) = path.parent() {
+        std::fs::create_dir_all(parent)?;
+    }
+    // Truncating rather than appending, and the mode is only applied at
+    // creation -- so it is set explicitly afterwards for the case where
+    // the file already existed.
+    let mut file = std::fs::OpenOptions::new()
+        .write(true)
+        .create(true)
+        .truncate(true)
+        .mode(0o700)
+        .open(path)?;
+    file.write_all(contents.as_bytes())?;
+    drop(file);
+    std::fs::set_permissions(path, std::fs::Permissions::from_mode(0o700))
+}
diff --git a/server/src/strip.rs b/server/src/strip.rs
new file mode 100644
index 0000000..aa173ba
--- /dev/null
+++ b/server/src/strip.rs
@@ -0,0 +1,194 @@
+//! Produces a sibling `<name>.slim.apk` for an APK with native `.so`
+//! debug symbols stripped out of every `lib/**/*.so` (everything else
+//! copied byte-for-byte, via `ZipWriter::raw_copy_file` so untouched
+//! entries are never decompressed/recompressed), re-signed with the same
+//! debug key so it still installs cleanly.
+//!
+//! Cached against the source APK's (mtime, size) in a `.slim-stamp`
+//! sidecar, so it's only regenerated when the underlying build actually
+//! changes.
+
+use std::io::{Read, Write};
+use std::path::{Path, PathBuf};
+use std::process::Command;
+use std::time::UNIX_EPOCH;
+
+use anyhow::{Context, Result};
+
+use crate::sdk::{self, run_checked};
+
+const DEBUG_KEYSTORE_PASS: &str = "android";
+const DEBUG_KEY_ALIAS: &str = "androiddebugkey";
+
+/// The path an app should actually be served from: `raw_path` itself when
+/// `strip` is off, or its cached `.slim.apk` otherwise (running the strip
+/// pipeline first if the cache is stale).
+///
+/// For the download itself, which is the one request that has to have the
+/// exact bytes. Anything that only wants to *describe* the download wants
+/// [`serveable_now`] instead.
+pub async fn resolve_serveable_path(raw_path: &Path, strip: bool) -> Result<PathBuf> {
+    if !strip {
+        return Ok(raw_path.to_path_buf());
+    }
+    let raw_path = raw_path.to_path_buf();
+    tokio::task::spawn_blocking(move || strip_debug_symbols(&raw_path))
+        .await
+        .context("strip task panicked")?
+}
+
+/// The path an app would be served from *as things stand*, doing no work:
+/// the slim copy if one has already been produced, otherwise the raw APK.
+///
+/// The manifest uses this rather than [`resolve_serveable_path`] because
+/// stripping is seconds of zip walking, `llvm-strip` and re-signing, and
+/// the manifest is fetched on every open, resume and Refresh. Generating a
+/// build artifact to answer a question about sizes is the wrong trade: a
+/// card is worth an approximate number, never a stall.
+///
+/// So the size shown just after a rebuild is the previous slim copy's,
+/// until a download regenerates it. That is a far closer answer than the
+/// unstripped size, which is the only other thing available without doing
+/// the work.
+pub fn serveable_now(raw_path: &Path, strip: bool) -> PathBuf {
+    if !strip {
+        return raw_path.to_path_buf();
+    }
+    let slim = with_suffix(raw_path, ".slim.apk");
+    if slim.is_file() {
+        slim
+    } else {
+        raw_path.to_path_buf()
+    }
+}
+
+fn strip_debug_symbols(src_path: &Path) -> Result<PathBuf> {
+    let slim_path = with_suffix(src_path, ".slim.apk");
+    let stamp_path = with_suffix(src_path, ".slim-stamp");
+
+    let metadata =
+        std::fs::metadata(src_path).with_context(|| format!("stat {}", src_path.display()))?;
+    let stamp = format!(
+        "{}:{}",
+        metadata.modified()?.duration_since(UNIX_EPOCH)?.as_nanos(),
+        metadata.len(),
+    );
+    if slim_path.is_file()
+        && std::fs::read_to_string(&stamp_path).ok().as_deref() == Some(stamp.as_str())
+    {
+        return Ok(slim_path);
+    }
+
+    let llvm_strip = sdk::llvm_strip_path()?;
+    let build_tools = sdk::build_tools_dir()?;
+
+    tracing::info!(
+        "stripping native debug symbols from {} ({} bytes)...",
+        src_path.display(),
+        metadata.len(),
+    );
+
+    let tmp = tempfile::tempdir()?;
+    let unaligned_path = tmp.path().join("unaligned.apk");
+    strip_native_libs(src_path, &unaligned_path, &llvm_strip, tmp.path())?;
+
+    let aligned_path = tmp.path().join("aligned.apk");
+    run_checked(
+        Command::new(build_tools.join("zipalign"))
+            .arg("-f")
+            .arg("-p")
+            .arg("4")
+            .arg(&unaligned_path)
+            .arg(&aligned_path),
+    )?;
+
+    run_checked(
+        Command::new(build_tools.join("apksigner"))
+            .arg("sign")
+            .arg("--ks")
+            .arg(sdk::debug_keystore_path()?)
+            .arg("--ks-pass")
+            .arg(format!("pass:{DEBUG_KEYSTORE_PASS}"))
+            .arg("--key-pass")
+            .arg(format!("pass:{DEBUG_KEYSTORE_PASS}"))
+            .arg("--ks-key-alias")
+            .arg(DEBUG_KEY_ALIAS)
+            .arg("--out")
+            .arg(&slim_path)
+            .arg(&aligned_path),
+    )?;
+
+    std::fs::write(&stamp_path, &stamp)?;
+    tracing::info!(
+        "stripped -> {} ({} bytes)",
+        slim_path.display(),
+        std::fs::metadata(&slim_path)?.len(),
+    );
+    Ok(slim_path)
+}
+
+/// Rewrites `src_path` into `dst_path`, running every `lib/**/*.so` entry
+/// through `llvm-strip --strip-debug` and copying everything else as-is.
+fn strip_native_libs(
+    src_path: &Path,
+    dst_path: &Path,
+    llvm_strip: &Path,
+    tmp_dir: &Path,
+) -> Result<()> {
+    let src_file =
+        std::fs::File::open(src_path).with_context(|| format!("open {}", src_path.display()))?;
+    let mut archive = zip::ZipArchive::new(src_file).context("read apk as zip")?;
+
+    let dst_file = std::fs::File::create(dst_path)
+        .with_context(|| format!("create {}", dst_path.display()))?;
+    let mut writer = zip::ZipWriter::new(dst_file);
+
+    for i in 0..archive.len() {
+        let mut file = archive
+            .by_index(i)
+            .with_context(|| format!("read entry {i}"))?;
+        let name = file.name().to_string();
+
+        if !(name.starts_with("lib/") && name.ends_with(".so")) {
+            writer
+                .raw_copy_file(file)
+                .with_context(|| format!("copy {name}"))?;
+            continue;
+        }
+
+        let mut options =
+            zip::write::SimpleFileOptions::default().compression_method(file.compression());
+        if let Some(mode) = file.unix_mode() {
+            options = options.unix_permissions(mode);
+        }
+        if let Some(modified) = file.last_modified() {
+            options = options.last_modified_time(modified);
+        }
+
+        let mut data = Vec::new();
+        file.read_to_end(&mut data)
+            .with_context(|| format!("read {name}"))?;
+
+        let so_path = tmp_dir.join(name.replace('/', "_"));
+        std::fs::write(&so_path, &data)?;
+        run_checked(Command::new(llvm_strip).arg("--strip-debug").arg(&so_path))
+            .with_context(|| format!("strip {name}"))?;
+        let stripped = std::fs::read(&so_path)?;
+
+        writer
+            .start_file(&name, options)
+            .with_context(|| format!("start {name}"))?;
+        writer
+            .write_all(&stripped)
+            .with_context(|| format!("write {name}"))?;
+    }
+
+    writer.finish().context("finish zip")?;
+    Ok(())
+}
+
+fn with_suffix(path: &Path, suffix: &str) -> PathBuf {
+    let mut s = path.as_os_str().to_owned();
+    s.push(suffix);
+    PathBuf::from(s)
+}
diff --git a/start.sh b/start.sh
new file mode 100755
index 0000000..d8c77ae
--- /dev/null
+++ b/start.sh
@@ -0,0 +1,73 @@
+#!/bin/sh
+# Builds both halves and gets the server service running again.
+#
+#   ./start.sh
+#
+# The "put it back the way it should be" script: run it after a pull, or
+# whenever the running server and the checkout have drifted apart. Every
+# step is safe to repeat, so running it when nothing is wrong is a no-op
+# that takes as long as a cached build.
+#
+# The service is reinstalled rather than only installed when missing. The
+# unit file is generated from the service script, so a pull that changes
+# how the service is defined leaves an installed unit that is out of date
+# -- and that unit is what decides the working directory the server starts
+# in, which is where it looks for its own checkout. Rewriting it every time
+# is the only way running this actually guarantees the state it claims to.
+#
+# The service steps go through the freshly built binary's `--service`,
+# which derives the name and the script from the same declaration the
+# running server reads. So there is one definition of this service rather
+# than a bootstrap copy of it here.
+set -eu
+cd "$(dirname "$0")"
+
+# The binary decides how its own service is named and invoked, so nothing
+# here has to. It is built by the step above, which is what makes asking it
+# possible at all -- and it means this script cannot drift out of step with
+# `service::driver` the way a second copy of the name and arguments would.
+SERVICE="./server/target/release/dev-updater --service"
+
+# This service used to be installed under its own name by a script of its
+# own. Left in place, that unit would still start a second copy at boot,
+# which then loses the race for the port -- so it goes before the new one
+# arrives. Harmless once it is gone; this is a no-op on every later run.
+LEGACY="${XDG_CONFIG_HOME:-$HOME/.config}/systemd/user/dev-updater.service"
+LEGACY_OPENRC="${XDG_CONFIG_HOME:-$HOME/.config}/rc/init.d/dev-updater"
+if [ -f "$LEGACY" ] || [ -f "$LEGACY_OPENRC" ]; then
+    echo "==> Removing the old dev-updater unit, which this service replaces"
+    if [ -f "$LEGACY" ]; then
+        systemctl --user disable --now dev-updater >/dev/null 2>&1 || true
+        rm -f "$LEGACY"
+        systemctl --user daemon-reload
+    fi
+    if [ -f "$LEGACY_OPENRC" ]; then
+        rc-service --user dev-updater stop >/dev/null 2>&1 || true
+        rc-update --user del dev-updater >/dev/null 2>&1 || true
+        rm -f "$LEGACY_OPENRC"
+    fi
+fi
+
+# Server first, then the APK: if the APK build fails, the phone keeps being
+# offered the one it already had rather than half of a matched pair.
+./build-self.sh
+
+echo
+echo "==> Installing the service"
+$SERVICE install
+
+# Told apart because restart on a service somebody stopped on purpose is a
+# different thing from starting one that is merely down.
+case "$($SERVICE status)" in
+    running)
+        echo "==> Restarting into the build just made"
+        $SERVICE restart
+        ;;
+    *)
+        echo "==> Starting"
+        $SERVICE start
+        ;;
+esac
+
+echo
+echo "==> the service is $($SERVICE status)"
diff --git a/test-projects/README.md b/test-projects/README.md
new file mode 100644
index 0000000..3a378e1
--- /dev/null
+++ b/test-projects/README.md
@@ -0,0 +1,85 @@
+# Test projects
+
+Small fake projects for exercising Dev Updater against something other than
+Dev Updater. They are apps in the sense the server cares about -- a path
+with a declaration and a build that produces an APK -- and nothing else.
+
+The point of having them is control. Dev Updater's job is installing *other*
+projects' builds, so trying it out needs something to install, and a real
+project only ever does what it happens to do: it builds, or it doesn't, and
+you cannot ask it to fail on the third component, produce two variants, or
+run a service that writes a coloured log. These can be asked for any of
+that.
+
+## Why they are not picked up automatically
+
+`scan_roots` in `server/src/discover.rs` descends two levels below each
+configured repo root, **and stops at any directory carrying a
+`.dev-updater.ron`** -- a declaration says "this directory is the project",
+so what is underneath is that project's own layout rather than more projects
+to offer. This checkout carries one at its root, so with `/home/bob/repos`
+as a root the scan considers `dev-updater` itself and descends no further.
+Nothing in here is ever suggested.
+
+To work with them, add `.../dev-updater/test-projects` as a repo root of its
+own from the app's settings; each directory below is then a suggestion. Or
+type one project's path into the Add screen, which is the escape hatch for
+anything the scan does not reach.
+
+## The `app/` directory each one builds into
+
+`find_apks` matches APKs up to **two** directories below a project root, and
+it is run against the *project* path, not a component's `cwd`. A test
+project building into `test-projects/<name>/build/outputs/apk/` would
+therefore also be found from the repository root -- offered as a build of
+Dev Updater itself, and, being the newest, served as the default. Somebody
+pressing Update on the Dev Updater card would get a stub app.
+
+One more level down (`test-projects/<name>/app/build/outputs/apk/`) is out of
+reach from the root while staying within reach from the test project, which
+is why `lib/build-apk.sh` writes there. It is also what a real Gradle project
+looks like, so nothing about it reads as a workaround. Check it after
+changing any of this:
+
+```sh
+cd <repo root> && for p in build/outputs/apk/*/*.apk */build/outputs/apk/*/*.apk \
+    */*/build/outputs/apk/*/*.apk; do [ -f "$p" ] && echo "$p"; done
+```
+
+Only `app/androidApp/build/outputs/apk/debug/androidApp-debug.apk` should
+appear.
+
+## What is here
+
+| project | what it is for |
+|---|---|
+| `hello-app` | The plain case: one APK, one variant. Declares **no** `resources:`, so Uninstall has to show its data and config toggles disabled and say why. |
+| `two-variants` | Builds `debug` and `release`, so the phone gets a variant picker and `resolve_apk` has something to fall back from. |
+| `breakable` | `touch breakable/break-the-build` and its next build fails, in colour, on stderr. `rm` it and it stops. |
+| `service-and-app` | A `Server` beside an `Apk`: two components building at once, the whole service contract, a runtime log that is not this server's own, and a `resources:` declaration giving Uninstall real paths. |
+
+All four are unaccepted when first added, so each is also a run through the
+acceptance gate.
+
+## The apps themselves
+
+One screen showing the app's label, its package, and when the installed copy
+landed -- `lib/StubActivity.java`, shared by all of them, because what
+differs between these projects is what Dev Updater has to do with them, not
+what the app is. The install time is `PackageInfo.lastUpdateTime`, which is
+the exact value the freshness check compares an APK's mtime against, so the
+screen shows what the card is reasoning about.
+
+They are built by `lib/build-apk.sh` -- aapt2, javac, d8, apksigner, about
+two seconds -- rather than by Gradle. A Gradle daemon is around a gigabyte
+resident and four of these would be four daemons, which is how this machine
+ran itself out of memory on 2026-08-30; and a fixture you wait forty seconds
+for stops getting used. The cost is that the script is a small build system,
+which is why it is one file and should stay one: a test project that needs
+more than a screen with its own name on it wants a real project.
+
+The signing key is generated once at
+`$XDG_DATA_HOME/dev-updater/test-projects/debug.keystore`, outside the
+repository -- the checkout is a mount shared with the host, and a stable key
+is what lets a rebuild install over the copy already on a device. Delete it
+to produce a signature-mismatch install failure on purpose.
diff --git a/test-projects/breakable/.dev-updater.ron b/test-projects/breakable/.dev-updater.ron
new file mode 100644
index 0000000..4b4a238
--- /dev/null
+++ b/test-projects/breakable/.dev-updater.ron
@@ -0,0 +1,15 @@
+// A test project for Dev Updater, not a real app. See ../README.md.
+//
+// The one that can be made to fail. Everything about a failed build is
+// awkward to produce with a real project and easy here: the card's failure
+// line, the build-log tab opening instead of the runtime one, a component
+// failing without stopping its siblings, and coloured compiler output
+// surviving the trip to the phone.
+label: "Test: Breakable",
+
+components: [
+    Apk(
+        name: "app",
+        build: "./build.sh",
+    ),
+],
diff --git a/test-projects/breakable/build.sh b/test-projects/breakable/build.sh
new file mode 100755
index 0000000..17158a3
--- /dev/null
+++ b/test-projects/breakable/build.sh
@@ -0,0 +1,31 @@
+#!/bin/sh
+# Builds this test app -- unless ./break-the-build exists, in which case it
+# fails instead.
+#
+#   touch break-the-build     # the next build fails
+#   rm break-the-build        # and then stops failing
+#
+# A marker file rather than an environment variable, because the point is to
+# change the outcome of a build somebody else starts: Dev Updater runs this
+# from a service with its own environment, and the phone is where the button
+# is. The file is gitignored, so the checked-in state is "works".
+#
+# The failure writes colour on stderr on purpose. A real compiler marks its
+# own errors that way, the app renders the escapes rather than stripping
+# them (AnsiLog.kt), and this is the cheapest way to have something to look
+# at that is not Dev Updater's own build.
+set -eu
+
+if [ -f break-the-build ]; then
+    echo "@@progress 1/3"
+    echo "==> Compiling"
+    printf '\033[1;31merror\033[0m: cannot borrow `the_kettle` as mutable more than once\n' >&2
+    printf '  \033[1;34m-->\033[0m src/main.rs:12:5\n' >&2
+    printf '\033[1;31merror\033[0m: could not compile `breakable` (1 error)\n' >&2
+    echo "break-the-build is present, so this build failed on purpose." >&2
+    exit 1
+fi
+
+exec ../lib/build-apk.sh \
+    --package com.example.dutest.breakable \
+    --label "Test Breakable"
diff --git a/test-projects/hello-app/.dev-updater.ron b/test-projects/hello-app/.dev-updater.ron
new file mode 100644
index 0000000..97b14a1
--- /dev/null
+++ b/test-projects/hello-app/.dev-updater.ron
@@ -0,0 +1,17 @@
+// A test project for Dev Updater, not a real app. See ../README.md.
+//
+// The plain case: one APK component, one variant, and nothing said about
+// resources -- which is itself the thing being tested here, since an
+// uninstall dialog for this project has to show its data and config toggles
+// disabled and say *why*, distinguishably from a project whose resources
+// could not be read.
+label: "Test: Hello",
+
+components: [
+    Apk(
+        name: "app",
+        // The list form rather than a line, because the label has a space
+        // in it and the line form splits on whitespace.
+        build: ["../lib/build-apk.sh", "--package", "com.example.dutest.hello", "--label", "Test Hello"],
+    ),
+],
diff --git a/test-projects/lib/AndroidManifest.xml b/test-projects/lib/AndroidManifest.xml
new file mode 100644
index 0000000..9659e59
--- /dev/null
+++ b/test-projects/lib/AndroidManifest.xml
@@ -0,0 +1,17 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!-- Template. build-apk.sh substitutes __PACKAGE__ and __LABEL__; the SDK
+     levels are passed to aapt2 on the command line rather than written
+     here, so there is one place they are set for every test app. -->
+<manifest xmlns:android="http://schemas.android.com/apk/res/android"
+    package="__PACKAGE__">
+    <application android:label="__LABEL__">
+        <activity
+            android:name="com.example.dutest.stub.StubActivity"
+            android:exported="true">
+            <intent-filter>
+                <action android:name="android.intent.action.MAIN" />
+                <category android:name="android.intent.category.LAUNCHER" />
+            </intent-filter>
+        </activity>
+    </application>
+</manifest>
diff --git a/test-projects/lib/StubActivity.java b/test-projects/lib/StubActivity.java
new file mode 100644
index 0000000..9f54ee4
--- /dev/null
+++ b/test-projects/lib/StubActivity.java
@@ -0,0 +1,63 @@
+package com.example.dutest.stub;
+
+import android.app.Activity;
+import android.content.pm.PackageInfo;
+import android.os.Bundle;
+import android.view.Gravity;
+import android.widget.TextView;
+import java.text.SimpleDateFormat;
+import java.util.Date;
+import java.util.Locale;
+
+/**
+ * The whole of every test app: one screen naming which app this is and when
+ * the installed copy landed.
+ *
+ * One class shared by all of them rather than one per project, because what
+ * differs between the test projects is what Dev Updater has to *do* with
+ * them -- how many variants they build, whether the build fails, whether
+ * they declare a service -- and none of that is a difference in the app.
+ * The manifest names this class fully qualified, so each APK can carry its
+ * own application id while the code keeps one package.
+ *
+ * It shows lastUpdateTime deliberately: that is the exact value Dev
+ * Updater's freshness check compares an APK's mtime against, so the screen
+ * shows what the card is reasoning about rather than a separate version
+ * string that could agree with it by luck.
+ */
+public class StubActivity extends Activity {
+    @Override
+    protected void onCreate(Bundle state) {
+        super.onCreate(state);
+        TextView view = new TextView(this);
+        view.setGravity(Gravity.CENTER);
+        view.setTextSize(20f);
+        view.setLineSpacing(0f, 1.3f);
+        view.setPadding(64, 64, 64, 64);
+        // Catppuccin Mocha Base and Text, matching the updater's own theme
+        // so a screenshot of one does not look like a different machine.
+        view.setBackgroundColor(0xFF1E1E2E);
+        view.setTextColor(0xFFCDD6F4);
+        view.setText(describe());
+        setContentView(view);
+    }
+
+    private String describe() {
+        CharSequence label = getApplicationInfo().loadLabel(getPackageManager());
+        return label + "\n\n" + getPackageName() + "\n\ninstalled " + installedAt();
+    }
+
+    /**
+     * When the package manager says this copy was installed, or why that
+     * could not be read -- never a stand-in that reads like an answer.
+     */
+    private String installedAt() {
+        try {
+            PackageInfo info = getPackageManager().getPackageInfo(getPackageName(), 0);
+            return new SimpleDateFormat("yyyy-MM-dd HH:mm:ss", Locale.US)
+                    .format(new Date(info.lastUpdateTime));
+        } catch (Exception failure) {
+            return "unknown (" + failure.getClass().getSimpleName() + ")";
+        }
+    }
+}
diff --git a/test-projects/lib/build-apk.sh b/test-projects/lib/build-apk.sh
new file mode 100755
index 0000000..fe6cf44
--- /dev/null
+++ b/test-projects/lib/build-apk.sh
@@ -0,0 +1,136 @@
+#!/bin/sh
+# Builds one test app's APK. Run from the test project's own directory,
+# which is where Dev Updater runs a component's build from.
+#
+#   ../lib/build-apk.sh --package com.example.dutest.hello --label "Hello" \
+#       [--variant debug]
+#
+# Deliberately not Gradle, which is the obvious way to build an Android app
+# and the wrong one here for two reasons. A Gradle daemon is around a
+# gigabyte resident, and several test projects each holding one is how this
+# machine ran itself out of memory on 2026-08-30 -- the emulators alone are
+# already close to the limit. And a Gradle build takes tens of seconds to do
+# what this does in about two, which matters because the thing under test is
+# Dev Updater, not the app: a fixture you wait for stops getting used.
+#
+# What it costs is that this is a small build system rather than a
+# declaration. It is kept to one file, and the whole of it is: link a
+# manifest, compile one class, dex it, add it, align, sign. Nothing here is
+# a general Android build and it should not grow into one -- a test project
+# needing more than a screen with its own name on it wants a real project.
+#
+# The signing key lives outside the repository
+# ($XDG_DATA_HOME/dev-updater/test-projects/debug.keystore) because the
+# repository is a mount shared with the host, and because a stable key is
+# what lets a rebuilt APK install *over* the copy already on the emulator
+# rather than being refused for a signature mismatch. Deleting it is how you
+# produce that refusal on purpose.
+set -eu
+
+PACKAGE=
+LABEL=
+VARIANT=debug
+while [ $# -gt 0 ]; do
+    case "$1" in
+        --package) PACKAGE=$2; shift 2 ;;
+        --label) LABEL=$2; shift 2 ;;
+        --variant) VARIANT=$2; shift 2 ;;
+        *) echo "usage: $0 --package ID --label TEXT [--variant NAME]" >&2; exit 2 ;;
+    esac
+done
+[ -n "$PACKAGE" ] || { echo "$0: --package is required" >&2; exit 2; }
+[ -n "$LABEL" ] || { echo "$0: --label is required" >&2; exit 2; }
+
+LIB=$(cd "$(dirname "$0")" && pwd)
+PROJECT=$(pwd)
+NAME=$(basename "$PROJECT")
+
+# Same cascade as app/build-apk.sh: the host and this VM do not keep the SDK
+# in the same place, and the ambient ANDROID_HOME points at one with no
+# build-tools under it.
+if [ -n "${ANDROID_HOME:-}" ] && [ -d "${ANDROID_HOME}/build-tools" ]; then
+    SDK="$ANDROID_HOME"
+elif [ -n "${ANDROID_SDK_ROOT:-}" ] && [ -d "${ANDROID_SDK_ROOT}/build-tools" ]; then
+    SDK="$ANDROID_SDK_ROOT"
+elif [ -d "$HOME/Android/Sdk/build-tools" ]; then
+    SDK="$HOME/Android/Sdk"
+else
+    echo "No Android SDK with build-tools found. Set ANDROID_HOME to one." >&2
+    exit 1
+fi
+
+# Newest of whatever is installed, rather than a pinned version this script
+# would have to be edited to follow.
+TOOLS="$SDK/build-tools/$(ls "$SDK/build-tools" | sort -V | tail -n1)"
+PLATFORM="$SDK/platforms/$(ls "$SDK/platforms" | sort -V | tail -n1)"
+JAR="$PLATFORM/android.jar"
+[ -f "$JAR" ] || { echo "No android.jar under $PLATFORM -- install a platform." >&2; exit 1; }
+
+MIN_SDK=24
+TARGET_SDK=$(basename "$PLATFORM" | sed 's/^android-//; s/\..*//')
+
+KEYSTORE="${XDG_DATA_HOME:-$HOME/.local/share}/dev-updater/test-projects/debug.keystore"
+
+# Six steps, counted out for the progress bar. Emitted directly rather than
+# through $DEV_UPDATER_PROGRESS: that wrapper exists to count Gradle tasks
+# for a build that cannot report its own, and this one knows exactly what it
+# is doing. The format is the same either way -- see server/src/build_state.rs.
+STEPS=6
+step() {
+    echo "@@progress $1/$STEPS"
+    echo "==> $2"
+}
+
+BUILD="$PROJECT/app/build"
+GEN="$BUILD/gen"
+OUT="$BUILD/outputs/apk/$VARIANT"
+# `app/` is not decoration. Dev Updater matches APKs at up to two directories
+# below a project root, so a test project building straight into
+# test-projects/<name>/build/ would also be found from the repository root --
+# i.e. offered as a build of Dev Updater itself, and being newest, served as
+# the default. One more level puts it out of that reach while keeping it one
+# level below the test project, where its own patterns find it.
+rm -rf "$GEN"
+mkdir -p "$GEN/classes" "$OUT"
+
+step 1 "Writing the manifest for $PACKAGE"
+sed -e "s|__PACKAGE__|$PACKAGE|" -e "s|__LABEL__|$LABEL|" \
+    "$LIB/AndroidManifest.xml" >"$GEN/AndroidManifest.xml"
+
+step 2 "Linking resources (aapt2)"
+"$TOOLS/aapt2" link \
+    -I "$JAR" \
+    --manifest "$GEN/AndroidManifest.xml" \
+    --min-sdk-version "$MIN_SDK" \
+    --target-sdk-version "$TARGET_SDK" \
+    -o "$GEN/linked.apk"
+
+step 3 "Compiling StubActivity"
+javac -nowarn -Xlint:-options --release 17 \
+    -classpath "$JAR" -d "$GEN/classes" "$LIB/StubActivity.java"
+
+step 4 "Dexing"
+find "$GEN/classes" -name '*.class' -print0 | xargs -0 \
+    "$TOOLS/d8" --release --lib "$JAR" --min-api "$MIN_SDK" --output "$GEN"
+
+step 5 "Packaging and aligning"
+(cd "$GEN" && jar --update --file linked.apk classes.dex)
+"$TOOLS/zipalign" -p -f 4 "$GEN/linked.apk" "$GEN/aligned.apk"
+
+step 6 "Signing"
+if [ ! -f "$KEYSTORE" ]; then
+    echo "    (generating a signing key at $KEYSTORE)"
+    mkdir -p "$(dirname "$KEYSTORE")"
+    chmod 700 "$(dirname "$KEYSTORE")"
+    keytool -genkeypair -keystore "$KEYSTORE" \
+        -storepass android -keypass android -alias test \
+        -keyalg RSA -keysize 2048 -validity 10000 \
+        -dname "CN=dev-updater test projects" >/dev/null
+fi
+"$TOOLS/apksigner" sign \
+    --ks "$KEYSTORE" --ks-pass pass:android --key-pass pass:android \
+    --ks-key-alias test --min-sdk-version "$MIN_SDK" \
+    --out "$OUT/$NAME-$VARIANT.apk" "$GEN/aligned.apk"
+
+echo "@@progress $STEPS/$STEPS"
+echo "==> Built $OUT/$NAME-$VARIANT.apk"
diff --git a/test-projects/service-and-app/.dev-updater.ron b/test-projects/service-and-app/.dev-updater.ron
new file mode 100644
index 0000000..c58b3ab
--- /dev/null
+++ b/test-projects/service-and-app/.dev-updater.ron
@@ -0,0 +1,38 @@
+// A test project for Dev Updater, not a real app. See ../README.md.
+//
+// The two-component case: a server on the build machine beside an APK for
+// the phone. That pairing is what Dev Updater itself is, so it is the shape
+// most worth having a second of -- a project where breaking something
+// cannot take the updater down with it.
+//
+// What it exercises that a one-component project cannot: two builds running
+// at once with a bar and a timing each, the project area at the bottom
+// holding only what belongs to the whole project, and the whole service
+// contract -- install, start, stop, status, restart, and a runtime log that
+// is not this server's own.
+label: "Test: Service + App",
+
+// Declared, so the Uninstall dialog has real paths to show and its data and
+// config toggles are enabled. `hello-app` deliberately declares nothing,
+// which is the other half of that test.
+resources: Ron("resources.ron"),
+
+components: [
+    Server(
+        name: "daemon",
+        build: "./build-daemon.sh",
+        // Managed, so Dev Updater's own service script drives it and this
+        // project needs no systemd or OpenRC knowledge of its own. The
+        // unit is named `<key>-daemon` after the key this project is added
+        // under.
+        //
+        // The leading `./` is load-bearing: service-default.sh resolves a
+        // program containing a slash against the working directory and
+        // looks anything else up on PATH.
+        service: Managed("./serve.sh"),
+    ),
+    Apk(
+        name: "app",
+        build: ["../lib/build-apk.sh", "--package", "com.example.dutest.service", "--label", "Test Service"],
+    ),
+],
diff --git a/test-projects/service-and-app/build-daemon.sh b/test-projects/service-and-app/build-daemon.sh
new file mode 100755
index 0000000..d60a3e3
--- /dev/null
+++ b/test-projects/service-and-app/build-daemon.sh
@@ -0,0 +1,21 @@
+#!/bin/sh
+# "Builds" this project's daemon, which is a shell script and so needs no
+# building at all. What it actually does is take a few seconds and report
+# progress, because that is the thing worth having: a component slow enough
+# to watch a bar move on, next to an APK component that finishes in two
+# seconds. A card with one instant component and one slow one is how you see
+# whether the per-component timings and the concurrent build really are per
+# component.
+set -eu
+
+STEPS=8
+i=0
+while [ "$i" -lt "$STEPS" ]; do
+    i=$((i + 1))
+    echo "@@progress $i/$STEPS"
+    echo "==> Pretending to compile part $i of $STEPS"
+    sleep 1
+done
+
+chmod +x ./serve.sh
+echo "==> Daemon ready"
diff --git a/test-projects/service-and-app/resources.ron b/test-projects/service-and-app/resources.ron
new file mode 100644
index 0000000..ac8af5a
--- /dev/null
+++ b/test-projects/service-and-app/resources.ron
@@ -0,0 +1,10 @@
+// Where this test project keeps its state, in the shape Dev Updater reads
+// (`ResourceFacts` in server/src/config.rs) -- the body of the struct, no
+// outer parentheses, which is the house rule for every RON file here.
+//
+// Only `name` is given, so the data and config directories follow from it:
+// $XDG_DATA_HOME/dutest-service and $XDG_CONFIG_HOME/dutest-service. That
+// is the ordinary case, and it keeps both paths under the XDG directories,
+// which matters because Uninstall removes a path wherever it points and the
+// dialog showing it is the only guard.
+name: "dutest-service",
diff --git a/test-projects/service-and-app/serve.sh b/test-projects/service-and-app/serve.sh
new file mode 100755
index 0000000..1b70a4d
--- /dev/null
+++ b/test-projects/service-and-app/serve.sh
@@ -0,0 +1,24 @@
+#!/bin/sh
+# The long-running half of this test project: a service that does nothing
+# except say so, once every ten seconds, forever.
+#
+# It writes into its own data directory -- the one resources.ron names -- so
+# that Uninstall's "remove data" toggle has something real to remove, and so
+# that the directory exists to be shown in the dialog. Its *log* is not
+# written here: a managed service's output is captured by Dev Updater's
+# service script, which is what the runtime log tab reads.
+set -eu
+
+DATA="${XDG_DATA_HOME:-$HOME/.local/share}/dutest-service"
+mkdir -p "$DATA"
+
+echo "started at $(date -Is), writing to $DATA"
+count=0
+while true; do
+    count=$((count + 1))
+    echo "$(date -Is) tick $count" >>"$DATA/ticks.log"
+    # Colour, so the runtime log tab has escapes to render too -- the same
+    # reason breakable/build.sh writes them.
+    printf 'tick \033[1;32m%s\033[0m -- still here\n' "$count"
+    sleep 10
+done
diff --git a/test-projects/two-variants/.dev-updater.ron b/test-projects/two-variants/.dev-updater.ron
new file mode 100644
index 0000000..1dc6ba7
--- /dev/null
+++ b/test-projects/two-variants/.dev-updater.ron
@@ -0,0 +1,15 @@
+// A test project for Dev Updater, not a real app. See ../README.md.
+//
+// Builds the same app twice under different variant directories, which is
+// the only thing this one is for: with more than one build present the
+// phone gets a variant picker, `resolve_apk` has something to fall back
+// from when a chosen variant is deleted, and the manifest has to report the
+// size of the one actually being served.
+label: "Test: Two Variants",
+
+components: [
+    Apk(
+        name: "app",
+        build: "./build.sh",
+    ),
+],
diff --git a/test-projects/two-variants/build.sh b/test-projects/two-variants/build.sh
new file mode 100755
index 0000000..0bb0aba
--- /dev/null
+++ b/test-projects/two-variants/build.sh
@@ -0,0 +1,15 @@
+#!/bin/sh
+# Builds this test app twice, once per variant.
+#
+# Two runs of the shared builder rather than a flag on it: what is being
+# tested is Dev Updater seeing two builds under one project, and the
+# simplest thing that produces that is building twice. They are byte-for-
+# byte the same app -- the variant is the directory name, which is where
+# `discover.rs` reads it from.
+set -eu
+for variant in debug release; do
+    ../lib/build-apk.sh \
+        --package com.example.dutest.variants \
+        --label "Test Variants" \
+        --variant "$variant"
+done
diff --git a/vendor/wg-app-link b/vendor/wg-app-link
new file mode 160000
index 0000000..f95bc77
--- /dev/null
+++ b/vendor/wg-app-link
@@ -0,0 +1 @@
+Subproject commit f95bc77f7bf55a57ba6c051b06f11d30ac68c55e