chore: update version number to 0.1.66

Release APKs are obfuscated since R8 was turned on, and nothing kept
the mapping that decodes their stack traces. The workflow now copies
`android/app/build/outputs/mapping/release/mapping.txt` to
`bulwark-mobile-<version>-<commit>-mapping.txt`, uploads it as a
workflow artifact and attaches it to the release next to the APK. The
in-app updater only picks `.apk` assets, so it ignores the new file.

If R8 is on (`android.enableMinifyInReleaseBuilds=true`) and no mapping
was written, the step fails instead of publishing an APK whose crashes
cannot be read. docs/android-release.md explains how to decode a trace
with `retrace`.

.github/workflows/release-android.yml

@@ -10,6 +10,13 @@ on:
         required: false
         default: ""
 
+# Signing is described in docs/android-release.md.
+env:
+  # Certificate SHA-256 of android/app/debug.keystore, the stock React Native
+  # template key (CN=Android Debug, SHA-1 5E:8F:16:06:...:F6:25). It is public,
+  # so Android 9+ must never see it as the signer of a published build.
+  DEBUG_CERT_SHA256: fac61745dc0903786fb9ede62a962b399f7348f0bb6f899b8332667591033b9c
+
 jobs:
   build:
     runs-on: ubuntu-latest
@@ -17,6 +24,26 @@ jobs:
     permissions:
       contents: write
     steps:
+      # Fail in seconds instead of after a 20-minute build. There is no
+      # unsigned or debug-signed fallback: anything signed with the debug key
+      # can be "updated" by anyone.
+      - name: Require the release signing secrets
+        env:
+          KEYSTORE_BASE64: ${{ secrets.ANDROID_KEYSTORE_BASE64 }}
+          KEYSTORE_PASSWORD: ${{ secrets.ANDROID_KEYSTORE_PASSWORD }}
+          KEY_ALIAS: ${{ secrets.ANDROID_KEY_ALIAS }}
+          KEY_PASSWORD: ${{ secrets.ANDROID_KEY_PASSWORD }}
+        run: |
+          missing=""
+          [ -n "$KEYSTORE_BASE64" ] || missing="$missing ANDROID_KEYSTORE_BASE64"
+          [ -n "$KEYSTORE_PASSWORD" ] || missing="$missing ANDROID_KEYSTORE_PASSWORD"
+          [ -n "$KEY_ALIAS" ] || missing="$missing ANDROID_KEY_ALIAS"
+          [ -n "$KEY_PASSWORD" ] || missing="$missing ANDROID_KEY_PASSWORD"
+          if [ -n "$missing" ]; then
+            echo "::error title=Release signing is not configured::Missing repository secrets:$missing. Release APKs are never signed with the public debug key; see docs/android-release.md."
+            exit 1
+          fi
+
       - uses: actions/checkout@v4
 
       - uses: actions/setup-node@v4
@@ -30,7 +57,12 @@ jobs:
           java-version: 17
           cache: gradle
 
+      # The action installs the legacy `tools` package by default, which the
+      # runner's cmdline-tools 16 no longer carries ("Failed to find package
+      # 'tools'"). Gradle fetches the platforms and build-tools it needs.
       - uses: android-actions/setup-android@v3
+        with:
+          packages: platform-tools
 
       - name: Cache Android NDK / CMake
         uses: actions/cache@v4
@@ -66,23 +98,38 @@ jobs:
       - name: Install JS dependencies
         run: npm ci
 
-      - name: Decode release keystore
-        id: keystore
+      # Checks the password and alias before the long build, and refuses a
+      # debug key that was uploaded as the release key by mistake.
+      - name: Decode and check the release key
+        id: key
         env:
           KEYSTORE_BASE64: ${{ secrets.ANDROID_KEYSTORE_BASE64 }}
+          KEYSTORE_PASSWORD: ${{ secrets.ANDROID_KEYSTORE_PASSWORD }}
+          KEY_ALIAS: ${{ secrets.ANDROID_KEY_ALIAS }}
         run: |
-          if [ -n "$KEYSTORE_BASE64" ]; then
-            echo "$KEYSTORE_BASE64" | base64 -d > "$RUNNER_TEMP/release.keystore"
-            echo "path=$RUNNER_TEMP/release.keystore" >> "$GITHUB_OUTPUT"
-            echo "present=true" >> "$GITHUB_OUTPUT"
-          else
-            echo "present=false" >> "$GITHUB_OUTPUT"
+          set -euo pipefail
+          KEYSTORE="$RUNNER_TEMP/release.keystore"
+          CERT="$RUNNER_TEMP/release-cert.der"
+          echo "$KEYSTORE_BASE64" | base64 -d > "$KEYSTORE"
+          if ! keytool -exportcert -keystore "$KEYSTORE" -alias "$KEY_ALIAS" \
+              -storepass:env KEYSTORE_PASSWORD -file "$CERT"; then
+            echo "::error title=Release key unreadable::Could not read alias ANDROID_KEY_ALIAS from ANDROID_KEYSTORE_BASE64 with ANDROID_KEYSTORE_PASSWORD."
+            exit 1
           fi
+          CERT_SHA256=$(sha256sum "$CERT" | cut -d' ' -f1)
+          OWNER=$(keytool -printcert -file "$CERT")
+          if [ "$CERT_SHA256" = "$DEBUG_CERT_SHA256" ] || [[ "$OWNER" == *"CN=Android Debug"* ]]; then
+            echo "::error title=Release key is a debug key::ANDROID_KEYSTORE_BASE64 holds an Android debug key. Generate a release key as described in docs/android-release.md."
+            exit 1
+          fi
+          echo "Release certificate SHA-256: $CERT_SHA256"
+          echo "store_file=$KEYSTORE" >> "$GITHUB_OUTPUT"
+          echo "cert_sha256=$CERT_SHA256" >> "$GITHUB_OUTPUT"
 
       - name: Build release APK
         working-directory: android
         env:
-          ORG_GRADLE_PROJECT_BULWARK_RELEASE_STORE_FILE: ${{ steps.keystore.outputs.path }}
+          ORG_GRADLE_PROJECT_BULWARK_RELEASE_STORE_FILE: ${{ steps.key.outputs.store_file }}
           ORG_GRADLE_PROJECT_BULWARK_RELEASE_STORE_PASSWORD: ${{ secrets.ANDROID_KEYSTORE_PASSWORD }}
           ORG_GRADLE_PROJECT_BULWARK_RELEASE_KEY_ALIAS: ${{ secrets.ANDROID_KEY_ALIAS }}
           ORG_GRADLE_PROJECT_BULWARK_RELEASE_KEY_PASSWORD: ${{ secrets.ANDROID_KEY_PASSWORD }}
@@ -90,15 +137,138 @@ jobs:
           chmod +x ./gradlew
           ./gradlew assembleRelease --no-daemon
 
-      - name: Rename APK with version
+      - name: Put apksigner on the PATH
+        run: |
+          BUILD_TOOLS=$(ls -d "$ANDROID_HOME"/build-tools/*/ | sort -V | tail -n 1)
+          echo "Using $BUILD_TOOLS"
+          echo "$BUILD_TOOLS" >> "$GITHUB_PATH"
+
+      # Optional v3 key rotation away from the debug key that signed every
+      # release up to 0.1.62. Gradle signed the APK with the release key only,
+      # which existing installs reject as a different app. With a lineage the
+      # APK is re-signed so that Android 9+ sees the release key plus proof
+      # that the debug key handed over to it, while Android 7-8.1 (v2 only)
+      # still see the debug key. docs/android-release.md has the details.
+      - name: Apply the signing key rotation
+        id: rotation
+        env:
+          LINEAGE_BASE64: ${{ secrets.ANDROID_SIGNING_LINEAGE_BASE64 }}
+          KEYSTORE: ${{ steps.key.outputs.store_file }}
+          KEYSTORE_PASSWORD: ${{ secrets.ANDROID_KEYSTORE_PASSWORD }}
+          KEY_ALIAS: ${{ secrets.ANDROID_KEY_ALIAS }}
+          KEY_PASSWORD: ${{ secrets.ANDROID_KEY_PASSWORD }}
+          RELEASE_CERT_SHA256: ${{ steps.key.outputs.cert_sha256 }}
+        run: |
+          set -euo pipefail
+          if [ -z "$LINEAGE_BASE64" ]; then
+            echo "No ANDROID_SIGNING_LINEAGE_BASE64: keeping the release-key-only signature."
+            echo "rotated=false" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+          LINEAGE="$RUNNER_TEMP/signing.lineage"
+          echo "$LINEAGE_BASE64" | base64 -d > "$LINEAGE"
+          apksigner lineage --in "$LINEAGE" --print-certs | tee "$RUNNER_TEMP/lineage.txt"
+
+          DIGESTS=$(sed -n 's/^Signer #[0-9]* in lineage certificate SHA-256 digest: //p' "$RUNNER_TEMP/lineage.txt")
+          if [ "$(sed -n '1p' <<< "$DIGESTS")" != "$DEBUG_CERT_SHA256" ] \
+              || [ "$(sed -n '$p' <<< "$DIGESTS")" != "$RELEASE_CERT_SHA256" ]; then
+            echo "::error title=Wrong signing lineage::ANDROID_SIGNING_LINEAGE_BASE64 must lead from the debug key to the key in ANDROID_KEYSTORE_BASE64."
+            exit 1
+          fi
+          # Rollback on an old signer lets anything signed with it take the app
+          # back after the rotation, which would undo the whole point.
+          PAST_ROLLBACK=$(grep 'Has rollback capability' "$RUNNER_TEMP/lineage.txt" | sed -e 's/.*: *//' -e '$d')
+          if [[ "$PAST_ROLLBACK" == *true* ]]; then
+            echo "::error title=Unsafe signing lineage::An old signer in the lineage has the rollback capability. Recreate it with --set-rollback false."
+            exit 1
+          fi
+
+          # Oldest signer first: apksigner uses it for v2, and the rotated key
+          # for v3 from API 28. Without --rotation-min-sdk-version it would
+          # only rotate on Android 13+ (v3.1) and leave 9-12L on the debug key.
+          APK=android/app/build/outputs/apk/release/app-release.apk
+          apksigner sign \
+            --v4-signing-enabled false \
+            --ks android/app/debug.keystore --ks-key-alias androiddebugkey \
+            --ks-pass pass:android --key-pass pass:android \
+            --next-signer \
+            --ks "$KEYSTORE" --ks-key-alias "$KEY_ALIAS" \
+            --ks-pass env:KEYSTORE_PASSWORD --key-pass env:KEY_PASSWORD \
+            --lineage "$LINEAGE" \
+            --rotation-min-sdk-version 28 \
+            --out "$RUNNER_TEMP/app-release-rotated.apk" \
+            "$APK"
+          mv "$RUNNER_TEMP/app-release-rotated.apk" "$APK"
+          echo "rotated=true" >> "$GITHUB_OUTPUT"
+
+      # The last gate before anything is uploaded.
+      - name: Verify the APK signature
+        env:
+          RELEASE_CERT_SHA256: ${{ steps.key.outputs.cert_sha256 }}
+          ROTATED: ${{ steps.rotation.outputs.rotated }}
+        run: |
+          set -euo pipefail
+          APK=android/app/build/outputs/apk/release/app-release.apk
+          apksigner verify --verbose --print-certs "$APK"
+          # build-tools 36 prints "Signer #1 certificate SHA-256 digest: …",
+          # 37 prints "V3.0 Signer: certificate …" and "V2 Signer: …".
+          signers() {
+            apksigner verify --print-certs "$@" "$APK" \
+              | sed -n -E 's/^(Signer #[0-9]+|V[0-9.]+ Signer:) certificate SHA-256 digest: //p' \
+              | sort -u
+          }
+          MODERN=$(signers --min-sdk-version 28)
+          LEGACY=$(signers --max-sdk-version 27)
+          echo "Signer on Android 9+:    $MODERN"
+          echo "Signer on Android 7-8.1: $LEGACY"
+
+          if [[ "$MODERN" == *"$DEBUG_CERT_SHA256"* ]]; then
+            echo "::error title=APK is debug-signed::Android 9+ would see the public debug key as the signer."
+            exit 1
+          fi
+          if [ "$MODERN" != "$RELEASE_CERT_SHA256" ]; then
+            echo "::error title=Wrong APK signer::Android 9+ would see '$MODERN', expected only the release key $RELEASE_CERT_SHA256."
+            exit 1
+          fi
+          if [ "$ROTATED" = "true" ]; then
+            echo "::warning title=Android 7-8.1 still trust the debug key::The v2 signature is made with the debug key so that installs on Android 7-8.1 can update. Those devices remain exposed; see docs/android-release.md."
+          elif [ "$LEGACY" != "$RELEASE_CERT_SHA256" ]; then
+            echo "::error title=Wrong APK signer::Android 7-8.1 would see '$LEGACY', expected only the release key $RELEASE_CERT_SHA256."
+            exit 1
+          fi
+          aapt2 dump badging "$APK" | grep '^package:' || true
+
+      # The R8 mapping goes out with the APK: without the one from this exact
+      # build, the obfuscated frames in a release stack trace cannot be
+      # decoded (docs/android-release.md, "Stack traces").
+      - name: Rename APK and R8 mapping with version
         id: artifact
         run: |
+          set -euo pipefail
           VERSION=$(cat VERSION | tr -d '[:space:]')
           SRC=android/app/build/outputs/apk/release/app-release.apk
           DEST="bulwark-mobile-${VERSION}-${GITHUB_SHA::7}.apk"
           cp "$SRC" "$DEST"
+
+          MAPPING_SRC=android/app/build/outputs/mapping/release/mapping.txt
+          MAPPING=""
+          if [ -f "$MAPPING_SRC" ]; then
+            MAPPING="bulwark-mobile-${VERSION}-${GITHUB_SHA::7}-mapping.txt"
+            cp "$MAPPING_SRC" "$MAPPING"
+          elif grep -Eq '^android\.enableMinifyInReleaseBuilds=true\s*$' android/gradle.properties; then
+            echo "::error title=R8 mapping missing::R8 is on but the build wrote no $MAPPING_SRC, so stack traces from this APK could not be decoded."
+            exit 1
+          fi
+
           echo "path=$DEST" >> "$GITHUB_OUTPUT"
+          echo "mapping=$MAPPING" >> "$GITHUB_OUTPUT"
           echo "version=$VERSION" >> "$GITHUB_OUTPUT"
+          {
+            echo "files<<FILES_EOF"
+            echo "$DEST"
+            if [ -n "$MAPPING" ]; then echo "$MAPPING"; fi
+            echo "FILES_EOF"
+          } >> "$GITHUB_OUTPUT"
 
       - uses: actions/upload-artifact@v4
         with:
@@ -106,6 +276,13 @@ jobs:
           path: ${{ steps.artifact.outputs.path }}
           if-no-files-found: error
 
+      - uses: actions/upload-artifact@v4
+        if: steps.artifact.outputs.mapping != ''
+        with:
+          name: ${{ steps.artifact.outputs.mapping }}
+          path: ${{ steps.artifact.outputs.mapping }}
+          if-no-files-found: error
+
       - name: Resolve target release tag
         id: target_tag
         env:
@@ -125,9 +302,9 @@ jobs:
             echo "No release tag resolved - APK is in workflow artifacts only."
           fi
 
-      - name: Attach APK to release
+      - name: Attach APK and R8 mapping to release
         if: steps.target_tag.outputs.tag != ''
         uses: softprops/action-gh-release@v2
         with:
           tag_name: ${{ steps.target_tag.outputs.tag }}
-          files: ${{ steps.artifact.outputs.path }}
+          files: ${{ steps.artifact.outputs.files }}

.gitignore

@@ -17,6 +17,9 @@ expo-env.d.ts
 *.p12
 *.key
 *.mobileprovision
+*.keystore
+!/android/app/debug.keystore
+*.lineage
 
 # Metro / Expo dev-server logs
 .metro-health-check*

App.tsx

@@ -2,7 +2,9 @@ import React from 'react';
 import { ActivityIndicator, AppState, Linking, StyleSheet, Text, View } from 'react-native';
 import { StatusBar } from 'expo-status-bar';
 import { useColorScheme } from 'react-native';
-import { NavigationContainer, createNavigationContainerRef } from '@react-navigation/native';
+import {
+  DarkTheme, DefaultTheme, NavigationContainer, createNavigationContainerRef, useIsFocused,
+} from '@react-navigation/native';
 import { createBottomTabNavigator } from '@react-navigation/bottom-tabs';
 import { createNativeStackNavigator, type NativeStackScreenProps } from '@react-navigation/native-stack';
 import { Mail, Calendar, BookUser, HardDrive, Settings } from 'lucide-react-native';
@@ -11,6 +13,15 @@ import { startLiveUpdates, type LiveUpdatesHandle } from './src/api/push-stream'
 import { jmapClient } from './src/api/jmap-client';
 import type { StateChange } from './src/api/types';
 import { dispatchStateChange } from './src/lib/state-change-bus';
+import {
+  startCalendarNotificationSync,
+  startCalendarReminderTapHandling,
+} from './src/lib/calendar-notifications';
+import { startLivenessMonitor } from './src/lib/connection-liveness';
+import {
+  setPendingCalendarOpen,
+  type CalendarReminderTarget,
+} from './src/navigation/pending-calendar-open';
 import { sweepStaleExportFiles } from './src/lib/email-export';
 import { useFilterStore } from './src/stores/filter-store';
 import { useVacationStore } from './src/stores/vacation-store';
@@ -20,10 +31,12 @@ import {
   addTokenRefreshListener,
   getInitialNotificationTap,
   getStoredRelayBaseUrl,
-  setupPushNotifications,
+  notificationTapJmapAccountId,
+  resyncPushNotifications,
   teardownPushNotificationsForAccount,
   type NotificationTapPayload,
 } from './src/lib/push-notifications';
+import { addUnifiedPushEndpointListener } from './src/lib/unified-push';
 import type { MainTabsParamList, RootStackParamList } from './src/navigation/types';
 import ComposeScreen from './src/screens/ComposeScreen';
 import EmailThreadScreen from './src/screens/EmailThreadScreen';
@@ -43,16 +56,23 @@ import { useAccountStore } from './src/stores/account-store';
 import { useAuthStore } from './src/stores/auth-store';
 import { useCalendarStore } from './src/stores/calendar-store';
 import { useContactsStore } from './src/stores/contacts-store';
-import { useEmailStore } from './src/stores/email-store';
+import { useEmailStore, viewerParamsForRow } from './src/stores/email-store';
+import { mailboxAccountId } from './src/lib/mailbox-tree';
+import { loadDetail, prefetchMessage } from './src/lib/email-detail-cache';
 import { useHasCalendar, useHasContacts, useHasFiles } from './src/lib/capabilities';
 import { useSettingsStore } from './src/stores/settings-store';
 import { useLocaleStore } from './src/stores/locale-store';
+import { toast } from './src/stores/toast-store';
 import { useNetworkStore } from './src/stores/network-store';
 import { useUpdatesStore } from './src/stores/updates-store';
 import { UpdateBanner } from './src/components/UpdateBanner';
 import { PushOnboardingPrompt } from './src/components/PushOnboardingPrompt';
 import { ToastHost } from './src/components/ToastHost';
+import { UndoSnackbar } from './src/components/UndoSnackbar';
+import { AppIconBadge } from './src/components/AppIconBadge';
 import { getEmails } from './src/api/email';
+import { signOutWidgets, startWidgetSync } from './src/widgets/sync';
+import { draftContextFromEmail } from './src/lib/draft-context';
 import { handleDeepLink, parseDeepLink, shareToDeepLink, type DeepLink } from './src/navigation/linking';
 import { addShareListener, getInitialShare, shareAttachments } from './src/lib/share-intent';
 import { OfflineCacheBanner } from './src/components/OfflineCacheBanner';
@@ -81,26 +101,60 @@ async function navigateToNotificationTap(payload: NotificationTapPayload): Promi
     if (useAuthStore.getState().activeAccountId !== payload.accountId) return;
   }
 
+  prefetchMessage({ id: payload.emailId, threadId: payload.threadId });
   navigationRef.navigate('EmailThread', {
     emailId: payload.emailId,
     threadId: payload.threadId,
     subject: payload.subject,
+    // A group mailbox's message lives under another JMAP account (#839).
+    jmapAccountId: notificationTapJmapAccountId(payload),
   });
 }
 
+// A tapped calendar reminder opens its event (or task) in the Calendar tab,
+// under the account it was scheduled for. The target is parked for
+// CalendarScreen, which also picks it up when it mounts after a cold start.
+async function openCalendarReminder(target: CalendarReminderTarget): Promise<void> {
+  const auth = useAuthStore.getState();
+  if (target.appAccountId && target.appAccountId !== auth.activeAccountId) {
+    if (!useAccountStore.getState().getAccountById(target.appAccountId)) return;
+    await auth.switchAccount(target.appAccountId);
+    if (useAuthStore.getState().activeAccountId !== target.appAccountId) return;
+  }
+  setPendingCalendarOpen(target);
+  // On a cold start the navigator mounts right after the auth gate flips.
+  for (let attempt = 0; attempt < 50 && !navigationRef.isReady(); attempt++) {
+    await new Promise((resolve) => setTimeout(resolve, 100));
+  }
+  if (navigationRef.isReady()) {
+    navigationRef.navigate('MainTabs', { screen: 'Calendar' } as never);
+  }
+}
+
 // Deep links (bulwarkmobile://, webmail https permalinks, mailto:) and
 // Android share-sheet payloads all end up here once the navigator is ready.
 async function openDeepLink(link: DeepLink): Promise<void> {
-  await handleDeepLink(link, {
+  const opened = await handleDeepLink(link, {
     navigation: navigationRef,
-    resolveThreadId: async (emailId) => {
+    resolveThreadId: async (emailId, jmapAccountId) => {
       try {
-        const [email] = await getEmails([emailId]);
+        const [email] = await getEmails([emailId], jmapAccountId);
         return email?.threadId ?? null;
       } catch {
         return null;
       }
     },
+    openDraft: async (emailId, jmapAccountId) => {
+      try {
+        // Cache first, so a draft read before still opens offline.
+        const draft = draftContextFromEmail(await loadDetail(emailId, jmapAccountId), jmapAccountId);
+        if (!navigationRef.isReady()) return false;
+        navigationRef.navigate('Compose', { draft });
+        return true;
+      } catch {
+        return false;
+      }
+    },
     switchAccount: async (accountId) => {
       const auth = useAuthStore.getState();
       if (auth.activeAccountId === accountId) return true;
@@ -109,6 +163,36 @@ async function openDeepLink(link: DeepLink): Promise<void> {
       return useAuthStore.getState().activeAccountId === accountId;
     },
   });
+  // A widget or a link elsewhere brought the app up for this; say it failed
+  // rather than leave the user wondering why the app just opened.
+  if (!opened) toast.error(useLocaleStore.getState().t('deep_link.open_failed', "Couldn't open this"));
+}
+
+// Toasts and the undo bar show on whichever stack screen is up, so a failure
+// that lands after leaving the screen it came from (a viewer action finishing
+// on the Unified Inbox or a contact) is still seen, and a reply held by the
+// undo-send delay can be undone from the viewer it was sent from. Every
+// screen carries the hosts, and only the focused one renders them, so
+// neither ever shows twice (the screen below the top one is kept live).
+// The composer gets no undo bar: its Undo would hand the open composer
+// another draft. A held send's bar shows on the screen below once it closes.
+function FocusedHosts({ undo }: { undo: boolean }) {
+  if (!useIsFocused()) return null;
+  return (
+    <>
+      {undo && <UndoSnackbar />}
+      <ToastHost />
+    </>
+  );
+}
+
+function withHosts({ route, children }: { route: { name: string }; children: React.ReactElement }) {
+  return (
+    <>
+      {children}
+      <FocusedHosts undo={route.name !== 'Compose'} />
+    </>
+  );
 }
 
 function LoadingScreen({ message }: { message: string }) {
@@ -123,23 +207,38 @@ function LoadingScreen({ message }: { message: string }) {
 
 function MainTabsNavigator({ navigation }: NativeStackScreenProps<RootStackParamList, 'MainTabs'>) {
   const c = useColors();
-  const mailboxes = useEmailStore((state) => state.mailboxes);
+  // Select the count, not the list: every mailbox fetch sets a new array, and
+  // re-rendering here re-renders the mail list with it.
+  const inboxUnreadCount = useEmailStore(
+    (state) => state.mailboxes.find((mailbox) => mailbox.role === 'inbox')?.unreadEmails ?? 0,
+  );
   const logout = useAuthStore((state) => state.logout);
-  const inboxUnreadCount = mailboxes.find((mailbox) => mailbox.role === 'inbox')?.unreadEmails ?? 0;
   const hasCalendar = useHasCalendar();
   const hasContacts = useHasContacts();
   const hasFiles = useHasFiles();
   const disabledTabStyle = { opacity: 0.4 } as const;
+  const t = useLocaleStore((state) => state.t);
+  // The webmail's navigation names; a tab the server lacks says so.
+  const tabLabels = {
+    mail: t('sidebar.mail', 'Mail'),
+    calendar: t('sidebar.calendar', 'Calendar'),
+    contacts: t('sidebar.contacts', 'Contacts'),
+    files: t('sidebar.files', 'Files'),
+    settings: t('sidebar.settings', 'Settings'),
+  };
+  const unavailable = (name: string) => t('sidebar.tab_unavailable', '{name} (unavailable)', { name });
 
   return (
     <View style={{ flex: 1, backgroundColor: c.background }}>
       <UpdateBanner />
       <OfflineCacheBanner />
       <PushOnboardingPrompt />
-      <ToastHost />
+      <AppIconBadge />
     <Tab.Navigator
       screenOptions={{
         headerShown: false,
+        // Tabs out of view stop re-rendering until they are shown again.
+        freezeOnBlur: true,
         tabBarActiveTintColor: c.text,
         tabBarInactiveTintColor: c.textSecondary,
         tabBarStyle: {
@@ -159,6 +258,7 @@ function MainTabsNavigator({ navigation }: NativeStackScreenProps<RootStackParam
       <Tab.Screen
         name="Mail"
         options={{
+          title: tabLabels.mail,
           tabBarIcon: ({ color, size }) => <Mail size={size} color={color} />,
           tabBarBadge: inboxUnreadCount > 0 ? (inboxUnreadCount > 99 ? '99+' : inboxUnreadCount) : undefined,
           tabBarBadgeStyle: {
@@ -179,10 +279,22 @@ function MainTabsNavigator({ navigation }: NativeStackScreenProps<RootStackParam
           <EmailListScreen
             onComposePress={() => navigation.navigate('Compose')}
             onEmailPress={(email) => {
+              // The list holds the open folder's mail: name its account so the
+              // viewer never has to guess it from whatever folder is open.
+              const { mailboxes: all, currentMailboxId } = useEmailStore.getState();
+              const target = {
+                jmapAccountId: mailboxAccountId(all, currentMailboxId),
+                // A row of an "All folders" list or a tag view names its own
+                // account instead, and pages over that account's rows.
+                ...viewerParamsForRow(email),
+              };
+              // Start on the body now: mounting the viewer takes a while.
+              prefetchMessage(email, target.jmapAccountId);
               navigation.navigate('EmailThread', {
                 emailId: email.id,
                 threadId: email.threadId,
                 subject: email.subject,
+                ...target,
               });
             }}
           />
@@ -192,9 +304,10 @@ function MainTabsNavigator({ navigation }: NativeStackScreenProps<RootStackParam
         name="Calendar"
         component={CalendarScreen}
         options={{
+          title: tabLabels.calendar,
           tabBarIcon: ({ color, size }) => <Calendar size={size} color={color} />,
           tabBarItemStyle: hasCalendar ? undefined : disabledTabStyle,
-          tabBarAccessibilityLabel: hasCalendar ? 'Calendar' : 'Calendar (unavailable)',
+          tabBarAccessibilityLabel: hasCalendar ? tabLabels.calendar : unavailable(tabLabels.calendar),
         }}
         listeners={{
           tabPress: (e) => {
@@ -206,9 +319,10 @@ function MainTabsNavigator({ navigation }: NativeStackScreenProps<RootStackParam
         name="Contacts"
         component={ContactsScreen}
         options={{
+          title: tabLabels.contacts,
           tabBarIcon: ({ color, size }) => <BookUser size={size} color={color} />,
           tabBarItemStyle: hasContacts ? undefined : disabledTabStyle,
-          tabBarAccessibilityLabel: hasContacts ? 'Contacts' : 'Contacts (unavailable)',
+          tabBarAccessibilityLabel: hasContacts ? tabLabels.contacts : unavailable(tabLabels.contacts),
         }}
         listeners={{
           tabPress: (e) => {
@@ -220,9 +334,10 @@ function MainTabsNavigator({ navigation }: NativeStackScreenProps<RootStackParam
         name="Files"
         component={FilesScreen}
         options={{
+          title: tabLabels.files,
           tabBarIcon: ({ color, size }) => <HardDrive size={size} color={color} />,
           tabBarItemStyle: hasFiles ? undefined : disabledTabStyle,
-          tabBarAccessibilityLabel: hasFiles ? 'Files' : 'Files (unavailable)',
+          tabBarAccessibilityLabel: hasFiles ? tabLabels.files : unavailable(tabLabels.files),
         }}
         listeners={{
           tabPress: (e) => {
@@ -233,6 +348,7 @@ function MainTabsNavigator({ navigation }: NativeStackScreenProps<RootStackParam
       <Tab.Screen
         name="Settings"
         options={{
+          title: tabLabels.settings,
           tabBarIcon: ({ color, size }) => <Settings size={size} color={color} />,
         }}
       >
@@ -248,6 +364,7 @@ export default function App() {
   const isAuthenticated = useAuthStore((state) => state.isAuthenticated);
   const client = useAuthStore((state) => state.client);
   const restoreSession = useAuthStore((state) => state.restoreSession);
+  const t = useLocaleStore((state) => state.t);
 
   // Resolve the user's theme preference to a concrete light/dark style for the
   // system status bar. The rest of the app's colors are still hard-coded dark
@@ -257,6 +374,13 @@ export default function App() {
   const resolvedScheme: 'light' | 'dark' =
     themePref === 'system' ? (systemScheme === 'light' ? 'light' : 'dark') : themePref;
   const statusBarStyle: 'light' | 'dark' = resolvedScheme === 'light' ? 'dark' : 'light';
+  // React Navigation's default theme is light: without this its containers
+  // paint white behind and between screens, even in dark mode.
+  const background = useColors().background;
+  const navigationTheme = React.useMemo(() => {
+    const base = resolvedScheme === 'light' ? DefaultTheme : DarkTheme;
+    return { ...base, colors: { ...base.colors, background, card: background } };
+  }, [resolvedScheme, background]);
   // Persisted active account is the signal that the user was already signed
   // in on the previous launch. When present we render the main UI with the
   // cached mail list instead of the "Restoring session" spinner; the real
@@ -272,9 +396,20 @@ export default function App() {
   React.useEffect(() => {
     void useSettingsStore.getState().hydrate();
     void useLocaleStore.getState().hydrate();
+    // Calendar reminders are kept scheduled from launch, not only once the
+    // Calendar tab has been opened.
+    startCalendarNotificationSync();
     return useNetworkStore.getState().init();
   }, []);
 
+  // Home-screen widgets follow the signed-in data; once the last account is
+  // gone they are wiped so no mail stays visible on the launcher.
+  React.useEffect(() => {
+    if (isAuthenticated) return startWidgetSync();
+    if (hasRestoredSession) void signOutWidgets();
+    return undefined;
+  }, [isAuthenticated, hasRestoredSession]);
+
   // When the network flips back on while we're authenticated-but-offline
   // (no live JMAP session), retry the session so the user lands back on
   // live data without needing to relaunch.
@@ -376,6 +511,15 @@ export default function App() {
     };
   }, [isAuthenticated]);
 
+  // Calendar reminders are local expo notifications; their taps come through
+  // expo-notifications, not the native tap store used for mail push above.
+  React.useEffect(() => {
+    if (!isAuthenticated) return;
+    return startCalendarReminderTapHandling((target) => {
+      void openCalendarReminder(target);
+    });
+  }, [isAuthenticated]);
+
   // Deep links and share-sheet payloads. The cold-start URL / share is read
   // once auth is restored so the target screen has credentials.
   React.useEffect(() => {
@@ -426,7 +570,8 @@ export default function App() {
   // and whenever the FCM token rotates. Honours the user's notification
   // preference - flipping it off tears down THIS account's subscription so
   // notifications stop arriving for it. Other logged-in accounts keep their
-  // setups intact.
+  // setups intact. An account the user turned push off for, or whose device
+  // registration was revoked, stays off (see resyncPushNotifications).
   const emailNotificationsEnabled = useSettingsStore(
     (s) => s.emailNotificationsEnabled,
   );
@@ -447,7 +592,7 @@ export default function App() {
       const relayBaseUrl = await getStoredRelayBaseUrl();
       if (!relayBaseUrl) return;
       try {
-        await setupPushNotifications({
+        await resyncPushNotifications({
           relayBaseUrl,
           accountLabel: client.username ?? undefined,
         });
@@ -464,10 +609,16 @@ export default function App() {
     const unsubscribe = addTokenRefreshListener(() => {
       void doSetup();
     });
+    // UnifiedPush equivalent of an FCM token rotation: the distributor handed
+    // out a new endpoint, so re-register it with the relay.
+    const unsubscribeUp = addUnifiedPushEndpointListener(() => {
+      void doSetup();
+    });
 
     return () => {
       cancelled = true;
       unsubscribe();
+      unsubscribeUp();
     };
   }, [client, isAuthenticated, emailNotificationsEnabled, activeAccountId]);
 
@@ -528,6 +679,23 @@ export default function App() {
       void useOutboxStore.getState().flush();
     };
 
+    // Foreground liveness for the per-account connection dot: the open
+    // stream's pings, or a `Core/echo` every 30 s while there is none (see
+    // startLivenessMonitor). NetInfo cannot tell an unreachable server.
+    const liveness = startLivenessMonitor({
+      ping: () => jmapClient.ping(),
+      streamHealthy: () => handle?.healthy ?? false,
+      isActive: () => appActive,
+      isOnline: () => useNetworkStore.getState().online,
+      onConnected: (connected) => {
+        if (!mounted || !activeAccountId) return;
+        const account = useAccountStore.getState().getAccountById(activeAccountId);
+        if (account && account.isConnected !== connected) {
+          useAccountStore.getState().updateAccount(activeAccountId, { isConnected: connected });
+        }
+      },
+    });
+
     void start();
 
     const subscription = AppState.addEventListener('change', (state) => {
@@ -539,19 +707,12 @@ export default function App() {
         handle = null;
         return;
       }
-      // Coming back: verify the session is still alive before trusting the
-      // stream, then reconnect and catch up on what was missed.
-      void (async () => {
-        const alive = await jmapClient.ping().catch(() => false);
-        if (!mounted) return;
-        if (!alive && useNetworkStore.getState().online) {
-          const ok = await useAuthStore.getState().retrySession().catch(() => false);
-          if (!ok || !mounted) return;
-        }
-        if (!handle) await start();
-        else handle.reconnect();
-        refreshAfterResume();
-      })();
+      // Coming back: reconnect and catch up on what was missed at once;
+      // one echo alongside checks the server for the connection dot.
+      if (!handle) void start();
+      else handle.reconnect();
+      refreshAfterResume();
+      void liveness.check();
     });
 
     // Reconnect when the network comes back while foregrounded.
@@ -566,39 +727,12 @@ export default function App() {
       mounted = false;
       subscription.remove();
       unsubscribeNetwork();
+      liveness.stop();
       handle?.close();
       handle = null;
     };
   }, [client, isAuthenticated, haveLiveSession, activeAccountId]);
 
-  // Foreground keep-alive: a `Core/echo` every 30 s tells us when the server
-  // is unreachable even though the device is online (NetInfo cannot), and
-  // drives the per-account connection dot.
-  React.useEffect(() => {
-    if (!isAuthenticated || !haveLiveSession || !activeAccountId) return;
-    let cancelled = false;
-    let failures = 0;
-    const timer = setInterval(() => {
-      if (AppState.currentState !== 'active') return;
-      if (!useNetworkStore.getState().online) return;
-      void jmapClient.ping().then((ok) => {
-        if (cancelled) return;
-        failures = ok ? 0 : failures + 1;
-        const account = useAccountStore.getState().getAccountById(activeAccountId);
-        if (!account) return;
-        // One missed echo can be a blip; two in a row is a lost connection.
-        const connected = failures < 2;
-        if (account.isConnected !== connected) {
-          useAccountStore.getState().updateAccount(activeAccountId, { isConnected: connected });
-        }
-      }).catch(() => undefined);
-    }, 30_000);
-    return () => {
-      cancelled = true;
-      clearInterval(timer);
-    };
-  }, [isAuthenticated, haveLiveSession, activeAccountId]);
-
   // Skip the "Restoring session" flash for returning users: if we already
   // have a persisted active account, render the main UI immediately with
   // whatever the email-store hydrated from cache. restoreSession still runs
@@ -607,7 +741,7 @@ export default function App() {
     return (
       <>
         <StatusBar style={statusBarStyle} />
-        <LoadingScreen message="Loading..." />
+        <LoadingScreen message={t('common.loading', 'Loading...')} />
       </>
     );
   }
@@ -622,9 +756,11 @@ export default function App() {
   }
 
   return (
-    <NavigationContainer ref={navigationRef}>
+    <NavigationContainer ref={navigationRef} theme={navigationTheme}>
       <StatusBar style={statusBarStyle} />
-      <Stack.Navigator screenOptions={{ headerShown: false }}>
+      {/* On Fabric, native-stack keeps the screen right below the top live and
+          freezes the ones further down. */}
+      <Stack.Navigator screenOptions={{ headerShown: false, freezeOnBlur: true }} screenLayout={withHosts}>
         <Stack.Screen name="MainTabs" component={MainTabsNavigator} />
         <Stack.Screen name="EmailThread" component={EmailThreadScreen} />
         <Stack.Screen name="EmailSource" component={EmailSourceScreen} />

PARITY_CHECKLIST.md

@@ -75,23 +75,34 @@ commit hash. The remaining `- [ ]` items are either deferred with a note
 for TOTP accounts, relay APNs/UnifiedPush transports, a server-side settings
 store for native #1).
 
+## Status after the 2026-09-24 fix pass
+
+The native audit of 2026-09-22 ([docs/audit-2026-09.md](docs/audit-2026-09.md))
+spot-checked this list and found 14 ticks that were broken or overstated and 11
+open items that were already done. The 2026-09-24 fix pass fixed 13 of the 14
+(their ticks now also name the fixing commit; the date-locale item is open
+again), dropped three obsolete items and ticked what it completed: 380 of 415
+items are done, 35 open. What still needs a device check or a decision is in
+the audit's "Fix pass, 2026-09-24" section.
+
 ## Areas
 
-| # | Area | File | Items | P1 | P2 | P3 |
-|---|---|---|---|---|---|---|
-| 01 | Authentication, login, session, multi-account | [docs/parity/01-auth-accounts.md](docs/parity/01-auth-accounts.md) | 30 | 4 | 8 | 18 |
-| 02 | Mail list, folders, unified views, search, tags | [docs/parity/02-mail-list-folders.md](docs/parity/02-mail-list-folders.md) | 54 | 1 | 20 | 33 |
-| 03 | Email viewer, thread view, rendering, attachments | [docs/parity/03-email-viewer.md](docs/parity/03-email-viewer.md) | 46 | 6 | 13 | 26 |
-| 04 | Composer, drafts, sending, identities, templates, scheduled send | [docs/parity/04-composer-send.md](docs/parity/04-composer-send.md) | 51 | 5 | 14 | 32 |
-| 05 | Calendar and tasks | [docs/parity/05-calendar.md](docs/parity/05-calendar.md) | 51 | 5 | 20 | 26 |
-| 06 | Contacts and address books | [docs/parity/06-contacts.md](docs/parity/06-contacts.md) | 51 | 1 | 18 | 31 |
-| 07 | Filters (Sieve), vacation responder, Files | [docs/parity/07-filters-vacation-files.md](docs/parity/07-filters-vacation-files.md) | 33 | 3 | 8 | 22 |
-| 08 | Settings, sync, push, i18n, themes, updates, misc UI | [docs/parity/08-settings-push-i18n-ui.md](docs/parity/08-settings-push-i18n-ui.md) | 46 | 0 | 14 | 32 |
-| 09 | JMAP client core, live sync, offline, security, S/MIME | [docs/parity/09-jmap-core-sync-security.md](docs/parity/09-jmap-core-sync-security.md) | 56 | 7 | 23 | 26 |
-| | **Total** | | **418** | **32** | **138** | **246** |
+| # | Area | File | Items | Done | Open | P1 | P2 | P3 |
+|---|---|---|---|---|---|---|---|---|
+| 01 | Authentication, login, session, multi-account | [docs/parity/01-auth-accounts.md](docs/parity/01-auth-accounts.md) | 30 | 29 | 1 | 4 | 8 | 18 |
+| 02 | Mail list, folders, unified views, search, tags | [docs/parity/02-mail-list-folders.md](docs/parity/02-mail-list-folders.md) | 54 | 50 | 4 | 1 | 20 | 33 |
+| 03 | Email viewer, thread view, rendering, attachments | [docs/parity/03-email-viewer.md](docs/parity/03-email-viewer.md) | 46 | 45 | 1 | 6 | 13 | 26 |
+| 04 | Composer, drafts, sending, identities, templates, scheduled send | [docs/parity/04-composer-send.md](docs/parity/04-composer-send.md) | 51 | 46 | 5 | 5 | 14 | 32 |
+| 05 | Calendar and tasks | [docs/parity/05-calendar.md](docs/parity/05-calendar.md) | 50 | 43 | 7 | 5 | 20 | 25 |
+| 06 | Contacts and address books | [docs/parity/06-contacts.md](docs/parity/06-contacts.md) | 50 | 46 | 4 | 1 | 18 | 31 |
+| 07 | Filters (Sieve), vacation responder, Files | [docs/parity/07-filters-vacation-files.md](docs/parity/07-filters-vacation-files.md) | 32 | 29 | 3 | 3 | 8 | 21 |
+| 08 | Settings, sync, push, i18n, themes, updates, misc UI | [docs/parity/08-settings-push-i18n-ui.md](docs/parity/08-settings-push-i18n-ui.md) | 46 | 38 | 8 | 0 | 14 | 32 |
+| 09 | JMAP client core, live sync, offline, security, S/MIME | [docs/parity/09-jmap-core-sync-security.md](docs/parity/09-jmap-core-sync-security.md) | 56 | 54 | 2 | 7 | 23 | 26 |
+| | **Total** | | **415** | **380** | **35** | **32** | **138** | **244** |
 
-Counts are of `- [ ]` items per file (a handful of "verified" notes carry a
-priority tag too, so P-sums can differ by one or two from the item count).
+Counts are of the `- [ ]` and `- [x]` items per file as of 2026-09-24. Done and
+Open split them by tick; the P columns count the priority tags on those items
+(one item carries none).
 
 ## All P1 findings (fix these first)
 

README.md

@@ -21,7 +21,7 @@ React Native (Expo SDK 54) client for [Bulwark Webmail](https://github.com/bulwa
 - Email list, threads, compose
 - Calendar (basic)
 - Contacts (basic)
-- Push notifications via FCM relay
+- Push notifications via the Bulwark relay - FCM by default, or [UnifiedPush](https://unifiedpush.org) (e.g. ntfy) for devices without Google Play services
 - In-app sideload updates from GitHub Releases
 
 ## What's missing or rough
@@ -40,7 +40,7 @@ npx expo start
 
 Then press `a` for Android, `i` for iOS, or scan the QR with Expo Go.
 
-For a release APK build see [.github/workflows/release-android.yml](.github/workflows/release-android.yml).
+For release APK builds and signing see [docs/android-release.md](docs/android-release.md).
 For iOS builds and TestFlight distribution see [docs/ios-release.md](docs/ios-release.md).
 
 ## License

VERSION

@@ -1 +1 @@
-0.1.62
+0.1.66

android/app/build.gradle

@@ -7,6 +7,62 @@ def projectRoot = rootDir.getAbsoluteFile().getParentFile().getAbsolutePath()
 
 def appVersionName = file("${projectRoot}/VERSION").text.trim()
 
+/**
+ * versionCode has to grow with every release, or Android refuses the update as
+ * a downgrade. It is derived from VERSION as
+ *
+ *     major * 10000000 + minor * 10000 + patch      (0.1.62 -> 10062)
+ *
+ * which keeps increasing as long as patch stays below 10000 and minor below
+ * 1000 (scripts/bump-version.mjs, which only ever bumps patch, enforces both),
+ * and stays under Android's 2100000000 ceiling up to major 209.
+ */
+def versionParts = (appVersionName =~ /^(\d+)\.(\d+)\.(\d+)$/)
+if (!versionParts.matches()) {
+    throw new GradleException("VERSION must be MAJOR.MINOR.PATCH, got '${appVersionName}'")
+}
+def (versionMajor, versionMinor, versionPatch) = (1..3).collect { versionParts.group(it) as long }
+if (versionMinor > 999 || versionPatch > 9999) {
+    throw new GradleException("VERSION ${appVersionName}: minor must stay below 1000 and patch below 10000, " +
+            "or versionCode stops increasing. Move to the next minor or major version instead.")
+}
+def appVersionCode = versionMajor * 10000000L + versionMinor * 10000L + versionPatch
+if (appVersionCode < 1 || appVersionCode > 2100000000L) {
+    throw new GradleException("VERSION ${appVersionName} gives versionCode ${appVersionCode}, " +
+            "outside the 1..2100000000 range Android accepts.")
+}
+
+/**
+ * Release signing. The key never lives in the repo: CI passes it as
+ * ORG_GRADLE_PROJECT_BULWARK_RELEASE_* environment variables, and a local
+ * release build can set the same names with -P, in ~/.gradle/gradle.properties
+ * or as plain environment variables. See docs/android-release.md.
+ *
+ * There is deliberately no automatic fallback to the debug key. It is the
+ * public React Native template key, so an APK signed with it can be replaced
+ * by an "update" anyone can sign.
+ */
+def releaseSigningNames = [
+    'BULWARK_RELEASE_STORE_FILE',
+    'BULWARK_RELEASE_STORE_PASSWORD',
+    'BULWARK_RELEASE_KEY_ALIAS',
+    'BULWARK_RELEASE_KEY_PASSWORD',
+]
+def releaseSigning = releaseSigningNames.collectEntries { name ->
+    [(name): (findProperty(name) ?: System.getenv(name))?.toString()]
+}
+def missingReleaseSigning = releaseSigningNames.findAll { !releaseSigning[it]?.trim() }
+def releaseSigningConfigured = missingReleaseSigning.isEmpty()
+def releaseStoreFile = releaseSigningConfigured ? file(releaseSigning.BULWARK_RELEASE_STORE_FILE.trim()) : null
+
+// Escape hatch for a local release build that never leaves the machine
+// (profiling, checking R8). It is refused whenever CI is set, so a stray flag
+// cannot turn a published build back into a debug-signed one.
+def ciEnv = System.getenv('CI')?.trim()?.toLowerCase()
+def onCi = ciEnv && !(ciEnv in ['false', '0'])
+def allowDebugSignedRelease = (findProperty('allowDebugSignedRelease') ?: 'false').toString().trim().toBoolean()
+def debugSignedRelease = !releaseSigningConfigured && allowDebugSignedRelease && !onCi
+
 /**
  * This is the configuration block to customize your React Native Android app.
  * By default you don't need to apply any configuration, just uncomment the lines you need.
@@ -95,7 +151,7 @@ android {
         applicationId 'com.anonymous.bulwarkmobile'
         minSdkVersion rootProject.ext.minSdkVersion
         targetSdkVersion rootProject.ext.targetSdkVersion
-        versionCode 1
+        versionCode appVersionCode.toInteger()
         versionName appVersionName
 
         buildConfigField "String", "REACT_NATIVE_RELEASE_LEVEL", "\"${findProperty('reactNativeReleaseLevel') ?: 'stable'}\""
@@ -107,13 +163,12 @@ android {
             keyAlias 'androiddebugkey'
             keyPassword 'android'
         }
-        if (project.hasProperty('BULWARK_RELEASE_STORE_FILE')
-                && project.property('BULWARK_RELEASE_STORE_FILE')?.trim()) {
+        if (releaseSigningConfigured) {
             release {
-                storeFile file(project.property('BULWARK_RELEASE_STORE_FILE'))
-                storePassword project.property('BULWARK_RELEASE_STORE_PASSWORD')
-                keyAlias project.property('BULWARK_RELEASE_KEY_ALIAS')
-                keyPassword project.property('BULWARK_RELEASE_KEY_PASSWORD')
+                storeFile releaseStoreFile
+                storePassword releaseSigning.BULWARK_RELEASE_STORE_PASSWORD
+                keyAlias releaseSigning.BULWARK_RELEASE_KEY_ALIAS
+                keyPassword releaseSigning.BULWARK_RELEASE_KEY_PASSWORD
             }
         }
     }
@@ -122,7 +177,13 @@ android {
             signingConfig signingConfigs.debug
         }
         release {
-            signingConfig signingConfigs.findByName('release') ?: signingConfigs.debug
+            // With neither a key nor the opt-in there is no signing config at
+            // all; checkReleaseSigning below stops the build before packaging.
+            if (releaseSigningConfigured) {
+                signingConfig signingConfigs.release
+            } else if (debugSignedRelease) {
+                signingConfig signingConfigs.debug
+            }
             def enableShrinkResources = findProperty('android.enableShrinkResourcesInReleaseBuilds') ?: 'false'
             shrinkResources enableShrinkResources.toBoolean()
             minifyEnabled enableMinifyInReleaseBuilds
@@ -142,6 +203,48 @@ android {
     }
 }
 
+// Stop a release build that has no real key. This runs only when a release
+// variant is actually built, so `expo run:android`, assembleDebug and IDE sync
+// keep working with no key configured.
+def releaseSigningHelp = [
+    "Release signing is not configured (missing: ${missingReleaseSigning.join(', ')}).",
+    "",
+    "Release builds are never signed with the debug key: it is the public React Native",
+    "template key, so an APK signed with it can be replaced by anyone. Provide the release",
+    "key as gradle properties (-P or ~/.gradle/gradle.properties) or environment variables:",
+    "  BULWARK_RELEASE_STORE_FILE       path to the keystore",
+    "  BULWARK_RELEASE_STORE_PASSWORD",
+    "  BULWARK_RELEASE_KEY_ALIAS",
+    "  BULWARK_RELEASE_KEY_PASSWORD",
+    "",
+    onCi && allowDebugSignedRelease
+        ? "allowDebugSignedRelease is ignored because CI is set: published builds must use the release key."
+        : "For a local test build that is never installed anywhere else, pass -PallowDebugSignedRelease=true.",
+    "See docs/android-release.md.",
+].join('\n')
+
+def checkReleaseSigning = tasks.register('checkReleaseSigning') {
+    group = 'verification'
+    description = 'Fails a release build that has no release signing key.'
+    doLast {
+        if (releaseSigningConfigured) {
+            if (!releaseStoreFile.isFile()) {
+                throw new GradleException("BULWARK_RELEASE_STORE_FILE points to ${releaseStoreFile}, which does not exist.")
+            }
+        } else if (debugSignedRelease) {
+            logger.warn("WARNING: this release build is signed with the PUBLIC debug key " +
+                    "(allowDebugSignedRelease). Do not distribute it.")
+        } else {
+            throw new GradleException(releaseSigningHelp)
+        }
+    }
+}
+tasks.configureEach { task ->
+    if (task.name == 'preReleaseBuild') {
+        task.dependsOn(checkReleaseSigning)
+    }
+}
+
 // Apply static values from `gradle.properties` to the `android.packagingOptions`
 // Accepts values in comma delimited lists, example:
 // android.packagingOptions.pickFirsts=/LICENSE,**/picasa.ini
@@ -171,6 +274,12 @@ dependencies {
     implementation(platform("com.google.firebase:firebase-bom:33.7.0"))
     implementation("com.google.firebase:firebase-messaging")
 
+    // UnifiedPush - Google-free push via a user-chosen distributor app such
+    // as ntfy. Coexists with FCM; the user picks the transport in settings.
+    // NOTE: 3.3.2-3.3.4 are built with Kotlin 2.3 and break this project's
+    // Kotlin 2.1 toolchain; 3.3.5 went back to 2.2 which it can read.
+    implementation("org.unifiedpush.android:connector:3.3.5")
+
     def isGifEnabled = (findProperty('expo.gif.enabled') ?: "") == "true";
     def isWebpEnabled = (findProperty('expo.webp.enabled') ?: "") == "true";
     def isWebpAnimatedEnabled = (findProperty('expo.webp.animated') ?: "") == "true";

android/app/proguard-rules.pro

@@ -12,3 +12,12 @@
 -keep class com.facebook.react.turbomodule.** { *; }
 
 # Add any project specific keep options here:
+
+# The app's own native code (com.anonymous.bulwarkmobile). What R8 must not
+# drop or rename there is already covered elsewhere: React Native's rules keep
+# every NativeModule, whose @ReactMethod methods JS calls by name, and AAPT
+# keeps the application, activity and services listed in AndroidManifest.xml
+# (FCM, UnifiedPush and the headless JS task). Keeping the package whole on
+# top of that costs a few KB and leaves its class and method names readable
+# in a crash report from an obfuscated release build.
+-keep class com.anonymous.bulwarkmobile.** { *; }

android/app/src/main/AndroidManifest.xml

@@ -59,6 +59,239 @@
       </intent-filter>
     </service>
     <service android:name=".BulwarkPushTaskService" android:exported="false"/>
+    <service android:name=".BulwarkPushJobService" android:permission="android.permission.BIND_JOB_SERVICE" android:exported="false"/>
+    <service android:name=".BulwarkUnifiedPushService" android:exported="false">
+      <intent-filter>
+        <action android:name="org.unifiedpush.android.connector.PUSH_EVENT"/>
+      </intent-filter>
+    </service>
     <meta-data android:name="com.google.firebase.messaging.default_notification_channel_id" android:value="bulwark_mail"/>
+    <!-- BEGIN WIDGETS: generated by scripts/sync-android-widgets.mjs, do not edit by hand -->
+    <service android:name="com.reactnativeandroidwidget.RNWidgetCollectionService" android:permission="android.permission.BIND_REMOTEVIEWS"/>
+    <receiver android:name=".widget.InboxWidget" android:exported="false" android:label="@string/widgetprovider_inboxwidget_label">
+      <intent-filter>
+        <action android:name="android.appwidget.action.APPWIDGET_UPDATE"/>
+        <action android:name="com.anonymous.bulwarkmobile.WIDGET_CLICK"/>
+      </intent-filter>
+      <meta-data android:name="android.appwidget.provider" android:resource="@xml/widgetprovider_inboxwidget"/>
+    </receiver>
+    <receiver android:name=".widget.TriageWidget" android:exported="false" android:label="@string/widgetprovider_triagewidget_label">
+      <intent-filter>
+        <action android:name="android.appwidget.action.APPWIDGET_UPDATE"/>
+        <action android:name="com.anonymous.bulwarkmobile.WIDGET_CLICK"/>
+      </intent-filter>
+      <meta-data android:name="android.appwidget.provider" android:resource="@xml/widgetprovider_triagewidget"/>
+    </receiver>
+    <receiver android:name=".widget.UnreadCountWidget" android:exported="false" android:label="@string/widgetprovider_unreadcountwidget_label">
+      <intent-filter>
+        <action android:name="android.appwidget.action.APPWIDGET_UPDATE"/>
+        <action android:name="com.anonymous.bulwarkmobile.WIDGET_CLICK"/>
+      </intent-filter>
+      <meta-data android:name="android.appwidget.provider" android:resource="@xml/widgetprovider_unreadcountwidget"/>
+    </receiver>
+    <receiver android:name=".widget.LatestMessageWidget" android:exported="false" android:label="@string/widgetprovider_latestmessagewidget_label">
+      <intent-filter>
+        <action android:name="android.appwidget.action.APPWIDGET_UPDATE"/>
+        <action android:name="com.anonymous.bulwarkmobile.WIDGET_CLICK"/>
+      </intent-filter>
+      <meta-data android:name="android.appwidget.provider" android:resource="@xml/widgetprovider_latestmessagewidget"/>
+    </receiver>
+    <receiver android:name=".widget.FolderCountsWidget" android:exported="false" android:label="@string/widgetprovider_foldercountswidget_label">
+      <intent-filter>
+        <action android:name="android.appwidget.action.APPWIDGET_UPDATE"/>
+        <action android:name="com.anonymous.bulwarkmobile.WIDGET_CLICK"/>
+      </intent-filter>
+      <meta-data android:name="android.appwidget.provider" android:resource="@xml/widgetprovider_foldercountswidget"/>
+    </receiver>
+    <receiver android:name=".widget.MailShortcutsWidget" android:exported="false" android:label="@string/widgetprovider_mailshortcutswidget_label">
+      <intent-filter>
+        <action android:name="android.appwidget.action.APPWIDGET_UPDATE"/>
+        <action android:name="com.anonymous.bulwarkmobile.WIDGET_CLICK"/>
+      </intent-filter>
+      <meta-data android:name="android.appwidget.provider" android:resource="@xml/widgetprovider_mailshortcutswidget"/>
+    </receiver>
+    <receiver android:name=".widget.AllAccountsWidget" android:exported="false" android:label="@string/widgetprovider_allaccountswidget_label">
+      <intent-filter>
+        <action android:name="android.appwidget.action.APPWIDGET_UPDATE"/>
+        <action android:name="com.anonymous.bulwarkmobile.WIDGET_CLICK"/>
+      </intent-filter>
+      <meta-data android:name="android.appwidget.provider" android:resource="@xml/widgetprovider_allaccountswidget"/>
+    </receiver>
+    <receiver android:name=".widget.StarredWidget" android:exported="false" android:label="@string/widgetprovider_starredwidget_label">
+      <intent-filter>
+        <action android:name="android.appwidget.action.APPWIDGET_UPDATE"/>
+        <action android:name="com.anonymous.bulwarkmobile.WIDGET_CLICK"/>
+      </intent-filter>
+      <meta-data android:name="android.appwidget.provider" android:resource="@xml/widgetprovider_starredwidget"/>
+    </receiver>
+    <receiver android:name=".widget.FavouritePeopleWidget" android:exported="false" android:label="@string/widgetprovider_favouritepeoplewidget_label">
+      <intent-filter>
+        <action android:name="android.appwidget.action.APPWIDGET_UPDATE"/>
+        <action android:name="com.anonymous.bulwarkmobile.WIDGET_CLICK"/>
+      </intent-filter>
+      <meta-data android:name="android.appwidget.provider" android:resource="@xml/widgetprovider_favouritepeoplewidget"/>
+    </receiver>
+    <receiver android:name=".widget.MailSearchWidget" android:exported="false" android:label="@string/widgetprovider_mailsearchwidget_label">
+      <intent-filter>
+        <action android:name="android.appwidget.action.APPWIDGET_UPDATE"/>
+        <action android:name="com.anonymous.bulwarkmobile.WIDGET_CLICK"/>
+      </intent-filter>
+      <meta-data android:name="android.appwidget.provider" android:resource="@xml/widgetprovider_mailsearchwidget"/>
+    </receiver>
+    <receiver android:name=".widget.OutboxWidget" android:exported="false" android:label="@string/widgetprovider_outboxwidget_label">
+      <intent-filter>
+        <action android:name="android.appwidget.action.APPWIDGET_UPDATE"/>
+        <action android:name="com.anonymous.bulwarkmobile.WIDGET_CLICK"/>
+      </intent-filter>
+      <meta-data android:name="android.appwidget.provider" android:resource="@xml/widgetprovider_outboxwidget"/>
+    </receiver>
+    <receiver android:name=".widget.TagWidget" android:exported="false" android:label="@string/widgetprovider_tagwidget_label">
+      <intent-filter>
+        <action android:name="android.appwidget.action.APPWIDGET_UPDATE"/>
+        <action android:name="com.anonymous.bulwarkmobile.WIDGET_CLICK"/>
+      </intent-filter>
+      <meta-data android:name="android.appwidget.provider" android:resource="@xml/widgetprovider_tagwidget"/>
+    </receiver>
+    <receiver android:name=".widget.LastDraftWidget" android:exported="false" android:label="@string/widgetprovider_lastdraftwidget_label">
+      <intent-filter>
+        <action android:name="android.appwidget.action.APPWIDGET_UPDATE"/>
+        <action android:name="com.anonymous.bulwarkmobile.WIDGET_CLICK"/>
+      </intent-filter>
+      <meta-data android:name="android.appwidget.provider" android:resource="@xml/widgetprovider_lastdraftwidget"/>
+    </receiver>
+    <receiver android:name=".widget.AgendaWidget" android:exported="false" android:label="@string/widgetprovider_agendawidget_label">
+      <intent-filter>
+        <action android:name="android.appwidget.action.APPWIDGET_UPDATE"/>
+        <action android:name="com.anonymous.bulwarkmobile.WIDGET_CLICK"/>
+      </intent-filter>
+      <meta-data android:name="android.appwidget.provider" android:resource="@xml/widgetprovider_agendawidget"/>
+    </receiver>
+    <receiver android:name=".widget.WeekWidget" android:exported="false" android:label="@string/widgetprovider_weekwidget_label">
+      <intent-filter>
+        <action android:name="android.appwidget.action.APPWIDGET_UPDATE"/>
+        <action android:name="com.anonymous.bulwarkmobile.WIDGET_CLICK"/>
+      </intent-filter>
+      <meta-data android:name="android.appwidget.provider" android:resource="@xml/widgetprovider_weekwidget"/>
+    </receiver>
+    <receiver android:name=".widget.MonthWidget" android:exported="false" android:label="@string/widgetprovider_monthwidget_label">
+      <intent-filter>
+        <action android:name="android.appwidget.action.APPWIDGET_UPDATE"/>
+        <action android:name="com.anonymous.bulwarkmobile.WIDGET_CLICK"/>
+      </intent-filter>
+      <meta-data android:name="android.appwidget.provider" android:resource="@xml/widgetprovider_monthwidget"/>
+    </receiver>
+    <receiver android:name=".widget.TodayEventsWidget" android:exported="false" android:label="@string/widgetprovider_todayeventswidget_label">
+      <intent-filter>
+        <action android:name="android.appwidget.action.APPWIDGET_UPDATE"/>
+        <action android:name="com.anonymous.bulwarkmobile.WIDGET_CLICK"/>
+      </intent-filter>
+      <meta-data android:name="android.appwidget.provider" android:resource="@xml/widgetprovider_todayeventswidget"/>
+    </receiver>
+    <receiver android:name=".widget.NextEventWidget" android:exported="false" android:label="@string/widgetprovider_nexteventwidget_label">
+      <intent-filter>
+        <action android:name="android.appwidget.action.APPWIDGET_UPDATE"/>
+        <action android:name="com.anonymous.bulwarkmobile.WIDGET_CLICK"/>
+      </intent-filter>
+      <meta-data android:name="android.appwidget.provider" android:resource="@xml/widgetprovider_nexteventwidget"/>
+    </receiver>
+    <receiver android:name=".widget.DateNextWidget" android:exported="false" android:label="@string/widgetprovider_datenextwidget_label">
+      <intent-filter>
+        <action android:name="android.appwidget.action.APPWIDGET_UPDATE"/>
+        <action android:name="com.anonymous.bulwarkmobile.WIDGET_CLICK"/>
+      </intent-filter>
+      <meta-data android:name="android.appwidget.provider" android:resource="@xml/widgetprovider_datenextwidget"/>
+    </receiver>
+    <receiver android:name=".widget.UpNextWidget" android:exported="false" android:label="@string/widgetprovider_upnextwidget_label">
+      <intent-filter>
+        <action android:name="android.appwidget.action.APPWIDGET_UPDATE"/>
+        <action android:name="com.anonymous.bulwarkmobile.WIDGET_CLICK"/>
+      </intent-filter>
+      <meta-data android:name="android.appwidget.provider" android:resource="@xml/widgetprovider_upnextwidget"/>
+    </receiver>
+    <receiver android:name=".widget.InvitationsWidget" android:exported="false" android:label="@string/widgetprovider_invitationswidget_label">
+      <intent-filter>
+        <action android:name="android.appwidget.action.APPWIDGET_UPDATE"/>
+        <action android:name="com.anonymous.bulwarkmobile.WIDGET_CLICK"/>
+      </intent-filter>
+      <meta-data android:name="android.appwidget.provider" android:resource="@xml/widgetprovider_invitationswidget"/>
+    </receiver>
+    <receiver android:name=".widget.FreeTimeWidget" android:exported="false" android:label="@string/widgetprovider_freetimewidget_label">
+      <intent-filter>
+        <action android:name="android.appwidget.action.APPWIDGET_UPDATE"/>
+        <action android:name="com.anonymous.bulwarkmobile.WIDGET_CLICK"/>
+      </intent-filter>
+      <meta-data android:name="android.appwidget.provider" android:resource="@xml/widgetprovider_freetimewidget"/>
+    </receiver>
+    <receiver android:name=".widget.TasksWidget" android:exported="false" android:label="@string/widgetprovider_taskswidget_label">
+      <intent-filter>
+        <action android:name="android.appwidget.action.APPWIDGET_UPDATE"/>
+        <action android:name="com.anonymous.bulwarkmobile.WIDGET_CLICK"/>
+      </intent-filter>
+      <meta-data android:name="android.appwidget.provider" android:resource="@xml/widgetprovider_taskswidget"/>
+    </receiver>
+    <receiver android:name=".widget.TaskProgressWidget" android:exported="false" android:label="@string/widgetprovider_taskprogresswidget_label">
+      <intent-filter>
+        <action android:name="android.appwidget.action.APPWIDGET_UPDATE"/>
+        <action android:name="com.anonymous.bulwarkmobile.WIDGET_CLICK"/>
+      </intent-filter>
+      <meta-data android:name="android.appwidget.provider" android:resource="@xml/widgetprovider_taskprogresswidget"/>
+    </receiver>
+    <receiver android:name=".widget.CountdownWidget" android:exported="false" android:label="@string/widgetprovider_countdownwidget_label">
+      <intent-filter>
+        <action android:name="android.appwidget.action.APPWIDGET_UPDATE"/>
+        <action android:name="com.anonymous.bulwarkmobile.WIDGET_CLICK"/>
+      </intent-filter>
+      <meta-data android:name="android.appwidget.provider" android:resource="@xml/widgetprovider_countdownwidget"/>
+    </receiver>
+    <receiver android:name=".widget.BirthdaysWidget" android:exported="false" android:label="@string/widgetprovider_birthdayswidget_label">
+      <intent-filter>
+        <action android:name="android.appwidget.action.APPWIDGET_UPDATE"/>
+        <action android:name="com.anonymous.bulwarkmobile.WIDGET_CLICK"/>
+      </intent-filter>
+      <meta-data android:name="android.appwidget.provider" android:resource="@xml/widgetprovider_birthdayswidget"/>
+    </receiver>
+    <receiver android:name=".widget.TodayHubWidget" android:exported="false" android:label="@string/widgetprovider_todayhubwidget_label">
+      <intent-filter>
+        <action android:name="android.appwidget.action.APPWIDGET_UPDATE"/>
+        <action android:name="com.anonymous.bulwarkmobile.WIDGET_CLICK"/>
+      </intent-filter>
+      <meta-data android:name="android.appwidget.provider" android:resource="@xml/widgetprovider_todayhubwidget"/>
+    </receiver>
+    <receiver android:name=".widget.MailAndNextWidget" android:exported="false" android:label="@string/widgetprovider_mailandnextwidget_label">
+      <intent-filter>
+        <action android:name="android.appwidget.action.APPWIDGET_UPDATE"/>
+        <action android:name="com.anonymous.bulwarkmobile.WIDGET_CLICK"/>
+      </intent-filter>
+      <meta-data android:name="android.appwidget.provider" android:resource="@xml/widgetprovider_mailandnextwidget"/>
+    </receiver>
+    <receiver android:name=".widget.RecentFilesWidget" android:exported="false" android:label="@string/widgetprovider_recentfileswidget_label">
+      <intent-filter>
+        <action android:name="android.appwidget.action.APPWIDGET_UPDATE"/>
+        <action android:name="com.anonymous.bulwarkmobile.WIDGET_CLICK"/>
+      </intent-filter>
+      <meta-data android:name="android.appwidget.provider" android:resource="@xml/widgetprovider_recentfileswidget"/>
+    </receiver>
+    <receiver android:name=".widget.AttachmentsWidget" android:exported="false" android:label="@string/widgetprovider_attachmentswidget_label">
+      <intent-filter>
+        <action android:name="android.appwidget.action.APPWIDGET_UPDATE"/>
+        <action android:name="com.anonymous.bulwarkmobile.WIDGET_CLICK"/>
+      </intent-filter>
+      <meta-data android:name="android.appwidget.provider" android:resource="@xml/widgetprovider_attachmentswidget"/>
+    </receiver>
+    <receiver android:name=".widget.VacationWidget" android:exported="false" android:label="@string/widgetprovider_vacationwidget_label">
+      <intent-filter>
+        <action android:name="android.appwidget.action.APPWIDGET_UPDATE"/>
+        <action android:name="com.anonymous.bulwarkmobile.WIDGET_CLICK"/>
+      </intent-filter>
+      <meta-data android:name="android.appwidget.provider" android:resource="@xml/widgetprovider_vacationwidget"/>
+    </receiver>
+    <receiver android:name=".widget.StorageWidget" android:exported="false" android:label="@string/widgetprovider_storagewidget_label">
+      <intent-filter>
+        <action android:name="android.appwidget.action.APPWIDGET_UPDATE"/>
+        <action android:name="com.anonymous.bulwarkmobile.WIDGET_CLICK"/>
+      </intent-filter>
+      <meta-data android:name="android.appwidget.provider" android:resource="@xml/widgetprovider_storagewidget"/>
+    </receiver>
+    <!-- END WIDGETS -->
   </application>
 </manifest>

android/app/src/main/java/com/anonymous/bulwarkmobile/BulwarkFcmModule.kt

@@ -66,6 +66,7 @@ class BulwarkFcmModule(reactContext: ReactApplicationContext)
         val threadId = options.getString("threadId")
         val subject = options.takeIf { it.hasKey("subject") }?.getString("subject")
         val accountId = options.takeIf { it.hasKey("accountId") }?.getString("accountId")
+        val jmapAccountId = options.takeIf { it.hasKey("jmapAccountId") }?.getString("jmapAccountId")
         val groupKey = options.takeIf { it.hasKey("groupKey") }?.getString("groupKey")
             ?: accountId?.let { "bulwark-mail:$it" }
         val groupTitle = options.takeIf { it.hasKey("groupTitle") }?.getString("groupTitle")
@@ -78,7 +79,7 @@ class BulwarkFcmModule(reactContext: ReactApplicationContext)
                 ?: makeLetterAvatar(initials, bgColorHex)
             postNotification(
                 notificationId, title, body, largeIcon, bgColorHex,
-                emailId, threadId, subject, accountId, groupKey,
+                emailId, threadId, subject, accountId, jmapAccountId, groupKey,
             )
             if (groupKey != null) postGroupSummary(groupKey, groupTitle, bgColorHex, accountId)
             promise.resolve(null)
@@ -107,6 +108,7 @@ class BulwarkFcmModule(reactContext: ReactApplicationContext)
         threadId: String?,
         subject: String?,
         accountId: String?,
+        jmapAccountId: String?,
         groupKey: String?,
     ) {
         val ctx = reactApplicationContext
@@ -116,6 +118,7 @@ class BulwarkFcmModule(reactContext: ReactApplicationContext)
             if (threadId != null) putExtra(NotificationTapStore.EXTRA_THREAD_ID, threadId)
             if (subject != null) putExtra(NotificationTapStore.EXTRA_SUBJECT, subject)
             if (accountId != null) putExtra(NotificationTapStore.EXTRA_ACCOUNT_ID, accountId)
+            if (jmapAccountId != null) putExtra(NotificationTapStore.EXTRA_JMAP_ACCOUNT_ID, jmapAccountId)
         }
         val pending = PendingIntent.getActivity(
             ctx,
@@ -125,7 +128,7 @@ class BulwarkFcmModule(reactContext: ReactApplicationContext)
         )
 
         val builder = NotificationCompat.Builder(ctx, BulwarkMessagingService.CHANNEL_ID)
-            .setSmallIcon(android.R.drawable.ic_dialog_email)
+            .setSmallIcon(R.drawable.ic_notification)
             .setLargeIcon(largeIcon)
             .setContentTitle(title)
             .setContentText(body)
@@ -178,7 +181,7 @@ class BulwarkFcmModule(reactContext: ReactApplicationContext)
             PendingIntent.FLAG_UPDATE_CURRENT or PendingIntent.FLAG_IMMUTABLE,
         )
         val summary = NotificationCompat.Builder(ctx, BulwarkMessagingService.CHANNEL_ID)
-            .setSmallIcon(android.R.drawable.ic_dialog_email)
+            .setSmallIcon(R.drawable.ic_notification)
             .setContentTitle(groupTitle)
             .setContentText(if (count == 1) "1 new message" else "$count new messages")
             .setStyle(inbox)

android/app/src/main/java/com/anonymous/bulwarkmobile/BulwarkFcmPackage.kt

@@ -3,14 +3,20 @@ package com.anonymous.bulwarkmobile
 import com.facebook.react.ReactPackage
 import com.facebook.react.bridge.NativeModule
 import com.facebook.react.bridge.ReactApplicationContext
+import com.facebook.react.internal.featureflags.ReactNativeNewArchitectureFeatureFlags
 import com.facebook.react.uimanager.ViewManager
 
 class BulwarkFcmPackage : ReactPackage {
     override fun createNativeModules(reactContext: ReactApplicationContext): List<NativeModule> =
-        listOf(
-            BulwarkFcmModule(reactContext),
-            BulwarkClientCertModule(reactContext),
-        )
+        buildList {
+            add(BulwarkFcmModule(reactContext))
+            add(BulwarkUnifiedPushModule(reactContext))
+            add(BulwarkClientCertModule(reactContext))
+            // The bridge registers React Native's own module under this name.
+            if (ReactNativeNewArchitectureFeatureFlags.enableBridgelessArchitecture()) {
+                add(BulwarkHeadlessJsTaskSupportModule(reactContext))
+            }
+        }
 
     override fun createViewManagers(reactContext: ReactApplicationContext): List<ViewManager<*, *>> =
         emptyList()

android/app/src/main/java/com/anonymous/bulwarkmobile/BulwarkHeadlessJsTaskSupportModule.kt

@@ -0,0 +1,35 @@
+package com.anonymous.bulwarkmobile
+
+import com.facebook.react.bridge.Promise
+import com.facebook.react.bridge.ReactApplicationContext
+import com.facebook.react.bridge.ReactContextBaseJavaModule
+import com.facebook.react.bridge.ReactMethod
+import com.facebook.react.jstasks.HeadlessJsTaskContext
+
+/**
+ * React Native's HeadlessJsTaskSupport module, which AppRegistry calls when a
+ * headless JS task's promise settles. RN 0.81 registers it only for the old
+ * bridge (CoreModulesPackage); the bridgeless runtime's CoreReactPackage
+ * leaves it out, so in this app JS could never report a finished task and
+ * every BulwarkPushTask ran until its 30 s timeout, keeping the service or job
+ * and its wake lock alive that long. Same logic as the RN module.
+ */
+class BulwarkHeadlessJsTaskSupportModule(reactContext: ReactApplicationContext) :
+    ReactContextBaseJavaModule(reactContext) {
+
+    override fun getName(): String = "HeadlessJsTaskSupport"
+
+    @ReactMethod
+    fun notifyTaskFinished(taskId: Double) {
+        val tasks = HeadlessJsTaskContext.getInstance(reactApplicationContext)
+        val id = taskId.toInt()
+        if (tasks.isTaskRunning(id)) tasks.finishTask(id)
+    }
+
+    @ReactMethod
+    fun notifyTaskRetry(taskId: Double, promise: Promise) {
+        val tasks = HeadlessJsTaskContext.getInstance(reactApplicationContext)
+        val id = taskId.toInt()
+        promise.resolve(tasks.isTaskRunning(id) && tasks.retryTask(id))
+    }
+}

android/app/src/main/java/com/anonymous/bulwarkmobile/BulwarkMessagingService.kt

@@ -8,8 +8,9 @@ import android.content.Context
 import android.content.Intent
 import android.os.Build
 import android.os.Bundle
+import android.os.PowerManager
+import android.util.Log
 import androidx.core.app.NotificationCompat
-import com.facebook.react.HeadlessJsTaskService
 import com.facebook.react.bridge.Arguments
 import com.google.firebase.messaging.FirebaseMessagingService
 import com.google.firebase.messaging.RemoteMessage
@@ -31,7 +32,7 @@ class BulwarkMessagingService : FirebaseMessagingService() {
         // receives JMAP push directly, so the fcm:message event below is
         // sufficient for it to refresh state.
         if (!isAppInForeground()) {
-            startHeadlessTask(data)
+            startHeadlessTask(applicationContext, data)
         }
 
         val params = Arguments.createMap().apply {
@@ -42,25 +43,60 @@ class BulwarkMessagingService : FirebaseMessagingService() {
         BulwarkFcmModule.emit("fcm:message", params)
     }
 
-    private fun isAppInForeground(): Boolean {
-        val info = ActivityManager.RunningAppProcessInfo()
-        ActivityManager.getMyMemoryState(info)
-        return info.importance == ActivityManager.RunningAppProcessInfo.IMPORTANCE_FOREGROUND ||
-            info.importance == ActivityManager.RunningAppProcessInfo.IMPORTANCE_VISIBLE
-    }
-
-    private fun startHeadlessTask(data: Map<String, String>) {
-        val intent = Intent(applicationContext, BulwarkPushTaskService::class.java)
-        val bundle = Bundle().apply {
-            for ((k, v) in data) putString(k, v)
-        }
-        intent.putExtras(bundle)
-        applicationContext.startService(intent)
-        HeadlessJsTaskService.acquireWakeLockNow(applicationContext)
-    }
-
     companion object {
         const val CHANNEL_ID = "bulwark_mail"
+        private const val TAG = "BulwarkPush"
+        private const val START_WAKE_LOCK_MS = 10_000L
+
+        // Shared with BulwarkUnifiedPushService - a push arriving over either
+        // transport is dispatched the same way.
+        fun isAppInForeground(): Boolean {
+            val info = ActivityManager.RunningAppProcessInfo()
+            ActivityManager.getMyMemoryState(info)
+            return info.importance == ActivityManager.RunningAppProcessInfo.IMPORTANCE_FOREGROUND ||
+                info.importance == ActivityManager.RunningAppProcessInfo.IMPORTANCE_VISIBLE
+        }
+
+        fun startHeadlessTask(context: Context, data: Map<String, String>) {
+            val intent = Intent(context, BulwarkPushTaskService::class.java)
+            val bundle = Bundle().apply {
+                for ((k, v) in data) putString(k, v)
+            }
+            intent.putExtras(bundle)
+            // Keep the device awake until the service holds React Native's
+            // wake lock; BulwarkPushTaskService releases this one then. Not
+            // HeadlessJsTaskService.acquireWakeLockNow: it is not
+            // thread-safe, and FCM calls this on a worker thread while the
+            // service takes the same static lock on the main thread, so both
+            // could create a lock and the overwritten one stayed held.
+            startWakeLock = context.getSystemService(PowerManager::class.java)
+                .newWakeLock(PowerManager.PARTIAL_WAKE_LOCK, "bulwark:push-start")
+                .apply {
+                    setReferenceCounted(false)
+                    acquire(START_WAKE_LOCK_MS)
+                }
+            try {
+                context.startService(intent)
+            } catch (e: IllegalStateException) {
+                // Android 8+ refuses to start a service from the background
+                // unless the app is temporarily allowlisted. A high-priority
+                // FCM message does that; a downgraded one or a UnifiedPush
+                // message may not (BackgroundServiceStartNotAllowedException
+                // on 12+), and uncaught this crashed the app on every such
+                // push. Run the same task from a job instead.
+                releaseStartWakeLock()
+                Log.w(TAG, "Push service start refused in the background, using a job: ${e.message}")
+                BulwarkPushJobService.schedule(context, data)
+            }
+        }
+
+        @Volatile private var startWakeLock: PowerManager.WakeLock? = null
+
+        /** Drops the wake lock taken in [startHeadlessTask]; it also times out on its own. */
+        fun releaseStartWakeLock() {
+            startWakeLock?.release()
+            startWakeLock = null
+        }
 
         fun ensureChannel(context: Context) {
             if (Build.VERSION.SDK_INT < Build.VERSION_CODES.O) return

android/app/src/main/java/com/anonymous/bulwarkmobile/BulwarkPushJobService.kt

@@ -0,0 +1,180 @@
+package com.anonymous.bulwarkmobile
+
+import android.app.job.JobInfo
+import android.app.job.JobParameters
+import android.app.job.JobScheduler
+import android.app.job.JobService
+import android.content.ComponentName
+import android.content.Context
+import android.os.Build
+import android.os.Bundle
+import android.os.PersistableBundle
+import android.os.SystemClock
+import android.util.Log
+import com.facebook.react.ReactApplication
+import com.facebook.react.ReactInstanceEventListener
+import com.facebook.react.bridge.ReactContext
+import com.facebook.react.bridge.UiThreadUtil
+import com.facebook.react.internal.featureflags.ReactNativeNewArchitectureFeatureFlags
+import com.facebook.react.jstasks.HeadlessJsTaskConfig
+import com.facebook.react.jstasks.HeadlessJsTaskContext
+import com.facebook.react.jstasks.HeadlessJsTaskEventListener
+import java.util.concurrent.ConcurrentHashMap
+import java.util.concurrent.atomic.AtomicBoolean
+
+/**
+ * Runs the BulwarkPushTask headless JS task from a JobScheduler job.
+ *
+ * A push normally starts BulwarkPushTaskService, but Android 8+ only lets a
+ * background app start a service while it is temporarily allowlisted, which a
+ * high-priority FCM message does. FCM delivers some messages at normal
+ * priority anyway (it downgrades apps whose high-priority pushes rarely end in
+ * a notification), and a UnifiedPush distributor may not raise the app at all.
+ * The service start then throws, so the push is handed to this job instead:
+ * expedited on Android 12+, where it runs right away while the app has
+ * expedited-job quota and as a regular job after that, and a regular job on
+ * Android 8-11. It needs no new dependency and ends in the same notification
+ * as the service path.
+ */
+class BulwarkPushJobService : JobService(), HeadlessJsTaskEventListener {
+    private class RunningTask(val params: JobParameters, val startedAt: Long)
+
+    private val running = ConcurrentHashMap<Int, RunningTask>()
+    private var taskContext: HeadlessJsTaskContext? = null
+
+    override fun onStartJob(params: JobParameters): Boolean {
+        val config = BulwarkPushTaskService.taskConfig(Bundle(params.extras))
+        withReadyReactContext { startTask(it, config, params) }
+        return true
+    }
+
+    // The JS task has its own 30 s timeout and finishes on its own; nothing to
+    // reschedule if the system stops the job first.
+    override fun onStopJob(params: JobParameters): Boolean {
+        running.values.removeIf { it.params.jobId == params.jobId }
+        return false
+    }
+
+    override fun onDestroy() {
+        taskContext?.removeTaskEventListener(this)
+        super.onDestroy()
+    }
+
+    override fun onHeadlessJsTaskStart(taskId: Int) = Unit
+
+    override fun onHeadlessJsTaskFinish(taskId: Int) {
+        val task = running.remove(taskId) ?: return
+        val ms = SystemClock.elapsedRealtime() - task.startedAt
+        Log.i(TAG, "Push task $taskId from job ${task.params.jobId} finished after $ms ms")
+        jobFinished(task.params, false)
+    }
+
+    private fun startTask(context: ReactContext, config: HeadlessJsTaskConfig, params: JobParameters) {
+        val tasks = HeadlessJsTaskContext.getInstance(context)
+        if (taskContext !== tasks) {
+            taskContext?.removeTaskEventListener(this)
+            tasks.addTaskEventListener(this)
+            taskContext = tasks
+        }
+        UiThreadUtil.runOnUiThread {
+            try {
+                val taskId = tasks.startTask(config)
+                running[taskId] = RunningTask(params, SystemClock.elapsedRealtime())
+            } catch (e: IllegalStateException) {
+                // The app came to the foreground since the push arrived and
+                // syncs on its own there.
+                Log.i(TAG, "Push job ${params.jobId} skipped: ${e.message}")
+                jobFinished(params, false)
+            }
+        }
+    }
+
+    /**
+     * Calls [onReady] once with a React context whose JS instance is up,
+     * starting React Native if the process was woken for this job.
+     *
+     * A context exists before its instance is ready, and a task started on
+     * it then never reaches JS (HeadlessJsTaskContext only logs "CatalystInstance
+     * not available" and waits for the timeout), which happened when several
+     * pushes arrived while the app was starting. So the listener goes in
+     * first and the ready check after it; whichever sees the ready instance
+     * first runs the task.
+     */
+    private fun withReadyReactContext(onReady: (ReactContext) -> Unit) {
+        val done = AtomicBoolean(false)
+        val runOnce = { context: ReactContext -> if (done.compareAndSet(false, true)) onReady(context) }
+        val app = application as ReactApplication
+        if (ReactNativeNewArchitectureFeatureFlags.enableBridgelessArchitecture()) {
+            val host = checkNotNull(app.reactHost) { "ReactHost is not initialized in New Architecture" }
+            val listener = object : ReactInstanceEventListener {
+                override fun onReactContextInitialized(context: ReactContext) {
+                    host.removeReactInstanceEventListener(this)
+                    runOnce(context)
+                }
+            }
+            host.addReactInstanceEventListener(listener)
+            val current = host.currentReactContext
+            if (current != null && current.hasActiveReactInstance()) {
+                host.removeReactInstanceEventListener(listener)
+                runOnce(current)
+            } else {
+                host.start()
+            }
+        } else {
+            @Suppress("DEPRECATION")
+            val manager = app.reactNativeHost.reactInstanceManager
+            val listener = object : ReactInstanceEventListener {
+                override fun onReactContextInitialized(context: ReactContext) {
+                    manager.removeReactInstanceEventListener(this)
+                    runOnce(context)
+                }
+            }
+            manager.addReactInstanceEventListener(listener)
+            val current = manager.currentReactContext
+            if (current != null && current.hasActiveReactInstance()) {
+                manager.removeReactInstanceEventListener(listener)
+                runOnce(current)
+            } else if (!manager.hasStartedCreatingInitialContext()) {
+                manager.createReactContextInBackground()
+            }
+        }
+    }
+
+    companion object {
+        private const val TAG = "BulwarkPush"
+
+        // A block of job ids for push jobs, one per push that is waiting or
+        // running. A pending job with the same id would be replaced (and a
+        // running one stopped), so each push takes a free id.
+        private const val JOB_ID_BASE = 0x42554c00
+        private const val JOB_ID_COUNT = 32
+
+        /** Schedules the push task as a job. Returns false if no job could be scheduled. */
+        fun schedule(context: Context, data: Map<String, String>): Boolean = try {
+            val scheduler = context.getSystemService(JobScheduler::class.java)
+            val busy = scheduler.allPendingJobs.mapTo(HashSet()) { it.id }
+            val jobId = (JOB_ID_BASE until JOB_ID_BASE + JOB_ID_COUNT).firstOrNull { it !in busy }
+            if (jobId == null) {
+                // Every slot holds a push that has not finished yet; any of
+                // them fetches the same new mail.
+                Log.w(TAG, "Push not scheduled: $JOB_ID_COUNT push jobs already pending")
+                false
+            } else {
+                val extras = PersistableBundle().apply {
+                    for ((key, value) in data) putString(key, value)
+                }
+                val job = JobInfo.Builder(jobId, ComponentName(context, BulwarkPushJobService::class.java))
+                    .setExtras(extras)
+                    .setRequiredNetworkType(JobInfo.NETWORK_TYPE_ANY)
+                    .apply { if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.S) setExpedited(true) }
+                    .build()
+                val scheduled = scheduler.schedule(job) == JobScheduler.RESULT_SUCCESS
+                Log.i(TAG, "Push job $jobId scheduled: $scheduled")
+                scheduled
+            }
+        } catch (e: Exception) {
+            Log.w(TAG, "Push job could not be scheduled", e)
+            false
+        }
+    }
+}

android/app/src/main/java/com/anonymous/bulwarkmobile/BulwarkPushTaskService.kt

@@ -1,18 +1,32 @@
 package com.anonymous.bulwarkmobile
 
 import android.content.Intent
+import android.os.Bundle
 import com.facebook.react.bridge.Arguments
 import com.facebook.react.jstasks.HeadlessJsTaskConfig
 import com.facebook.react.HeadlessJsTaskService
 
 class BulwarkPushTaskService : HeadlessJsTaskService() {
+    override fun onStartCommand(intent: Intent?, flags: Int, startId: Int): Int =
+        super.onStartCommand(intent, flags, startId).also {
+            // startTask has taken React Native's wake lock by now.
+            BulwarkMessagingService.releaseStartWakeLock()
+        }
+
     override fun getTaskConfig(intent: Intent?): HeadlessJsTaskConfig? {
         val extras = intent?.extras ?: return null
-        return HeadlessJsTaskConfig(
-            "BulwarkPushTask",
-            Arguments.fromBundle(extras),
-            30000L,
-            false,
-        )
+        return taskConfig(extras)
+    }
+
+    companion object {
+        // Shared with BulwarkPushJobService, which runs the same task when
+        // this service may not be started.
+        fun taskConfig(extras: Bundle): HeadlessJsTaskConfig =
+            HeadlessJsTaskConfig(
+                "BulwarkPushTask",
+                Arguments.fromBundle(extras),
+                30000L,
+                false,
+            )
     }
 }

android/app/src/main/java/com/anonymous/bulwarkmobile/BulwarkUnifiedPushModule.kt

@@ -0,0 +1,110 @@
+package com.anonymous.bulwarkmobile
+
+import com.facebook.react.bridge.Arguments
+import com.facebook.react.bridge.Promise
+import com.facebook.react.bridge.ReactApplicationContext
+import com.facebook.react.bridge.ReactContextBaseJavaModule
+import com.facebook.react.bridge.ReactMethod
+import org.unifiedpush.android.connector.UnifiedPush
+
+// JS-facing surface for UnifiedPush distributor management. Events from the
+// distributor (endpoint changes, incoming messages) arrive through
+// BulwarkUnifiedPushService, which emits them on the shared device-event
+// channel.
+class BulwarkUnifiedPushModule(reactContext: ReactApplicationContext)
+    : ReactContextBaseJavaModule(reactContext) {
+
+    override fun getName(): String = "BulwarkUnifiedPush"
+
+    @ReactMethod
+    fun getDistributors(promise: Promise) {
+        try {
+            val array = Arguments.createArray()
+            for (d in UnifiedPush.getDistributors(reactApplicationContext)) array.pushString(d)
+            promise.resolve(array)
+        } catch (err: Exception) {
+            promise.reject("up_distributors_failed", err)
+        }
+    }
+
+    @ReactMethod
+    fun getSavedDistributor(promise: Promise) {
+        try {
+            promise.resolve(UnifiedPush.getSavedDistributor(reactApplicationContext))
+        } catch (err: Exception) {
+            promise.reject("up_distributor_failed", err)
+        }
+    }
+
+    @ReactMethod
+    fun getAckDistributor(promise: Promise) {
+        try {
+            promise.resolve(UnifiedPush.getAckDistributor(reactApplicationContext))
+        } catch (err: Exception) {
+            promise.reject("up_distributor_failed", err)
+        }
+    }
+
+    @ReactMethod
+    fun saveDistributor(distributor: String, promise: Promise) {
+        try {
+            UnifiedPush.saveDistributor(reactApplicationContext, distributor)
+            promise.resolve(null)
+        } catch (err: Exception) {
+            promise.reject("up_save_distributor_failed", err)
+        }
+    }
+
+    // Asks the saved distributor for an endpoint. The endpoint itself arrives
+    // asynchronously via BulwarkUnifiedPushService.onNewEndpoint (event
+    // `up:newEndpoint`); failures via `up:registrationFailed`. `vapid` is the
+    // relay's VAPID public key - optional, some distributors use it to
+    // restrict who may push.
+    @ReactMethod
+    fun register(vapid: String?, promise: Promise) {
+        try {
+            UnifiedPush.register(
+                reactApplicationContext,
+                messageForDistributor = null,
+                vapid = vapid?.takeIf { it.isNotBlank() },
+            )
+            promise.resolve(null)
+        } catch (err: Exception) {
+            promise.reject("up_register_failed", err)
+        }
+    }
+
+    @ReactMethod
+    fun unregister(promise: Promise) {
+        try {
+            UnifiedPush.unregister(reactApplicationContext)
+            BulwarkUnifiedPushService.clearEndpoint(reactApplicationContext)
+            promise.resolve(null)
+        } catch (err: Exception) {
+            promise.reject("up_unregister_failed", err)
+        }
+    }
+
+    @ReactMethod
+    fun getEndpoint(promise: Promise) {
+        val stored = BulwarkUnifiedPushService.readEndpoint(reactApplicationContext)
+        if (stored == null) {
+            promise.resolve(null)
+            return
+        }
+        val (url, p256dh, auth) = stored
+        val map = Arguments.createMap().apply {
+            putString("url", url)
+            putString("p256dh", p256dh)
+            putString("auth", auth)
+        }
+        promise.resolve(map)
+    }
+
+    // NativeEventEmitter required no-ops.
+    @ReactMethod
+    fun addListener(eventName: String) {}
+
+    @ReactMethod
+    fun removeListeners(count: Int) {}
+}

android/app/src/main/java/com/anonymous/bulwarkmobile/BulwarkUnifiedPushService.kt

@@ -0,0 +1,100 @@
+package com.anonymous.bulwarkmobile
+
+import android.content.Context
+import com.facebook.react.bridge.Arguments
+import org.json.JSONArray
+import org.json.JSONObject
+import org.unifiedpush.android.connector.FailedReason
+import org.unifiedpush.android.connector.PushService
+import org.unifiedpush.android.connector.data.PushEndpoint
+import org.unifiedpush.android.connector.data.PushMessage
+
+// Receives UnifiedPush events from the user's distributor app (ntfy, ...).
+// The relay sends the same content-blind ForwardPayload it sends over FCM -
+// as encrypted Web Push when the connector provided RFC 8291 keys (the
+// connector decrypts before this service sees it) - so an incoming message is
+// dispatched exactly like an FCM data message: headless task when the app is
+// backgrounded, `fcm:message` device event for the live JS instance.
+class BulwarkUnifiedPushService : PushService() {
+
+    override fun onNewEndpoint(endpoint: PushEndpoint, instance: String) {
+        saveEndpoint(this, endpoint)
+        val params = Arguments.createMap().apply {
+            putString("url", endpoint.url)
+            putString("p256dh", endpoint.pubKeySet?.pubKey)
+            putString("auth", endpoint.pubKeySet?.auth)
+        }
+        BulwarkFcmModule.emit("up:newEndpoint", params)
+    }
+
+    override fun onMessage(message: PushMessage, instance: String) {
+        BulwarkMessagingService.ensureChannel(this)
+        val data = parsePayload(message.content) ?: return
+
+        if (!BulwarkMessagingService.isAppInForeground()) {
+            BulwarkMessagingService.startHeadlessTask(applicationContext, data)
+        }
+
+        // Same event name and shape as the FCM path so the foreground JS
+        // handler (App.tsx addMessageListener) works transport-agnostically.
+        val params = Arguments.createMap().apply {
+            val dataMap = Arguments.createMap()
+            for ((k, v) in data) dataMap.putString(k, v)
+            putMap("data", dataMap)
+        }
+        BulwarkFcmModule.emit("fcm:message", params)
+    }
+
+    override fun onUnregistered(instance: String) {
+        clearEndpoint(this)
+        BulwarkFcmModule.emit("up:unregistered", Arguments.createMap())
+    }
+
+    override fun onRegistrationFailed(reason: FailedReason, instance: String) {
+        val params = Arguments.createMap().apply { putString("reason", reason.name) }
+        BulwarkFcmModule.emit("up:registrationFailed", params)
+    }
+
+    companion object {
+        private const val PREFS = "bulwark_unifiedpush"
+        private const val KEY_URL = "endpointUrl"
+        private const val KEY_P256DH = "endpointP256dh"
+        private const val KEY_AUTH = "endpointAuth"
+
+        // The endpoint arrives asynchronously (possibly while no JS instance
+        // is alive), so persist it for BulwarkUnifiedPushModule.getEndpoint.
+        fun saveEndpoint(context: Context, endpoint: PushEndpoint) {
+            context.getSharedPreferences(PREFS, Context.MODE_PRIVATE).edit()
+                .putString(KEY_URL, endpoint.url)
+                .putString(KEY_P256DH, endpoint.pubKeySet?.pubKey)
+                .putString(KEY_AUTH, endpoint.pubKeySet?.auth)
+                .apply()
+        }
+
+        fun readEndpoint(context: Context): Triple<String, String?, String?>? {
+            val prefs = context.getSharedPreferences(PREFS, Context.MODE_PRIVATE)
+            val url = prefs.getString(KEY_URL, null) ?: return null
+            return Triple(url, prefs.getString(KEY_P256DH, null), prefs.getString(KEY_AUTH, null))
+        }
+
+        fun clearEndpoint(context: Context) {
+            context.getSharedPreferences(PREFS, Context.MODE_PRIVATE).edit().clear().apply()
+        }
+
+        // The relay's ForwardPayload JSON, flattened to the string map the
+        // FCM data payload uses (repos/relay/src/fcm.ts) so the headless task
+        // and foreground handler can stay transport-blind.
+        fun parsePayload(content: ByteArray): Map<String, String>? = try {
+            val json = JSONObject(String(content, Charsets.UTF_8))
+            buildMap {
+                json.optString("kind").takeIf { it.isNotEmpty() }?.let { put("kind", it) }
+                json.optString("accountLabel").takeIf { it.isNotEmpty() }?.let { put("accountLabel", it) }
+                json.optString("accountId").takeIf { it.isNotEmpty() }?.let { put("accountId", it) }
+                put("emailIds", (json.optJSONArray("emailIds") ?: JSONArray()).toString())
+                put("changed", (json.optJSONObject("changed") ?: JSONObject()).toString())
+            }
+        } catch (_: Exception) {
+            null
+        }
+    }
+}

android/app/src/main/java/com/anonymous/bulwarkmobile/MainActivity.kt

@@ -17,15 +17,17 @@ class MainActivity : ReactActivity() {
     // coloring the background, status bar, and navigation bar.
     // This is required for expo-splash-screen.
     setTheme(R.style.AppTheme);
+    ShareIntentStore.rewriteSendToAsView(intent)
     super.onCreate(null)
     NotificationTapStore.captureFromIntent(intent)
-    ShareIntentStore.captureFromIntent(intent)
+    ShareIntentStore.captureFromIntent(intent, contentResolver)
   }
 
   override fun onNewIntent(intent: Intent) {
+    ShareIntentStore.rewriteSendToAsView(intent)
     super.onNewIntent(intent)
     setIntent(intent)
-    ShareIntentStore.captureFromIntent(intent)?.let { share ->
+    ShareIntentStore.captureFromIntent(intent, contentResolver)?.let { share ->
       BulwarkFcmModule.emit("app:share", share.toMap())
     }
     val payload = NotificationTapStore.captureFromIntent(intent) ?: return

android/app/src/main/java/com/anonymous/bulwarkmobile/NotificationTapStore.kt

@@ -40,13 +40,17 @@ object NotificationTapStore {
         // the navigation payload.
         val subject = extras.getString(EXTRA_SUBJECT)?.take(512)
         val accountId = extras.getString(EXTRA_ACCOUNT_ID)?.takeIf { ACCOUNT_ID_PATTERN.matches(it) }
-        val payload = TapPayload(emailId, threadId, subject, accountId)
+        // The JMAP account a group/shared mailbox's message lives in - a JMAP
+        // id like the email id. Optional: older notifications don't carry it.
+        val jmapAccountId = extras.getString(EXTRA_JMAP_ACCOUNT_ID)?.takeIf { ID_PATTERN.matches(it) }
+        val payload = TapPayload(emailId, threadId, subject, accountId, jmapAccountId)
         pending = payload
         // Clear so a subsequent activity lifecycle event doesn't replay this.
         extras.remove(EXTRA_EMAIL_ID)
         extras.remove(EXTRA_THREAD_ID)
         extras.remove(EXTRA_SUBJECT)
         extras.remove(EXTRA_ACCOUNT_ID)
+        extras.remove(EXTRA_JMAP_ACCOUNT_ID)
         return payload
     }
 
@@ -55,12 +59,14 @@ object NotificationTapStore {
         val threadId: String,
         val subject: String?,
         val accountId: String?,
+        val jmapAccountId: String?,
     ) {
         fun toMap(): WritableMap = Arguments.createMap().apply {
             putString("emailId", emailId)
             putString("threadId", threadId)
             if (subject != null) putString("subject", subject)
             if (accountId != null) putString("accountId", accountId)
+            if (jmapAccountId != null) putString("jmapAccountId", jmapAccountId)
         }
     }
 
@@ -68,4 +74,5 @@ object NotificationTapStore {
     const val EXTRA_THREAD_ID = "bulwark.notification.threadId"
     const val EXTRA_SUBJECT = "bulwark.notification.subject"
     const val EXTRA_ACCOUNT_ID = "bulwark.notification.accountId"
+    const val EXTRA_JMAP_ACCOUNT_ID = "bulwark.notification.jmapAccountId"
 }

android/app/src/main/java/com/anonymous/bulwarkmobile/ShareIntentStore.kt

@@ -1,15 +1,19 @@
 package com.anonymous.bulwarkmobile
 
+import android.content.ContentResolver
 import android.content.Intent
 import android.net.Uri
 import android.os.Build
+import android.provider.OpenableColumns
+import android.webkit.MimeTypeMap
 import com.facebook.react.bridge.Arguments
 import com.facebook.react.bridge.WritableMap
 
 // Process-wide holder for the most recent ACTION_SEND / ACTION_SEND_MULTIPLE
 // intent (the system share sheet). MainActivity fills this on onCreate /
 // onNewIntent; JS drains it via BulwarkFcm.getInitialShare or reacts to the
-// live "app:share" event and opens the composer.
+// live "app:share" event and opens the composer. `SENDTO mailto:` intents are
+// rewritten into `VIEW mailto:` links instead (see rewriteSendToAsView).
 object ShareIntentStore {
     @Volatile
     private var pending: SharePayload? = null
@@ -20,7 +24,7 @@ object ShareIntentStore {
         return value
     }
 
-    fun captureFromIntent(intent: Intent?): SharePayload? {
+    fun captureFromIntent(intent: Intent?, resolver: ContentResolver): SharePayload? {
         val action = intent?.action ?: return null
         if (action != Intent.ACTION_SEND && action != Intent.ACTION_SEND_MULTIPLE) return null
 
@@ -35,11 +39,14 @@ object ShareIntentStore {
         val type = intent.type
 
         if (text.isNullOrBlank() && uris.isEmpty()) return null
+        val files = uris.mapIndexed { i, uri -> describe(resolver, uri, type, i) }
         val payload = SharePayload(
             text = text,
             subject = subject,
             uris = uris.map { it.toString() },
-            mimeTypes = uris.map { type ?: "" },
+            mimeTypes = files.map { it.mimeType },
+            names = files.map { it.name },
+            sizes = files.map { it.size },
         )
         pending = payload
         // Clear so a later lifecycle event doesn't replay this share.
@@ -50,6 +57,80 @@ object ShareIntentStore {
         return payload
     }
 
+    // `SENDTO mailto:` is how most apps start an email, but React Native's
+    // Linking only forwards VIEW intents, so the app opened on the inbox.
+    // Turn it into the equivalent `VIEW mailto:` link, folding the recipient,
+    // subject and text extras into the URI, so it reaches JS like any other
+    // mailto link: Linking.getInitialURL on a cold start, the "url" event
+    // while running. Must run before the intent is handed to React Native.
+    fun rewriteSendToAsView(intent: Intent?) {
+        val action = intent?.action ?: return
+        if (action != Intent.ACTION_SENDTO) return
+        val data = intent.data ?: return
+        if (!"mailto".equals(data.scheme, ignoreCase = true)) return
+
+        val params = mutableListOf<String>()
+        addressExtra(intent, Intent.EXTRA_EMAIL).forEach { params.add("to=${Uri.encode(it)}") }
+        addressExtra(intent, Intent.EXTRA_CC).forEach { params.add("cc=${Uri.encode(it)}") }
+        addressExtra(intent, Intent.EXTRA_BCC).forEach { params.add("bcc=${Uri.encode(it)}") }
+        intent.getCharSequenceExtra(Intent.EXTRA_SUBJECT)?.let {
+            params.add("subject=${Uri.encode(it.toString().take(512))}")
+        }
+        intent.getCharSequenceExtra(Intent.EXTRA_TEXT)?.let {
+            params.add("body=${Uri.encode(it.toString().take(MAX_TEXT))}")
+        }
+
+        val link = data.toString()
+        val separator = if (link.contains('?')) "&" else "?"
+        intent.action = Intent.ACTION_VIEW
+        intent.data = if (params.isEmpty()) data else Uri.parse(link + separator + params.joinToString("&"))
+    }
+
+    // EXTRA_EMAIL/CC/BCC are documented as String[], but some apps put a
+    // single String.
+    private fun addressExtra(intent: Intent, key: String): List<String> =
+        intent.getStringArrayExtra(key)?.filterNotNull() ?: listOfNotNull(intent.getStringExtra(key))
+
+    private class SharedFile(val name: String, val mimeType: String, val size: Double)
+
+    // Ask the provider for the file's real name, type and size: a MediaStore
+    // URI ends in a bare row id ("1000000027") and SEND_MULTIPLE only carries
+    // a wildcard type such as "image/*". Size is -1 when unknown.
+    private fun describe(resolver: ContentResolver, uri: Uri, intentType: String?, index: Int): SharedFile {
+        var displayName: String? = null
+        var size = -1.0
+        try {
+            resolver.query(uri, arrayOf(OpenableColumns.DISPLAY_NAME, OpenableColumns.SIZE), null, null, null)?.use { cursor ->
+                if (cursor.moveToFirst()) {
+                    val nameColumn = cursor.getColumnIndex(OpenableColumns.DISPLAY_NAME)
+                    if (nameColumn >= 0 && !cursor.isNull(nameColumn)) displayName = cursor.getString(nameColumn)
+                    val sizeColumn = cursor.getColumnIndex(OpenableColumns.SIZE)
+                    if (sizeColumn >= 0 && !cursor.isNull(sizeColumn)) size = cursor.getLong(sizeColumn).toDouble()
+                }
+            }
+        } catch (_: Exception) {
+            // Provider without OpenableColumns: fall back to the URI below.
+        }
+        val resolvedType = try {
+            resolver.getType(uri)
+        } catch (_: Exception) {
+            null
+        }
+        val mimeType = resolvedType ?: intentType?.takeUnless { it.contains('*') } ?: ""
+        val name = displayName?.takeIf { it.isNotBlank() } ?: fallbackName(uri, mimeType, index)
+        return SharedFile(name, mimeType, size)
+    }
+
+    // Last path segment plus an extension for the MIME type, so the
+    // recipient's mail client can still open the attachment.
+    private fun fallbackName(uri: Uri, mimeType: String, index: Int): String {
+        val base = uri.lastPathSegment?.substringAfterLast('/')?.takeIf { it.isNotBlank() }
+            ?: "shared-${index + 1}"
+        if (base.contains('.')) return base
+        val extension = MimeTypeMap.getSingleton().getExtensionFromMimeType(mimeType)
+        return if (extension.isNullOrEmpty()) base else "$base.$extension"
+    }
+
     @Suppress("DEPRECATION")
     private fun streamExtra(intent: Intent): Uri? =
         if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.TIRAMISU) {
@@ -71,12 +152,16 @@ object ShareIntentStore {
         val subject: String?,
         val uris: List<String>,
         val mimeTypes: List<String>,
+        val names: List<String>,
+        val sizes: List<Double>,
     ) {
         fun toMap(): WritableMap = Arguments.createMap().apply {
             if (text != null) putString("text", text)
             if (subject != null) putString("subject", subject)
             putArray("uris", Arguments.fromList(uris))
             putArray("mimeTypes", Arguments.fromList(mimeTypes))
+            putArray("names", Arguments.fromList(names))
+            putArray("sizes", Arguments.fromList(sizes))
         }
     }
 

android/app/src/main/java/com/anonymous/bulwarkmobile/widget/WidgetProviders.kt

@@ -0,0 +1,40 @@
+// Generated by scripts/sync-android-widgets.mjs from src/widgets/catalog.json.
+// react-native-android-widget names a widget after its provider class, so each
+// widget needs its own subclass; the JS side (src/widgets/task-handler.tsx)
+// renders by that name.
+package com.anonymous.bulwarkmobile.widget
+
+import com.reactnativeandroidwidget.RNWidgetProvider
+
+class InboxWidget : RNWidgetProvider()
+class TriageWidget : RNWidgetProvider()
+class UnreadCountWidget : RNWidgetProvider()
+class LatestMessageWidget : RNWidgetProvider()
+class FolderCountsWidget : RNWidgetProvider()
+class MailShortcutsWidget : RNWidgetProvider()
+class AllAccountsWidget : RNWidgetProvider()
+class StarredWidget : RNWidgetProvider()
+class FavouritePeopleWidget : RNWidgetProvider()
+class MailSearchWidget : RNWidgetProvider()
+class OutboxWidget : RNWidgetProvider()
+class TagWidget : RNWidgetProvider()
+class LastDraftWidget : RNWidgetProvider()
+class AgendaWidget : RNWidgetProvider()
+class WeekWidget : RNWidgetProvider()
+class MonthWidget : RNWidgetProvider()
+class TodayEventsWidget : RNWidgetProvider()
+class NextEventWidget : RNWidgetProvider()
+class DateNextWidget : RNWidgetProvider()
+class UpNextWidget : RNWidgetProvider()
+class InvitationsWidget : RNWidgetProvider()
+class FreeTimeWidget : RNWidgetProvider()
+class TasksWidget : RNWidgetProvider()
+class TaskProgressWidget : RNWidgetProvider()
+class CountdownWidget : RNWidgetProvider()
+class BirthdaysWidget : RNWidgetProvider()
+class TodayHubWidget : RNWidgetProvider()
+class MailAndNextWidget : RNWidgetProvider()
+class RecentFilesWidget : RNWidgetProvider()
+class AttachmentsWidget : RNWidgetProvider()
+class VacationWidget : RNWidgetProvider()
+class StorageWidget : RNWidgetProvider()

android/app/src/main/res/drawable/ic_notification.xml

@@ -0,0 +1,29 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!-- Status-bar icon for mail notifications: the Bulwark shield from
+     assets/logos/Bulwark Logo White.svg, white on transparent. Android draws
+     only the alpha channel of a small icon; the group scale keeps the shield
+     inside the 22dp live area of the 24dp canvas. -->
+<vector xmlns:android="http://schemas.android.com/apk/res/android"
+    android:width="24dp"
+    android:height="24dp"
+    android:viewportWidth="1000"
+    android:viewportHeight="1000">
+    <group
+        android:pivotX="500"
+        android:pivotY="500"
+        android:scaleX="0.9"
+        android:scaleY="0.9">
+        <path
+            android:fillColor="#FFFFFFFF"
+            android:pathData="M 373.467 557.247 L 55.226 271.52 L 55.226 385.564 C 55.226 398.153 62.453 415.6 71.355 424.501 L 107.525 460.671 C 116.426 469.573 123.653 487.02 123.653 499.609 L 123.653 682.08 C 123.655 718.462 133.336 750.017 152.047 778.668 L 373.467 557.247 Z" />
+        <path
+            android:fillColor="#FFFFFFFF"
+            android:pathData="M 626.533 557.247 L 944.774 271.52 L 944.774 396.969 C 944.774 403.263 941.16 411.987 936.709 416.437 L 884.411 468.736 C 879.96 473.186 876.347 481.91 876.347 488.204 L 876.347 682.08 C 876.345 718.462 866.664 750.017 847.953 778.668 L 626.533 557.247 Z" />
+        <path
+            android:fillColor="#FFFFFFFF"
+            android:pathData="M 500 638.743 L 500 638.743 C 466.206 638.738 448.855 625.316 424.448 603.033 L 197.809 829.672 C 261.382 884.635 364.213 931.859 500 990 Q 500 990 500 990 C 635.787 931.859 738.618 884.635 802.191 829.672 L 575.552 603.033 C 551.145 625.316 533.794 638.738 500 638.743 Z" />
+        <path
+            android:fillColor="#FFFFFFFF"
+            android:pathData="M 483.028 563.647 L 63.713 187.183 C 59.029 182.978 55.226 174.454 55.226 168.159 L 55.226 122.542 C 55.226 116.247 60.206 109.988 66.339 108.573 L 215.181 74.225 C 221.314 72.809 226.293 76.77 226.293 83.065 L 226.293 176.92 L 352.034 147.895 C 358.167 146.479 363.147 140.219 363.147 133.925 L 363.147 51.483 C 363.147 45.189 368.126 38.93 374.259 37.514 L 488.888 11.061 C 495.021 9.646 504.979 9.646 511.112 11.061 L 625.741 37.514 C 631.874 38.93 636.853 45.189 636.853 51.483 L 636.853 133.925 C 636.853 140.219 641.833 146.479 647.966 147.895 L 773.707 176.92 L 773.707 83.065 C 773.707 76.77 778.686 72.809 784.819 74.225 L 933.661 108.573 C 939.794 109.988 944.774 116.247 944.774 122.542 L 944.774 168.159 C 944.774 174.454 940.971 182.978 936.287 187.183 L 516.972 563.647 C 507.605 572.056 492.395 572.056 483.028 563.647 Z" />
+    </group>
+</vector>

android/app/src/main/res/drawable/widget_frame.xml

@@ -0,0 +1,9 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!-- Home-screen widget edge, drawn over the widget by layout/rn_widget.xml. -->
+<shape xmlns:android="http://schemas.android.com/apk/res/android"
+    android:shape="rectangle">
+    <stroke
+        android:width="1dp"
+        android:color="@color/widget_frame" />
+    <corners android:radius="@dimen/widget_radius" />
+</shape>

android/app/src/main/res/drawable/widget_surface.xml

@@ -0,0 +1,7 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!-- Home-screen widget root (layout/rn_widget.xml): its rounded outline is what the widget clips to. -->
+<shape xmlns:android="http://schemas.android.com/apk/res/android"
+    android:shape="rectangle">
+    <solid android:color="@color/widget_surface" />
+    <corners android:radius="@dimen/widget_radius" />
+</shape>

android/app/src/main/res/layout-night/rn_widget.xml

@@ -0,0 +1,38 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!-- Night twin of layout/rn_widget.xml, which explains the override. -->
+<FrameLayout xmlns:android="http://schemas.android.com/apk/res/android"
+    xmlns:tools="http://schemas.android.com/tools"
+    android:id="@android:id/background"
+    android:layout_width="match_parent"
+    android:layout_height="match_parent"
+    android:background="@drawable/widget_surface"
+    android:clipToOutline="true"
+    android:foreground="@drawable/widget_frame"
+    tools:targetApi="31">
+
+    <ImageView
+        android:id="@+id/rn_widget_image_light"
+        android:layout_width="match_parent"
+        android:layout_height="match_parent"
+        android:background="@android:color/transparent"
+        android:scaleType="matrix"
+        android:visibility="gone" />
+
+    <ImageView
+        android:id="@+id/rn_widget_image_dark"
+        android:layout_width="match_parent"
+        android:layout_height="match_parent"
+        android:background="@android:color/transparent"
+        android:scaleType="matrix"
+        android:visibility="visible" />
+
+    <FrameLayout
+        android:id="@+id/rn_widget_clickable_container"
+        android:layout_width="match_parent"
+        android:layout_height="match_parent" />
+
+    <FrameLayout
+        android:id="@+id/rn_widget_collection_container"
+        android:layout_width="match_parent"
+        android:layout_height="match_parent" />
+</FrameLayout>

android/app/src/main/res/layout/rn_widget.xml

@@ -0,0 +1,50 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!--
+  Overrides react-native-android-widget's rn_widget.xml (same ids and children;
+  layout-night/rn_widget.xml is its night twin).
+
+  The library draws each widget into one bitmap sized from the size the
+  launcher reports, and pins it to the top left without scaling. When the real
+  frame is smaller (after a rotation, or on a launcher that over-reports), the
+  bitmap's bottom edge is cut off and takes the rounded corners and the border
+  with it, so the bottom corners fall back to whatever the launcher clips to.
+  This root always has the real size, so it owns the shape instead: it clips to
+  a rounded outline (Android 12+; the launcher then leaves the corners to us),
+  fills in where the bitmap falls short, and draws the frame on top.
+-->
+<FrameLayout xmlns:android="http://schemas.android.com/apk/res/android"
+    xmlns:tools="http://schemas.android.com/tools"
+    android:id="@android:id/background"
+    android:layout_width="match_parent"
+    android:layout_height="match_parent"
+    android:background="@drawable/widget_surface"
+    android:clipToOutline="true"
+    android:foreground="@drawable/widget_frame"
+    tools:targetApi="31">
+
+    <ImageView
+        android:id="@+id/rn_widget_image_light"
+        android:layout_width="match_parent"
+        android:layout_height="match_parent"
+        android:background="@android:color/transparent"
+        android:scaleType="matrix"
+        android:visibility="visible" />
+
+    <ImageView
+        android:id="@+id/rn_widget_image_dark"
+        android:layout_width="match_parent"
+        android:layout_height="match_parent"
+        android:background="@android:color/transparent"
+        android:scaleType="matrix"
+        android:visibility="gone" />
+
+    <FrameLayout
+        android:id="@+id/rn_widget_clickable_container"
+        android:layout_width="match_parent"
+        android:layout_height="match_parent" />
+
+    <FrameLayout
+        android:id="@+id/rn_widget_collection_container"
+        android:layout_width="match_parent"
+        android:layout_height="match_parent" />
+</FrameLayout>

android/app/src/main/res/values-night/colors.xml

@@ -1 +1,8 @@
-<resources/>
+<resources>
+  <!-- As `splash.dark.backgroundColor` in app.config.js. -->
+  <color name="splashscreen_background">#09090b</color>
+  <!-- Matches the dark palette background (src/theme/tokens.ts). -->
+  <color name="window_background">#09090b</color>
+  <!-- DARK.bg in src/widgets/theme.ts. -->
+  <color name="widget_surface">#0a0a0a</color>
+</resources>

android/app/src/main/res/values/colors.xml

@@ -1,6 +1,13 @@
 <resources>
-  <color name="splashscreen_background">#09090b</color>
+  <!-- Splash background, as `splash.backgroundColor` in app.config.js; the dark one is in values-night. -->
+  <color name="splashscreen_background">#ffffff</color>
   <color name="iconBackground">#09090b</color>
   <color name="colorPrimary">#023c69</color>
   <color name="colorPrimaryDark">#09090b</color>
+  <!-- Behind the React root until the first frame; matches the light palette background (src/theme/tokens.ts). -->
+  <color name="window_background">#ffffff</color>
+  <!-- Home-screen widget surface (LIGHT.bg in src/widgets/theme.ts); it only shows where the drawn widget falls short of the launcher's frame. -->
+  <color name="widget_surface">#ffffff</color>
+  <!-- Home-screen widget edge, one colour for both schemes: the app can force a theme the launcher's night mode doesn't know about. -->
+  <color name="widget_frame">#4d808080</color>
 </resources>

android/app/src/main/res/values/dimens.xml

@@ -0,0 +1,4 @@
+<resources>
+  <!-- Home-screen widget corners; WIDGET_RADIUS in src/widgets/primitives.tsx. -->
+  <dimen name="widget_radius">22dp</dimen>
+</resources>

android/app/src/main/res/values/styles.xml

@@ -4,6 +4,7 @@
     <item name="android:editTextBackground">@drawable/rn_edit_text_material</item>
     <item name="colorPrimary">@color/colorPrimary</item>
     <item name="android:statusBarColor">#09090b</item>
+    <item name="android:windowBackground">@color/window_background</item>
   </style>
   <style name="Theme.App.SplashScreen" parent="AppTheme">
     <item name="android:windowBackground">@drawable/ic_launcher_background</item>

android/app/src/main/res/values/widget_strings.xml

@@ -0,0 +1,68 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!-- Generated by scripts/sync-android-widgets.mjs from src/widgets/catalog.json. -->
+<resources>
+  <string name="widgetprovider_inboxwidget_label">Inbox</string>
+  <string name="widgetprovider_inboxwidget_description">Newest messages with sender, time and subject. Taller sizes add avatars and a line of preview.</string>
+  <string name="widgetprovider_triagewidget_label">Triage</string>
+  <string name="widgetprovider_triagewidget_description">One unread message at a time with archive, delete and reply buttons.</string>
+  <string name="widgetprovider_unreadcountwidget_label">Unread count</string>
+  <string name="widgetprovider_unreadcountwidget_description">Unread count for the inbox, with the latest senders.</string>
+  <string name="widgetprovider_latestmessagewidget_label">Latest message</string>
+  <string name="widgetprovider_latestmessagewidget_description">Only the newest unread message.</string>
+  <string name="widgetprovider_foldercountswidget_label">Folder counts</string>
+  <string name="widgetprovider_foldercountswidget_description">Unread counts for up to four folders.</string>
+  <string name="widgetprovider_mailshortcutswidget_label">Shortcuts</string>
+  <string name="widgetprovider_mailshortcutswidget_description">Compose, calendar, contacts and files.</string>
+  <string name="widgetprovider_allaccountswidget_label">All accounts</string>
+  <string name="widgetprovider_allaccountswidget_description">The unified inbox across every signed-in account.</string>
+  <string name="widgetprovider_starredwidget_label">Starred</string>
+  <string name="widgetprovider_starredwidget_description">Starred messages, newest first.</string>
+  <string name="widgetprovider_favouritepeoplewidget_label">Favourite people</string>
+  <string name="widgetprovider_favouritepeoplewidget_description">The people you hear from most, with their unread count.</string>
+  <string name="widgetprovider_mailsearchwidget_label">Search mail</string>
+  <string name="widgetprovider_mailsearchwidget_description">Search bar with your recent searches.</string>
+  <string name="widgetprovider_outboxwidget_label">Scheduled and outbox</string>
+  <string name="widgetprovider_outboxwidget_description">Scheduled messages and anything waiting in the outbox.</string>
+  <string name="widgetprovider_tagwidget_label">Tag</string>
+  <string name="widgetprovider_tagwidget_description">Unread count for your busiest tag.</string>
+  <string name="widgetprovider_lastdraftwidget_label">Last draft</string>
+  <string name="widgetprovider_lastdraftwidget_description">Back into the draft you left.</string>
+  <string name="widgetprovider_agendawidget_label">Agenda</string>
+  <string name="widgetprovider_agendawidget_description">Upcoming events by day with time, colour and place.</string>
+  <string name="widgetprovider_weekwidget_label">This week</string>
+  <string name="widgetprovider_weekwidget_description">The week at a glance from 8:00 to 18:00.</string>
+  <string name="widgetprovider_monthwidget_label">Month</string>
+  <string name="widgetprovider_monthwidget_description">Month grid with a dot per calendar and the next two events.</string>
+  <string name="widgetprovider_todayeventswidget_label">Today</string>
+  <string name="widgetprovider_todayeventswidget_description">Today\'s date with the rest of today and tomorrow.</string>
+  <string name="widgetprovider_nexteventwidget_label">Next event</string>
+  <string name="widgetprovider_nexteventwidget_description">What\'s next, when and where.</string>
+  <string name="widgetprovider_datenextwidget_label">Date and next two</string>
+  <string name="widgetprovider_datenextwidget_description">Today\'s date with the next two events.</string>
+  <string name="widgetprovider_upnextwidget_label">Up next</string>
+  <string name="widgetprovider_upnextwidget_description">Countdown to the next event with join and running-late buttons.</string>
+  <string name="widgetprovider_invitationswidget_label">Invitations</string>
+  <string name="widgetprovider_invitationswidget_description">Pending invitations with accept, maybe and decline.</string>
+  <string name="widgetprovider_freetimewidget_label">Free time</string>
+  <string name="widgetprovider_freetimewidget_description">When you\'re free this week.</string>
+  <string name="widgetprovider_taskswidget_label">Tasks</string>
+  <string name="widgetprovider_taskswidget_description">Open tasks with tick boxes that work from the home screen.</string>
+  <string name="widgetprovider_taskprogresswidget_label">Task progress</string>
+  <string name="widgetprovider_taskprogresswidget_description">How many tasks are done.</string>
+  <string name="widgetprovider_countdownwidget_label">Countdown</string>
+  <string name="widgetprovider_countdownwidget_description">Days until your next all-day event.</string>
+  <string name="widgetprovider_birthdayswidget_label">Birthdays</string>
+  <string name="widgetprovider_birthdayswidget_description">Upcoming birthdays from your contacts.</string>
+  <string name="widgetprovider_todayhubwidget_label">Today overview</string>
+  <string name="widgetprovider_todayhubwidget_description">Next event, newest unread mail and tasks due, in one widget.</string>
+  <string name="widgetprovider_mailandnextwidget_label">Mail and next event</string>
+  <string name="widgetprovider_mailandnextwidget_description">Unread mail on one side, the next event on the other.</string>
+  <string name="widgetprovider_recentfileswidget_label">Recent files</string>
+  <string name="widgetprovider_recentfileswidget_description">Recently changed items in Files.</string>
+  <string name="widgetprovider_attachmentswidget_label">Recent attachments</string>
+  <string name="widgetprovider_attachmentswidget_description">The newest attachments from your mail.</string>
+  <string name="widgetprovider_vacationwidget_label">Vacation responder</string>
+  <string name="widgetprovider_vacationwidget_description">Vacation responder status with an on/off switch.</string>
+  <string name="widgetprovider_storagewidget_label">Storage</string>
+  <string name="widgetprovider_storagewidget_description">How much of your mailbox quota is used.</string>
+</resources>

android/app/src/main/res/xml/widgetprovider_agendawidget.xml

@@ -0,0 +1,16 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!-- Generated by scripts/sync-android-widgets.mjs from src/widgets/catalog.json. -->
+<appwidget-provider xmlns:android="http://schemas.android.com/apk/res/android"
+    android:minWidth="250dp"
+    android:minHeight="250dp"
+    android:minResizeWidth="180dp"
+    android:minResizeHeight="110dp"
+    android:targetCellWidth="4"
+    android:targetCellHeight="4"
+    android:resizeMode="horizontal|vertical"
+    android:description="@string/widgetprovider_agendawidget_description"
+    android:initialLayout="@layout/rn_widget"
+    android:previewImage="@drawable/agendawidget_preview"
+    android:updatePeriodMillis="1800000"
+    android:widgetCategory="home_screen">
+</appwidget-provider>

android/app/src/main/res/xml/widgetprovider_allaccountswidget.xml

@@ -0,0 +1,16 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!-- Generated by scripts/sync-android-widgets.mjs from src/widgets/catalog.json. -->
+<appwidget-provider xmlns:android="http://schemas.android.com/apk/res/android"
+    android:minWidth="250dp"
+    android:minHeight="110dp"
+    android:minResizeWidth="180dp"
+    android:minResizeHeight="110dp"
+    android:targetCellWidth="4"
+    android:targetCellHeight="2"
+    android:resizeMode="horizontal|vertical"
+    android:description="@string/widgetprovider_allaccountswidget_description"
+    android:initialLayout="@layout/rn_widget"
+    android:previewImage="@drawable/allaccountswidget_preview"
+    android:updatePeriodMillis="1800000"
+    android:widgetCategory="home_screen">
+</appwidget-provider>

android/app/src/main/res/xml/widgetprovider_attachmentswidget.xml

@@ -0,0 +1,16 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!-- Generated by scripts/sync-android-widgets.mjs from src/widgets/catalog.json. -->
+<appwidget-provider xmlns:android="http://schemas.android.com/apk/res/android"
+    android:minWidth="250dp"
+    android:minHeight="110dp"
+    android:minResizeWidth="180dp"
+    android:minResizeHeight="110dp"
+    android:targetCellWidth="4"
+    android:targetCellHeight="2"
+    android:resizeMode="horizontal|vertical"
+    android:description="@string/widgetprovider_attachmentswidget_description"
+    android:initialLayout="@layout/rn_widget"
+    android:previewImage="@drawable/attachmentswidget_preview"
+    android:updatePeriodMillis="1800000"
+    android:widgetCategory="home_screen">
+</appwidget-provider>

android/app/src/main/res/xml/widgetprovider_birthdayswidget.xml

@@ -0,0 +1,16 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!-- Generated by scripts/sync-android-widgets.mjs from src/widgets/catalog.json. -->
+<appwidget-provider xmlns:android="http://schemas.android.com/apk/res/android"
+    android:minWidth="250dp"
+    android:minHeight="110dp"
+    android:minResizeWidth="180dp"
+    android:minResizeHeight="110dp"
+    android:targetCellWidth="4"
+    android:targetCellHeight="2"
+    android:resizeMode="horizontal|vertical"
+    android:description="@string/widgetprovider_birthdayswidget_description"
+    android:initialLayout="@layout/rn_widget"
+    android:previewImage="@drawable/birthdayswidget_preview"
+    android:updatePeriodMillis="1800000"
+    android:widgetCategory="home_screen">
+</appwidget-provider>

android/app/src/main/res/xml/widgetprovider_countdownwidget.xml

@@ -0,0 +1,16 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!-- Generated by scripts/sync-android-widgets.mjs from src/widgets/catalog.json. -->
+<appwidget-provider xmlns:android="http://schemas.android.com/apk/res/android"
+    android:minWidth="110dp"
+    android:minHeight="110dp"
+    android:minResizeWidth="110dp"
+    android:minResizeHeight="110dp"
+    android:targetCellWidth="2"
+    android:targetCellHeight="2"
+    android:resizeMode="horizontal|vertical"
+    android:description="@string/widgetprovider_countdownwidget_description"
+    android:initialLayout="@layout/rn_widget"
+    android:previewImage="@drawable/countdownwidget_preview"
+    android:updatePeriodMillis="1800000"
+    android:widgetCategory="home_screen">
+</appwidget-provider>

android/app/src/main/res/xml/widgetprovider_datenextwidget.xml

@@ -0,0 +1,16 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!-- Generated by scripts/sync-android-widgets.mjs from src/widgets/catalog.json. -->
+<appwidget-provider xmlns:android="http://schemas.android.com/apk/res/android"
+    android:minWidth="110dp"
+    android:minHeight="110dp"
+    android:minResizeWidth="110dp"
+    android:minResizeHeight="110dp"
+    android:targetCellWidth="2"
+    android:targetCellHeight="2"
+    android:resizeMode="horizontal|vertical"
+    android:description="@string/widgetprovider_datenextwidget_description"
+    android:initialLayout="@layout/rn_widget"
+    android:previewImage="@drawable/datenextwidget_preview"
+    android:updatePeriodMillis="1800000"
+    android:widgetCategory="home_screen">
+</appwidget-provider>

android/app/src/main/res/xml/widgetprovider_favouritepeoplewidget.xml

@@ -0,0 +1,16 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!-- Generated by scripts/sync-android-widgets.mjs from src/widgets/catalog.json. -->
+<appwidget-provider xmlns:android="http://schemas.android.com/apk/res/android"
+    android:minWidth="250dp"
+    android:minHeight="110dp"
+    android:minResizeWidth="180dp"
+    android:minResizeHeight="110dp"
+    android:targetCellWidth="4"
+    android:targetCellHeight="2"
+    android:resizeMode="horizontal|vertical"
+    android:description="@string/widgetprovider_favouritepeoplewidget_description"
+    android:initialLayout="@layout/rn_widget"
+    android:previewImage="@drawable/favouritepeoplewidget_preview"
+    android:updatePeriodMillis="1800000"
+    android:widgetCategory="home_screen">
+</appwidget-provider>

android/app/src/main/res/xml/widgetprovider_foldercountswidget.xml

@@ -0,0 +1,16 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!-- Generated by scripts/sync-android-widgets.mjs from src/widgets/catalog.json. -->
+<appwidget-provider xmlns:android="http://schemas.android.com/apk/res/android"
+    android:minWidth="110dp"
+    android:minHeight="110dp"
+    android:minResizeWidth="110dp"
+    android:minResizeHeight="110dp"
+    android:targetCellWidth="2"
+    android:targetCellHeight="2"
+    android:resizeMode="horizontal|vertical"
+    android:description="@string/widgetprovider_foldercountswidget_description"
+    android:initialLayout="@layout/rn_widget"
+    android:previewImage="@drawable/foldercountswidget_preview"
+    android:updatePeriodMillis="1800000"
+    android:widgetCategory="home_screen">
+</appwidget-provider>

android/app/src/main/res/xml/widgetprovider_freetimewidget.xml

@@ -0,0 +1,16 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!-- Generated by scripts/sync-android-widgets.mjs from src/widgets/catalog.json. -->
+<appwidget-provider xmlns:android="http://schemas.android.com/apk/res/android"
+    android:minWidth="250dp"
+    android:minHeight="110dp"
+    android:minResizeWidth="180dp"
+    android:minResizeHeight="110dp"
+    android:targetCellWidth="4"
+    android:targetCellHeight="2"
+    android:resizeMode="horizontal|vertical"
+    android:description="@string/widgetprovider_freetimewidget_description"
+    android:initialLayout="@layout/rn_widget"
+    android:previewImage="@drawable/freetimewidget_preview"
+    android:updatePeriodMillis="1800000"
+    android:widgetCategory="home_screen">
+</appwidget-provider>

android/app/src/main/res/xml/widgetprovider_inboxwidget.xml

@@ -0,0 +1,16 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!-- Generated by scripts/sync-android-widgets.mjs from src/widgets/catalog.json. -->
+<appwidget-provider xmlns:android="http://schemas.android.com/apk/res/android"
+    android:minWidth="250dp"
+    android:minHeight="110dp"
+    android:minResizeWidth="110dp"
+    android:minResizeHeight="110dp"
+    android:targetCellWidth="4"
+    android:targetCellHeight="2"
+    android:resizeMode="horizontal|vertical"
+    android:description="@string/widgetprovider_inboxwidget_description"
+    android:initialLayout="@layout/rn_widget"
+    android:previewImage="@drawable/inboxwidget_preview"
+    android:updatePeriodMillis="1800000"
+    android:widgetCategory="home_screen">
+</appwidget-provider>

android/app/src/main/res/xml/widgetprovider_invitationswidget.xml

@@ -0,0 +1,16 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!-- Generated by scripts/sync-android-widgets.mjs from src/widgets/catalog.json. -->
+<appwidget-provider xmlns:android="http://schemas.android.com/apk/res/android"
+    android:minWidth="250dp"
+    android:minHeight="110dp"
+    android:minResizeWidth="180dp"
+    android:minResizeHeight="110dp"
+    android:targetCellWidth="4"
+    android:targetCellHeight="2"
+    android:resizeMode="horizontal|vertical"
+    android:description="@string/widgetprovider_invitationswidget_description"
+    android:initialLayout="@layout/rn_widget"
+    android:previewImage="@drawable/invitationswidget_preview"
+    android:updatePeriodMillis="1800000"
+    android:widgetCategory="home_screen">
+</appwidget-provider>

android/app/src/main/res/xml/widgetprovider_lastdraftwidget.xml

@@ -0,0 +1,16 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!-- Generated by scripts/sync-android-widgets.mjs from src/widgets/catalog.json. -->
+<appwidget-provider xmlns:android="http://schemas.android.com/apk/res/android"
+    android:minWidth="110dp"
+    android:minHeight="110dp"
+    android:minResizeWidth="110dp"
+    android:minResizeHeight="110dp"
+    android:targetCellWidth="2"
+    android:targetCellHeight="2"
+    android:resizeMode="horizontal|vertical"
+    android:description="@string/widgetprovider_lastdraftwidget_description"
+    android:initialLayout="@layout/rn_widget"
+    android:previewImage="@drawable/lastdraftwidget_preview"
+    android:updatePeriodMillis="1800000"
+    android:widgetCategory="home_screen">
+</appwidget-provider>

android/app/src/main/res/xml/widgetprovider_latestmessagewidget.xml

@@ -0,0 +1,16 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!-- Generated by scripts/sync-android-widgets.mjs from src/widgets/catalog.json. -->
+<appwidget-provider xmlns:android="http://schemas.android.com/apk/res/android"
+    android:minWidth="110dp"
+    android:minHeight="110dp"
+    android:minResizeWidth="110dp"
+    android:minResizeHeight="110dp"
+    android:targetCellWidth="2"
+    android:targetCellHeight="2"
+    android:resizeMode="horizontal|vertical"
+    android:description="@string/widgetprovider_latestmessagewidget_description"
+    android:initialLayout="@layout/rn_widget"
+    android:previewImage="@drawable/latestmessagewidget_preview"
+    android:updatePeriodMillis="1800000"
+    android:widgetCategory="home_screen">
+</appwidget-provider>

android/app/src/main/res/xml/widgetprovider_mailandnextwidget.xml

@@ -0,0 +1,16 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!-- Generated by scripts/sync-android-widgets.mjs from src/widgets/catalog.json. -->
+<appwidget-provider xmlns:android="http://schemas.android.com/apk/res/android"
+    android:minWidth="250dp"
+    android:minHeight="110dp"
+    android:minResizeWidth="180dp"
+    android:minResizeHeight="110dp"
+    android:targetCellWidth="4"
+    android:targetCellHeight="2"
+    android:resizeMode="horizontal|vertical"
+    android:description="@string/widgetprovider_mailandnextwidget_description"
+    android:initialLayout="@layout/rn_widget"
+    android:previewImage="@drawable/mailandnextwidget_preview"
+    android:updatePeriodMillis="1800000"
+    android:widgetCategory="home_screen">
+</appwidget-provider>

android/app/src/main/res/xml/widgetprovider_mailsearchwidget.xml

@@ -0,0 +1,16 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!-- Generated by scripts/sync-android-widgets.mjs from src/widgets/catalog.json. -->
+<appwidget-provider xmlns:android="http://schemas.android.com/apk/res/android"
+    android:minWidth="250dp"
+    android:minHeight="110dp"
+    android:minResizeWidth="180dp"
+    android:minResizeHeight="40dp"
+    android:targetCellWidth="4"
+    android:targetCellHeight="2"
+    android:resizeMode="horizontal|vertical"
+    android:description="@string/widgetprovider_mailsearchwidget_description"
+    android:initialLayout="@layout/rn_widget"
+    android:previewImage="@drawable/mailsearchwidget_preview"
+    android:updatePeriodMillis="1800000"
+    android:widgetCategory="home_screen">
+</appwidget-provider>

android/app/src/main/res/xml/widgetprovider_mailshortcutswidget.xml

@@ -0,0 +1,16 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!-- Generated by scripts/sync-android-widgets.mjs from src/widgets/catalog.json. -->
+<appwidget-provider xmlns:android="http://schemas.android.com/apk/res/android"
+    android:minWidth="110dp"
+    android:minHeight="110dp"
+    android:minResizeWidth="110dp"
+    android:minResizeHeight="110dp"
+    android:targetCellWidth="2"
+    android:targetCellHeight="2"
+    android:resizeMode="horizontal|vertical"
+    android:description="@string/widgetprovider_mailshortcutswidget_description"
+    android:initialLayout="@layout/rn_widget"
+    android:previewImage="@drawable/mailshortcutswidget_preview"
+    android:updatePeriodMillis="0"
+    android:widgetCategory="home_screen">
+</appwidget-provider>

android/app/src/main/res/xml/widgetprovider_monthwidget.xml

@@ -0,0 +1,16 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!-- Generated by scripts/sync-android-widgets.mjs from src/widgets/catalog.json. -->
+<appwidget-provider xmlns:android="http://schemas.android.com/apk/res/android"
+    android:minWidth="250dp"
+    android:minHeight="250dp"
+    android:minResizeWidth="180dp"
+    android:minResizeHeight="180dp"
+    android:targetCellWidth="4"
+    android:targetCellHeight="4"
+    android:resizeMode="horizontal|vertical"
+    android:description="@string/widgetprovider_monthwidget_description"
+    android:initialLayout="@layout/rn_widget"
+    android:previewImage="@drawable/monthwidget_preview"
+    android:updatePeriodMillis="1800000"
+    android:widgetCategory="home_screen">
+</appwidget-provider>

android/app/src/main/res/xml/widgetprovider_nexteventwidget.xml

@@ -0,0 +1,16 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!-- Generated by scripts/sync-android-widgets.mjs from src/widgets/catalog.json. -->
+<appwidget-provider xmlns:android="http://schemas.android.com/apk/res/android"
+    android:minWidth="110dp"
+    android:minHeight="110dp"
+    android:minResizeWidth="110dp"
+    android:minResizeHeight="110dp"
+    android:targetCellWidth="2"
+    android:targetCellHeight="2"
+    android:resizeMode="horizontal|vertical"
+    android:description="@string/widgetprovider_nexteventwidget_description"
+    android:initialLayout="@layout/rn_widget"
+    android:previewImage="@drawable/nexteventwidget_preview"
+    android:updatePeriodMillis="1800000"
+    android:widgetCategory="home_screen">
+</appwidget-provider>

android/app/src/main/res/xml/widgetprovider_outboxwidget.xml

@@ -0,0 +1,16 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!-- Generated by scripts/sync-android-widgets.mjs from src/widgets/catalog.json. -->
+<appwidget-provider xmlns:android="http://schemas.android.com/apk/res/android"
+    android:minWidth="250dp"
+    android:minHeight="110dp"
+    android:minResizeWidth="180dp"
+    android:minResizeHeight="110dp"
+    android:targetCellWidth="4"
+    android:targetCellHeight="2"
+    android:resizeMode="horizontal|vertical"
+    android:description="@string/widgetprovider_outboxwidget_description"
+    android:initialLayout="@layout/rn_widget"
+    android:previewImage="@drawable/outboxwidget_preview"
+    android:updatePeriodMillis="1800000"
+    android:widgetCategory="home_screen">
+</appwidget-provider>

android/app/src/main/res/xml/widgetprovider_recentfileswidget.xml

@@ -0,0 +1,16 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!-- Generated by scripts/sync-android-widgets.mjs from src/widgets/catalog.json. -->
+<appwidget-provider xmlns:android="http://schemas.android.com/apk/res/android"
+    android:minWidth="250dp"
+    android:minHeight="110dp"
+    android:minResizeWidth="180dp"
+    android:minResizeHeight="110dp"
+    android:targetCellWidth="4"
+    android:targetCellHeight="2"
+    android:resizeMode="horizontal|vertical"
+    android:description="@string/widgetprovider_recentfileswidget_description"
+    android:initialLayout="@layout/rn_widget"
+    android:previewImage="@drawable/recentfileswidget_preview"
+    android:updatePeriodMillis="1800000"
+    android:widgetCategory="home_screen">
+</appwidget-provider>

android/app/src/main/res/xml/widgetprovider_starredwidget.xml

@@ -0,0 +1,16 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!-- Generated by scripts/sync-android-widgets.mjs from src/widgets/catalog.json. -->
+<appwidget-provider xmlns:android="http://schemas.android.com/apk/res/android"
+    android:minWidth="250dp"
+    android:minHeight="110dp"
+    android:minResizeWidth="180dp"
+    android:minResizeHeight="110dp"
+    android:targetCellWidth="4"
+    android:targetCellHeight="2"
+    android:resizeMode="horizontal|vertical"
+    android:description="@string/widgetprovider_starredwidget_description"
+    android:initialLayout="@layout/rn_widget"
+    android:previewImage="@drawable/starredwidget_preview"
+    android:updatePeriodMillis="1800000"
+    android:widgetCategory="home_screen">
+</appwidget-provider>

android/app/src/main/res/xml/widgetprovider_storagewidget.xml

@@ -0,0 +1,16 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!-- Generated by scripts/sync-android-widgets.mjs from src/widgets/catalog.json. -->
+<appwidget-provider xmlns:android="http://schemas.android.com/apk/res/android"
+    android:minWidth="110dp"
+    android:minHeight="110dp"
+    android:minResizeWidth="110dp"
+    android:minResizeHeight="110dp"
+    android:targetCellWidth="2"
+    android:targetCellHeight="2"
+    android:resizeMode="horizontal|vertical"
+    android:description="@string/widgetprovider_storagewidget_description"
+    android:initialLayout="@layout/rn_widget"
+    android:previewImage="@drawable/storagewidget_preview"
+    android:updatePeriodMillis="1800000"
+    android:widgetCategory="home_screen">
+</appwidget-provider>

android/app/src/main/res/xml/widgetprovider_tagwidget.xml

@@ -0,0 +1,16 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!-- Generated by scripts/sync-android-widgets.mjs from src/widgets/catalog.json. -->
+<appwidget-provider xmlns:android="http://schemas.android.com/apk/res/android"
+    android:minWidth="110dp"
+    android:minHeight="110dp"
+    android:minResizeWidth="110dp"
+    android:minResizeHeight="110dp"
+    android:targetCellWidth="2"
+    android:targetCellHeight="2"
+    android:resizeMode="horizontal|vertical"
+    android:description="@string/widgetprovider_tagwidget_description"
+    android:initialLayout="@layout/rn_widget"
+    android:previewImage="@drawable/tagwidget_preview"
+    android:updatePeriodMillis="1800000"
+    android:widgetCategory="home_screen">
+</appwidget-provider>

android/app/src/main/res/xml/widgetprovider_taskprogresswidget.xml

@@ -0,0 +1,16 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!-- Generated by scripts/sync-android-widgets.mjs from src/widgets/catalog.json. -->
+<appwidget-provider xmlns:android="http://schemas.android.com/apk/res/android"
+    android:minWidth="110dp"
+    android:minHeight="110dp"
+    android:minResizeWidth="110dp"
+    android:minResizeHeight="110dp"
+    android:targetCellWidth="2"
+    android:targetCellHeight="2"
+    android:resizeMode="horizontal|vertical"
+    android:description="@string/widgetprovider_taskprogresswidget_description"
+    android:initialLayout="@layout/rn_widget"
+    android:previewImage="@drawable/taskprogresswidget_preview"
+    android:updatePeriodMillis="1800000"
+    android:widgetCategory="home_screen">
+</appwidget-provider>

android/app/src/main/res/xml/widgetprovider_taskswidget.xml

@@ -0,0 +1,16 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!-- Generated by scripts/sync-android-widgets.mjs from src/widgets/catalog.json. -->
+<appwidget-provider xmlns:android="http://schemas.android.com/apk/res/android"
+    android:minWidth="250dp"
+    android:minHeight="250dp"
+    android:minResizeWidth="180dp"
+    android:minResizeHeight="110dp"
+    android:targetCellWidth="4"
+    android:targetCellHeight="4"
+    android:resizeMode="horizontal|vertical"
+    android:description="@string/widgetprovider_taskswidget_description"
+    android:initialLayout="@layout/rn_widget"
+    android:previewImage="@drawable/taskswidget_preview"
+    android:updatePeriodMillis="1800000"
+    android:widgetCategory="home_screen">
+</appwidget-provider>

android/app/src/main/res/xml/widgetprovider_todayeventswidget.xml

@@ -0,0 +1,16 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!-- Generated by scripts/sync-android-widgets.mjs from src/widgets/catalog.json. -->
+<appwidget-provider xmlns:android="http://schemas.android.com/apk/res/android"
+    android:minWidth="250dp"
+    android:minHeight="110dp"
+    android:minResizeWidth="180dp"
+    android:minResizeHeight="110dp"
+    android:targetCellWidth="4"
+    android:targetCellHeight="2"
+    android:resizeMode="horizontal|vertical"
+    android:description="@string/widgetprovider_todayeventswidget_description"
+    android:initialLayout="@layout/rn_widget"
+    android:previewImage="@drawable/todayeventswidget_preview"
+    android:updatePeriodMillis="1800000"
+    android:widgetCategory="home_screen">
+</appwidget-provider>

android/app/src/main/res/xml/widgetprovider_todayhubwidget.xml

@@ -0,0 +1,16 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!-- Generated by scripts/sync-android-widgets.mjs from src/widgets/catalog.json. -->
+<appwidget-provider xmlns:android="http://schemas.android.com/apk/res/android"
+    android:minWidth="250dp"
+    android:minHeight="250dp"
+    android:minResizeWidth="180dp"
+    android:minResizeHeight="180dp"
+    android:targetCellWidth="4"
+    android:targetCellHeight="4"
+    android:resizeMode="horizontal|vertical"
+    android:description="@string/widgetprovider_todayhubwidget_description"
+    android:initialLayout="@layout/rn_widget"
+    android:previewImage="@drawable/todayhubwidget_preview"
+    android:updatePeriodMillis="1800000"
+    android:widgetCategory="home_screen">
+</appwidget-provider>

android/app/src/main/res/xml/widgetprovider_triagewidget.xml

@@ -0,0 +1,16 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!-- Generated by scripts/sync-android-widgets.mjs from src/widgets/catalog.json. -->
+<appwidget-provider xmlns:android="http://schemas.android.com/apk/res/android"
+    android:minWidth="250dp"
+    android:minHeight="110dp"
+    android:minResizeWidth="180dp"
+    android:minResizeHeight="110dp"
+    android:targetCellWidth="4"
+    android:targetCellHeight="2"
+    android:resizeMode="horizontal|vertical"
+    android:description="@string/widgetprovider_triagewidget_description"
+    android:initialLayout="@layout/rn_widget"
+    android:previewImage="@drawable/triagewidget_preview"
+    android:updatePeriodMillis="1800000"
+    android:widgetCategory="home_screen">
+</appwidget-provider>

android/app/src/main/res/xml/widgetprovider_unreadcountwidget.xml

@@ -0,0 +1,16 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!-- Generated by scripts/sync-android-widgets.mjs from src/widgets/catalog.json. -->
+<appwidget-provider xmlns:android="http://schemas.android.com/apk/res/android"
+    android:minWidth="110dp"
+    android:minHeight="110dp"
+    android:minResizeWidth="110dp"
+    android:minResizeHeight="110dp"
+    android:targetCellWidth="2"
+    android:targetCellHeight="2"
+    android:resizeMode="horizontal|vertical"
+    android:description="@string/widgetprovider_unreadcountwidget_description"
+    android:initialLayout="@layout/rn_widget"
+    android:previewImage="@drawable/unreadcountwidget_preview"
+    android:updatePeriodMillis="1800000"
+    android:widgetCategory="home_screen">
+</appwidget-provider>

android/app/src/main/res/xml/widgetprovider_upnextwidget.xml

@@ -0,0 +1,16 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!-- Generated by scripts/sync-android-widgets.mjs from src/widgets/catalog.json. -->
+<appwidget-provider xmlns:android="http://schemas.android.com/apk/res/android"
+    android:minWidth="250dp"
+    android:minHeight="110dp"
+    android:minResizeWidth="180dp"
+    android:minResizeHeight="110dp"
+    android:targetCellWidth="4"
+    android:targetCellHeight="2"
+    android:resizeMode="horizontal|vertical"
+    android:description="@string/widgetprovider_upnextwidget_description"
+    android:initialLayout="@layout/rn_widget"
+    android:previewImage="@drawable/upnextwidget_preview"
+    android:updatePeriodMillis="1800000"
+    android:widgetCategory="home_screen">
+</appwidget-provider>

android/app/src/main/res/xml/widgetprovider_vacationwidget.xml

@@ -0,0 +1,16 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!-- Generated by scripts/sync-android-widgets.mjs from src/widgets/catalog.json. -->
+<appwidget-provider xmlns:android="http://schemas.android.com/apk/res/android"
+    android:minWidth="110dp"
+    android:minHeight="110dp"
+    android:minResizeWidth="110dp"
+    android:minResizeHeight="110dp"
+    android:targetCellWidth="2"
+    android:targetCellHeight="2"
+    android:resizeMode="horizontal|vertical"
+    android:description="@string/widgetprovider_vacationwidget_description"
+    android:initialLayout="@layout/rn_widget"
+    android:previewImage="@drawable/vacationwidget_preview"
+    android:updatePeriodMillis="1800000"
+    android:widgetCategory="home_screen">
+</appwidget-provider>

android/app/src/main/res/xml/widgetprovider_weekwidget.xml

@@ -0,0 +1,16 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!-- Generated by scripts/sync-android-widgets.mjs from src/widgets/catalog.json. -->
+<appwidget-provider xmlns:android="http://schemas.android.com/apk/res/android"
+    android:minWidth="250dp"
+    android:minHeight="110dp"
+    android:minResizeWidth="250dp"
+    android:minResizeHeight="110dp"
+    android:targetCellWidth="4"
+    android:targetCellHeight="2"
+    android:resizeMode="horizontal|vertical"
+    android:description="@string/widgetprovider_weekwidget_description"
+    android:initialLayout="@layout/rn_widget"
+    android:previewImage="@drawable/weekwidget_preview"
+    android:updatePeriodMillis="1800000"
+    android:widgetCategory="home_screen">
+</appwidget-provider>

android/gradle.properties

@@ -25,6 +25,11 @@ android.useAndroidX=true
 # Enable AAPT2 PNG crunching
 android.enablePngCrunchInReleaseBuilds=true
 
+# Shrink release builds with R8 (code) and the resource shrinker. Keep rules
+# for classes reached by reflection go in app/proguard-rules.pro.
+android.enableMinifyInReleaseBuilds=true
+android.enableShrinkResourcesInReleaseBuilds=true
+
 # Use this property to specify which architecture you want to build.
 # You can also override it from the CLI using
 # ./gradlew <task> -PreactNativeArchitectures=x86_64
@@ -63,3 +68,9 @@ expo.useLegacyPackaging=false
 # Specifies whether the app is configured to use edge-to-edge via the app config or plugin
 # WARNING: This property has been deprecated and will be removed in Expo SDK 55. Use `edgeToEdgeEnabled` or `react.edgeToEdgeEnabled` to determine whether the project is using edge-to-edge.
 expo.edgeToEdgeEnabled=true
+
+# AsyncStorage caps its SQLite database at 6 MB unless this is set. The
+# offline mail cache keeps message bodies there and can be set to 500 MB,
+# and once the database is full every write fails, the account registry
+# and the outbox included. This is a ceiling, not an allocation.
+AsyncStorage_db_size_in_MB=1024

babel.config.js

@@ -0,0 +1,15 @@
+const path = require('node:path');
+
+// babel-preset-expo ships inside `expo` rather than as a direct dependency, so
+// resolve it from there; this is the preset Expo uses when no config exists.
+const presetExpo = require.resolve('babel-preset-expo', {
+  paths: [path.dirname(require.resolve('expo/package.json'))],
+});
+
+module.exports = function babelConfig(api) {
+  api.cache(true);
+  return {
+    presets: [presetExpo],
+    plugins: [require.resolve('./scripts/babel-plugin-lucide-imports')],
+  };
+};

docs/android-release.md

@@ -0,0 +1,294 @@
+# Android release signing
+
+The release APK is built by
+[.github/workflows/release-android.yml](../.github/workflows/release-android.yml)
+on an Ubuntu runner whenever a GitHub release is published, and attached to that
+release. Installed apps pick it up through the in-app updater.
+
+Every APK up to and including 0.1.62 was signed with `android/app/debug.keystore`,
+the debug key that ships with the React Native template. Its password is
+`android` and copies of it are everywhere, so anyone could sign an APK that
+Android accepts as an update to Bulwark Mobile. Such an "update" runs as the
+app, with its accounts, SecureStore credentials and mail cache. This is
+[S2 in the 2026-09 audit](audit-2026-09.md#s2).
+
+Release builds now need a real key:
+
+- `android/app/build.gradle` reads the key from `BULWARK_RELEASE_*` properties.
+  Without them, a release build fails in `checkReleaseSigning` before anything
+  is packaged. Debug builds and `npx expo run:android` are not affected.
+- The workflow fails in its first step when a signing secret is missing, checks
+  the key before the build, and refuses to upload an APK that Android 9+ would
+  not see as signed by the release key.
+- `versionCode` now comes from `VERSION` (see [versionCode](#versioncode)).
+
+## One-time setup
+
+The commands are for Git Bash on Windows, run from the repository root. They
+need `keytool`, which ships with every JDK, and `apksigner` from the Android SDK
+build-tools. Its `.jar` runs on Java 8 or newer:
+
+```bash
+apksigner() { java -jar "$LOCALAPPDATA/Android/Sdk/build-tools/36.0.0/lib/apksigner.jar" "$@"; }
+```
+
+On macOS or Linux, call `$ANDROID_HOME/build-tools/36.0.0/apksigner` instead.
+
+### 1. Generate the release key
+
+```bash
+read -rsp 'Keystore password: ' BULWARK_KS_PASS; echo; export BULWARK_KS_PASS
+keytool -genkeypair -v -storetype PKCS12 -keystore bulwark-release.p12 \
+  -alias bulwark -keyalg RSA -keysize 4096 -validity 10000 \
+  -dname "CN=Bulwark Mail, O=Bulwark Mail" \
+  -storepass:env BULWARK_KS_PASS -keypass:env BULWARK_KS_PASS
+```
+
+`-validity 10000` is about 27 years. A PKCS12 keystore uses one password for
+the store and the key, so `ANDROID_KEYSTORE_PASSWORD` and `ANDROID_KEY_PASSWORD`
+below get the same value. `*.p12` is gitignored, but move the file out of the
+checkout once the secrets are set.
+
+**Back up `bulwark-release.p12` and its password in two places**, for example
+a password manager and an offline copy. If the key is lost, no later APK can
+update an installed app: every user has to uninstall, which loses their accounts
+and local data, and install again. If the key leaks, you are back where S2
+started.
+
+The certificate's SHA-256 is what the workflow log prints as the release key:
+
+```bash
+keytool -exportcert -keystore bulwark-release.p12 -alias bulwark \
+  -storepass:env BULWARK_KS_PASS | sha256sum
+```
+
+### 2. Create the rotation lineage
+
+Skip this and the first release signed with the new key cannot be installed
+over any existing install. Android reports "App not installed as package
+conflicts with an existing package", and every user has to uninstall and
+reinstall.
+
+APK Signature Scheme v3, read by Android 9 and newer, lets an APK carry a
+*signing lineage*: a record signed by the old key that names the new key as its
+successor. The old key here is the public debug key, so you can create that
+record yourself:
+
+```bash
+apksigner rotate --out bulwark.lineage \
+  --old-signer --ks android/app/debug.keystore --ks-key-alias androiddebugkey \
+    --ks-pass pass:android --key-pass pass:android \
+    --set-installed-data true --set-rollback false \
+    --set-permission false --set-auth false --set-shared-uid false \
+  --new-signer --ks bulwark-release.p12 --ks-key-alias bulwark \
+    --ks-pass env:BULWARK_KS_PASS --key-pass env:BULWARK_KS_PASS
+apksigner lineage --in bulwark.lineage --print-certs
+```
+
+The `--set-*` flags on the old signer decide what the debug key can still do on
+a device that has moved to the new key:
+
+- `--set-installed-data true` lets the new key take over an install made with
+  the debug key. Without it the rotation does nothing.
+- `--set-rollback false` keeps an APK signed with the debug key from being
+  accepted again afterwards. With `true` the rotation would be pointless, and the
+  workflow refuses such a lineage.
+- `--set-permission false` stops granting the app's signature permissions to
+  apps signed with the debug key, which includes every React Native debug build.
+  The merged manifest defines one,
+  `com.anonymous.bulwarkmobile.DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSION`. It
+  guards the receivers that are registered as not exported on Android 12L and
+  older.
+- `--set-auth false` and `--set-shared-uid false`: the app uses neither.
+
+The lineage holds only certificates and a signature made with the debug key, so
+it is not secret. It is stored as a secret only so the workflow can find it.
+
+### 3. Repository secrets
+
+Settings → Secrets and variables → Actions:
+
+| Secret | Value |
+| --- | --- |
+| `ANDROID_KEYSTORE_BASE64` | `bulwark-release.p12`, base64-encoded |
+| `ANDROID_KEYSTORE_PASSWORD` | The keystore password |
+| `ANDROID_KEY_ALIAS` | `bulwark` |
+| `ANDROID_KEY_PASSWORD` | The same password again |
+| `ANDROID_SIGNING_LINEAGE_BASE64` | `bulwark.lineage`, base64-encoded. Optional, but see step 2 |
+
+With the GitHub CLI, from the checkout and in the same shell as step 1:
+
+```bash
+base64 -w0 bulwark-release.p12 | gh secret set ANDROID_KEYSTORE_BASE64
+printf %s "$BULWARK_KS_PASS" | gh secret set ANDROID_KEYSTORE_PASSWORD
+printf %s "$BULWARK_KS_PASS" | gh secret set ANDROID_KEY_PASSWORD
+gh secret set ANDROID_KEY_ALIAS --body bulwark
+base64 -w0 bulwark.lineage | gh secret set ANDROID_SIGNING_LINEAGE_BASE64
+```
+
+Or copy a file as base64 for the web form:
+
+```powershell
+[Convert]::ToBase64String([IO.File]::ReadAllBytes('bulwark-release.p12')) | Set-Clipboard
+```
+
+## The first release with the new key
+
+1. Set all five secrets.
+2. Release as usual with `npm run bump`.
+3. In the workflow run, "Verify the APK signature" prints the release key's
+   SHA-256 as the Android 9+ signer and `fac61745…3b9c`, the debug key, as the
+   Android 7-8.1 signer, followed by a warning about the latter. The warning is
+   expected for as long as the lineage is used.
+4. Check it on the emulators before you announce anything:
+   - Install 0.1.62 (`gh release download 0.1.62 -p '*.apk'`) on
+     `Pixel_6_Pro_API_32` and `Pixel_7_API_34` and sign in. Then `adb install -r`
+     the new APK. It has to install over 0.1.62 and keep the account.
+   - Set `VERSION` above the new release locally (don't commit it), build with
+     `-PallowDebugSignedRelease=true` (see [Local release builds](#local-release-builds))
+     and `adb install -r` that APK over the updated app. It has to fail with
+     `INSTALL_FAILED_UPDATE_INCOMPATIBLE`.
+5. Add a line `severity: security` to the release notes (web UI or
+   `gh release edit`). The in-app update banner then cannot be dismissed, which
+   matters because a device on 0.1.62 accepts a debug-signed "update" until it
+   has installed this release.
+
+## What rotation does and does not protect
+
+| Device | After it installs a rotated release |
+| --- | --- |
+| Android 9 and newer (API 28+) | Updates in place and keeps accounts and data. From then on it accepts only updates signed with the release key. An APK signed with the debug key is refused, and so is one that carries a lineage from the debug key to some other key. |
+| Android 7.0-8.1 (API 24-27) | Updates in place, but these versions do not read v3 signatures. They check the v2 signature, which the workflow still makes with the debug key so that they can update at all. They keep accepting debug-signed "updates". |
+
+What it does not cover:
+
+- **Devices that have not updated yet.** Until a device installs a rotated
+  release it trusts the debug key as before. Whoever gets a debug-signed APK onto
+  it first can attach a lineage to their own key and keep the app for good. The
+  window closes for each device when it updates, which is why the release should
+  carry `severity: security`.
+- **Android 7.0-8.1**, as long as the lineage is used. New installs on those
+  versions also start out trusting the debug key. The only fix is
+  [ending the migration](#ending-the-migration), after which they need a
+  reinstall.
+- **Anything that already happened.** Rotation does not repair a device that
+  already runs a malicious "update".
+- **The release key itself.** Rotation moves the trust to
+  `bulwark-release.p12`. It is only as safe as that file and its password.
+
+The workflow passes `--rotation-min-sdk-version 28` to `apksigner sign`. By
+default apksigner puts the rotated key in a v3.1 block that only Android 13+
+reads and signs the v3.0 block with the old key, which would leave Android
+9-12L on the debug key.
+
+If you restricted the Firebase API key in `google-services.json` to Android apps
+by certificate fingerprint in the Google Cloud console, add the release key's
+SHA-1 there before the first release and keep the debug key's entry until the
+migration has ended. Otherwise push registration can fail. An unrestricted key
+needs nothing.
+
+## Ending the migration
+
+Keep `ANDROID_SIGNING_LINEAGE_BASE64` set while installs of 0.1.62 or older may
+still be around: without it they cannot update at all.
+
+Once you delete it, every APK is signed with the release key alone:
+
+- Devices that already moved to the release key keep updating normally.
+- Anything still on 0.1.62 or older, and every Android 7.0-8.1 install, refuses
+  the update. Those users have to uninstall, reinstall and sign in again, and
+  they lose local data. Afterwards their devices trust only the release key.
+
+## Local release builds
+
+CI signs releases, so you normally don't need the release key on your machine.
+For a local release build, for profiling or checking R8, opt in to the debug key:
+
+```bash
+cd android
+./gradlew assembleRelease -PallowDebugSignedRelease=true
+```
+
+```powershell
+$env:ORG_GRADLE_PROJECT_allowDebugSignedRelease = 'true'
+npx expo run:android --variant release
+```
+
+The build prints a warning. The APK is signed with the public key, so never
+give it to anyone. On a device that has moved to the release key it will not
+install over the official app; uninstall that first. `allowDebugSignedRelease`
+is ignored when the `CI` environment variable is set, so the workflow cannot
+use it.
+
+To sign locally with the real key, set these as `-P` flags, in
+`~/.gradle/gradle.properties` or as environment variables. Never put them in
+`android/gradle.properties`, which is committed.
+
+```properties
+BULWARK_RELEASE_STORE_FILE=C:/Users/you/keys/bulwark-release.p12
+BULWARK_RELEASE_STORE_PASSWORD=...
+BULWARK_RELEASE_KEY_ALIAS=bulwark
+BULWARK_RELEASE_KEY_PASSWORD=...
+```
+
+That APK has no lineage, so it will not install over a debug-signed install
+either.
+
+With neither, a release build stops and lists what is missing. Debug builds and
+`npx expo run:android` never need any of this.
+
+## Stack traces
+
+Release builds are shrunk and obfuscated by R8, so library frames in a crash
+report look like `com.facebook.react.uimanager.U.a`. The app's own classes
+(`com.anonymous.bulwarkmobile`) keep their names. The workflow attaches
+`bulwark-mobile-<version>-<commit>-mapping.txt` to the release next to the APK
+and keeps it as a workflow artifact. Decode a trace with the mapping of that
+exact build:
+
+```bash
+retrace bulwark-mobile-0.1.63-abc1234-mapping.txt stacktrace.txt
+```
+
+`retrace` is in the Android SDK command-line tools (`cmdline-tools/latest/bin`).
+A local build writes its mapping to
+`android/app/build/outputs/mapping/release/mapping.txt`.
+
+## versionCode
+
+`versionCode` was `1` for every release up to 0.1.62. It is now derived from
+`VERSION` in `android/app/build.gradle`:
+
+```
+major * 10000000 + minor * 10000 + patch        0.1.63 -> 10063
+```
+
+Android refuses an update whose `versionCode` is lower than the installed one,
+so the number may only grow. The formula keeps growing while patch stays below
+10000 and minor below 1000, and `npm run bump` refuses to go past either. It
+stays under Android's limit of 2100000000 up to major 209. Existing installs
+have `versionCode` 1, so the first release with this change updates them
+normally.
+
+Never switch to a formula that gives smaller numbers: installed apps would
+refuse every update until the numbers caught up.
+
+## Rotating again
+
+If the release key ever has to change, extend the lineage instead of starting
+a new one. Generate `bulwark-release-2.p12` as in step 1, with its password in
+`NEW_KS_PASS`:
+
+```bash
+apksigner rotate --in bulwark.lineage --out bulwark-2.lineage \
+  --old-signer --ks bulwark-release.p12 --ks-key-alias bulwark \
+    --ks-pass env:BULWARK_KS_PASS --key-pass env:BULWARK_KS_PASS --set-rollback false \
+  --new-signer --ks bulwark-release-2.p12 --ks-key-alias bulwark \
+    --ks-pass env:NEW_KS_PASS --key-pass env:NEW_KS_PASS
+```
+
+Then update the secrets. The workflow accepts any lineage that starts at the
+debug key and ends at the key in `ANDROID_KEYSTORE_BASE64`, and refuses one in
+which an earlier key has the rollback capability. As with the first rotation,
+only Android 9+ devices that install the new release follow it. If the old key
+leaked, a device that someone reached first stays theirs.

docs/parity/01-auth-accounts.md

@@ -54,7 +54,7 @@ RN covers the happy paths (password login, webmail-mediated OAuth handoff, QR pa
   - What RN does: `rewriteSessionUrls` only rewrites absolute URLs; `extractOrigin` returns null for `/jmap/` so the relative value is passed through unchanged and `secureFetch('/jmap/')` fails (`src/api/jmap-client.ts:320-340`). Same in the unified inbox `rewriteApiUrl` (`src/api/unified-inbox.ts:55-60`).
   - Fix hint: when the URL has no `^https?://`, return `serverOrigin + (url.startsWith('/') ? url : '/' + url)`; keep the plain string splitting (the comment about the RN URL polyfill corrupting templates still applies).
 
-- [x] **Redirected session fetch may lose the Authorization header** — `P3` — `partial` — fixed in 0b1c240
+- [x] **Redirected session fetch may lose the Authorization header** — `P3` — `partial` — fixed in 0b1c240; the check keyed on `response.redirected`, which React Native's fetch never sets, so it only works since 859770b (audit B15)
   - What WEB does: `fetchSessionResponse` detects a redirected 200 with no accounts/username (Safari and some auth proxies drop `Authorization` on redirect) and refetches `response.url` with the header (`lib/jmap/client.ts:911-925`).
   - What RN does: `fetchSession` trusts the redirected response (`src/api/jmap-client.ts:363-383`); Stalwart 0.16.19 answers `/.well-known/jmap` with a 307 to `/jmap/session` (verified against stw-test19), and iOS `NSURLSession` can strip the header on redirect, which ends in `resolveAccountId` throwing "No account found in JMAP session".
   - Fix hint: mirror the WEB check (`response.redirected` and empty `accounts`/`username` → refetch `response.url` with the header).
@@ -106,12 +106,12 @@ RN covers the happy paths (password login, webmail-mediated OAuth handoff, QR pa
   - What RN does: `connectWithOAuth` uses `session.username || accessToken.slice(0, 8)` (`src/api/jmap-client.ts:135-136`), so the same mailbox logged in via password and via OAuth can produce two registry entries, and the drawer synthesizes `username@host`.
   - Fix hint: read `Identity/get` after connect and use the primary identity email for `email` (and ideally for the registry id).
 
-- [ ] **Cannot remove a non-active account** — `P2` — `missing` (changelog 1.7.8 "Remove a specific account from the switcher")
+- [x] **Cannot remove a non-active account** — `P2` — `missing` (changelog 1.7.8 "Remove a specific account from the switcher") — done in 6ae21d5, 490355c
   - What WEB does: per-row remove button in the switcher (`components/layout/account-switcher.tsx:138-143, 322-333`) backed by `removeAccount` which tears down the client, evicts caches and clears cookies (`stores/auth-store.ts:1382-1401`).
   - What RN does: only "Sign out of <active>" and "Sign out all" (`src/components/SidebarDrawer.tsx:400-437`).
   - Fix hint: add a per-row remove (long-press or trailing X) that runs `teardownPushNotificationsForAccount(id)`, `jmapClient.clearAccountCredentials(id)`, `useEmailStore.removeAccount(id)`, `accountStore.removeAccount(id)`.
 
-- [ ] **Switcher shows stale connection state and no error indicator** — `P3` — `partial`
+- [x] **Switcher shows stale connection state and no error indicator** — `P3` — `partial` — done in 6ae21d5 (the drawer shows `hasError` with its message)
   - What WEB does: shows `hasError` (alert icon) with `errorMessage` and a live `isConnected` dot per account (`account-switcher.tsx:296-303`).
   - What RN does: renders only the `isConnected` dot (`SidebarDrawer.tsx:355-361`); `hasError`/`errorMessage` (set in `restoreSession`) are never displayed, and since only the active account is ever connected, other rows show whatever value they had last.
   - Fix hint: render `hasError`; show the dot only for the active account (or treat inactive as "cached").
@@ -126,17 +126,17 @@ RN covers the happy paths (password login, webmail-mediated OAuth handoff, QR pa
   - What RN does: `authMode = props.authMode ?? 'basic'` and `quotaUsed = props.quotaUsed ?? 0` (`AccountSettings.tsx:46-47`) but `SettingsScreen` renders `<Component />` with no props (`SettingsScreen.tsx:242`), so OAuth accounts read "Basic" and the storage row never appears (RN has no `Quota/get` at all — flag for the mail/settings audit).
   - Fix hint: derive from `jmapClient.usesBearerAuth` (or persist `authMode` on `AccountEntry`); fetch quota via `Quota/get` when `urn:ietf:params:jmap:quota` is advertised.
 
-- [ ] **Hard account cap of 5** — `P3` — `partial`
+- [x] **Hard account cap of 5** — `P3` — `partial` — done in 6ae21d5 (cap raised to 10, `src/lib/account-utils.ts:4`)
   - What WEB does: 5 on HTTP/1.1, lifted to 50 when HTTP/2 is observed, because each web account pins an SSE socket (`lib/account-utils.ts:75-107`).
   - What RN does: `MAX_ACCOUNTS = 5` (`src/lib/account-utils.ts:1`) although only the active account holds a live connection.
   - Fix hint: raise the constant (or drop the cap) once the unified inbox cost per account is acceptable.
 
-- [ ] **Shared/group account settings scope is missing** — `P3` — `missing` (changelog 1.7.5 "Manage shared/group account settings from the Accounts page") — deferred: shared accounts are now listed read-only in AccountSettings (490355c); scoped filter/vacation stores need an accountId parameter first
+- [ ] **Shared/group account settings scope is missing** — `P3` — `missing` (changelog 1.7.5 "Manage shared/group account settings from the Accounts page") — partly: shared accounts are listed in AccountSettings (490355c), and tapping one scopes Filters and Vacation to it since a86cd1d; calendar and contacts settings are not scoped yet
   - What WEB does: lists `client.getSharedAccounts()` (non-primary) on the Accounts page and enters a scoped settings mode (filters, vacation, calendars, contacts) via `managed-account-store` (`components/settings/account-settings.tsx:43-48, 112-118, 225-262`; `stores/managed-account-store.ts`).
   - What RN does: `getSharedMailAccounts()` exists for mail/unified inbox (`src/api/jmap-client.ts:480-495`) but there is no shared-account listing or scoped settings.
   - Fix hint: list non-personal `session.accounts` in `AccountSettings` and pass an `accountId` into the filter/vacation stores.
 
-- [ ] **Unified-inbox shared-account filter disagrees with `getSharedMailAccounts`** — `P3` — `rn-only-bug`
+- [x] **Unified-inbox shared-account filter disagrees with `getSharedMailAccounts`** — `P3` — `rn-only-bug` — done in 6ae21d5
   - What WEB does: a non-personal account counts as mail-capable even when its `accountCapabilities` omit mail (`lib/jmap/client.ts:4421-4445`); RN's own `getSharedMailAccounts` mirrors that (`jmap-client.ts:486-493`).
   - What RN does: the unified inbox requires `accountCapabilities == null || MAIL in accountCapabilities` (`src/api/unified-inbox.ts:208-210`), so a shared account that advertises other capabilities but not mail is silently skipped there while it appears in the sidebar.
   - Fix hint: reuse the `!advertisesMail && info.isPersonal → skip` rule from `getSharedMailAccounts`.