Store shots: default to the iPhone 16 Pro Max for the 6.9 inch slot

App Store Connect refused the 1284x2778 set on 2026-10-20 and took 1320x2868 in the 6.9 inch slot. The header now names the iPad device type for 2048x2732 too. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
String catalogs as Xcode writes them after a build
2026-10-20 13:57:50 -04:00 · 2026-10-20 13:38:37 -04:00 · 2026-10-20 13:34:55 -04:00 · 2026-10-20 13:21:38 -04:00 · 2026-10-20 08:50:03 -04:00 · 2026-10-16 15:14:53 -04:00
946 changed files with 127055 additions and 57646 deletions
@@ -0,0 +1 @@
+4b4042f72880758ee2dea7713f7a2cb63fa12f73
@@ -0,0 +1,31 @@
+# Why this repository pins flamenet-e2e
+
+`.e2e-ref` is the commit of [flamenet-e2e](https://git.extant2000.com/extant2000/flamenet-e2e)
+that the copies in `Tests/Vectors/` are checked against. See
+`Tests/Vectors/PROVENANCE.md` for why they are copies at all.
+
+**The pin exists because a merge in that repository could stop all work in
+this one.** flamenet-relay learned it the hard way, its jobs cloned `main` at
+HEAD, and that switch was thrown three times in twelve hours
+(flamenet-relay#56), once producing a deadlock with no way out from inside
+either repository. Its `.e2e-ref.md` has the full account.
+
+A pin alone is worse than HEAD, though. The argument for HEAD is real: an
+app tested against a pinned old harness is tested against a pinned old spec. If
+the vectors move and nothing says so, `ProtocolVectorTests` quietly goes on
+checking last month's protocol and reports green, which is precisely the
+failure that suite exists to prevent, reintroduced one level up.
+
+That is what `vectors-head` is for, and why it is `continue-on-error: true` in `.gitea/workflows/ci.yml`.
+Being behind is LOUD and NON-BLOCKING. Being broken is a hard stop.
+
+## Taking an update
+
+One MR, all parts together:
+
+1. Put the new e2e commit in `.e2e-ref`.
+2. `cp <e2e>/test/vectors/*.json Tests/Vectors/`
+3. Read what changed before accepting it. A moved vector is a protocol change,
+   and this app is one of the two ends that has to agree about it, the other
+   is `flamenet-messenger-android`, which pins the same commit and should move
+   in step.
@@ -0,0 +1,355 @@
+# CI for the iOS app on Gitea Actions. Translated from .gitlab-ci.yml on
+# 2026-10-13; every gate it had is kept.
+#
+# Builds and tests only. TestFlight and App Store uploads stay manual on the
+# MacBook Air and the iMac; no signing material is in CI.
+#
+# Runners: the Xcode jobs need `pauls-imac` (host mode, Xcode 27, capacity 1,
+# so they run one after the other). The three jobs that only read source run
+# on mac1/mac2 (`ubuntu-latest`) to keep the iMac free.
+name: ci
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+  # A timed-out iOS job is the normal failure here, and re-running it needed a
+  # commit because there was no other trigger. The unit job can take 90
+  # minutes before it says anything, so "push something to try again" is an
+  # expensive way to ask a question.
+  workflow_dispatch:
+
+env:
+  GITEA_BASE: https://git.extant2000.com/extant2000
+
+jobs:
+  # The repository is public, so this sweep is the last thing between a pasted
+  # key and the internet. It was red for nine days in 2026-09 because nobody
+  # ran it. No submodule fetch: a sweep of this repo is about this repo.
+  secret-sweep:
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@v4
+      - run: bash Scripts/secret-sweep.sh
+
+  unit-tests:
+    runs-on: pauls-imac
+    # 90, not 30. The first run of this workflow died at exactly 30 minutes
+    # with "context deadline exceeded", 15 seconds past the vector gate and
+    # still inside xcodebuild. The suite is 1289 tests since the 0.32 merge,
+    # against 741 when 30 was chosen, and a cold `ci-build` adds a full
+    # compile of the app, its tests and the obfs4 package on top.
+    #
+    # 90 was not enough either: the 2026-10-14 run spent all 90 minutes
+    # inside xcodebuild and printed no `Executed` line at all, so the cold
+    # compile alone outlasts it on this runner. The same commit builds and
+    # runs all 1289 tests in about 37 minutes on an M-series Mac, so this is
+    # the Intel compile, not the suite. 180 leaves room for a cold build;
+    # a warm `ci-build` in the reused workspace should come in far under it.
+    timeout-minutes: 180
+    steps:
+      # The obfs4 transport is the Packages/Obfs4 submodule
+      # (flamenet-elligator2, public on Gitea). Without it package resolution
+      # fails with "the package manifest at Packages/Obfs4/Package.swift
+      # cannot be accessed".
+      - uses: actions/checkout@v4
+        with:
+          submodules: recursive
+      - name: Unit tests
+        shell: bash
+        run: |
+          set -euo pipefail
+          # The selected Xcode, never a hardcoded beta path (see
+          # xcode-is-the-release-now). Printed so the log says what built.
+          export DEVELOPER_DIR="$(xcode-select -p)"
+          # 🔴 Boot the simulator HERE, and wait for it, because xcodebuild
+          # waits for it forever.
+          #
+          # Shutting the device down and leaving xcodebuild to boot it is what
+          # burned two runs: the suite compiled, xcodebuild handed off to a
+          # device that never came up, and the step was cancelled at the
+          # timeout with no error. The 90-minute and the 180-minute run both
+          # produced ci-test.log at 889,54x bytes, ending at
+          # `PruneExplicitPrecompiledModules`, which is the end of a
+          # successful build. Raising the timeout twice was treating a hang as
+          # slowness.
+          #
+          # `simctl bootstatus -b` boots the device and blocks until it is
+          # usable, and exits non-zero when it cannot. A device that will not
+          # boot is now a message rather than three silent hours.
+          xcrun simctl shutdown "iPhone 17" 2>/dev/null || true
+          if ! xcrun simctl bootstatus "iPhone 17" -b; then
+            echo "GATE: the iPhone 17 simulator would not boot on this runner"
+            xcrun simctl list devices available
+            exit 1
+          fi
+          xcodebuild -version
+
+          # Vectors are copied into Tests/Vectors and pinned by .e2e-ref.
+          # Check the copy against the pinned flamenet-e2e commit.
+          # `vectors-head` below is the advisory half that watches HEAD.
+          FLAMENET_E2E_PIN=$(cat .e2e-ref)
+          rm -rf ci-vectors
+          git clone -q "$GITEA_BASE/flamenet-e2e.git" ci-vectors
+          git -C ci-vectors checkout -q "$FLAMENET_E2E_PIN"
+          for f in protocol-v1 pqx3dh-v2 account-kdf-v1 backup-v1 backup-payload-v1 content-v1 \
+                   poll-tally-v1 padding-v1 sync-merge-v1 handle-cert-v1 links-v1 bridge-offer-v1 \
+                   content-kinds-v1 today-v1 hello-link-v1; do
+            if ! diff -q "ci-vectors/test/vectors/$f.json" "Tests/Vectors/$f.json" >/dev/null; then
+              echo "GATE: Tests/Vectors/$f.json differs from flamenet-e2e@$FLAMENET_E2E_PIN."
+              echo "GATE: the vectors moved. Read what changed, then refresh the copy:"
+              echo "GATE:   cp ci-vectors/test/vectors/*.json Tests/Vectors/"
+              diff "ci-vectors/test/vectors/$f.json" "Tests/Vectors/$f.json" | head -20 || true
+              exit 1
+            fi
+          done
+          echo "GATE: protocol vectors match flamenet-e2e@$FLAMENET_E2E_PIN"
+
+          # Scripts/generate.sh, never bare `xcodegen generate`: only the script
+          # copies the pinned Package.resolved into the generated project.
+          Scripts/generate.sh
+          # Keep the ~700 MB build output out of Spotlight; indexing it drove
+          # the runner host to a load average in the hundreds.
+          mkdir -p ci-build && touch ci-build/.metadata_never_index
+
+          # Build and test are two xcodebuild calls, each under its own cap, so
+          # the log says which phase stopped. The 2026-10-16 run proved why:
+          # ci-test.log reached 889,595 bytes and ended at
+          # PruneExplicitPrecompiledModules, which is the end of a clean build,
+          # and then xcodebuild sat for 150 minutes without printing "Testing
+          # started". One call could not tell a slow compile from a test phase
+          # that never begins. Two can.
+          #
+          # The watchdog needs nothing but the shell: coreutils is on one Mac
+          # runner and not the other, and the run that printed "runs uncapped"
+          # burned the whole 180-minute deadline and uploaded a log nobody
+          # read. It holds xcodebuild's own pid because the log is a redirect
+          # rather than a pipe.
+          #
+          # `-collect-test-diagnostics never`: the default is on-failure, and
+          # on a failure xcodebuild runs `simctl diagnose`, a sysdiagnose plus
+          # 8 minutes of simulator logs with a 600s timeout each, before it
+          # reports anything. Reproduced on an M3 by watching that pid.
+          capped() {
+            local limit=$1 label=$2; shift 2
+            "$@" >> ci-test.log 2>&1 &
+            local xcb=$!
+            ( sleep "$limit"
+              kill -0 "$xcb" 2>/dev/null || exit 0
+              echo "GATE: $label gave no result after ${limit}s, killing xcodebuild"
+              kill -TERM "$xcb" 2>/dev/null
+              sleep 20
+              kill -KILL "$xcb" 2>/dev/null ) &
+            local dog=$!
+            wait "$xcb"; local rc=$?
+            kill "$dog" 2>/dev/null || true
+            return $rc
+          }
+
+          XC=(xcodebuild -project FlamenetMessenger.xcodeproj -scheme FlamenetMessenger
+              -sdk iphonesimulator -destination "platform=iOS Simulator,name=iPhone 17"
+              -collect-test-diagnostics never -derivedDataPath ci-build)
+
+          : > ci-test.log
+          # Progress in the job log while it runs; ci-test.log keeps everything.
+          ( tail -f ci-test.log 2>/dev/null \
+            | grep --line-buffered -E "Executed|TEST (SUCCEEDED|FAILED)|TEST BUILD" ) &
+          TAIL=$!
+
+          capped 5400 build-for-testing "${XC[@]}" build-for-testing || true
+          if ! grep -q '\*\* TEST BUILD SUCCEEDED \*\*' ci-test.log; then
+            kill "$TAIL" 2>/dev/null || true
+            echo "GATE: the test build did not succeed"
+            tail -40 ci-test.log; exit 1
+          fi
+          echo "GATE: test build succeeded, running FlamenetMessengerTests"
+
+          capped 3600 test-without-building "${XC[@]}" test-without-building -only-testing:FlamenetMessengerTests || true
+          kill "$TAIL" 2>/dev/null || true
+
+          # Assert on the LOG, never on grep's exit status: a failing run
+          # prints "TEST FAILED", grep matches it and exits 0.
+          grep -q '\*\* TEST SUCCEEDED \*\*' ci-test.log || {
+            echo "GATE: xcodebuild did not report '** TEST SUCCEEDED **'"
+            tail -40 ci-test.log; exit 1; }
+          grep -qE 'Executed [1-9][0-9]* tests, with 0 failures' ci-test.log || {
+            echo "GATE: no run of at least one test with zero failures"
+            tail -40 ci-test.log; exit 1; }
+          # Floor below today's count, so a suite that drops from 1289 to 12
+          # cannot pass. Raise it when it stops meaning anything.
+          COUNT=$(grep -oE 'Executed [0-9]+ tests, with 0 failures' ci-test.log \
+                  | tail -1 | grep -oE '[0-9]+' | head -1)
+          if [ "${COUNT:-0}" -lt 1150 ]; then
+            echo "GATE: only ${COUNT:-0} tests ran; the suite is not all there"
+            tail -40 ci-test.log; exit 1
+          fi
+          echo "GATE: Executed $COUNT tests, with 0 failures"
+      - if: failure()
+        uses: actions/upload-artifact@v3
+        with:
+          name: ci-test-log
+          path: ci-test.log
+          retention-days: 7
+
+  # The 14 UI tests that need no live relay (69 more skip without one).
+  # Gating since 2026-09-25. Its own job so a UI failure reads as one.
+  ui-tests:
+    runs-on: pauls-imac
+    # pauls-imac has capacity 1, so this waits for unit-tests and then builds
+    # again from its own derived data. Raised with the unit job for the same
+    # reason: the cold compile on this runner is the cost, not the tests.
+    timeout-minutes: 120
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          submodules: recursive
+      - name: UI tests
+        shell: bash
+        run: |
+          set -euo pipefail
+          export DEVELOPER_DIR="$(xcode-select -p)"
+          # 🔴 Boot the simulator HERE, and wait for it, because xcodebuild
+          # waits for it forever.
+          #
+          # Shutting the device down and leaving xcodebuild to boot it is what
+          # burned two runs: the suite compiled, xcodebuild handed off to a
+          # device that never came up, and the step was cancelled at the
+          # timeout with no error. The 90-minute and the 180-minute run both
+          # produced ci-test.log at 889,54x bytes, ending at
+          # `PruneExplicitPrecompiledModules`, which is the end of a
+          # successful build. Raising the timeout twice was treating a hang as
+          # slowness.
+          #
+          # `simctl bootstatus -b` boots the device and blocks until it is
+          # usable, and exits non-zero when it cannot. A device that will not
+          # boot is now a message rather than three silent hours.
+          xcrun simctl shutdown "iPhone 17" 2>/dev/null || true
+          if ! xcrun simctl bootstatus "iPhone 17" -b; then
+            echo "GATE: the iPhone 17 simulator would not boot on this runner"
+            xcrun simctl list devices available
+            exit 1
+          fi
+          Scripts/generate.sh
+          mkdir -p ci-build && touch ci-build/.metadata_never_index
+          # Build and test are two xcodebuild calls, each under its own cap, so
+          # the log says which phase stopped. The 2026-10-16 run proved why:
+          # ci-test.log reached 889,595 bytes and ended at
+          # PruneExplicitPrecompiledModules, which is the end of a clean build,
+          # and then xcodebuild sat for 150 minutes without printing "Testing
+          # started". One call could not tell a slow compile from a test phase
+          # that never begins. Two can.
+          #
+          # The watchdog needs nothing but the shell: coreutils is on one Mac
+          # runner and not the other, and the run that printed "runs uncapped"
+          # burned the whole 180-minute deadline and uploaded a log nobody
+          # read. It holds xcodebuild's own pid because the log is a redirect
+          # rather than a pipe.
+          #
+          # `-collect-test-diagnostics never`: the default is on-failure, and
+          # on a failure xcodebuild runs `simctl diagnose`, a sysdiagnose plus
+          # 8 minutes of simulator logs with a 600s timeout each, before it
+          # reports anything. Reproduced on an M3 by watching that pid.
+          capped() {
+            local limit=$1 label=$2; shift 2
+            "$@" >> ci-ui.log 2>&1 &
+            local xcb=$!
+            ( sleep "$limit"
+              kill -0 "$xcb" 2>/dev/null || exit 0
+              echo "GATE: $label gave no result after ${limit}s, killing xcodebuild"
+              kill -TERM "$xcb" 2>/dev/null
+              sleep 20
+              kill -KILL "$xcb" 2>/dev/null ) &
+            local dog=$!
+            wait "$xcb"; local rc=$?
+            kill "$dog" 2>/dev/null || true
+            return $rc
+          }
+
+          XC=(xcodebuild -project FlamenetMessenger.xcodeproj -scheme FlamenetMessenger
+              -sdk iphonesimulator -destination "platform=iOS Simulator,name=iPhone 17"
+              -collect-test-diagnostics never -derivedDataPath ci-build)
+
+          : > ci-ui.log
+          # Progress in the job log while it runs; ci-ui.log keeps everything.
+          ( tail -f ci-ui.log 2>/dev/null \
+            | grep --line-buffered -E "Executed|TEST (SUCCEEDED|FAILED)|TEST BUILD" ) &
+          TAIL=$!
+
+          capped 4200 build-for-testing "${XC[@]}" build-for-testing || true
+          if ! grep -q '\*\* TEST BUILD SUCCEEDED \*\*' ci-ui.log; then
+            kill "$TAIL" 2>/dev/null || true
+            echo "GATE: the test build did not succeed"
+            tail -40 ci-ui.log; exit 1
+          fi
+          echo "GATE: test build succeeded, running FlamenetMessengerUITests"
+
+          capped 2400 test-without-building "${XC[@]}" test-without-building -only-testing:FlamenetMessengerUITests || true
+          kill "$TAIL" 2>/dev/null || true
+          grep -q '\*\* TEST SUCCEEDED \*\*' ci-ui.log || {
+            echo "GATE: xcodebuild did not report '** TEST SUCCEEDED **'"
+            tail -60 ci-ui.log; exit 1; }
+          # A floor on what actually RAN. Both summary shapes are read:
+          #   Executed 83 tests, with 69 tests skipped and 0 failures ...
+          #   Executed 14 tests, with 0 failures ...
+          RAN=$(grep -oE 'Executed [0-9]+ tests' ci-ui.log | tail -1 | grep -oE '[0-9]+' || true)
+          SKIPPED=$(grep -oE '[0-9]+ tests skipped' ci-ui.log | tail -1 | grep -oE '[0-9]+' || true)
+          ACTUAL=$(( ${RAN:-0} - ${SKIPPED:-0} ))
+          if [ "$ACTUAL" -lt 10 ]; then
+            echo "GATE: only ${ACTUAL} UI test(s) actually ran; the rest skipped"
+            tail -60 ci-ui.log; exit 1
+          fi
+          echo "GATE: ${ACTUAL} UI tests ran, ${SKIPPED:-0} skipped for want of a live relay"
+      - if: failure()
+        uses: actions/upload-artifact@v3
+        with:
+          name: ci-ui-log
+          path: ci-ui.log
+          retention-days: 7
+
+  # The pin's conscience: compares the carried vectors with flamenet-e2e HEAD.
+  # Allowed to fail. A red run means an update is waiting; see .e2e-ref.md.
+  vectors-head:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    continue-on-error: true
+    steps:
+      - uses: actions/checkout@v4
+      - name: Compare vectors with flamenet-e2e HEAD
+        run: |
+          rm -rf ci-vectors-head
+          git clone --depth 1 "$GITEA_BASE/flamenet-e2e.git" ci-vectors-head
+          echo "pinned:  $(cat .e2e-ref)"
+          echo "at HEAD: $(git -C ci-vectors-head rev-parse HEAD)"
+          behind=0
+          for f in protocol-v1 pqx3dh-v2 account-kdf-v1 backup-v1 backup-payload-v1 content-v1 \
+                   poll-tally-v1 padding-v1 sync-merge-v1 handle-cert-v1 links-v1 bridge-offer-v1 \
+                   content-kinds-v1 today-v1 hello-link-v1; do
+            if ! diff -q "ci-vectors-head/test/vectors/$f.json" "Tests/Vectors/$f.json" >/dev/null; then
+              echo "ADVISORY: $f.json has moved at HEAD:"
+              diff "ci-vectors-head/test/vectors/$f.json" "Tests/Vectors/$f.json" | head -30 || true
+              behind=1
+            fi
+          done
+          if [ "$behind" = "1" ]; then
+            echo "ADVISORY: the published vectors have changed. This is not a failure of"
+            echo "ADVISORY: this branch; it means an update is waiting. See .e2e-ref.md."
+            exit 1
+          fi
+          echo "ADVISORY: vectors are current with flamenet-e2e HEAD"
+
+  # The weekly scrub, on every change. Its checks are the silent ones: an
+  # envelope kind one app sends and the other cannot parse shows nothing at
+  # either end. The siblings are public, so they clone with no credentials.
+  parity-scrub:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@v4
+      - name: Parity scrub
+        run: |
+          rm -rf ci-scrub && mkdir -p ci-scrub
+          git clone --depth 1 "$GITEA_BASE/flamenet-messenger-android.git" ci-scrub/android
+          git clone --depth 1 "$GITEA_BASE/flamenet-relay.git" ci-scrub/relay
+          # Non-zero on a HIGH, which is the whole contract.
+          python3 Scripts/parity-scrub.py --ios . --android ci-scrub/android --relay ci-scrub/relay
@@ -0,0 +1,15 @@
+#!/usr/bin/env bash
+# Regenerate the Xcode project after anything that can change project.yml.
+#
+# `FlamenetMessenger.xcodeproj` is generated by xcodegen and is not in git, so
+# a pull updates project.yml and leaves the project Xcode opens exactly as it
+# was. That is how a stale version number gets archived: everything on disk is
+# correct and the one file Xcode reads is a day old.
+#
+# Installed by Scripts/generate.sh, which sets core.hooksPath to this
+# directory. Silent when nothing changed.
+set -u
+cd "$(git rev-parse --show-toplevel)" || exit 0
+[ -f project.yml ] || exit 0
+./Scripts/generate.sh >/dev/null 2>&1 && echo "xcodegen: project regenerated"
+exit 0
@@ -0,0 +1,15 @@
+#!/usr/bin/env bash
+# Regenerate the Xcode project after anything that can change project.yml.
+#
+# `FlamenetMessenger.xcodeproj` is generated by xcodegen and is not in git, so
+# a pull updates project.yml and leaves the project Xcode opens exactly as it
+# was. That is how a stale version number gets archived: everything on disk is
+# correct and the one file Xcode reads is a day old.
+#
+# Installed by Scripts/generate.sh, which sets core.hooksPath to this
+# directory. Silent when nothing changed.
+set -u
+cd "$(git rev-parse --show-toplevel)" || exit 0
+[ -f project.yml ] || exit 0
+./Scripts/generate.sh >/dev/null 2>&1 && echo "xcodegen: project regenerated"
+exit 0
@@ -0,0 +1,15 @@
+#!/usr/bin/env bash
+# Regenerate the Xcode project after anything that can change project.yml.
+#
+# `FlamenetMessenger.xcodeproj` is generated by xcodegen and is not in git, so
+# a pull updates project.yml and leaves the project Xcode opens exactly as it
+# was. That is how a stale version number gets archived: everything on disk is
+# correct and the one file Xcode reads is a day old.
+#
+# Installed by Scripts/generate.sh, which sets core.hooksPath to this
+# directory. Silent when nothing changed.
+set -u
+cd "$(git rev-parse --show-toplevel)" || exit 0
+[ -f project.yml ] || exit 0
+./Scripts/generate.sh >/dev/null 2>&1 && echo "xcodegen: project regenerated"
+exit 0
@@ -6,6 +6,19 @@ xcuserdata/
 *.xcscmblueprint
 *.xccheckout

+# Derived data from the documented test command, which passes
+# `-derivedDataPath ci-build`. Note this does NOT match the `build/` rule above
+# — that matches a directory named exactly "build" — and 3,500 files of index
+# and compilation cache were staged once because of it.
+ci-build/
+# The iPad simulator build used to photograph the two-column layout. The same
+# derived-data shape as ci-build, and just as large.
+ipad-build/
+
+# Same trap, second spelling: the signed device build uses
+# `-derivedDataPath device-build`. Any new derived-data path needs a line here.
+device-build/
+
 # XcodeGen output — regenerate with `xcodegen generate`.
 # Comment the next line out if you prefer to commit the project file.
 FlamenetMessenger.xcodeproj/
@@ -17,25 +30,16 @@ FlamenetMessenger.xcodeproj/
 .build/
 .swiftpm/

-# Swift build products
-server/.build/
-
 # Secrets. `.env` holds the database password, the at-rest key, the issuer
 # signing seed and the Stripe secret — none of which belong in git, and the
 # issuer seed in particular cannot be rotated without invalidating every token
 # already issued.
 .env
-server/.env
 *.pem

-# Android / Gradle build products
-android/.gradle/
-android/build/
-android/*/build/
-# Machine-specific SDK path.
-android/local.properties
+# ⚠️ The `server/`, `android/` and `engine/` rules that used to be here went
+# with the 2026-08-28 split — those subtrees are separate repositories now and
+# each carries its own ignores. Re-adding a rule here does not affect them.

-# The compiled Swift interop driver. A macOS arm64 binary, rebuilt by
-# engine/test/interop/build.sh — committing it put an unrunnable file in front
-# of the Linux CI runner, which reported it as a shell syntax error.
-engine/test/interop/interop-swift
+# CI clones the pinned flamenet-e2e here to check Tests/Vectors is current.
+ci-vectors*/
@@ -1,174 +0,0 @@
-# Flamenet Messenger — one repo, three implementations.
-#
-# The iOS app, the Swift relay, and the JS engine that both are checked against
-# now live together. This pipeline runs what a Linux runner can run, publishes
-# the engine to its public mirror, and is explicit about the two things it
-# cannot run rather than letting a green pipeline imply they passed.
-#
-# Everything runs on our own runner (docker executor on the OVH box), so it
-# costs zero GitLab SaaS minutes. Untagged jobs fall through to GitLab's shared
-# runners and burn the shared quota, which is why `default: tags` is set once
-# here rather than per job.
-stages: [test, publish]
-
-default:
-  tags: [vps]
-
-variables:
-  GIT_DEPTH: "20"
-
-.rules: &rules
-  rules:
-    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
-    - if: $CI_COMMIT_BRANCH == "main"
-
-# ---------------------------------------------------------------------------
-# test
-# ---------------------------------------------------------------------------
-
-# The engine suites.
-#
-# Node 22, because the engine needs WebCrypto X25519/Ed25519 (>= 20). Node 25
-# additionally has native ML-KEM-768, which lets conformance cross-check the
-# vendored backend against it; on 22 that section reports as skipped rather
-# than silently passing, which is the honest default for CI.
-#
-# `crosslayer.mjs` is gone with the WordPress plugin it checked; `interop.mjs`
-# and `relay.mjs` have their own jobs below. What is left is the three suites a
-# bare Linux node image can actually run.
-engine:
-  <<: *rules
-  stage: test
-  image: node:22
-  script:
-    - cd engine
-    - node test/conformance.mjs
-    - node test/ratchet.mjs
-    - node test/client.mjs
-
-# The Kotlin engine, against the same published vectors as the other two.
-#
-# Runs on a plain JDK image with no Android SDK, which is the point: the engine
-# is a Kotlin/JVM library and nothing in the protocol is Android-specific, so a
-# third implementation can be gated in CI on Linux rather than on somebody's
-# laptop with an emulator.
-android-engine:
-  <<: *rules
-  stage: test
-  image: gradle:9-jdk21
-  script:
-    - cd android
-    - gradle :engine:test --no-daemon --console=plain
-
-# The relay: built, then driven over real HTTP against SPEC.md §8.
-#
-# This is the job that makes the relay's spec-conformance a gate rather than a
-# claim. The image is pinned — an unpinned toolchain has broken every deploy in
-# this account before, and a compiler that changes underneath you fails in ways
-# that look like your own regression.
-#
-# 6.1, not 6.0: postgres-kit 2.16.1 declares swift-tools-version 6.1, and a 6.0
-# toolchain refuses to resolve it. The Dockerfile is on 6.1 for the same reason,
-# and the two must not drift.
-relay:
-  <<: *rules
-  stage: test
-  image: swift:6.1-noble
-  cache:
-    key: "swift-$CI_COMMIT_REF_SLUG"
-    paths: [server/.build/]
-  before_script:
-    # Node 22, not the distribution's.
-    #
-    # Ubuntu Noble ships Node 18, where `globalThis.crypto` is not exposed by
-    # default. The engine's own job pins node:22 for that reason and this one
-    # quietly did not — which stayed invisible until §20 landed, because
-    # ML-DSA signing is the first code path to reach for
-    # `crypto.getRandomValues` at run time rather than at import.
-    - apt-get update -qq
-    - apt-get install -y -qq --no-install-recommends curl ca-certificates gnupg
-    - curl -fsSL https://deb.nodesource.com/setup_22.x | bash -
-    - apt-get install -y -qq nodejs
-    - node -e "if (!globalThis.crypto?.getRandomValues) { console.error('no WebCrypto on ' + process.version); process.exit(1) }"
-    - node --version
-  script:
-    - cd server && swift build
-    - cd ../engine && node test/relay.mjs
-  timeout: 30 minutes
-
-# Cross-engine interop — the JS engine against the iOS app's OWN Swift sources.
-#
-# Cannot run here: the driver builds from Sources/E2E/*.swift against CryptoKit,
-# which is Apple-only. Declared rather than omitted, because it is the
-# tiebreaker between three implementations and "CI is green" must not be read as
-# "interop was checked". Run it on a Mac before merging anything under engine/src/
-# or Sources/E2E/.
-interop:
-  stage: test
-  rules: [{ when: never }]
-  script:
-    - cd engine && node test/interop.mjs
-
-# The iOS app itself. Needs Xcode; there is no Linux path to it at all. Same
-# reasoning as interop: named so its absence is visible.
-ios:
-  stage: test
-  rules: [{ when: never }]
-  script:
-    - xcodebuild -project FlamenetMessenger.xcodeproj -scheme FlamenetMessenger build
-
-# ---------------------------------------------------------------------------
-# publish
-# ---------------------------------------------------------------------------
-
-# Mirror the engine subtree to the PUBLIC repository.
-#
-# `engine/` and `server/` are published to the root of
-# gitlab.com/paulhitt/flamenet-e2e (MIT). The
-# iOS app is NOT: it stays in this private repo, and the mirror is built from a
-# path allowlist rather than an ignore list, so a new top-level directory here
-# is private by default instead of published by accident.
-#
-# MANUAL on purpose. Everything else in this pipeline is reversible; a push to a
-# public repository is not — a key that lands there is leaked at the moment of
-# the push, whatever the next commit says. The runner does the work; a person
-# decides when. Requires MIRROR_TOKEN: a project access token on flamenet-e2e
-# with write_repository, set masked in CI/CD variables.
-mirror:
-  stage: publish
-  image: alpine:3.20
-  rules:
-    - if: $CI_COMMIT_BRANCH == "main"
-      when: manual
-      allow_failure: true
-  variables:
-    MIRROR_REPO: gitlab.com/paulhitt/flamenet-e2e.git
-  script:
-    - apk add --no-cache git bash rsync
-    # The gate. It reads what is about to be published, not what is in HEAD.
-    - bash engine/scripts/secret-sweep.sh engine
-    - bash engine/scripts/secret-sweep.sh server
-    - |
-      set -eu
-      test -n "${MIRROR_TOKEN:-}" || { echo "MIRROR_TOKEN is not set"; exit 1; }
-      git clone --depth 1 "https://oauth2:${MIRROR_TOKEN}@${MIRROR_REPO}" /tmp/mirror
-      # Allowlist, not `rsync --delete` of everything: an explicit list is the
-      # difference between publishing the engine and publishing whatever
-      # happened to be in the directory. `Sources/` — the iOS app — is not on
-      # it, and cannot be added by accident.
-      for path in src test docs vendor scripts \
-                  LICENSE README.md SECURITY.md SELF-HOSTING.md package.json; do
-        [ -e "engine/$path" ] || { echo "missing from source: engine/$path"; exit 1; }
-        rsync -a --delete "engine/$path" /tmp/mirror/
-      done
-      # The Swift server ships with the engine: publishing the protocol and
-      # withholding the thing that speaks it is the gap the notes call out in
-      # Signal, and it costs nothing to not repeat.
-      rsync -a --delete --exclude='.build/' server /tmp/mirror/
-      cd /tmp/mirror
-      git config user.email "ci@flamenet.io"
-      git config user.name "Flamenet CI"
-      git add -A
-      git diff --cached --quiet && { echo "mirror already current"; exit 0; }
-      git commit -m "Sync engine and relay from flamenetmessenger@${CI_COMMIT_SHORT_SHA}"
-      git push origin HEAD:main
@@ -0,0 +1,3 @@
+[submodule "Packages/Obfs4"]
+	path = Packages/Obfs4
+	url = https://git.extant2000.com/extant2000/flamenet-elligator2.git
@@ -0,0 +1,81 @@
+{
+  "fileScopedDeclarationPrivacy": {
+    "accessLevel": "private"
+  },
+  "indentBlankLines": false,
+  "indentConditionalCompilationBlocks": true,
+  "indentSwitchCaseLabels": false,
+  "indentation": {
+    "spaces": 4
+  },
+  "lineBreakAroundMultilineExpressionChainComponents": false,
+  "lineBreakBeforeControlFlowKeywords": false,
+  "lineBreakBeforeEachArgument": false,
+  "lineBreakBeforeEachGenericRequirement": false,
+  "lineBreakBetweenDeclarationAttributes": false,
+  "lineLength": 100,
+  "maximumBlankLines": 1,
+  "multiElementCollectionTrailingCommas": true,
+  "multilineTrailingCommaBehavior": "keptAsWritten",
+  "noAssignmentInExpressions": {
+    "allowedFunctions": [
+      "XCTAssertNoThrow"
+    ]
+  },
+  "orderedImports": {
+    "includeConditionalImports": false,
+    "shouldGroupImports": true
+  },
+  "prioritizeKeepingFunctionOutputTogether": false,
+  "reflowMultilineStringLiterals": "never",
+  "respectsExistingLineBreaks": true,
+  "rules": {
+    "AllPublicDeclarationsHaveDocumentation": false,
+    "AlwaysUseLiteralForEmptyCollectionInit": false,
+    "AlwaysUseLowerCamelCase": true,
+    "AmbiguousTrailingClosureOverload": true,
+    "AvoidRetroactiveConformances": true,
+    "BeginDocumentationCommentWithOneLineSummary": false,
+    "DoNotUseSemicolons": true,
+    "DontRepeatTypeInStaticProperties": true,
+    "FileScopedDeclarationPrivacy": true,
+    "FullyIndirectEnum": true,
+    "GroupNumericLiterals": true,
+    "IdentifiersMustBeASCII": true,
+    "NeverForceUnwrap": false,
+    "NeverUseForceTry": false,
+    "NeverUseImplicitlyUnwrappedOptionals": false,
+    "NoAccessLevelOnExtensionDeclaration": true,
+    "NoAssignmentInExpressions": true,
+    "NoBlockComments": false,
+    "NoCasesWithOnlyFallthrough": true,
+    "NoEmptyLinesOpeningClosingBraces": false,
+    "NoEmptyTrailingClosureParentheses": true,
+    "NoLabelsInCasePatterns": true,
+    "NoLeadingUnderscores": false,
+    "NoParensAroundConditions": true,
+    "NoPlaygroundLiterals": true,
+    "NoVoidReturnOnFunctionSignature": true,
+    "OmitExplicitReturns": false,
+    "OneCasePerLine": true,
+    "OneVariableDeclarationPerLine": true,
+    "OnlyOneTrailingClosureArgument": true,
+    "OrderedImports": true,
+    "ReplaceForEachWithForLoop": true,
+    "ReturnVoidInsteadOfEmptyTuple": true,
+    "TypeNamesShouldBeCapitalized": true,
+    "UseEarlyExits": false,
+    "UseExplicitNilCheckInConditions": true,
+    "UseLetInEveryBoundCaseVariable": true,
+    "UseShorthandTypeNames": true,
+    "UseSingleLinePropertyGetter": true,
+    "UseSynthesizedInitializer": true,
+    "UseTripleSlashForDocumentationComments": true,
+    "UseWhereClausesInForLoops": false,
+    "ValidateDocumentationComments": false
+  },
+  "spacesAroundRangeFormationOperators": false,
+  "spacesBeforeEndOfLineComments": 2,
+  "tabWidth": 8,
+  "version": 1
+}
@@ -0,0 +1,3 @@
+FlameNet sticker pack `flamenet.retro`: 24 original drawings in `svg/`, rendered to the 288x288 transparent PNGs the app ships in `Resources/stickers/flamenet.retro/`, in the picker order of `Resources/stickers/flamenet.retro.json`. The Android app ships the same PNG bytes.
+
+To re-render after editing an SVG, run this from this folder with Node 22 or later: `MANIFEST=../../Resources/stickers/flamenet.retro.json OUT=../../Resources/stickers/flamenet.retro PW_DIR=<folder with node_modules/playwright-core> CHROME=<Chromium binary> node render.mjs`. It also writes two contact sheets here, which are not shipped.
@@ -0,0 +1,191 @@
+// Renders the FlameNet sticker pack: svg/<id>.svg -> flamenet.retro/<id>.png
+// (288x288, transparent, 8-bit palette PNG) and the two contact sheets.
+// Picker order and names come from flamenet.retro.json.
+//
+// Needs Node 22 or later and playwright-core with a Chromium build:
+//   PW_DIR=<folder whose node_modules has playwright-core> \
+//   CHROME=<chromium or chrome-headless-shell binary> node render.mjs
+// Without PW_DIR it imports playwright-core from here; without CHROME it
+// uses the browser Playwright installed. MANIFEST and OUT point it at other
+// copies of flamenet.retro.json and the PNG folder; both default to here.
+
+import fs from "node:fs";
+import path from "node:path";
+import zlib from "node:zlib";
+import { createRequire } from "node:module";
+import { fileURLToPath } from "node:url";
+
+const HERE = path.dirname(fileURLToPath(import.meta.url));
+const SIZE = 288;
+const SHEET = 96;
+
+const require = createRequire(import.meta.url);
+const { chromium } = require(process.env.PW_DIR
+  ? require.resolve("playwright-core", { paths: [process.env.PW_DIR] })
+  : "playwright-core");
+
+const manifest = JSON.parse(fs.readFileSync(process.env.MANIFEST || path.join(HERE, "flamenet.retro.json"), "utf8"));
+
+// The sources have to render the same everywhere: no ids, no references,
+// no fonts, one canvas size.
+function check(id, svg) {
+  const bad = [
+    [/\sid\s*=/, "an id"],
+    [/href|url\(/, "a reference"],
+    [/<(text|tspan|image|style|script|foreignObject)\b|font-/, "text, fonts or embedded content"],
+  ].find(([re]) => re.test(svg));
+  if (bad) throw new Error(`${id}.svg has ${bad[1]}`);
+  if (!/^<svg [^>]*viewBox="0 0 200 200"/.test(svg)) throw new Error(`${id}.svg needs viewBox="0 0 200 200"`);
+}
+
+// 8-bit palette PNG.
+
+// Colours compared premultiplied, so faint edge pixels count for little.
+const unpack = k => [k >>> 24, (k >>> 16) & 255, (k >>> 8) & 255, k & 255];
+const pm = k => { const [r, g, b, a] = unpack(k); return [r * a / 255, g * a / 255, b * a / 255, a]; };
+const pack = (r, g, b, a) => ((r << 24) | (g << 16) | (b << 8) | a) >>> 0;
+
+// Splits the leftover edge colours into n boxes, each time cutting the box
+// with the largest squared error along its widest channel.
+function medianCut(entries, n) {
+  const sse = box => {
+    let w = 0; const s = [0, 0, 0, 0], q = [0, 0, 0, 0];
+    for (const p of box) { w += p.c; for (let d = 0; d < 4; d++) { s[d] += p.v[d] * p.c; q[d] += p.v[d] * p.v[d] * p.c; } }
+    const per = q.map((x, d) => x - s[d] * s[d] / w);
+    return { total: per.reduce((a, b) => a + b, 0), dim: per.indexOf(Math.max(...per)), w };
+  };
+  let boxes = [entries.map(([k, c]) => ({ k, c, v: pm(k) }))].filter(b => b.length);
+  while (boxes.length && boxes.length < n) {
+    let best = -1, bestErr = 0, dim = 0;
+    boxes.forEach((b, i) => {
+      if (b.length < 2) return;
+      const e = sse(b);
+      if (e.total > bestErr) { bestErr = e.total; best = i; dim = e.dim; }
+    });
+    if (best < 0) break;
+    const box = boxes[best].slice().sort((a, b) => a.v[dim] - b.v[dim] || a.k - b.k);
+    const half = box.reduce((a, p) => a + p.c, 0) / 2;
+    let acc = 0, cut = 1;
+    for (let i = 0; i < box.length - 1; i++) { acc += box[i].c; if (acc >= half) { cut = i + 1; break; } }
+    boxes.splice(best, 1, box.slice(0, cut), box.slice(cut));
+  }
+  return boxes.map(box => {
+    let w = 0; const s = [0, 0, 0, 0];
+    for (const p of box) { w += p.c; for (let d = 0; d < 4; d++) s[d] += p.v[d] * p.c; }
+    const a = Math.round(s[3] / w);
+    if (a === 0) return 0;
+    const ch = d => Math.max(0, Math.min(255, Math.round((s[d] / w) * 255 / (s[3] / w))));
+    return pack(ch(0), ch(1), ch(2), a);
+  });
+}
+
+function chunk(type, data) {
+  const head = Buffer.alloc(4); head.writeUInt32BE(data.length);
+  const body = Buffer.concat([Buffer.from(type, "latin1"), data]);
+  const crc = Buffer.alloc(4); crc.writeUInt32BE(zlib.crc32(body) >>> 0);
+  return Buffer.concat([head, body, crc]);
+}
+
+function encodePalettePNG(rgba, w, h) {
+  const n = w * h, keys = new Uint32Array(n), hist = new Map();
+  for (let i = 0; i < n; i++) {
+    const a = rgba[4 * i + 3];
+    const k = a === 0 ? 0 : pack(rgba[4 * i], rgba[4 * i + 1], rgba[4 * i + 2], a);
+    keys[i] = k;
+    hist.set(k, (hist.get(k) || 0) + 1);
+  }
+  const byCount = [...hist.entries()].sort((a, b) => b[1] - a[1] || a[0] - b[0]);
+  let palette;
+  if (byCount.length <= 256) {
+    palette = byCount.map(e => e[0]);
+  } else {
+    // Flat fills keep their exact colour; only edge blends are merged.
+    const fixed = byCount.filter(e => e[1] >= 24).slice(0, 128).map(e => e[0]);
+    const taken = new Set(fixed);
+    palette = [...new Set(fixed.concat(medianCut(byCount.filter(e => !taken.has(e[0])), 256 - fixed.length)))];
+  }
+  // Translucent entries first, so tRNS can stop at the last one.
+  palette.sort((a, b) => ((a & 255) === 255) - ((b & 255) === 255) || (a & 255) - (b & 255) || a - b);
+  const pv = palette.map(pm);
+  const index = new Map();
+  for (const k of hist.keys()) {
+    const v = pm(k);
+    let best = 0, bd = Infinity;
+    for (let j = 0; j < pv.length; j++) {
+      const d = (v[0] - pv[j][0]) ** 2 + (v[1] - pv[j][1]) ** 2 + (v[2] - pv[j][2]) ** 2 + 2 * (v[3] - pv[j][3]) ** 2;
+      if (d < bd) { bd = d; best = j; }
+    }
+    index.set(k, best);
+  }
+  const raw = Buffer.alloc(h * (w + 1));
+  for (let y = 0; y < h; y++) {
+    raw[y * (w + 1)] = 0;
+    for (let x = 0; x < w; x++) raw[y * (w + 1) + 1 + x] = index.get(keys[y * w + x]);
+  }
+  const ihdr = Buffer.alloc(13);
+  ihdr.writeUInt32BE(w, 0); ihdr.writeUInt32BE(h, 4);
+  ihdr[8] = 8; ihdr[9] = 3;
+  const plte = Buffer.alloc(palette.length * 3), alpha = [];
+  palette.forEach((k, j) => {
+    const [r, g, b, a] = unpack(k);
+    plte[3 * j] = r; plte[3 * j + 1] = g; plte[3 * j + 2] = b;
+    if (a < 255) alpha.push(a);
+  });
+  return Buffer.concat([
+    Buffer.from([137, 80, 78, 71, 13, 10, 26, 10]),
+    chunk("IHDR", ihdr),
+    chunk("PLTE", plte),
+    ...(alpha.length ? [chunk("tRNS", Buffer.from(alpha))] : []),
+    chunk("IDAT", zlib.deflateSync(raw, { level: 9, memLevel: 9 })),
+    chunk("IEND", Buffer.alloc(0)),
+  ]);
+}
+
+// Render.
+
+const browser = await chromium.launch(process.env.CHROME ? { executablePath: process.env.CHROME } : {});
+const page = await browser.newPage({ viewport: { width: SIZE, height: SIZE }, deviceScaleFactor: 1 });
+const outDir = process.env.OUT || path.join(HERE, "flamenet.retro");
+fs.mkdirSync(outDir, { recursive: true });
+
+const pngs = {};
+for (const s of manifest.stickers) {
+  const svg = fs.readFileSync(path.join(HERE, "svg", `${s.id}.svg`), "utf8").trim();
+  check(s.id, svg);
+  if (s.image !== `${s.id}.png`) throw new Error(`${s.id}: image should be ${s.id}.png`);
+  const sized = svg.replace("<svg ", `<svg width="${SIZE}" height="${SIZE}" `);
+  const b64 = await page.evaluate(async ({ sized, size }) => {
+    const img = new Image();
+    img.src = "data:image/svg+xml;charset=utf-8," + encodeURIComponent(sized);
+    await img.decode();
+    const canvas = new OffscreenCanvas(size, size);
+    const g = canvas.getContext("2d");
+    g.drawImage(img, 0, 0, size, size);
+    const d = g.getImageData(0, 0, size, size).data;
+    let bin = "";
+    for (let i = 0; i < d.length; i += 0x8000) bin += String.fromCharCode.apply(null, d.subarray(i, i + 0x8000));
+    return btoa(bin);
+  }, { sized, size: SIZE });
+  const png = encodePalettePNG(Buffer.from(b64, "base64"), SIZE, SIZE);
+  fs.writeFileSync(path.join(outDir, s.image), png);
+  pngs[s.id] = png;
+  console.log(`${s.image.padEnd(22)} ${String(png.length).padStart(6)} bytes`);
+}
+
+// Contact sheets, 96 px on white and on black.
+
+const esc = t => t.replace(/[&<>"]/g, c => `&#${c.charCodeAt(0)};`);
+for (const [name, bg, fg] of [["sheet-light.png", "#ffffff", "#333333"], ["sheet-dark.png", "#000000", "#e8e8e8"]]) {
+  const cells = manifest.stickers.map(s =>
+    `<figure><img src="data:image/png;base64,${pngs[s.id].toString("base64")}" width="${SHEET}" height="${SHEET}" alt=""><figcaption>${esc(s.name)}</figcaption></figure>`).join("");
+  await page.setViewportSize({ width: 6 * 124 + 24, height: 200 });
+  await page.setContent(`<!doctype html><html><head><style>
+    body { margin: 0; padding: 12px; background: ${bg}; color: ${fg}; font: 12px -apple-system, Helvetica, Arial, sans-serif; }
+    main { display: grid; grid-template-columns: repeat(6, 124px); }
+    figure { margin: 0; padding: 8px 0 10px; text-align: center; }
+    img { display: block; margin: 0 auto 4px; }
+  </style></head><body><main>${cells}</main></body></html>`);
+  await page.screenshot({ path: path.join(HERE, name), fullPage: true });
+  console.log(`${name} written`);
+}
+await browser.close();
@@ -0,0 +1,13 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 200 200">
+<g transform="rotate(-8 100 100)">
+<g fill="#fff" stroke="#fff" stroke-width="14" stroke-linejoin="round" stroke-linecap="round">
+<path d="M100 14 C136 14 156 42 156 76 C156 110 128 138 100 140 C72 138 44 110 44 76 C44 42 64 14 100 14 Z"/>
+<path d="M92 150 L100 139 L108 150 Z"/>
+<path d="M100 150 C91 160 108 167 100 175 C94 181 99 183 97 186" fill="none"/>
+</g>
+<path d="M100 150 C91 160 108 167 100 175 C94 181 99 183 97 186" fill="none" stroke="#333" stroke-width="2.5" stroke-linecap="round"/>
+<path d="M100 14 C136 14 156 42 156 76 C156 110 128 138 100 140 C72 138 44 110 44 76 C44 42 64 14 100 14 Z" fill="#FF3B3B" stroke="#333" stroke-width="2"/>
+<path d="M92 150 L100 139 L108 150 Z" fill="#FF3B3B" stroke="#333" stroke-width="2" stroke-linejoin="round"/>
+<ellipse cx="76" cy="50" rx="10" ry="19" fill="#fff" opacity=".55" transform="rotate(20 76 50)"/>
+</g>
+</svg>
@@ -0,0 +1,20 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 200 200">
+<g transform="rotate(-6 100 108)">
+<g fill="#fff" stroke="#fff" stroke-width="14" stroke-linejoin="round" stroke-linecap="round">
+<circle cx="100" cy="24" r="7"/>
+<path d="M100 26 L44 66 M100 26 L156 66" fill="none" stroke-width="17"/>
+<rect x="24" y="64" width="152" height="88" rx="10"/>
+</g>
+<path d="M100 26 L44 66 M100 26 L156 66" fill="none" stroke="#6B3E1F" stroke-width="3" stroke-linecap="round"/>
+<circle cx="100" cy="24" r="7" fill="#B8B8B8" stroke="#333" stroke-width="2"/>
+<rect x="24" y="64" width="152" height="88" rx="10" fill="#FFCC00" stroke="#333" stroke-width="2"/>
+<rect x="31" y="71" width="138" height="74" rx="6" fill="none" stroke="#E6A800" stroke-width="2"/>
+<circle cx="44" cy="68" r="3" fill="#6B3E1F"/>
+<circle cx="156" cy="68" r="3" fill="#6B3E1F"/>
+<g fill="#003399" fill-rule="evenodd">
+<path transform="translate(46.5 0)" d="M0 85 H19 C26 85 29 90 29 96.5 C29 101 27 104 23.5 105.5 C28 107 31 111 31 117.5 C31 125.5 26 131 18 131 H0 Z M11 94 H16 C18.5 94 19 95.5 19 97 C19 98.5 18.5 100 16 100 H11 Z M11 111 H18 C20.5 111 21 113 21 115.5 C21 118 20.5 121 18 121 H11 Z"/>
+<path transform="translate(84.5 0)" d="M0 131 V85 H18 C26 85 30 90.5 30 98 C30 104 27 108 22.5 110 L31 131 H19.5 L12 112.5 H11 V131 Z M11 94 H17 C19.5 94 20 96 20 98.5 C20 101 19.5 103.5 17 103.5 H11 Z"/>
+<path transform="translate(122.5 0)" d="M0 85 H19 C26 85 29 90 29 96.5 C29 101 27 104 23.5 105.5 C28 107 31 111 31 117.5 C31 125.5 26 131 18 131 H0 Z M11 94 H16 C18.5 94 19 95.5 19 97 C19 98.5 18.5 100 16 100 H11 Z M11 111 H18 C20.5 111 21 113 21 115.5 C21 118 20.5 121 18 121 H11 Z"/>
+</g>
+</g>
+</svg>
@@ -0,0 +1,43 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 200 200">
+<g fill="#fff" stroke="#fff" stroke-width="14" stroke-linejoin="round" stroke-linecap="round">
+<ellipse cx="100" cy="174" rx="80" ry="12"/>
+<rect x="26" y="92" width="148" height="80" rx="10"/>
+<rect x="57" y="56" width="10" height="40"/>
+<rect x="95" y="56" width="10" height="40"/>
+<rect x="133" y="56" width="10" height="40"/>
+<path d="M62 30 C70 40 70 48 62 54 C54 48 54 40 62 30 Z"/>
+<path d="M100 30 C108 40 108 48 100 54 C92 48 92 40 100 30 Z"/>
+<path d="M138 30 C146 40 146 48 138 54 C130 48 130 40 138 30 Z"/>
+</g>
+<g stroke="#333" stroke-width="2" stroke-linejoin="round">
+<ellipse cx="100" cy="174" rx="80" ry="12" fill="#CCE6FF"/>
+<path d="M30 106 H170 V162 Q170 172 160 172 H40 Q30 172 30 162 Z" fill="#FF99BB"/>
+<rect x="30" y="146" width="140" height="8" fill="#FFFDF5" stroke-width="1.5"/>
+<path d="M30 106 H170 V162 Q170 172 160 172 H40 Q30 172 30 162 Z" fill="none"/>
+<path d="M26 102 Q26 92 36 92 H164 Q174 92 174 102 V112 C174 120 160 120 160 112 C160 108 152 108 150 112 V124 C150 132 136 132 136 124 V114 C136 108 124 108 120 114 C118 120 108 120 106 114 C104 108 96 108 94 114 V128 C94 136 80 136 80 128 V114 C80 108 70 108 66 114 C64 120 54 120 52 114 C50 108 42 108 40 114 V120 C40 128 26 128 26 120 Z" fill="#FFFDF5"/>
+<rect x="57" y="62" width="10" height="30" fill="#3366FF"/>
+<rect x="95" y="62" width="10" height="30" fill="#FFCC00"/>
+<rect x="133" y="62" width="10" height="30" fill="#33AA33"/>
+</g>
+<g stroke="#333" stroke-width="2.5" stroke-linecap="round">
+<path d="M62 62 V55 M100 62 V55 M138 62 V55"/>
+</g>
+<g fill="#FF9900" stroke="#333" stroke-width="2" stroke-linejoin="round">
+<path d="M62 30 C70 40 70 48 62 54 C54 48 54 40 62 30 Z"/>
+<path d="M100 30 C108 40 108 48 100 54 C92 48 92 40 100 30 Z"/>
+<path d="M138 30 C146 40 146 48 138 54 C130 48 130 40 138 30 Z"/>
+</g>
+<g fill="#FFCC00">
+<ellipse cx="62" cy="46" rx="3.5" ry="5"/>
+<ellipse cx="100" cy="46" rx="3.5" ry="5"/>
+<ellipse cx="138" cy="46" rx="3.5" ry="5"/>
+</g>
+<g>
+<rect x="46" y="135" width="9" height="4" rx="2" fill="#3366FF" transform="rotate(30 50 137)"/>
+<rect x="112" y="136" width="9" height="4" rx="2" fill="#FFCC00" transform="rotate(-25 116 138)"/>
+<rect x="152" y="134" width="9" height="4" rx="2" fill="#FFFFFF" transform="rotate(40 156 136)"/>
+<rect x="60" y="160" width="9" height="4" rx="2" fill="#FFCC00" transform="rotate(-30 64 162)"/>
+<rect x="96" y="161" width="9" height="4" rx="2" fill="#3366FF" transform="rotate(15 100 163)"/>
+<rect x="136" y="160" width="9" height="4" rx="2" fill="#33AA33" transform="rotate(-35 140 162)"/>
+</g>
+</svg>
@@ -0,0 +1,18 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 200 200">
+<g fill="#fff" stroke="#fff" stroke-width="14" stroke-linejoin="round" stroke-linecap="round">
+<path d="M100 12 C118 34 119 52 100 64 C81 52 82 34 100 12 Z"/>
+<path d="M100 60 V74"/>
+<rect x="64" y="72" width="72" height="100" rx="5"/>
+<ellipse cx="100" cy="176" rx="62" ry="14"/>
+</g>
+<path d="M100 60 V74" stroke="#333" stroke-width="3.5" stroke-linecap="round"/>
+<path d="M100 12 C118 34 119 52 100 64 C81 52 82 34 100 12 Z" fill="#FF9900" stroke="#333" stroke-width="2" stroke-linejoin="round"/>
+<path d="M100 30 C109 43 109 54 100 60 C91 54 91 43 100 30 Z" fill="#FFCC00"/>
+<g stroke="#333" stroke-width="2" stroke-linejoin="round">
+<ellipse cx="100" cy="177" rx="62" ry="13" fill="#E6A800"/>
+<ellipse cx="100" cy="171" rx="62" ry="13" fill="#FFCC00"/>
+<rect x="64" y="72" width="72" height="100" rx="5" fill="#FFF6CC"/>
+<path d="M64 77 Q64 72 69 72 H131 Q136 72 136 77 V92 C136 98 127 98 127 92 C127 87 120 87 120 93 V104 C120 113 108 113 108 104 V93 C108 87 99 87 97 93 C95 99 86 99 86 93 C86 88 79 87 77 93 V98 C77 105 64 105 64 98 Z" fill="#FFFFFF"/>
+</g>
+<rect x="73" y="112" width="8" height="50" rx="4" fill="#fff" opacity=".8"/>
+</svg>
@@ -0,0 +1,22 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 200 200">
+<g fill="#fff" stroke="#fff" stroke-width="14" stroke-linejoin="round" stroke-linecap="round">
+<path d="M40 66 H140 V146 Q140 176 110 176 H70 Q40 176 40 146 Z"/>
+<ellipse cx="90" cy="66" rx="50" ry="10"/>
+<path d="M140 86 C178 84 180 138 140 136" fill="none" stroke-width="35"/>
+<path d="M70 46 C62 36 78 30 70 18 M92 44 C84 34 100 28 92 14 M114 46 C106 36 122 30 114 18" fill="none" stroke-width="19"/>
+</g>
+<g fill="none" stroke-linecap="round">
+<path d="M70 46 C62 36 78 30 70 18 M92 44 C84 34 100 28 92 14 M114 46 C106 36 122 30 114 18" stroke="#8C9BB0" stroke-width="5"/>
+<path d="M140 86 C178 84 180 138 140 136" stroke="#333" stroke-width="21"/>
+<path d="M140 86 C178 84 180 138 140 136" stroke="#CC0000" stroke-width="17"/>
+</g>
+<g stroke="#333" stroke-width="2" stroke-linejoin="round">
+<path d="M40 66 H140 V146 Q140 176 110 176 H70 Q40 176 40 146 Z" fill="#CC0000"/>
+<ellipse cx="90" cy="66" rx="50" ry="10" fill="#CC0000"/>
+<ellipse cx="90" cy="67" rx="43" ry="6.5" fill="#6B3E1F"/>
+</g>
+<rect x="40" y="88" width="100" height="10" fill="#fff"/>
+<path d="M40 70 V146 Q40 176 70 176 H110 Q140 176 140 146 V70" fill="none" stroke="#333" stroke-width="2" stroke-linejoin="round"/>
+<path d="M40 88 H140 M40 98 H140" stroke="#333" stroke-width="1.5"/>
+<rect x="50" y="106" width="8" height="52" rx="4" fill="#fff" opacity=".4"/>
+</svg>
@@ -0,0 +1,21 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 200 200">
+<g fill="#fff" stroke="#fff" stroke-width="14" stroke-linejoin="round">
+<rect x="24" y="20" width="152" height="126" rx="16"/>
+<path d="M80 144 H120 L126 160 H74 Z"/>
+<rect x="46" y="158" width="108" height="20" rx="9"/>
+</g>
+<g stroke="#333" stroke-width="2" stroke-linejoin="round">
+<path d="M80 144 H120 L126 160 H74 Z" fill="#D6CFB6"/>
+<rect x="46" y="158" width="108" height="20" rx="9" fill="#E8E2CC"/>
+<rect x="24" y="20" width="152" height="126" rx="16" fill="#E8E2CC"/>
+<rect x="40" y="34" width="120" height="88" rx="14" fill="#003399"/>
+<rect x="50" y="129" width="18" height="8" rx="3" fill="#D6CFB6" stroke-width="1.5"/>
+<circle cx="148" cy="133" r="4.5" fill="#33AA33" stroke-width="1.5"/>
+</g>
+<rect x="50" y="42" width="28" height="6" rx="3" fill="#fff" opacity=".35"/>
+<g fill="#FFCC00">
+<rect x="73" y="56" width="12" height="21" rx="6"/>
+<rect x="115" y="56" width="12" height="21" rx="6"/>
+</g>
+<path d="M72 90 Q100 114 128 90" fill="none" stroke="#FFCC00" stroke-width="7" stroke-linecap="round"/>
+</svg>
@@ -0,0 +1,51 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 200 200">
+<g fill="#fff" stroke="#fff" stroke-width="14" stroke-linejoin="round">
+<circle cx="46" cy="38" r="13"/>
+<circle cx="154" cy="38" r="13"/>
+<rect x="40" y="46" width="12" height="130"/>
+<rect x="148" y="46" width="12" height="130"/>
+<rect x="28" y="168" width="36" height="12" rx="3"/>
+<rect x="136" y="168" width="36" height="12" rx="3"/>
+<rect x="24" y="66" width="152" height="80"/>
+<path d="M46 20 V14 M30 26 L25 22 M62 26 L67 22 M154 20 V14 M138 26 L133 22 M170 26 L175 22" stroke-width="17" stroke-linecap="round"/>
+</g>
+<g stroke="#333" stroke-width="2" stroke-linejoin="round">
+<rect x="40" y="50" width="12" height="122" fill="#E6E6E6"/>
+<rect x="148" y="50" width="12" height="122" fill="#E6E6E6"/>
+<rect x="28" y="168" width="36" height="12" rx="3" fill="#FF9900"/>
+<rect x="136" y="168" width="36" height="12" rx="3" fill="#FF9900"/>
+<rect x="24" y="66" width="152" height="32" fill="#FFCC00"/>
+<rect x="24" y="116" width="152" height="30" fill="#FFCC00"/>
+</g>
+<g fill="#333">
+<polygon points="24,88 24,72 30,66 46,66"/>
+<polygon points="46,98 30,98 62,66 78,66"/>
+<polygon points="78,98 62,98 94,66 110,66"/>
+<polygon points="110,98 94,98 126,66 142,66"/>
+<polygon points="142,98 126,98 158,66 174,66"/>
+<polygon points="158,98 176,80 176,96 174,98"/>
+<polygon points="24,138 24,122 30,116 46,116"/>
+<polygon points="48,146 32,146 62,116 78,116"/>
+<polygon points="80,146 64,146 94,116 110,116"/>
+<polygon points="112,146 96,146 126,116 142,116"/>
+<polygon points="144,146 128,146 158,116 174,116"/>
+<polygon points="160,146 176,130 176,146"/>
+</g>
+<g fill="none" stroke="#333" stroke-width="2" stroke-linejoin="round">
+<rect x="24" y="66" width="152" height="32"/>
+<rect x="24" y="116" width="152" height="30"/>
+</g>
+<g stroke="#333" stroke-width="2" stroke-linejoin="round">
+<rect x="38" y="44" width="16" height="8" rx="2" fill="#555"/>
+<rect x="146" y="44" width="16" height="8" rx="2" fill="#555"/>
+<path d="M34 44 A12 12 0 0 1 58 44 Z" fill="#FF9900"/>
+<path d="M142 44 A12 12 0 0 1 166 44 Z" fill="#FF9900"/>
+</g>
+<g fill="#fff" opacity=".7">
+<ellipse cx="41" cy="37" rx="2.5" ry="4"/>
+<ellipse cx="149" cy="37" rx="2.5" ry="4"/>
+</g>
+<g stroke="#FF9900" stroke-width="3" stroke-linecap="round">
+<path d="M46 20 V14 M30 26 L25 22 M62 26 L67 22 M154 20 V14 M138 26 L133 22 M170 26 L175 22"/>
+</g>
+</svg>
@@ -0,0 +1,7 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 200 200">
+<path d="M100 188 C68 188 44 166 44 136 C44 110 48 86 52 62 C60 78 68 90 76 96 C74 68 88 40 116 12 C110 36 116 58 132 80 C140 72 150 64 156 54 C162 84 158 108 158 136 C158 166 132 188 100 188 Z" fill="#fff" stroke="#fff" stroke-width="14" stroke-linejoin="round"/>
+<path d="M100 188 C68 188 44 166 44 136 C44 110 48 86 52 62 C60 78 68 90 76 96 C74 68 88 40 116 12 C110 36 116 58 132 80 C140 72 150 64 156 54 C162 84 158 108 158 136 C158 166 132 188 100 188 Z" fill="#FF5A1F" stroke="#333" stroke-width="2" stroke-linejoin="round"/>
+<path d="M100 180 C76 180 62 162 62 140 C62 114 84 96 106 58 C102 84 138 108 138 140 C138 162 122 180 100 180 Z" fill="#FF9900"/>
+<path d="M100 176 C86 176 78 166 78 152 C78 134 92 124 102 104 C110 124 122 136 122 152 C122 166 114 176 100 176 Z" fill="#FFCC00"/>
+<ellipse cx="100" cy="160" rx="9" ry="11" fill="#FFF3B0"/>
+</svg>
@@ -0,0 +1,19 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 200 200">
+<g transform="rotate(-6 100 100)">
+<path d="M38 28 H150 L172 50 V164 Q172 172 164 172 H36 Q28 172 28 164 V38 Q28 28 38 28 Z" fill="#fff" stroke="#fff" stroke-width="14" stroke-linejoin="round"/>
+<g stroke="#333" stroke-width="2" stroke-linejoin="round">
+<path d="M38 28 H150 L172 50 V164 Q172 172 164 172 H36 Q28 172 28 164 V38 Q28 28 38 28 Z" fill="#003399"/>
+<rect x="58" y="28" width="80" height="48" fill="#C9D1DE"/>
+<rect x="110" y="37" width="16" height="30" rx="2" fill="#003399"/>
+<rect x="46" y="96" width="108" height="76" rx="4" fill="#FFFFFF"/>
+<path d="M46 106 V100 Q46 96 50 96 H150 Q154 96 154 100 V106 Z" fill="#FF3B3B"/>
+</g>
+<g fill="#B8C8F0">
+<rect x="56" y="120" width="88" height="5" rx="2.5"/>
+<rect x="56" y="136" width="88" height="5" rx="2.5"/>
+<rect x="56" y="152" width="58" height="5" rx="2.5"/>
+</g>
+<rect x="34" y="38" width="6" height="46" rx="3" fill="#fff" opacity=".35"/>
+<rect x="64" y="34" width="5" height="36" rx="2.5" fill="#fff" opacity=".6"/>
+</g>
+</svg>
@@ -0,0 +1,42 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 200 200">
+<g fill="#fff" stroke="#fff" stroke-width="14" stroke-linejoin="round" stroke-linecap="round">
+<circle cx="100" cy="48" r="30"/>
+<circle cx="62" cy="70" r="30"/>
+<circle cx="138" cy="70" r="30"/>
+<ellipse cx="40" cy="106" rx="20" ry="9" transform="rotate(-30 40 106)"/>
+<ellipse cx="160" cy="106" rx="20" ry="9" transform="rotate(30 160 106)"/>
+<path d="M62 90 L100 112 L138 90 Z"/>
+<path d="M40 106 H160 L104 188 H96 Z"/>
+</g>
+<g stroke="#333" stroke-width="2" stroke-linejoin="round">
+<ellipse cx="40" cy="106" rx="20" ry="9" transform="rotate(-30 40 106)" fill="#43A047"/>
+<ellipse cx="160" cy="106" rx="20" ry="9" transform="rotate(30 160 106)" fill="#43A047"/>
+</g>
+<g stroke="#2E7D32" stroke-width="5" stroke-linecap="round">
+<path d="M62 92 L88 110 M100 70 V110 M138 92 L112 110"/>
+</g>
+<g stroke="#333" stroke-width="2">
+<g fill="#FFFFFF">
+<circle cx="100" cy="31" r="13"/><circle cx="114.7" cy="39.5" r="13"/><circle cx="114.7" cy="56.5" r="13"/><circle cx="100" cy="65" r="13"/><circle cx="85.3" cy="56.5" r="13"/><circle cx="85.3" cy="39.5" r="13"/>
+</g>
+<circle cx="100" cy="48" r="9" fill="#FF9900"/>
+<g fill="#FF7AA2">
+<circle cx="62" cy="53" r="13"/><circle cx="76.7" cy="61.5" r="13"/><circle cx="76.7" cy="78.5" r="13"/><circle cx="62" cy="87" r="13"/><circle cx="47.3" cy="78.5" r="13"/><circle cx="47.3" cy="61.5" r="13"/>
+</g>
+<circle cx="62" cy="70" r="9" fill="#FFCC00"/>
+<g fill="#B388FF">
+<circle cx="138" cy="53" r="13"/><circle cx="152.7" cy="61.5" r="13"/><circle cx="152.7" cy="78.5" r="13"/><circle cx="138" cy="87" r="13"/><circle cx="123.3" cy="78.5" r="13"/><circle cx="123.3" cy="61.5" r="13"/>
+</g>
+<circle cx="138" cy="70" r="9" fill="#FFCC00"/>
+</g>
+<path d="M40 106 H160 L104 188 H96 Z" fill="#CCE6FF" stroke="#333" stroke-width="2" stroke-linejoin="round"/>
+<path d="M112 106 H160 L104 188 Z" fill="#B3D6FA"/>
+<path d="M40 106 H160 L104 188 H96 Z" fill="none" stroke="#333" stroke-width="2" stroke-linejoin="round"/>
+<g fill="#FF3B3B" stroke="#333" stroke-width="2" stroke-linejoin="round">
+<path d="M97 152 L87 173 L95 171 L100 157 Z"/>
+<path d="M103 152 L113 173 L105 171 L100 157 Z"/>
+<ellipse cx="86" cy="147" rx="14" ry="8" transform="rotate(-20 86 147)"/>
+<ellipse cx="114" cy="147" rx="14" ry="8" transform="rotate(20 114 147)"/>
+<circle cx="100" cy="150" r="6"/>
+</g>
+</svg>
@@ -0,0 +1,23 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 200 200">
+<g fill="#fff" stroke="#fff" stroke-width="14" stroke-linejoin="round">
+<rect x="38" y="96" width="124" height="84" rx="4"/>
+<rect x="30" y="72" width="140" height="28" rx="4"/>
+<path d="M100 72 C84 42 52 44 56 64 C58 74 84 76 100 72 Z"/>
+<path d="M100 72 C116 42 148 44 144 64 C142 74 116 76 100 72 Z"/>
+</g>
+<g stroke="#333" stroke-width="2" stroke-linejoin="round">
+<rect x="38" y="96" width="124" height="84" rx="4" fill="#3366FF"/>
+<g fill="#fff" stroke="none" opacity=".45">
+<circle cx="58" cy="120" r="6"/><circle cx="70" cy="156" r="6"/><circle cx="132" cy="134" r="6"/><circle cx="148" cy="164" r="6"/>
+</g>
+<rect x="88" y="100" width="24" height="80" fill="#FFCC00"/>
+<rect x="30" y="72" width="140" height="28" rx="4" fill="#5C85FF"/>
+<rect x="86" y="72" width="28" height="28" fill="#FFCC00"/>
+<path d="M100 72 C84 42 52 44 56 64 C58 74 84 76 100 72 Z" fill="#FFCC00"/>
+<path d="M100 72 C116 42 148 44 144 64 C142 74 116 76 100 72 Z" fill="#FFCC00"/>
+<path d="M96 69 C86 56 70 54 69 62 C69 68 84 70 96 69 Z" fill="#E6A800" stroke="none"/>
+<path d="M104 69 C114 56 130 54 131 62 C131 68 116 70 104 69 Z" fill="#E6A800" stroke="none"/>
+<ellipse cx="100" cy="70" rx="10" ry="9" fill="#FFCC00"/>
+</g>
+<rect x="36" y="76" width="40" height="5" rx="2.5" fill="#fff" opacity=".45"/>
+</svg>
@@ -0,0 +1,7 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 200 200">
+<g transform="rotate(-6 100 100)">
+<path d="M16 58 C16 2 100 2 100 58 C100 2 184 2 184 58 C184 114 100 156 100 184 C100 156 16 114 16 58 Z" fill="#fff" stroke="#fff" stroke-width="14" stroke-linejoin="round"/>
+<path d="M16 58 C16 2 100 2 100 58 C100 2 184 2 184 58 C184 114 100 156 100 184 C100 156 16 114 16 58 Z" fill="#E0245E" stroke="#333" stroke-width="2" stroke-linejoin="round"/>
+<ellipse cx="48" cy="52" rx="10" ry="19" fill="#fff" opacity=".55" transform="rotate(-35 48 52)"/>
+</g>
+</svg>
@@ -0,0 +1,27 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 200 200">
+<g transform="rotate(8 100 100)">
+<g fill="#fff" stroke="#fff" stroke-width="14" stroke-linejoin="round">
+<rect x="38" y="18" width="124" height="18" rx="6"/>
+<rect x="38" y="164" width="124" height="18" rx="6"/>
+<rect x="46" y="36" width="9" height="128"/>
+<rect x="145" y="36" width="9" height="128"/>
+<path d="M64 36 H136 C136 74 108 86 108 100 C108 114 136 126 136 164 H64 C64 126 92 114 92 100 C92 86 64 74 64 36 Z"/>
+</g>
+<path d="M64 36 H136 C136 74 108 86 108 100 C108 114 136 126 136 164 H64 C64 126 92 114 92 100 C92 86 64 74 64 36 Z" fill="#E6F2FF"/>
+<path d="M76 72 H124 C116 82 106 88 104 98 H96 C94 88 84 82 76 72 Z" fill="#FFCC00"/>
+<path d="M100 98 V150" stroke="#FFCC00" stroke-width="3"/>
+<path d="M68 163 C70 147 88 139 100 137 C112 139 130 147 132 163 Z" fill="#FFCC00"/>
+<path d="M73 44 C73 60 80 70 88 78" fill="none" stroke="#fff" stroke-width="4" stroke-linecap="round"/>
+<g stroke="#333" stroke-width="2" stroke-linejoin="round">
+<path d="M64 36 H136 C136 74 108 86 108 100 C108 114 136 126 136 164 H64 C64 126 92 114 92 100 C92 86 64 74 64 36 Z" fill="none"/>
+<rect x="46" y="36" width="9" height="128" fill="#A0632F"/>
+<rect x="145" y="36" width="9" height="128" fill="#A0632F"/>
+<rect x="38" y="18" width="124" height="18" rx="6" fill="#C8874A"/>
+<rect x="38" y="164" width="124" height="18" rx="6" fill="#C8874A"/>
+</g>
+<g fill="#fff" opacity=".35">
+<rect x="46" y="22" width="40" height="4" rx="2"/>
+<rect x="46" y="168" width="40" height="4" rx="2"/>
+</g>
+</g>
+</svg>
@@ -0,0 +1,11 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 200 200">
+<g transform="rotate(-5 100 100)">
+<path d="M48 28 H152 Q182 28 182 58 V110 Q182 140 152 140 H88 L56 174 L64 140 H48 Q18 140 18 110 V58 Q18 28 48 28 Z" fill="#fff" stroke="#fff" stroke-width="14" stroke-linejoin="round"/>
+<path d="M48 28 H152 Q182 28 182 58 V110 Q182 140 152 140 H88 L56 174 L64 140 H48 Q18 140 18 110 V58 Q18 28 48 28 Z" fill="#FFFFFF" stroke="#333" stroke-width="2" stroke-linejoin="round"/>
+<g fill="#CC0000" fill-rule="evenodd">
+<polygon transform="translate(44 0)" points="0,59 12,59 12,97 28,97 28,109 0,109"/>
+<path transform="translate(79 0)" d="M18 59 H24 A18 18 0 0 1 42 77 V91 A18 18 0 0 1 24 109 H18 A18 18 0 0 1 0 91 V77 A18 18 0 0 1 18 59 Z M19 71 H23 A7 7 0 0 1 30 78 V90 A7 7 0 0 1 23 97 H19 A7 7 0 0 1 12 90 V78 A7 7 0 0 1 19 71 Z"/>
+<polygon transform="translate(128 0)" points="0,59 12,59 12,97 28,97 28,109 0,109"/>
+</g>
+</g>
+</svg>
@@ -0,0 +1,16 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 200 200">
+<g transform="rotate(-8 100 108)">
+<g fill="#fff" stroke="#fff" stroke-width="14" stroke-linejoin="round">
+<rect x="22" y="56" width="156" height="104" rx="8"/>
+<path d="M138 34.6 C138 25.8 151.2 25.8 151.2 34.6 C151.2 25.8 164.4 25.8 164.4 34.6 C164.4 43.4 151.2 50 151.2 54.4 C151.2 50 138 43.4 138 34.6 Z"/>
+</g>
+<g stroke="#333" stroke-width="2" stroke-linejoin="round">
+<rect x="22" y="56" width="156" height="104" rx="8" fill="#FFE0EC"/>
+<path d="M25 156 L84 112 M175 156 L116 112" fill="none" stroke-width="1.5" stroke-linecap="round"/>
+<path d="M22 64 Q22 56 30 56 H170 Q178 56 178 64 L100 120 Z" fill="#FFC9DC"/>
+<path d="M79.6 103.8 C79.6 90.2 100 90.2 100 103.8 C100 90.2 120.4 90.2 120.4 103.8 C120.4 117.4 100 127.6 100 134.4 C100 127.6 79.6 117.4 79.6 103.8 Z" fill="#E0245E"/>
+<path d="M138 34.6 C138 25.8 151.2 25.8 151.2 34.6 C151.2 25.8 164.4 25.8 164.4 34.6 C164.4 43.4 151.2 50 151.2 54.4 C151.2 50 138 43.4 138 34.6 Z" fill="#FF99BB"/>
+</g>
+<ellipse cx="88" cy="100" rx="3" ry="5" fill="#fff" opacity=".6" transform="rotate(-30 88 100)"/>
+</g>
+</svg>
@@ -0,0 +1,13 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 200 200">
+<g fill="#fff" stroke="#fff" stroke-width="14" stroke-linejoin="round">
+<path d="M83.7 24.4 A80 80 0 1 0 167.1 131.7 A68 68 0 0 1 83.7 24.4 Z"/>
+<polygon points="108.3,99.2 111.3,109.4 121.3,112.8 112.6,118.8 112.5,129.4 104.1,122.9 94,126.1 97.6,116.1 91.4,107.5 102,107.8"/>
+<polygon points="76.8,70.5 80.5,76 87.2,76 83.1,81.3 85.1,87.6 78.9,85.4 73.5,89.2 73.7,82.6 68.4,78.7 74.7,76.8"/>
+</g>
+<path d="M83.7 24.4 A80 80 0 1 0 167.1 131.7 A68 68 0 0 1 83.7 24.4 Z" fill="#FFE680" stroke="#333" stroke-width="2" stroke-linejoin="round"/>
+<ellipse cx="30" cy="100" rx="5" ry="20" fill="#fff" opacity=".6" transform="rotate(8 30 100)"/>
+<g fill="#FFCC00" stroke="#333" stroke-width="2" stroke-linejoin="round">
+<polygon points="108.3,99.2 111.3,109.4 121.3,112.8 112.6,118.8 112.5,129.4 104.1,122.9 94,126.1 97.6,116.1 91.4,107.5 102,107.8"/>
+<polygon points="76.8,70.5 80.5,76 87.2,76 83.1,81.3 85.1,87.6 78.9,85.4 73.5,89.2 73.7,82.6 68.4,78.7 74.7,76.8"/>
+</g>
+</svg>
@@ -0,0 +1,30 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 200 200">
+<g transform="translate(-15.3 -15.3) scale(1.15)">
+<g fill="#fff" stroke="#fff" stroke-width="14" stroke-linejoin="round">
+<ellipse cx="64" cy="150" rx="20" ry="15" transform="rotate(-22 64 150)"/>
+<ellipse cx="140" cy="134" rx="20" ry="15" transform="rotate(-22 140 134)"/>
+<rect x="73" y="54" width="10" height="96"/>
+<rect x="149" y="38" width="10" height="96"/>
+<polygon points="73,54 159,38 159,62 73,78"/>
+</g>
+<g fill="#333" stroke="#333" stroke-width="3.5" stroke-linejoin="round">
+<ellipse cx="64" cy="150" rx="20" ry="15" transform="rotate(-22 64 150)"/>
+<ellipse cx="140" cy="134" rx="20" ry="15" transform="rotate(-22 140 134)"/>
+<rect x="73" y="54" width="10" height="96"/>
+<rect x="149" y="38" width="10" height="96"/>
+<polygon points="73,54 159,38 159,62 73,78"/>
+</g>
+<g fill="#5B2C8F">
+<ellipse cx="64" cy="150" rx="20" ry="15" transform="rotate(-22 64 150)"/>
+<ellipse cx="140" cy="134" rx="20" ry="15" transform="rotate(-22 140 134)"/>
+<rect x="73" y="54" width="10" height="96"/>
+<rect x="149" y="38" width="10" height="96"/>
+<polygon points="73,54 159,38 159,62 73,78"/>
+</g>
+<g fill="#fff" opacity=".55">
+<ellipse cx="56" cy="145" rx="7" ry="3.5" transform="rotate(-22 56 145)"/>
+<ellipse cx="132" cy="129" rx="7" ry="3.5" transform="rotate(-22 132 129)"/>
+<polygon points="80,58 152,45 152,49 80,62"/>
+</g>
+</g>
+</svg>
@@ -0,0 +1,13 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 200 200">
+<g transform="rotate(-10 100 100)">
+<polygon points="100,12 114,29.4 133.7,18.7 140,40.1 162.2,37.8 159.9,60 181.3,66.3 170.6,86 188,100 170.6,114 181.3,133.7 159.9,140 162.2,162.2 140,159.9 133.7,181.3 114,170.6 100,188 86,170.6 66.3,181.3 60,159.9 37.8,162.2 40.1,140 18.7,133.7 29.4,114 12,100 29.4,86 18.7,66.3 40.1,60 37.8,37.8 60,40.1 66.3,18.7 86,29.4" fill="#fff" stroke="#fff" stroke-width="14" stroke-linejoin="round"/>
+<polygon points="100,12 114,29.4 133.7,18.7 140,40.1 162.2,37.8 159.9,60 181.3,66.3 170.6,86 188,100 170.6,114 181.3,133.7 159.9,140 162.2,162.2 140,159.9 133.7,181.3 114,170.6 100,188 86,170.6 66.3,181.3 60,159.9 37.8,162.2 40.1,140 18.7,133.7 29.4,114 12,100 29.4,86 18.7,66.3 40.1,60 37.8,37.8 60,40.1 66.3,18.7 86,29.4" fill="#FFCC00" stroke="#333" stroke-width="2" stroke-linejoin="round"/>
+<g fill="#CC0000">
+<polygon transform="translate(37.5 0)" points="0,121 0,79 10.4,79 22,101.6 22,79 32,79 32,121 21.6,121 10,98.4 10,121"/>
+<polygon transform="translate(73.5 0)" points="0,79 24,79 24,88 10,88 10,95.5 21,95.5 21,104.5 10,104.5 10,112 24,112 24,121 0,121"/>
+<polygon transform="translate(101.5 0)" points="0,79 11,79 14.9,99.3 17.5,91 28.5,91 31.1,99.3 35,79 46,79 38,121 27,121 23,108.4 19,121 8,121"/>
+<polygon transform="translate(151.5 0)" points="0,79 11,79 9,107 2,107"/>
+<rect x="152" y="111" width="10" height="10" rx="2"/>
+</g>
+</g>
+</svg>
@@ -0,0 +1,15 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 200 200">
+<g fill="#fff" stroke="#fff" stroke-width="14" stroke-linejoin="round" stroke-linecap="round">
+<polygon points="186,18 30,84 104,122"/>
+<polygon points="186,18 104,122 130,110"/>
+<polygon points="104,122 130,110 112,156"/>
+<path d="M92 136 C76 156 52 168 40 152 C30 138 50 124 58 140 C66 156 44 178 18 182" fill="none" stroke-width="18.5"/>
+</g>
+<path d="M92 136 C76 156 52 168 40 152 C30 138 50 124 58 140 C66 156 44 178 18 182" fill="none" stroke="#3366FF" stroke-width="4.5" stroke-linecap="round" stroke-dasharray="8 8"/>
+<g stroke="#333" stroke-width="2" stroke-linejoin="round">
+<polygon points="104,122 130,110 112,156" fill="#8FA8E0"/>
+<polygon points="186,18 104,122 130,110" fill="#B8C8F0"/>
+<polygon points="186,18 30,84 104,122" fill="#EEF2FF"/>
+</g>
+<path d="M164 32 L56 80" stroke="#fff" stroke-width="5" stroke-linecap="round"/>
+</svg>
@@ -0,0 +1,27 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 200 200">
+<g transform="rotate(-10 100 112)">
+<g fill="#fff" stroke="#fff" stroke-width="14" stroke-linejoin="round">
+<path d="M30 64 Q100 46 170 64 L104 184 Q100 190 96 184 Z"/>
+<path d="M22 58 Q100 34 178 58 Q182 66 174 72 Q100 52 26 72 Q18 66 22 58 Z"/>
+</g>
+<g stroke="#333" stroke-width="2" stroke-linejoin="round">
+<path d="M30 64 Q100 46 170 64 L104 184 Q100 190 96 184 Z" fill="#FFCC00"/>
+<g fill="#FFE680" stroke="none">
+<circle cx="56" cy="80" r="4.5"/><circle cx="146" cy="76" r="3.5"/><circle cx="108" cy="158" r="3.5"/><circle cx="98" cy="72" r="3"/>
+</g>
+<circle cx="72" cy="90" r="13" fill="#CC0000"/>
+<circle cx="126" cy="92" r="13" fill="#CC0000"/>
+<circle cx="99" cy="130" r="12" fill="#CC0000"/>
+<g fill="#33AA33" stroke-width="1.5">
+<ellipse cx="100" cy="98" rx="7" ry="3.5" transform="rotate(30 100 98)"/>
+<ellipse cx="80" cy="120" rx="6" ry="3" transform="rotate(-40 80 120)"/>
+<ellipse cx="116" cy="114" rx="6" ry="3" transform="rotate(50 116 114)"/>
+</g>
+<path d="M22 58 Q100 34 178 58 Q182 66 174 72 Q100 52 26 72 Q18 66 22 58 Z" fill="#E0A050"/>
+</g>
+<g fill="#fff" opacity=".5">
+<circle cx="67" cy="85" r="3.5"/><circle cx="121" cy="87" r="3.5"/><circle cx="94" cy="125" r="3"/>
+</g>
+<path d="M44 54 Q100 40 156 54" fill="none" stroke="#fff" stroke-width="3" stroke-linecap="round" opacity=".5"/>
+</g>
+</svg>
@@ -0,0 +1,8 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 200 200">
+<g transform="rotate(-6 100 106)">
+<polygon points="100,18 125.9,70.4 183.7,78.8 141.8,119.6 151.7,177.2 100,150 48.3,177.2 58.2,119.6 16.3,78.8 74.1,70.4" fill="#fff" stroke="#fff" stroke-width="14" stroke-linejoin="round"/>
+<polygon points="100,18 125.9,70.4 183.7,78.8 141.8,119.6 151.7,177.2 100,150 48.3,177.2 58.2,119.6 16.3,78.8 74.1,70.4" fill="#FFCC00" stroke="#333" stroke-width="2" stroke-linejoin="round"/>
+<polygon points="100,60 112.9,86.2 141.8,90.4 120.9,110.8 125.9,139.6 100,126 74.1,139.6 79.1,110.8 58.2,90.4 87.1,86.2" fill="#FFE066"/>
+<ellipse cx="93" cy="50" rx="4.5" ry="13" fill="#fff" opacity=".6" transform="rotate(25 93 50)"/>
+</g>
+</svg>
@@ -0,0 +1,15 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 200 200">
+<g fill="none" stroke-linecap="round">
+<circle cx="100" cy="100" r="62" fill="#fff" stroke="#fff" stroke-width="14"/>
+<path d="M164 100 H184 M155.4 132 L172.7 142 M132 155.4 L142 172.7 M100 164 V184 M68 155.4 L58 172.7 M44.6 132 L27.3 142 M36 100 H16 M44.6 68 L27.3 58 M68 44.6 L58 27.3 M100 36 V16 M132 44.6 L142 27.3 M155.4 68 L172.7 58" stroke="#fff" stroke-width="27"/>
+<path d="M164 100 H184 M155.4 132 L172.7 142 M132 155.4 L142 172.7 M100 164 V184 M68 155.4 L58 172.7 M44.6 132 L27.3 142 M36 100 H16 M44.6 68 L27.3 58 M68 44.6 L58 27.3 M100 36 V16 M132 44.6 L142 27.3 M155.4 68 L172.7 58" stroke="#333" stroke-width="13"/>
+<path d="M164 100 H184 M155.4 132 L172.7 142 M132 155.4 L142 172.7 M100 164 V184 M68 155.4 L58 172.7 M44.6 132 L27.3 142 M36 100 H16 M44.6 68 L27.3 58 M68 44.6 L58 27.3 M100 36 V16 M132 44.6 L142 27.3 M155.4 68 L172.7 58" stroke="#FF9900" stroke-width="9"/>
+</g>
+<circle cx="100" cy="100" r="52" fill="#FFCC00" stroke="#333" stroke-width="2"/>
+<ellipse cx="74" cy="68" rx="11" ry="5.5" fill="#fff" opacity=".6" transform="rotate(-38 74 68)"/>
+<circle cx="70" cy="113" r="7" fill="#FF7AA2" opacity=".65"/>
+<circle cx="130" cy="113" r="7" fill="#FF7AA2" opacity=".65"/>
+<ellipse cx="83" cy="92" rx="5" ry="8" fill="#333"/>
+<ellipse cx="117" cy="92" rx="5" ry="8" fill="#333"/>
+<path d="M78 110 Q100 130 122 110" fill="none" stroke="#333" stroke-width="4.5" stroke-linecap="round"/>
+</svg>
@@ -0,0 +1,36 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 200 200">
+<g fill="#fff" stroke="#fff" stroke-width="16" stroke-linejoin="round">
+<rect x="18" y="96" width="40" height="88" rx="6"/>
+<rect x="50" y="92" width="70" height="88" rx="18"/>
+<rect x="92" y="88" width="68" height="26" rx="13"/>
+<rect x="92" y="112" width="74" height="26" rx="13"/>
+<rect x="92" y="136" width="70" height="24" rx="12"/>
+<rect x="92" y="158" width="62" height="22" rx="11"/>
+<path d="M56 104 C54 80 58 56 68 38 C76 24 96 22 98 38 C100 54 96 74 104 96 L100 104 Z"/>
+</g>
+<g fill="#333" stroke="#333" stroke-width="4" stroke-linejoin="round">
+<rect x="50" y="92" width="70" height="88" rx="18"/>
+<rect x="92" y="88" width="68" height="26" rx="13"/>
+<rect x="92" y="112" width="74" height="26" rx="13"/>
+<rect x="92" y="136" width="70" height="24" rx="12"/>
+<rect x="92" y="158" width="62" height="22" rx="11"/>
+<path d="M56 104 C54 80 58 56 68 38 C76 24 96 22 98 38 C100 54 96 74 104 96 L100 104 Z"/>
+</g>
+<g fill="#FFCC00">
+<rect x="50" y="92" width="70" height="88" rx="18"/>
+<rect x="92" y="88" width="68" height="26" rx="13"/>
+<rect x="92" y="112" width="74" height="26" rx="13"/>
+<rect x="92" y="136" width="70" height="24" rx="12"/>
+<rect x="92" y="158" width="62" height="22" rx="11"/>
+<path d="M56 104 C54 80 58 56 68 38 C76 24 96 22 98 38 C100 54 96 74 104 96 L100 104 Z"/>
+</g>
+<g fill="none" stroke="#333" stroke-width="2" stroke-linecap="round">
+<path d="M108 113 H152 M108 137 H155 M108 159 H149"/>
+<path d="M66 100 C76 104 90 103 98 96"/>
+</g>
+<ellipse cx="73" cy="52" rx="4" ry="13" fill="#fff" opacity=".55" transform="rotate(18 73 52)"/>
+<g stroke="#333" stroke-width="2" stroke-linejoin="round">
+<rect x="18" y="96" width="40" height="88" rx="6" fill="#3366FF"/>
+<path d="M46 96 H52 Q58 96 58 102 V178 Q58 184 52 184 H46 Z" fill="#003399"/>
+</g>
+</svg>
@@ -0,0 +1,24 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 200 200">
+<g fill="#fff" stroke="#fff" stroke-width="14" stroke-linejoin="round" stroke-linecap="round">
+<path d="M56 42 C24 40 22 82 60 90 M144 42 C176 40 178 82 140 90" fill="none" stroke-width="29"/>
+<rect x="44" y="24" width="112" height="12" rx="5"/>
+<path d="M50 30 H150 V62 C150 98 128 118 100 120 C72 118 50 98 50 62 Z"/>
+<path d="M92 118 H108 L110 140 H90 Z"/>
+<rect x="78" y="138" width="44" height="10" rx="4"/>
+<rect x="56" y="148" width="88" height="34" rx="5"/>
+</g>
+<g fill="none" stroke-linecap="round">
+<path d="M56 42 C24 40 22 82 60 90 M144 42 C176 40 178 82 140 90" stroke="#333" stroke-width="15"/>
+<path d="M56 42 C24 40 22 82 60 90 M144 42 C176 40 178 82 140 90" stroke="#FFCC00" stroke-width="11"/>
+</g>
+<g stroke="#333" stroke-width="2" stroke-linejoin="round">
+<path d="M92 118 H108 L110 140 H90 Z" fill="#E6B800"/>
+<path d="M50 30 H150 V62 C150 98 128 118 100 120 C72 118 50 98 50 62 Z" fill="#FFCC00"/>
+<rect x="44" y="24" width="112" height="12" rx="5" fill="#FFE066"/>
+<rect x="78" y="138" width="44" height="10" rx="4" fill="#FFCC00"/>
+<rect x="56" y="148" width="88" height="34" rx="5" fill="#003399"/>
+<rect x="76" y="157" width="48" height="15" rx="3" fill="#FFCC00" stroke-width="1.5"/>
+<polygon points="100,53 105,63.1 116.2,64.7 108.1,72.6 110,83.8 100,78.5 90,83.8 91.9,72.6 83.8,64.7 95,63.1" fill="#FFFFFF" stroke-width="1.5"/>
+</g>
+<ellipse cx="66" cy="66" rx="5.5" ry="20" fill="#fff" opacity=".5"/>
+</svg>
@@ -0,0 +1,80 @@
+# Contributing
+
+The iOS client for Flamenet Messenger, in Swift and SwiftUI. This repository is
+the **source of truth** for the app *and* for the encryption engine, the
+JavaScript reference implementation published as `flamenet-e2e` is mirrored out
+of this tree, not the other way round.
+
+## Security bugs do not go in an issue
+
+Email **security@flamenetmessenger.com**. See [SECURITY.md](SECURITY.md).
+
+## Building
+
+Xcode with an iOS 17+ SDK, and:
+
+```bash
+xcodegen generate
+```
+
+**`FlamenetMessenger.xcodeproj/project.pbxproj` is gitignored and generated.**
+Do not hand-edit it and do not commit it. Files and build settings are declared
+in `project.yml`; adding a source file means adding it there (or dropping it
+into an existing group's directory) and re-running `xcodegen generate`. Editing
+the pbxproj directly produces a project that works on your machine and on
+nobody else's, and a truncated one, which is a fun afternoon.
+
+## Testing
+
+```bash
+xcodebuild -project FlamenetMessenger.xcodeproj -scheme FlamenetMessenger \
+  -sdk iphonesimulator -destination "platform=iOS Simulator,name=iPhone 17" \
+  test -only-testing:FlamenetMessengerTests
+```
+
+That unit suite is the merge gate and runs on the project's own macOS runner.
+
+UI tests are not in the gate, on purpose: `FlamenetMessengerUITests` needs a
+local relay listening on port 18810 and, for the conversation tests, two booted
+simulators. Without the relay the suite **skips rather than fails**: a green
+run that tested nothing looks identical to a green run that tested everything,
+so check the executed count, not the tick.
+
+Two traps that will cost you an hour each:
+
+- The suite occasionally reports `TEST FAILED` with no failing test. A clean
+  rerun passes. Rerun before believing it.
+- **Two test runners against one simulator** produce what looks like an app
+  crash and is not. One runner per device.
+
+## What a change needs
+
+- **Touching `Sources/E2E/`?** You are editing the reference implementation.
+  Read `CONTRIBUTING.md` in `flamenet-e2e` as well, spec first, vectors second,
+  code third, and keep the JS mirror in agreement. Cross-platform interop is a
+  claim this project makes, so it has to actually be run.
+- **Touching the wire?** Android and the relay have to move with you. A field
+  the client requires and the relay never sends breaks a feature 100% of the
+  time while every unit test stays green, that has happened here, to groups.
+  **Diff the wire types first.**
+- **Touching state that arrives incrementally**: avatars, rosters, device
+  lists, merge, never replace. Absent from a fetch means "not loaded yet", not
+  "deleted". Both platforms have shipped this bug.
+- **Adding a user-visible security claim?** It must be true of *this* client
+  specifically. See `SECURITY.md`; several true-of-the-app statements are false
+  of the web client, and the distinction is not optional.
+
+## House rules
+
+- Fail closed. An unverifiable signature, an unknown version, an unpinned
+  identity are refusals, and the user is told which.
+- Never log message contents, keys, or tokens.
+- No secrets, keystores or passphrases in the repository. It is public.
+- Match the surrounding style. Comments explain why a line exists, most often,
+  which attack it prevents.
+
+## Comments and prose
+
+Plain text. No emoji or symbol markers, no markdown bold inside code comments,
+no em-dashes. Say what the code does and why, briefly; the history of how it
+got that way belongs in the commit message, not in the file.
@@ -0,0 +1,132 @@
+# Layout spec
+
+Extracted from `Messenger App V2.sketch` (Sketch 71, 120 artboards, ~280
+symbols) by reading the file's JSON directly. Every number below is measured
+from a symbol master, not eyeballed from a render.
+
+The layout is theirs; the colour is ours. Flamenet orange `#FF5A1F`
+stays. The kit's primary is blue `#2298FF` and adopting it would mean the app
+no longer looks like the product it belongs to. Everywhere the kit says
+"primary", read Flamenet orange.
+
+The typeface is not adopted, only the scale. The kit is set in DM Sans.
+Bundling it means shipping font files and an OFL notice, which is a licensing
+decision rather than a layout one, so the sizes, weights and line heights
+below are applied to the system face. Swapping the face in later changes
+nothing about the measurements.
+
+Canvas is 375pt wide (iPhone X). Treat the horizontal numbers as insets from
+the edges rather than fixed widths, or the layout breaks on every other phone.
+
+## Grid
+
+| | |
+|---|---|
+| Page margin | 24 |
+| Content width | 327 (375 − 48) |
+| List row pitch | 72 (48pt row + 24pt gap) |
+
+## Bars
+
+**Large title**: 96 tall. Title 24 bold at (24, 52). Trailing icons 24×24 at
+x = 279 and 327, y = 60, i.e. 24 from the right edge, 48 apart.
+
+**Conversation bar**: 88 tall. Back chevron 24×24 at (24, 54). Title 16 medium
+at (72, 45). Beneath it at (72, 69): a 12×12 presence dot, then the subtitle at
+12 regular, 16 from the dot's origin. Trailing icons at x = 279, 327, y = 54.
+
+**Tab bar**: 84 tall, and it is a **floating pill**, not a full-width strip:
+a 328×50 rounded rectangle at x = 24 with radius 25 on `#F3F3F3`, holding four
+82×50 tab items. This is the single biggest visual difference from what both
+apps do today.
+
+**Composer**: 84 tall. A 50-tall pill with radius 25 on `#F3F3F3`, text inset
+16, placeholder at 14 regular. Leading `+` at (16, 12); trailing camera at
+x = 287 and overflow at x = 335, all 24×24.
+
+## Conversation row (327×48)
+
+| element | position | type |
+|---|---|---|
+| Avatar | 0, 0 — 48×48 | |
+| Name | x 64, y 0 | 16 medium, 24 line |
+| Preview | x 64, y 24 | 14 regular, 24 line |
+| Timestamp | right aligned, y 5 | 12 regular |
+| Unread badge | 24×16 at y 28 | |
+
+The 64 is not a gap of 64, it is the 48pt avatar plus a 16pt gutter.
+
+## Message bubbles
+
+The corners are asymmetric, and that is the whole character of them.
+Every corner is radius 16 except one, which is radius 2 and points at its
+author: **bottom-right** on a message you sent, **top-left** on one you
+received. Rounding all four equally throws away the only thing that
+distinguishes these bubbles from every other chat app's.
+
+| | sent | received |
+|---|---|---|
+| Fill | Flamenet orange (kit: `#2298FF`) | `#F3F3F3` |
+| Square corner | bottom-right | top-left |
+| Text | 16 regular | 16 regular |
+| Padding | 12 horizontal, 12 vertical | 12 horizontal, 12 vertical |
+| Avatar | none | 32×32, leading, top-aligned |
+| Bubble inset | — | 40 from the leading edge |
+| Timestamp | 10 regular, above, trailing | 10 regular, above, leading |
+
+**Day divider**: 14 regular, centred.
+
+## Type scale
+
+| name | size | weight |
+|---|---|---|
+| H1 | 40 | bold |
+| H2 | 32 | bold |
+| H3 | 24 | bold |
+| H4 | 20 | bold |
+| Sub 1 / 2 / 3 | 12 / 14 / 16 | medium |
+| Body 1 / 2 | 14 / 16 | regular |
+| Description 1 / 2 | 12 / 10 | regular |
+
+## Kit palette, for reference
+
+`#4FACFE` primary · `#2298FF` bubble · `#2F2F2F` ink · `#B3BEC9` muted ·
+`#F9F9F9` background · `#F3F3F3` surface · `#3BD5B2` success · `#ED497C` alert
+
+Only `#F3F3F3` is adopted directly, as the received-bubble and pill fill. The
+rest map onto the existing Flamenet palette.
+
+## What was not taken
+
+Phone number entry and SMS verification (Flamenet is handle + passphrase, and
+being phone-number-free is a point against Signal rather than an omission);
+wallet and money transfer; the timeline, post and comment social feed; people
+nearby; profile follow/following.
+
+## Settings and list screens
+
+The kit does not use cards here either. Rows are grouped into sections,
+and sections are separated by a **full-bleed 16pt band filled `#F3F3F3`**: a
+thick grey spacer spanning the whole width, not a hairline and not a gap
+between floating surfaces. Inside a section the rows butt up against each
+other, divided only by a hairline that starts after the leading icon.
+
+**`Item/48`, 56 tall**
+
+| element | position |
+|---|---|
+| Leading icon | 24×24 at x 0, y 16 |
+| Label | x 40, y 16 — 14 medium |
+| Trailing chevron | 24×24, right aligned |
+| Hairline | y 55, inset 36 from the leading edge |
+
+**`Item/48 no icon-description`, 93 tall**, for a row that needs a sentence
+under it: label 14 medium at (24, 16), description 12 regular at (24, 44),
+switch 44×28 on the trailing edge, hairline at the full 24 inset.
+
+The description is 12pt and sits under the label it belongs to, not a
+paragraph floating between controls. A setting whose explanation is longer than
+the section it lives in is a setting that needs a shorter explanation.
+
+**Sign out** is an icon plus "Sign Out" at 14 medium, on the same row grammar
+as everything else, not a full-width filled button.
@@ -1,42 +1,178 @@
-# Export compliance — v0.1 (decided 2026-08-19)
+# Export compliance, v0.2

-**Answer on the App Store Connect encryption questions:**
+**This is a record of a decision, not legal advice.** The authorities are the
+Bureau of Industry and Security and Apple. Where this document is unsure it
+says so rather than sounding certain.

- *Does your app use encryption?* — **Yes**
- *Does it qualify for any of the exemptions?* — **No** (it implements its own
-  end-to-end messaging protocol, not just HTTPS/ATS)
- *Does it implement proprietary or non-standard algorithms?* — **No.**
-  Standard, published algorithms only: X25519 (key agreement), Ed25519
-  (signatures), HKDF-SHA256, HMAC-SHA256, AES-256-GCM (AEAD), SHA-256/512.
-  The protocols are the published Signal specifications (X3DH and Double
-  Ratchet), implemented over Apple CryptoKit primitives.
- Classification: **mass-market, self-classified 5D992.c** (ECCN), License
-  Exception ENC favorable treatment not required for mass-market.
+## The route: publicly available source code

-**Plist key note (learned 2026-08-19):** do NOT set
-`ITSAppUsesNonExemptEncryption` alone — ASC rejects the upload with "Invalid
-Export Compliance Code" because a non-exempt declaration in the plist must be
-accompanied by an `ITSEncryptionExportComplianceCode` that matches compliance
-documentation ASC has issued. Workflow: answer the questions interactively in
-App Store Connect for the first build; ASC then issues the code; add
-`ITSEncryptionExportComplianceCode: <code>` to project.yml so later uploads
-skip the questionnaire.
+Flamenet Messenger takes the **publicly available encryption source code**
+route, License Exception TSU, EAR §740.13(e). The obligation is one email to
+BIS and one to NSA naming where the source lives. There is no encryption
+registration, no Encryption Registration Number, and no annual
+self-classification report.

-**Crypto description (paste when asked):**
+Two facts make it eligible, and both are checkable rather than asserted:

-> Flamenet Messenger is an end-to-end encrypted instant messenger. It uses
-> the published Signal protocol constructions — X3DH asynchronous key
-> agreement and the Double Ratchet — implemented with Apple CryptoKit using
-> standard algorithms only: Curve25519 (X25519 key agreement, Ed25519
-> signatures), HKDF-SHA256, HMAC-SHA256, and AES-256-GCM authenticated
-> encryption. Media attachments are encrypted client-side with per-file
+- **All four repositories are public.** `flamenet-messenger-ios`,
+  `flamenet-messenger-android`, `flamenet-relay` and `flamenet-e2e` all answer
+  an anonymous request. Every line of the protocol, the client and the server
+  is readable by anyone.
+- **The licence is MIT.** §740.13(e) excludes source code that is subject to
+  an express agreement for the payment of a licensing fee or royalty for
+  commercial production or sale. MIT charges neither.
+
+### What this replaced
+
+v0.1 of this document chose the other route: mass-market, self-classified
+5D992.c, with the annual BIS self-classification report and encryption
+registration through SNAP-R. That route needs an ERN, because registration is
+what issues one. It also cited §740.17(e)(3), which is the reporting rule for
+License Exception ENC rather than for mass market.
+
+The two routes are alternatives, not steps. Nothing had been filed under the
+old one, so switching costs nothing.
+
+## The notification: sent 2026-09-15
+
+Sent to both addresses on 2026-09-15 at 17:37 UTC, from
+`security@flamenetmessenger.com`, and accepted by both:
+
+- BIS, `crypt@bis.doc.gov`: `250 2.6.0 ... Queued mail for delivery`
+- NSA, `enc@nsa.gov`: `250 ok: Message 151032564 accepted`
+
+Accepted is not the same as read. Keep an eye on that mailbox for a reply, and
+keep these lines: they are the evidence that the notification went, and the
+date is what a later question would turn on.
+
+The text as sent:
+
+> Subject: Notification under EAR 740.13(e): publicly available encryption
+> source code
+>
+> Extant 2000 LLC notifies BIS and NSA, under EAR §740.13(e), of the internet
+> location of publicly available encryption source code.
+>
+> Submitter
+>   Extant 2000 LLC
+>   7051 Brookfield Plz, PO Box 41, Springfield, VA 22150, USA
+>   security@flamenetmessenger.com
+>
+> Product
+>   Flamenet Messenger, an end-to-end encrypted instant messenger for iPhone
+>   and Android, with its relay server and its protocol engine.
+>
+> Source code locations
+>   https://gitlab.com/paulhitt/flamenet-messenger-ios
+>   https://gitlab.com/paulhitt/flamenet-messenger-android
+>   https://gitlab.com/paulhitt/flamenet-relay
+>   https://gitlab.com/paulhitt/flamenet-e2e
+>
+> The source at those locations is public and free to read. It is published
+> under the MIT licence and is not subject to an express agreement for the
+> payment of a licensing fee or royalty for commercial production or sale.
+>
+> Algorithms: X25519 key agreement, Ed25519 signatures, ML-KEM-768 (FIPS 203),
+> ML-DSA-65 (FIPS 204), HKDF-SHA256, HMAC-SHA256, AES-256-GCM, SHA-256 and
+> SHA-512.
+>
+> Protocols: the published X3DH key agreement and the Double Ratchet.
+> ML-KEM-768 is combined with X25519 for key agreement, and ML-DSA-65
+> accompanies Ed25519 on identity keys. The implementation contains no
+> proprietary or non-standard cryptography.
+
+Re-notify if the source moves to a different location. Notification is about
+where the code is, so a new commit needs nothing; a new URL does.
+
+## The re-notification: sent 2026-09-28
+
+On 28 September 2026 the source moved from `gitlab.com/paulhitt` to
+`gitlab.com/extant2000`. On the same day `flamenet-elligator2`, which holds the
+obfs4 bridge and the iPhone app's obfs4 transport, was published under MIT.
+Both changes call for a new notification, so one was sent.
+
+Sent to both addresses on 2026-09-28 at 19:10 UTC, in one message from
+`security@flamenetmessenger.com`, and accepted by both:
+
+- BIS, `crypt@bis.doc.gov`: `250 2.6.0 ... Queued mail for delivery`
+- NSA, `enc@nsa.gov`: `250 ok: Message 199757828 accepted`
+
+The locations it gave:
+
+    https://gitlab.com/extant2000/flamenet-messenger-ios
+    https://gitlab.com/extant2000/flamenet-messenger-android
+    https://gitlab.com/extant2000/flamenet-relay
+    https://gitlab.com/extant2000/flamenet-e2e
+    https://gitlab.com/extant2000/flamenet-elligator2
+
+It also listed the four earlier locations above and said they now redirect.
+The algorithm list repeats the one in the first notification, and adds what
+the obfs4 transport uses: the Elligator2 encoding of Curve25519 public keys,
+the ntor handshake (Curve25519 with HMAC-SHA256), XSalsa20-Poly1305 (NaCl
+secretbox) and SipHash-2-4.
+
+The same rule applies from here: a new commit needs nothing, and a new
+location or a newly published repository with cryptography in it needs
+another notification.
+
+## Open question worth an hour of a lawyer
+
+Whether the binary Apple distributes counts as the object code corresponding
+to that published source. The iOS app, the engine and the relay are all
+public, so the honest reading is that it does, but the binary also links Apple
+CryptoKit and WebRTC, which are not ours and not published by us. If that
+reading is wrong, the fallback is the mass-market route this document used to
+describe, and then an ERN is needed after all. Worth asking before relying on
+it for years rather than before the first submission.
+
+## App Store Connect
+
+Apple's questionnaire is a separate obligation from the BIS one, and it still
+has to be answered on the submission.
+
+- *Does your app use encryption?* **Yes.**
+- *Does it qualify for any of the exemptions?* Apple's list includes an option
+  for apps whose encryption source code is publicly available. **Read the
+  options on the screen and pick that one if it is offered**, because it is now
+  the accurate answer. v0.1 answered **No** here, which was accurate under the
+  mass-market route and is not under this one.
+- *Does it implement proprietary or non-standard algorithms?* **No.** Standard
+  published algorithms only, listed above.
+
+Whether `ITSAppUsesNonExemptEncryption` should be `false` follows from that
+exemption answer rather than being decided here: if Apple treats the app as
+exempt, the plist can say so and later uploads skip the questionnaire. Do not
+guess it. Setting a non-exempt declaration without a matching
+`ITSEncryptionExportComplianceCode` from documentation Apple has issued
+rejects the upload with "Invalid Export Compliance Code", which is how this
+was found the first time.
+
+**Crypto description, to paste when asked:**
+
+> Flamenet Messenger is an end-to-end encrypted instant messenger. It uses the
+> published Signal protocol constructions: X3DH asynchronous key agreement and
+> the Double Ratchet, implemented with Apple CryptoKit using standard
+> algorithms only, Curve25519 (X25519 key agreement, Ed25519 signatures),
+> HKDF-SHA256, HMAC-SHA256, and AES-256-GCM authenticated encryption. Key
+> agreement and identity signatures are hybrid post-quantum: ML-KEM-768 (FIPS
+> 203) is combined with X25519 so that recorded traffic stays protected
+> against a future quantum adversary, and ML-DSA-65 (FIPS 204) accompanies
+> Ed25519 on identity keys so an attacker must defeat both rather than
+> whichever is weaker. Both are NIST-standard algorithms used through Apple
+> CryptoKit. Media attachments are encrypted client-side with per-file
 > AES-256-GCM keys conveyed inside the encrypted channel. Voice calls use
-> WebRTC's standard DTLS-SRTP with the certificate fingerprints
-> authenticated through the same encrypted channel. TLS (HTTPS) protects
-> all client–server transport. No proprietary or non-standard cryptography
-> is implemented.
+> WebRTC's standard DTLS-SRTP with the certificate fingerprints authenticated
+> through the same encrypted channel. TLS (HTTPS) protects all client-server
+> transport. No proprietary or non-standard cryptography is implemented.

-**Recurring obligation:** file the annual **BIS self-classification report**
-(due each February for the prior calendar year) covering this app —
-encryption registration via SNAP-R/email per EAR §740.17(e)(3). Add a
-calendar reminder.
+## Keeping this true
+
+The algorithm list above is part of a declaration, so it has to match the
+binary. The post-quantum algorithms were added after v0.1 was written and were
+missing from it, and a declaration that omits an algorithm the binary contains
+is inaccurate. Anything added to the protocol from here belongs in this list on
+the same commit that ships it.
+
+The repositories being public is the whole basis of this route. If any of them
+is ever made private, this document stops being true and the mass-market route,
+with its registration and its annual report, comes back.
@@ -0,0 +1,143 @@
+# The original nine
+
+Verified by driving the apps and the relays, not by reading code. Where
+something is unproven it says so.
+
+**Re-checked** 45 commits after the baseline. Three rows
+moved. What was re-run this time is marked; anything not marked is carried
+forward from the baseline and has not been re-driven.
+
+| # | Item | Status |
+|---|---|---|
+| 1 | Sign-up on managed / shared self-hosted / local self-hosted, iOS **and** Android | **done**, with one caveat |
+| 2 | Sign-up against each type, both platforms | **done** |
+| 3 | Messages **between** relay types | **server yes, iOS built, Android no** |
+| 4 | Everything wired and usable, repeat rounds | **done** on the managed relay |
+| 5 | iOS → Android message | **done** |
+| 6 | api-docs self-hosting documentation | **done** |
+| 7 | Public / donation / comparison pages | **done** |
+| 8 | Relay deployed to relay.flamenet.io | **deployed and current** |
+| 9 | Self-hosted accounts. Files optional | **done** |
+
+## 1 & 2, sign-up across relay types
+
+Both platforms, all four relays.
+
+| relay | kind | iOS | Android |
+|---|---|---|---|
+| `relay.flamenet.io` | managed (`accounts: shared`) | yes | yes |
+| `relay2.flamenet.io` | shared self-hosted | yes | yes |
+| `relay1.flamenet.io` | local self-hosted (`accounts: local`) | yes | yes |
+| `relay3.flamenet.io` | local self-hosted | n/a | yes |
+
+**"Three clean rounds" cannot be run back to back against a shared account
+service, and that is correct.** It allows 3 new accounts per hour per IP;
+rounds 2 and 3 exhaust it and the service answers `429 Too many accounts
+created from here recently`, which the app shows verbatim. The suites report
+that as SKIP, not FAIL, a suite that fails for a service working properly
+teaches everyone to ignore it.
+
+Only **local self-hosted** survives repeated rounds, because it keeps its
+own accounts and has no such quota.
+
+Repeatable via `Scripts/android-signup.sh` and `RelayTypesUITests`.
+
+## 3, cross-relay messaging
+
+**The relays do it.** `test/federation.mjs` (in [flamenet-e2e](https://git.extant2000.com/extant2000/flamenet-e2e) since the split) against the live fleet:
+**11 passed, 0 failed**: relay1 fetches bob's devices from relay2, sends
+across the boundary, bob's relay accepts exactly one envelope, he polls and it
+is there, it carries no sender attribution across the boundary, a relay off
+the allowlist is refused, and an unknown address is reported rather than
+silently dropped.
+
+Re-run against the live fleet: 11 passed, 0 failed. Unchanged.
+
+iOS now has the client path; Android still does not. `E2EClient` gained
+`remoteDevices`, `remoteBundles` and `sendRemote`, and `E2EInbox` gained
+`transmitRemote`, `deliverRemote` and a separate `remoteThreads` keyed on
+`fnid@relay`. Android calls none of it, it still reads the `federation` field
+from the descriptor and never acts on it.
+
+**Built is not proven.** The iOS path compiles and its unit tests pass; it
+has NOT been driven across a real relay boundary from the app. The distinction
+matters here more than anywhere else on this list, because the Node harness
+passing is exactly what made the previous row look better than it was.
+
+**The comparison page still overstates it.** "Servers can talk to each other
+Yes" is now true of the relay and of one client out of two. Reword the row or
+finish Android; a row that is half true reads as false to the half it is false
+for.
+
+## 8, deployed
+
+**Deployed and current, verified by checksum.** Re-checked after
+two deploys: `Config.swift`, `RoutesAccount.swift` and `Retention.swift` on the
+box are md5-identical to `flamenet-relay` HEAD. Production has the signup rate
+limit (verified live: five signups pass, the sixth is 429), the reset-token
+sweep, and retention logging at a level that is actually visible.
+
+Since the split, deploys rsync from a `flamenet-relay` checkout,
+`flamenetmessenger/server/` no longer exists.
+
+Production also runs `FN_LOG_LEVEL=error`, which suppresses the hourly
+retention line entirely. Retention *is* working, verified by
+querying the database directly and finding zero rows past any window, oldest
+envelope hours old, but there is no way to see that from the logs, which is
+the same unverifiable claim the retention code says it exists to avoid.
+
+## 4, wired and usable
+
+Three consecutive demo rounds on the managed relay, both directions, with the
+group visible each time, `DemoRoundUITests` plus the Android half. Not run
+against the other relay types.
+
+## 6, documentation
+
+`api-docs.relay.flamenet.io` now carries a compose file, every environment
+variable with whether it is actually required, and curl commands to check a
+relay is up. It previously documented the protocol thoroughly and never said
+how to start one.
+
+## 7, public pages
+
+Live and on **production keys**: `sk_live` / `pk_live` confirmed on the
+box. Stripe.js loads, the form is present, and the card fields appear after
+Continue by design.
+
+Not exercised: a payment taken end to end. Doing so means creating a
+real PaymentIntent on the live connected account, so it was left alone. Closed
+on the owner's call. Recorded here rather than dropped, because "we
+verified the donation page" and "we watched a payment complete" are different
+claims and only one of them is true.
+
+## Found after the baseline
+
+**Android silently lost messages.** A send to somebody with no registered
+device, anyone signed out, looped over an empty device list, made no request,
+and returned an empty failure map, which every caller reads as success. 1:1
+text wrote nothing to the thread at all; group text wrote a bubble nobody
+received. iOS never had this. Fixed, with a regression test proved failing
+without the guard, and both platforms now hold undelivered messages in an
+outbox and retry rather than dropping them.
+
+Android → iOS calls do not connect, cause unknown. Ruled out: wire
+shapes match, iOS hooks `onCallSignal` eagerly at sign-in, Android sets no
+`from_addr` so the federated fork is not swallowing it, and every clock agrees
+within a second so the 45s staleness check is not misfiring. The real defect
+found was that Android discarded the send result entirely, so an offer that
+reached nobody was indistinguishable from one that rang. Both sides are now
+instrumented; the next attempt will say where it stopped.
+
+iOS conversation history had been written and never merged. The
+encrypted store sat alone on a parked branch while main moved 174 commits past
+it, so the app discarded every conversation on quit. Restored and now covered
+by five tests.
+
+## Known gaps at this tag
+
+- iOS push is built and **never observed**: needs a `.p8` and a real device.
+- Call audio has never been heard by anyone.
+- No third-party audit, no reproducible builds, no post-quantum below iOS 26.
+- `FN_DELETE_ON_ACK` is **off** and must stay off until it has an end-to-end
+  test. It deleted a message on production.
@@ -1,22 +1,22 @@
 # Delivery without Google or Apple in the middle

-> **Constraint set by the owner, 2026-08-26:** no third party on the delivery
+> **Constraint set by the owner:** no third party on the delivery
 > path. That rules out FCM and rules out APNs. It does not rule out fast
-> delivery — but it does rule out one thing completely, and that is worth
+> delivery, but it does rule out one thing completely, and that is worth
 > stating before anything else.

 ---

 ## The one thing this constraint costs

-🔴 **On iOS, a closed app cannot be woken without APNs. There is no alternative.**
+On iOS, a closed app cannot be woken without APNs. There is no alternative.

 iOS suspends a backgrounded process and tears down its sockets. A long-lived
-connection, a NATS client, a foreground service — none of these exist on iOS.
+connection, a NATS client, a foreground service, none of these exist on iOS.
 Apple provides exactly one wake-up mechanism for a suspended app and it is APNs.

 So "no Apple in the middle" means, precisely: **on iPhone, messages arrive when
-the user opens the app.** Not late — immediately on open — but not while it is
+the user opens the app.** Not late, immediately on open, but not while it is
 closed. That is an OS decision, not something the relay can engineer around.

 The honest options are:
@@ -25,7 +25,7 @@ The honest options are:
  product whose pitch is that no third party is involved, that sentence is an
  asset rather than an apology.
 - **Use APNs anyway** for a content-free wake-up. Apple learns *that* a device
-  has mail and when — not from whom, not what. That is a smaller leak than FCM
+  has mail and when, not from whom, not what. That is a smaller leak than FCM
  on Android (Google correlates far more), but it is still a third party.

 **Android has no such limit.** A foreground service can hold a connection with
@@ -35,7 +35,7 @@ that will sever it anyway.

 ---

-## What actually fixes "I had to hit refresh" — and needs no third party
+## What actually fixes "I had to hit refresh", and needs no third party

 Today `E2EInbox` polls every **5 seconds** while the app is open
 (`pollInterval: 5_000_000_000`). That is both slow and wasteful. Replace it with
@@ -52,12 +52,12 @@ GET /e2e/poll?after=<cursor>       # server holds the request open ~30–60s,
 | requests per device | ~12/min | ~1–2/min |
 | battery | a wake every 5s | one idle socket |

-🔴 **This is strictly better on every axis and involves nobody.** It is the
+This is strictly better on every axis and involves nobody. It is the
 single highest-value change here, it is a relay + client change only, and it
-makes the app feel like it pushes whenever it is open — which covers the whole
+makes the app feel like it pushes whenever it is open, which covers the whole
 iOS story and most of the Android one.

-⚠️ Held requests need care: a timeout below the proxy's idle timeout (Traefik
+Held requests need care: a timeout below the proxy's idle timeout (Traefik
 and Cloudflare both cut long connections), a cursor so nothing is missed between
 requests, and a cap on concurrent held requests per device.

@@ -67,7 +67,7 @@ network transitions with far less code.

 ---

-## Where NATS fits — and where it does not
+## Where NATS fits, and where it does not

 **NATS does not deliver to phones.** It is server-side plumbing. A phone still
 needs its own live connection, so NATS changes nothing about the iOS constraint
@@ -77,22 +77,22 @@ above. Adding it as "the push server" would be solving the wrong half.
 requests, something has to notice a new message and wake exactly the right ones.
 Three ways, in ascending cost:

-1. **Poll Postgres from each held request.** Simplest, and fine at this scale —
+1. **Poll Postgres from each held request.** Simplest, and fine at this scale,
   a held request checking once a second is still 5× less DB load than the
   current client polling, for far better latency.
 2. **Postgres `LISTEN`/`NOTIFY`.** The send issues `NOTIFY user_42`; held
-   requests wake instantly. **No new infrastructure at all** — you already run
-   Postgres. ⚠️ Notifications are not durable: a listener that is not connected
+   requests wake instantly. **No new infrastructure at all**: you already run
+   Postgres. Notifications are not durable: a listener that is not connected
   misses them, so the cursor query on reconnect stays load-bearing.
 3. **NATS.** Proper pub/sub, durable with JetStream, scales across relays and
   fits the federation work already in the tree. It is also **another service to
   run, monitor, secure and back up** on a box that has had one intrusion and a
   volume-prune incident.

-🔴 **Recommendation: 2, not 3, today.** `LISTEN`/`NOTIFY` gets the same felt
+**Recommendation: 2, not 3, today.** `LISTEN`/`NOTIFY` gets the same felt
 result with zero new moving parts. Reach for NATS when there are enough
 concurrent connections that one Postgres cannot hold them, or when relay-to-relay
-fan-out needs it — not before.
+fan-out needs it, not before.

 ---

@@ -102,7 +102,7 @@ fan-out needs it — not before.
   loop. Biggest win, no third party, no new infrastructure.
 2. **`LISTEN`/`NOTIFY`** behind it so held requests wake instantly instead of
   polling the database.
-3. **Android foreground service** holding the long-poll while backgrounded —
+3. **Android foreground service** holding the long-poll while backgrounded,
   opt-in, with the persistent notification explained honestly.
 4. **iOS**: decide between "no background delivery, and we say so" and
   "content-free APNs". Nothing else exists.
@@ -119,5 +119,5 @@ an engineering one.
 - The crypto, the ratchet, and the wire format are untouched.
 - `NotificationManager` already draws the banner; only the wake-up changes.
 - The relay still holds ciphertext it cannot read, so any notification it
-  triggers is content-free by construction — the device decrypts and writes the
+  triggers is content-free by construction, the device decrypts and writes the
  real banner locally.
@@ -0,0 +1,31 @@
+// swift-tools-version:6.0
+import PackageDescription
+
+/// The Files crypto and wire layer, vendored into Messenger.
+let package = Package(
+    name: "FlamenetFiles",
+    platforms: [.iOS(.v16), .macOS(.v13)],
+    products: [
+        .library(name: "FilesEngine", targets: ["FilesEngine"]),
+        .library(name: "FilesClient", targets: ["FilesClient"]),
+    ],
+    targets: [
+        .target(
+            name: "FilesEngine",
+            // The BIP-39 word list ships with the app and is verified on every
+            // load, a check that only ran at build would not notice one that
+            // arrived corrupted.
+            resources: [.copy("Resources/english.txt")]
+        ),
+        .target(name: "FilesClient", dependencies: ["FilesEngine"]),
+        .testTarget(
+            name: "FilesEngineTests",
+            dependencies: ["FilesEngine"],
+            resources: [.copy("vectors")]
+        ),
+        // Tests/FilesClientTests existed with no target declared, so its files
+        // were compiled by nothing and run by nothing, `swift test` reported a
+        // clean pass over a directory it was not looking at.
+        .testTarget(name: "FilesClientTests", dependencies: ["FilesClient"]),
+    ]
+)
@@ -0,0 +1,197 @@
+import CryptoKit
+import FilesEngine
+import Foundation
+
+/// The shared FlameNet account service.
+public struct AccountsClient: Sendable {
+    public let baseURL: String
+    let http = HTTP()
+
+    public init(baseURL: String) { self.baseURL = baseURL }
+
+    func url(_ path: String) throws -> URL { try .endpoint(baseURL, path) }
+
+    func authHeaders(_ token: String?) -> [String: String] {
+        token.map { ["Authorization": "Bearer \($0)"] } ?? [:]
+    }
+
+    // MARK: credentials
+
+    /// Stretch parameters for a handle.
+    public func params(handle: String) async throws -> Wire.KDFParams {
+        let lowered = handle.lowercased()
+        let escaped =
+            lowered.addingPercentEncoding(withAllowedCharacters: .urlPathAllowed) ?? lowered
+        let (data, _) = try await http.request("GET", try url("/accounts/" + escaped + "/params"))
+        return try http.decode(Wire.KDFParams.self, from: data)
+    }
+
+    struct RegisterBody: Encodable {
+        let handle: String
+        let authSecret: Data
+        let kdfSalt: Data
+        let kdfIterations: Int
+        let recoveryAuthSecret: Data?
+        let identity: Wire.NewIdentity?
+    }
+
+    /// Register an account and its first identity in one call.
+    public func register(
+        handle: String, passphrase: String, recoveryEntropy: Data?, identity: Wire.NewIdentity?
+    ) async throws {
+        let salt = Random.bytes(16)
+        let authSecret = try KDF.authSecret(passphrase: passphrase, salt: salt)
+        _ = try await http.request(
+            "POST", try url("/accounts"),
+            json: RegisterBody(
+                handle: handle.lowercased(),
+                authSecret: authSecret,
+                kdfSalt: salt,
+                kdfIterations: KDF.Parameters.v1.iterations,
+                recoveryAuthSecret: recoveryEntropy.map(KDF.recoveryAuthSecret(entropy:)),
+                identity: identity
+            ))
+    }
+
+    struct SessionBody: Encodable {
+        let handle: String
+        let authSecret: Data
+        let product: String
+    }
+
+    /// Sign in.
+    public func signIn(handle: String, passphrase: String, product: String = "files")
+        async throws -> Wire.Session
+    {
+        let params = try await params(handle: handle)
+        let authSecret = try KDF.authSecret(
+            passphrase: passphrase, salt: params.kdfSalt,
+            parameters: .init(id: Int(params.kdfID), iterations: params.kdfIterations))
+        do {
+            let (data, _) = try await http.request(
+                "POST", try url("/sessions"),
+                json: SessionBody(
+                    handle: handle.lowercased(), authSecret: authSecret, product: product))
+            return try http.decode(Wire.Session.self, from: data)
+        } catch ClientError.http(status: 401, _) {
+            throw ClientError.wrongPassphrase
+        }
+    }
+
+    struct RotateBody: Encodable {
+        let handle: String
+        let recoveryAuthSecret: Data
+        let newAuthSecret: Data
+        let newKdfSalt: Data
+        let newKdfIterations: Int
+        let newRecoveryAuthSecret: Data
+    }
+
+    /// Prove a recovery code and set a new passphrase.
+    public func rotate(
+        handle: String, entropy: Data, newPassphrase: String, nextEntropy: Data
+    ) async throws {
+        let salt = Random.bytes(16)
+        let newAuthSecret = try KDF.authSecret(passphrase: newPassphrase, salt: salt)
+        _ = try await http.request(
+            "POST", try url("/accounts/rotate"),
+            json: RotateBody(
+                handle: handle.lowercased(),
+                recoveryAuthSecret: KDF.recoveryAuthSecret(entropy: entropy),
+                newAuthSecret: newAuthSecret,
+                newKdfSalt: salt,
+                newKdfIterations: KDF.Parameters.v1.iterations,
+                newRecoveryAuthSecret: KDF.recoveryAuthSecret(entropy: nextEntropy)
+            ))
+    }
+
+    struct ChangePassphraseBody: Encodable {
+        let handle: String
+        let currentAuthSecret: Data
+        let newAuthSecret: Data
+        let newKdfSalt: Data
+        let newKdfIterations: Int
+    }
+
+    public func changePassphrase(
+        handle: String, currentPassphrase: String, newPassphrase: String
+    ) async throws {
+        let params = try await params(handle: handle)
+        let current = try KDF.authSecret(
+            passphrase: currentPassphrase, salt: params.kdfSalt,
+            parameters: .init(id: Int(params.kdfID), iterations: params.kdfIterations))
+        let salt = Random.bytes(16)
+        let next = try KDF.authSecret(passphrase: newPassphrase, salt: salt)
+        do {
+            _ = try await http.request(
+                "POST", try url("/accounts/passphrase"),
+                json: ChangePassphraseBody(
+                    handle: handle.lowercased(), currentAuthSecret: current,
+                    newAuthSecret: next, newKdfSalt: salt,
+                    newKdfIterations: KDF.Parameters.v1.iterations))
+        } catch ClientError.http(status: 401, _) {
+            throw ClientError.wrongPassphrase
+        }
+    }
+
+    // MARK: identities
+    // These live here rather than on the file server.
+
+    public func identity(token: String) async throws -> Wire.Identity? {
+        let (data, response) = try await http.request(
+            "GET", try url("/identity"), headers: authHeaders(token))
+        // 204: the account exists but has no identity for this product yet,
+        // which is how the app decides between "unlock" and "create".
+        if response.statusCode == 204 { return nil }
+        return try http.decode(Wire.Identity.self, from: data)
+    }
+
+    struct EnrollBody: Encodable {
+        let publicKey: Data
+        let protectedRecord: String
+        let recoveryRecord: String?
+    }
+
+    public func enroll(
+        token: String, publicKey: Data, protectedRecord: String, recoveryRecord: String?
+    ) async throws {
+        _ = try await http.request(
+            "POST", try url("/identity"), headers: authHeaders(token),
+            json: EnrollBody(
+                publicKey: publicKey, protectedRecord: protectedRecord,
+                recoveryRecord: recoveryRecord))
+    }
+
+    struct RekeyBody: Encodable {
+        let protectedRecord: String
+        let recoveryRecord: String?
+    }
+
+    struct ResolveBody: Encodable, Sendable {
+        let handle: String
+        let classification: Int16
+        let compartments: [Int]
+    }
+
+    /// Resolve a handle to the principal the file server knows, but only if
+    /// they are cleared for the area being asked about.
+    public func resolveRecipient(token: String, handle: String, label: Label) async throws
+        -> Wire.Recipient
+    {
+        let (data, _) = try await http.request(
+            "POST", try url("/clearance/check"), headers: authHeaders(token),
+            json: ResolveBody(
+                handle: handle.lowercased(),
+                classification: label.classification,
+                compartments: label.compartments.sorted()))
+        return try http.decode(Wire.Recipient.self, from: data)
+    }
+
+    public func rekey(token: String, protectedRecord: String, recoveryRecord: String?)
+        async throws
+    {
+        _ = try await http.request(
+            "POST", try url("/identity/rekey"), headers: authHeaders(token),
+            json: RekeyBody(protectedRecord: protectedRecord, recoveryRecord: recoveryRecord))
+    }
+}
@@ -0,0 +1,169 @@
+import FilesEngine
+import Foundation
+
+/// The file server.
+public actor FilesAPI {
+    public let baseURL: String
+    public private(set) var token: String
+    private var label: Label?
+    private let http = HTTP()
+
+    public init(baseURL: String, token: String) {
+        self.baseURL = baseURL
+        self.token = token
+    }
+
+    public func setLabel(_ label: Label?) { self.label = label }
+
+    /// What a server says about itself.
+    public static func config(baseURL: String) async throws -> Wire.ServerConfig {
+        let http = HTTP()
+        let (data, _) = try await http.request("GET", try .endpoint(baseURL, "/api/config"))
+        return try http.decode(Wire.ServerConfig.self, from: data)
+    }
+
+    private var headers: [String: String] { headers(for: label) }
+
+    /// Headers for one request, at a label that need not be the session's.
+    private func headers(for label: Label?) -> [String: String] {
+        var headers = ["Authorization": "Bearer \(token)"]
+        if let label {
+            headers["X-Enclave-Classification"] = String(label.classification)
+            headers["X-Enclave-Compartments"] =
+                label.compartments.sorted().map(String.init).joined(separator: ",")
+        }
+        return headers
+    }
+
+    func get<T: Decodable>(_ type: T.Type, _ path: String) async throws -> T? {
+        let (data, response) = try await http.request(
+            "GET", try .endpoint(baseURL, path), headers: headers)
+        if response.statusCode == 204 { return nil }
+        return try http.decode(type, from: data)
+    }
+
+    @discardableResult
+    func post<T: Decodable>(
+        _ type: T.Type, _ path: String, _ body: some Encodable & Sendable,
+        at oneOff: Label? = nil
+    )
+        async throws -> T?
+    {
+        let (data, response) = try await http.request(
+            "POST", try .endpoint(baseURL, path),
+            headers: headers(for: oneOff ?? label), json: body)
+        if response.statusCode == 204 || data.isEmpty { return nil }
+        return try? http.decode(type, from: data)
+    }
+
+    func delete(_ path: String) async throws {
+        _ = try await http.request("DELETE", try .endpoint(baseURL, path), headers: headers)
+    }
+
+    // MARK: nodes
+
+    public func roots() async throws -> [Wire.Node] {
+        try await get([Wire.Node].self, "/api/nodes/roots") ?? []
+    }
+
+    public func children(of folderID: UUID) async throws -> [Wire.Node] {
+        try await get([Wire.Node].self, "/api/nodes/\(folderID.uuidString)/children") ?? []
+    }
+
+    struct CreateNodeBody: Encodable {
+        let parentID: UUID?
+        let nameDigest: Data
+        let nameCiphertext: Data
+        let isFolder: Bool
+        let wrappedKey: Data
+        let contentKey: Data?
+        let blobID: UUID?
+        let sizeBytes: Int64
+    }
+
+    func create(_ body: CreateNodeBody) async throws -> Wire.Node? {
+        try await post(Wire.Node.self, "/api/nodes", body)
+    }
+
+    // MARK: keys
+
+    public func labelGrants() async throws -> [Wire.LabelGrant] {
+        try await get([Wire.LabelGrant].self, "/api/keys/labels") ?? []
+    }
+
+    struct GrantBody: Encodable {
+        let classification: Int16
+        let compartments: [Int]
+        let wrappedKey: Data
+    }
+
+    func storeGrant(label: Label, wrappedKey: Data) async throws {
+        // Sent at the grant's own label without disturbing the session's.
+        _ = try await post(
+            Wire.LabelGrant.self, "/api/keys/labels",
+            GrantBody(
+                classification: label.classification,
+                compartments: label.compartments.sorted(), wrappedKey: wrappedKey),
+            at: label)
+    }
+
+    struct DelegateBody: Encodable, Sendable {
+        let handle: String
+        let principalID: UUID
+        let wrappedKey: Data
+    }
+
+    func delegateGrant(_ body: DelegateBody) async throws {
+        _ = try await post(Wire.LabelGrant.self, "/api/keys/labels/delegate", body)
+    }
+
+    func nodeKey(_ nodeID: UUID) async throws -> Wire.NodeKey {
+        guard let key = try await get(Wire.NodeKey.self, "/api/keys/nodes/\(nodeID.uuidString)")
+        else { throw ClientError.http(status: 404, detail: "") }
+        return key
+    }
+
+    // MARK: blobs
+
+    func putBlob(_ ciphertext: Data) async throws -> UUID {
+        let (data, _) = try await http.request(
+            "POST", try .endpoint(baseURL, "/api/blobs"), headers: headers, body: ciphertext)
+        return try http.decode(Wire.BlobCreated.self, from: data).id
+    }
+
+    func getBlob(_ blobID: UUID) async throws -> Data {
+        let (data, _) = try await http.request(
+            "GET", try .endpoint(baseURL, "/api/blobs/\(blobID.uuidString)"), headers: headers)
+        return data
+    }
+
+    // MARK: vocabulary
+
+    public func vocabulary() async throws -> Wire.Vocabulary {
+        try await get(Wire.Vocabulary.self, "/api/vocabulary")
+            ?? Wire.Vocabulary(levels: [], compartments: [], canEdit: false)
+    }
+
+    // MARK: shares
+
+    struct CreateShareBody: Encodable {
+        let nodeID: UUID
+        let wrappedContentKey: Data
+        let wrappedName: Data
+        let passwordSalt: Data?
+        let passwordIterations: Int?
+        let expiresInHours: Int
+    }
+
+    public func share(_ shareID: UUID) async throws -> Wire.Share? {
+        try await get(Wire.Share.self, "/api/shares/\(shareID.uuidString)")
+    }
+
+    public func shares(for nodeID: UUID) async throws -> [Wire.Share] {
+        try await get([Wire.Share].self, "/api/shares/for/\(nodeID.uuidString)") ?? []
+    }
+
+    public func revokeShare(_ shareID: UUID) async throws {
+        try await delete("/api/shares/\(shareID.uuidString)")
+    }
+}
@@ -0,0 +1,394 @@
+import CryptoKit
+import FilesEngine
+import Foundation
+
+/// An unlocked working session.
+public actor FilesSession {
+    public struct Entry: Sendable, Identifiable, Hashable {
+        public let node: Wire.Node
+        /// `nil` when this session holds no key for the row's label: visible to
+        /// the database, unreadable here.
+        public let name: String?
+        public var id: UUID { node.id }
+        public var label: Label { node.label }
+        public var isFolder: Bool { node.isFolder }
+    }
+
+    public let api: FilesAPI
+    public let accounts: AccountsClient
+    public let token: String
+    public let clearance: Clearance
+    public private(set) var label: Label
+    /// Set only when a code was just issued, and never persisted.
+    public private(set) var recoveryCode: String?
+
+    private let privateKey: Curve25519.KeyAgreement.PrivateKey
+    private let publicKey: Curve25519.KeyAgreement.PublicKey
+    private var labelKeys: [Label: Data] = [:]
+
+    init(
+        api: FilesAPI, accounts: AccountsClient, token: String, clearance: Clearance,
+        privateKey: Curve25519.KeyAgreement.PrivateKey, recoveryCode: String? = nil
+    ) {
+        self.api = api
+        self.accounts = accounts
+        self.token = token
+        self.clearance = clearance
+        self.label = clearance.minimum
+        self.privateKey = privateKey
+        self.publicKey = privateKey.publicKey
+        self.recoveryCode = recoveryCode
+    }
+
+    public func clearRecoveryCode() { recoveryCode = nil }
+
+    // MARK: opening
+
+    /// Unlock an existing identity.
+    public static func open(
+        api: FilesAPI, accounts: AccountsClient, token: String,
+        passphrase: String, clearance: Clearance,
+        recoveryEntropy: Data? = nil
+    ) async throws -> FilesSession {
+        await api.setLabel(clearance.minimum)
+        guard let record = try await accounts.identity(token: token),
+            let protectedRecord = record.protectedRecord
+        else {
+            // No identity for this product yet.
+            return try await enrol(
+                api: api, accounts: accounts, token: token,
+                passphrase: passphrase, clearance: clearance, recoveryEntropy: recoveryEntropy)
+        }
+        let decoded = try Identity.Record.parse(protectedRecord)
+        let privateKey: Curve25519.KeyAgreement.PrivateKey
+        do {
+            privateKey = try Identity.unlock(decoded, passphrase: passphrase)
+        } catch {
+            // The only realistic cause is a wrong passphrase: the record is
+            // authenticated, so tampering and a bad key look identical here.
+            throw ClientError.wrongPassphrase
+        }
+        return FilesSession(
+            api: api, accounts: accounts, token: token,
+            clearance: clearance, privateKey: privateKey)
+    }
+
+    /// Create and enrol a keypair for an account that has none.
+    static func enrol(
+        api: FilesAPI, accounts: AccountsClient, token: String,
+        passphrase: String, clearance: Clearance, recoveryEntropy: Data?
+    ) async throws -> FilesSession {
+        let entropy = recoveryEntropy ?? Recovery.generate().entropy
+        let key = Identity.generate()
+        try await accounts.enroll(
+            token: token,
+            publicKey: Identity.exportPublicKey(key.publicKey),
+            protectedRecord: try Identity.protect(key, passphrase: passphrase).json,
+            recoveryRecord: try Identity.protectWithRecovery(key, entropy: entropy).json)
+
+        return FilesSession(
+            api: api, accounts: accounts, token: token, clearance: clearance,
+            privateKey: key, recoveryCode: try Recovery.encode(entropy))
+    }
+
+    /// Adopt a keypair this device just created during registration.
+    public static func enrolled(
+        api: FilesAPI, accounts: AccountsClient, token: String,
+        privateKey: Curve25519.KeyAgreement.PrivateKey, clearance: Clearance,
+        recoveryCode: String?
+    ) async -> FilesSession {
+        await api.setLabel(clearance.minimum)
+        return FilesSession(
+            api: api, accounts: accounts, token: token, clearance: clearance,
+            privateKey: privateKey, recoveryCode: recoveryCode)
+    }
+
+    /// Unlock with a recovery code and set a new passphrase.
+    public static func recover(
+        api: FilesAPI, accounts: AccountsClient, token: String,
+        code: String, newPassphrase: String, clearance: Clearance, nextEntropy: Data
+    ) async throws -> FilesSession {
+        await api.setLabel(clearance.minimum)
+        guard let record = try await accounts.identity(token: token),
+            let recoveryRecord = record.recoveryRecord
+        else { throw ClientError.badServer("This account has no recovery code on file.") }
+
+        let entropy = try Recovery.decode(code)
+        let decoded = try Identity.Record.parse(recoveryRecord)
+        let privateKey = try Identity.unlockWithRecovery(decoded, entropy: entropy)
+
+        let next = try Identity.protect(privateKey, passphrase: newPassphrase)
+        let nextRecovery = try Identity.protectWithRecovery(privateKey, entropy: nextEntropy)
+        try await accounts.rekey(
+            token: token,
+            protectedRecord: next.json,
+            recoveryRecord: nextRecovery.json)
+
+        return FilesSession(
+            api: api, accounts: accounts, token: token, clearance: clearance,
+            privateKey: privateKey,
+            recoveryCode: try Recovery.encode(nextEntropy))
+    }
+
+    // MARK: label keys
+
+    /// Load and unwrap every label key granted to this principal.
+    @discardableResult
+    public func loadLabelKeys() async throws -> [Label] {
+        for grant in try await api.labelGrants() {
+            do {
+                labelKeys[grant.label] = try Keys.acceptLabelKey(
+                    grant.wrappedKey, label: grant.label, privateKey: privateKey)
+            } catch {
+                // A grant that will not unwrap is not fatal: it may have been
+                // wrapped to a superseded identity key.
+                continue
+            }
+        }
+        return Array(labelKeys.keys)
+    }
+
+    /// Ensure a label key exists for `label`, creating and self-granting one if
+    /// not.
+    @discardableResult
+    func ensureLabelKey(_ wanted: Label) async throws -> Data {
+        guard clearance.permits(wanted) else { throw ClientError.notCleared }
+        if let existing = labelKeys[wanted] { return existing }
+
+        // Stored at the wanted label without moving the session's, so a request
+        // that overlaps this one still goes out under the area the caller is
+        // actually in.
+        let key = Random.bytes(32)
+        try await api.storeGrant(
+            label: wanted,
+            wrappedKey: try Keys.grantLabelKey(key, label: wanted, to: publicKey))
+
+        labelKeys[wanted] = key
+        return key
+    }
+
+    /// Switch to an area.
+    public func use(_ wanted: Label) async throws {
+        guard clearance.permits(wanted) else { throw ClientError.notCleared }
+        label = wanted
+        await api.setLabel(wanted)
+    }
+
+    /// The key for the current label, minting one if this is the first write.
+    @discardableResult
+    func requireLabelKey() async throws -> Data {
+        try await ensureLabelKey(label)
+    }
+
+    var currentLabelKey: Data {
+        get throws {
+            guard let key = labelKeys[label] else { throw ClientError.noKeyForArea }
+            return key
+        }
+    }
+
+    /// The key that names a folder's children.
+    func folderKey(_ folderID: UUID?) async throws -> Data {
+        guard let folderID else { return try currentLabelKey }
+        let record = try await api.nodeKey(folderID)
+        return try Keys.unwrapNodeKey(
+            record.wrappedKey, labelKey: try currentLabelKey, label: label)
+    }
+
+    // MARK: browsing
+
+    /// List a folder, decrypting each visible child's name locally.
+    public func list(_ folderID: UUID?) async throws -> [Entry] {
+        let rows =
+            folderID.map { id in { try await self.api.children(of: id) } }
+            ?? { try await self.api.roots() }
+        let nodes = try await rows()
+
+        // Inside a folder every child is named under that folder's node key,
+        // which the caller necessarily holds to have got here at all.
+        let folderNodeKey = folderID == nil ? nil : try await folderKey(folderID)
+
+        return nodes.map { node in
+            let key = folderNodeKey ?? labelKeys[node.label]
+            var name: String?
+            if let key {
+                name = try? Names.decrypt(
+                    folderKey: key, blob: node.nameCiphertext,
+                    digest: node.nameDigest, label: node.label)
+            }
+            return Entry(node: node, name: name)
+        }
+    }
+
+    // MARK: writing
+
+    @discardableResult
+    public func createFolder(_ name: String, in parentID: UUID? = nil) async throws -> Wire.Node? {
+        try await requireLabelKey()
+        let folderKey = try await folderKey(parentID)
+        let nodeKey = Random.bytes(32)
+        let named = try Names.encrypt(folderKey: folderKey, name: name, label: label)
+        return try await api.create(
+            .init(
+                parentID: parentID,
+                nameDigest: named.digest, nameCiphertext: named.ciphertext,
+                isFolder: true,
+                wrappedKey: try Keys.wrapNodeKey(
+                    nodeKey, labelKey: try currentLabelKey, label: label),
+                contentKey: nil, blobID: nil, sizeBytes: 0))
+    }
+
+    /// Encrypt then upload.
+    public private(set) var maxUploadBytes: Int?
+
+    public func setMaxUploadBytes(_ limit: Int?) { maxUploadBytes = limit }
+
+    @discardableResult
+    public func upload(_ bytes: Data, named name: String, in parentID: UUID? = nil)
+        async throws -> Wire.Node?
+    {
+        if let limit = maxUploadBytes, bytes.count > limit {
+            throw ClientError.tooLarge(limit: limit, actual: bytes.count)
+        }
+        try await requireLabelKey()
+        let folderKey = try await folderKey(parentID)
+        let nodeKey = Random.bytes(32)
+        let contentKey = Random.bytes(32)
+
+        let ciphertext = try Content.encrypt(bytes, contentKey: contentKey, label: label)
+        let blobID = try await api.putBlob(ciphertext)
+        let named = try Names.encrypt(folderKey: folderKey, name: name, label: label)
+
+        return try await api.create(
+            .init(
+                parentID: parentID,
+                nameDigest: named.digest, nameCiphertext: named.ciphertext,
+                isFolder: false,
+                wrappedKey: try Keys.wrapNodeKey(
+                    nodeKey, labelKey: try currentLabelKey, label: label),
+                contentKey: try Keys.wrapContentKey(contentKey, nodeKey: nodeKey, label: label),
+                blobID: blobID, sizeBytes: Int64(bytes.count)))
+    }
+
+    public func download(_ node: Wire.Node) async throws -> Data {
+        guard let blobID = node.blobID, let wrappedContentKey = node.contentKey else {
+            throw ClientError.badServer("That entry has no contents.")
+        }
+        let record = try await api.nodeKey(node.id)
+        let nodeKey = try Keys.unwrapNodeKey(
+            record.wrappedKey, labelKey: try currentLabelKey, label: node.label)
+        let contentKey = try Keys.unwrapContentKey(
+            wrappedContentKey, nodeKey: nodeKey, label: node.label)
+        return try Content.decrypt(
+            try await api.getBlob(blobID),
+            contentKey: contentKey, label: node.label)
+    }
+
+    // MARK: sharing an area
+
+    /// Give someone else the key to the area you are working in.
+    @discardableResult
+    public func shareArea(with handle: String) async throws -> UUID {
+        // Not `requireLabelKey`: giving away a key you have never used would
+        // mint one on the spot and share an empty area, which is not what the
+        // person meant and would collide with whatever the recipient holds.
+        guard let key = labelKeys[label] else {
+            throw ClientError.badServer(
+                "You don't have a key for this area yet. Put something in it first.")
+        }
+        let recipient = try await accounts.resolveRecipient(
+            token: token, handle: handle, label: label)
+
+        let publicKey = try Curve25519.KeyAgreement.PublicKey(
+            rawRepresentation: recipient.publicKey)
+        try await api.delegateGrant(
+            .init(
+                handle: handle.lowercased(),
+                principalID: recipient.pseudonym,
+                wrappedKey: try Keys.grantLabelKey(key, label: label, to: publicKey)))
+        return recipient.pseudonym
+    }
+
+    // MARK: shares, removed
+
+    /// Public share links are gone, deliberately.
+}
+
+public struct Clearance: Sendable, Hashable {
+    public let maximum: Label
+    public let minimum: Label
+
+    public init(maximum: Label, minimum: Label) {
+        self.maximum = maximum
+        self.minimum = minimum
+    }
+
+    /// Both bounds, always: a label must sit inside the range, not merely below
+    /// the top of it.
+    public func permits(_ label: Label) -> Bool {
+        maximum.dominates(label) && label.dominates(minimum)
+    }
+
+    /// No read up: nothing above the clearance, and nothing outside its areas.
+    public func mayRead(_ label: Label) -> Bool { permits(label) }
+
+    /// Whether a write to `label` is allowed, which is the same range check.
+    ///
+    /// The second rule of the model, that somebody who can read above a level
+    /// must not write below it, is deliberately NOT enforced. A person cleared
+    /// high can file something in a low area, and nothing stops them putting
+    /// high material in it. The label still decides who can open the file.
+    ///
+    /// Enforced on one client and not the other, this would be worse than the
+    /// gap: a file that saves on one phone and is refused on the other, with
+    /// neither person able to tell which rule they met, reads as a bug and
+    /// gets worked around. So both engines document it and both pin it in a
+    /// test, and they change together or not at all. See ios#65, android#15.
+    public func mayWrite(_ label: Label) -> Bool { permits(label) }
+}
+
+/// The wallet, on the identity this session already unlocked.
+extension FilesSession {
+
+    /// A new wallet.
+    public func createWallet(words: [String], entropyBytes: Int = 32)
+        throws -> (phrase: String, record: Data)
+    {
+        try Wallet.create(
+            walletKEK: Wallet.kek(identity: privateKey),
+            words: words, entropyBytes: entropyBytes)
+    }
+
+    /// Adopt a phrase from another wallet.
+    public func importWallet(phrase: String, words: [String]) throws -> Data {
+        try Wallet.import(
+            phrase: phrase,
+            walletKEK: Wallet.kek(identity: privateKey), words: words)
+    }
+
+    /// The phrase again, for somebody writing it down properly this time.
+    public func walletPhrase(record: Data, words: [String]) throws -> String {
+        try Wallet.phrase(
+            record: record,
+            walletKEK: Wallet.kek(identity: privateKey), words: words)
+    }
+
+    /// The next receive address, and the path it came from.
+    public func nextReceiveKey(record: Data, words: [String], index: UInt32) throws
+        -> (address: String, path: String)
+    {
+        let seed = try Wallet.seed(
+            record: record, walletKEK: Wallet.kek(identity: privateKey),
+            words: words)
+        let account = HDAccount(seed: seed, coinType: 501)
+        let key = try account.key(index: index)
+        return (Base58.encode(try key.publicKey()), account.path(index: index))
+    }
+
+    /// The 64-byte seed.
+    public func walletSeed(record: Data, words: [String], passphrase: String = "") throws -> Data {
+        try Wallet.seed(
+            record: record, walletKEK: Wallet.kek(identity: privateKey),
+            words: words, passphrase: passphrase)
+    }
+}
@@ -0,0 +1,106 @@
+import Foundation
+
+/// How the sessions this package builds are configured. The app sets it
+/// once, at launch, so they go through its bridges like every other session.
+public enum FilesTransport {
+    nonisolated(unsafe) public static var configure: @Sendable (URLSessionConfiguration) -> Void = { _ in }
+}
+
+/// A very small HTTP layer.
+struct HTTP: Sendable {
+    let session: URLSession
+
+    init() {
+        let configuration = URLSessionConfiguration.ephemeral
+        // Nothing here should be written to a shared cache: responses carry
+        // wrapped keys and, for the identity endpoint, the protected private
+        // key record.
+        configuration.urlCache = nil
+        configuration.requestCachePolicy = .reloadIgnoringLocalCacheData
+        configuration.httpCookieStorage = nil
+        configuration.timeoutIntervalForRequest = 30
+        // The host app's transport: a bridge when one is set (SPEC §24.6).
+        FilesTransport.configure(configuration)
+        self.session = URLSession(configuration: configuration)
+    }
+
+    /// JSON in, JSON out.
+    static let decoder: JSONDecoder = {
+        let decoder = JSONDecoder()
+        decoder.dateDecodingStrategy = .iso8601
+        // Vapor encodes `Data` as base64, and `Data`'s synthesised Codable
+        // conformance expects an array of bytes.
+        decoder.dataDecodingStrategy = .base64
+        return decoder
+    }()
+
+    static let encoder: JSONEncoder = {
+        let encoder = JSONEncoder()
+        encoder.dateEncodingStrategy = .iso8601
+        encoder.dataEncodingStrategy = .base64
+        return encoder
+    }()
+
+    func request(
+        _ method: String, _ url: URL, headers: [String: String] = [:],
+        json: (some Encodable & Sendable)? = Optional<String>.none, body: Data? = nil
+    ) async throws -> (Data, HTTPURLResponse) {
+        var request = URLRequest(url: url)
+        request.httpMethod = method
+        for (key, value) in headers { request.setValue(value, forHTTPHeaderField: key) }
+
+        if let json {
+            request.setValue("application/json", forHTTPHeaderField: "Content-Type")
+            request.httpBody = try Self.encoder.encode(json)
+        } else if let body {
+            request.setValue("application/octet-stream", forHTTPHeaderField: "Content-Type")
+            request.httpBody = body
+        }
+
+        let (data, response) = try await session.data(for: request)
+        guard let http = response as? HTTPURLResponse else {
+            throw ClientError.badServer("That address did not answer as a web server.")
+        }
+        guard (200..<300).contains(http.statusCode) else {
+            throw ClientError.http(
+                status: http.statusCode,
+                detail: Self.reason(from: data))
+        }
+        return (data, http)
+    }
+
+    /// Vapor puts a human-readable message in `reason`.
+    static func reason(from data: Data) -> String {
+        if let object = try? JSONSerialization.jsonObject(with: data) as? [String: Any],
+            let reason = object["reason"] as? String
+        {
+            return reason
+        }
+        let text = String(data: data, encoding: .utf8) ?? ""
+        return text.count <= 200 ? text : ""
+    }
+
+    func decode<T: Decodable>(_ type: T.Type, from data: Data) throws -> T {
+        do { return try Self.decoder.decode(type, from: data) } catch {
+            throw ClientError.badServer(
+                "The server sent something this version cannot read. It may be newer than the app.")
+        }
+    }
+}
+
+extension URL {
+    /// Joins a path onto a base that may or may not have a trailing slash, and
+    /// refuses anything that is not http(s), a `file:` base would otherwise
+    /// silently "work" and read the device's own disk.
+    static func endpoint(_ base: String, _ path: String) throws -> URL {
+        var trimmed = base.trimmingCharacters(in: .whitespaces)
+        if trimmed.isEmpty { throw ClientError.badServer("Enter a server address.") }
+        if !trimmed.contains("://") { trimmed = "https://" + trimmed }
+        while trimmed.hasSuffix("/") { trimmed.removeLast() }
+        guard let url = URL(string: trimmed + path),
+            let scheme = url.scheme?.lowercased(),
+            scheme == "https" || scheme == "http"
+        else { throw ClientError.badServer("That doesn't look like a server address.") }
+        return url
+    }
+}
@@ -0,0 +1,445 @@
+import CryptoKit
+import FilesEngine
+import Foundation
+
+/// Files that live on this phone.
+public actor LocalVault {
+
+    /// Where a row's bytes actually are.
+    public enum Storage: String, Codable, Sendable {
+        case vault
+        case reference
+    }
+
+    /// A row.
+    public struct Node: Codable, Sendable, Identifiable, Hashable {
+        public let id: UUID
+        public var parentID: UUID?
+        public var isFolder: Bool
+        /// In the clear, as it was in the database: a label is not a secret,
+        /// and it has to be readable to be shown on a row you cannot open.
+        public var classification: Int16
+        public var compartments: [Int]
+        public var wrappedNodeKey: Data
+        public var nameDigest: Data
+        public var wrappedName: Data
+        public var wrappedContentKey: Data?
+        public var byteCount: Int
+        public var addedAt: Date
+
+        /// Optional in storage, non-optional in use.
+        private var storageRaw: Storage?
+        public var storage: Storage {
+            get { storageRaw ?? .vault }
+            set { storageRaw = newValue }
+        }
+
+        /// Set only for `.reference`.
+        public var bookmark: Data?
+
+        private enum CodingKeys: String, CodingKey {
+            case id, parentID, isFolder, classification, compartments
+            case wrappedNodeKey, nameDigest, wrappedName, wrappedContentKey
+            case byteCount, addedAt, bookmark
+            case storageRaw = "storage"
+        }
+
+        public var label: Label {
+            Label(classification: classification, compartments: Set(compartments))
+        }
+    }
+
+    struct Index: Codable {
+        var version: Int = 1
+        var nodes: [Node] = []
+    }
+
+    /// What a screen shows: the row, plus the name if this device can read it.
+    public struct Entry: Sendable, Identifiable, Hashable {
+        public let node: Node
+        public let name: String?
+        /// True when this is a reference whose file is no longer where it was.
+        public let isMissing: Bool
+        public var id: UUID { node.id }
+        public var label: Label { node.label }
+        public var isFolder: Bool { node.isFolder }
+        public var byteCount: Int { node.byteCount }
+        public var storage: Storage { node.storage }
+    }
+
+    private let root: URL
+    private let identity: Curve25519.KeyAgreement.PrivateKey
+    private var index = Index()
+
+    public init(root: URL, identity: Curve25519.KeyAgreement.PrivateKey) {
+        self.root = root
+        self.identity = identity
+    }
+
+    // MARK: - Keys
+
+    /// The key for a label, derived rather than fetched.
+    func labelKey(_ label: Label) -> Data {
+        let key = HKDF<SHA256>.deriveKey(
+            inputKeyMaterial: SymmetricKey(data: identity.rawRepresentation),
+            salt: label.bytes,
+            info: Data("flamenet/files/local-label/v1".utf8),
+            outputByteCount: 32
+        )
+        return key.withUnsafeBytes { Data($0) }
+    }
+
+    /// Whether this device can read a label at all.
+    private func canRead(_ node: Node) -> Bool {
+        (try? name(of: node)) != nil
+    }
+
+    private func name(of node: Node) throws -> String {
+        let key = labelKey(node.label)
+        let nodeKey = try Keys.unwrapNodeKey(node.wrappedNodeKey, labelKey: key, label: node.label)
+        return try Names.decrypt(
+            folderKey: nodeKey, blob: node.wrappedName,
+            digest: node.nameDigest, label: node.label)
+    }
+
+    // MARK: - Storage
+
+    private var indexURL: URL { root.appendingPathComponent("index.json") }
+    private func blobURL(_ id: UUID) -> URL {
+        root.appendingPathComponent("blobs", isDirectory: true)
+            .appendingPathComponent(id.uuidString)
+    }
+
+    public func load() throws {
+        try FileManager.default.createDirectory(
+            at: root.appendingPathComponent("blobs", isDirectory: true),
+            withIntermediateDirectories: true)
+        guard let data = try? Data(contentsOf: indexURL) else { return }
+        index = try JSONDecoder().decode(Index.self, from: data)
+    }
+
+    /// Written to a temporary file and moved into place.
+    private func save() throws {
+        let data = try JSONEncoder().encode(index)
+        let temporary = root.appendingPathComponent("index.json.new")
+        try data.write(to: temporary, options: .atomic)
+        _ = try FileManager.default.replaceItemAt(indexURL, withItemAt: temporary)
+    }
+
+    // MARK: - Reading
+
+    public func list(_ parentID: UUID?) -> [Entry] {
+        index.nodes
+            .filter { $0.parentID == parentID }
+            .map {
+                Entry(
+                    node: $0, name: try? name(of: $0),
+                    isMissing: $0.storage == .reference && resolve($0) == nil)
+            }
+            .sorted {
+                // Folders first, then by name; unreadable rows last, where they
+                // are least in the way of the ones you can act on.
+                if $0.isFolder != $1.isFolder { return $0.isFolder }
+                switch ($0.name, $1.name) {
+                case (let a?, let b?):
+                    return a.localizedCaseInsensitiveCompare(b) == .orderedAscending
+                case (nil, _): return false
+                case (_, nil): return true
+                }
+            }
+    }
+
+    // MARK: - References
+
+    /// Re-establish access to a referenced file, or nil if it has gone.
+    func resolve(_ node: Node) -> URL? {
+        guard node.storage == .reference, let bookmark = node.bookmark else { return nil }
+        var stale = false
+        #if os(macOS)
+            let options: URL.BookmarkResolutionOptions = [.withSecurityScope]
+        #else
+            let options: URL.BookmarkResolutionOptions = []
+        #endif
+        guard
+            let url = try? URL(
+                resolvingBookmarkData: bookmark,
+                options: options,
+                relativeTo: nil,
+                bookmarkDataIsStale: &stale)
+        else { return nil }
+        // Existence is checked inside the scope: for a provider-backed file the
+        // path is not readable until access is started.
+        let scoped = url.startAccessingSecurityScopedResource()
+        defer { if scoped { url.stopAccessingSecurityScopedResource() } }
+        return FileManager.default.fileExists(atPath: url.path) ? url : nil
+    }
+
+    /// File a document that stays where it is.
+    @discardableResult
+    public func reference(
+        _ url: URL, named name: String, label: Label,
+        parentID: UUID? = nil
+    ) throws -> Node {
+        #if os(macOS)
+            let bookmark = try url.bookmarkData(
+                options: [.withSecurityScope],
+                includingResourceValuesForKeys: nil,
+                relativeTo: nil)
+        #else
+            let bookmark = try url.bookmarkData(
+                options: [],
+                includingResourceValuesForKeys: nil,
+                relativeTo: nil)
+        #endif
+        let size = (try? url.resourceValues(forKeys: [.fileSizeKey]).fileSize) ?? 0
+        var node = try makeNode(
+            named: name, label: label, parentID: parentID,
+            isFolder: false, byteCount: size)
+        node.storage = .reference
+        node.bookmark = bookmark
+        index.nodes.append(node)
+        try save()
+        return node
+    }
+
+    /// Turn a reference into an encrypted copy, in place.
+    @discardableResult
+    public func encrypt(_ id: UUID) throws -> URL? {
+        guard let position = index.nodes.firstIndex(where: { $0.id == id }) else {
+            throw ClientError.badServer("That file isn't here any more.")
+        }
+        let node = index.nodes[position]
+        guard node.storage == .reference else { return nil }
+        guard let origin = resolve(node) else {
+            throw ClientError.badServer(
+                "That file isn't where it was, it may have been moved or deleted.")
+        }
+
+        let plaintext = try contents(of: node)
+        let key = labelKey(node.label)
+        let nodeKey = try Keys.unwrapNodeKey(node.wrappedNodeKey, labelKey: key, label: node.label)
+        var contentKey = Data(count: 32)
+        contentKey.withUnsafeMutableBytes {
+            _ = SecRandomCopyBytes(kSecRandomDefault, 32, $0.baseAddress!)
+        }
+
+        // Bytes before index, as everywhere else here: a crash between the two
+        // leaves an unreferenced blob, not a row pointing at nothing.
+        try Content.encrypt(plaintext, contentKey: contentKey, label: node.label)
+            .write(to: blobURL(node.id), options: .atomic)
+
+        var updated = node
+        updated.storage = .vault
+        // The bookmark goes.
+        updated.bookmark = nil
+        updated.wrappedContentKey = try Keys.wrapContentKey(
+            contentKey, nodeKey: nodeKey,
+            label: node.label)
+        updated.byteCount = plaintext.count
+        index.nodes[position] = updated
+        try save()
+        return origin
+    }
+
+    /// The bytes, encrypted for sending, whichever way they are stored.
+    public func sealedForSending(_ node: Node) throws -> (blob: Data, contentKey: Data) {
+        let plaintext = try contents(of: node)
+        var contentKey = Data(count: 32)
+        contentKey.withUnsafeMutableBytes {
+            _ = SecRandomCopyBytes(kSecRandomDefault, 32, $0.baseAddress!)
+        }
+        return (
+            try Content.encrypt(plaintext, contentKey: contentKey, label: node.label),
+            contentKey
+        )
+    }
+
+    public func contents(of node: Node) throws -> Data {
+        guard !node.isFolder else { throw ClientError.badServer("That is a folder.") }
+
+        if node.storage == .reference {
+            guard let url = resolve(node) else {
+                throw ClientError.badServer(
+                    "That file isn't where it was, it may have been moved or deleted.")
+            }
+            let scoped = url.startAccessingSecurityScopedResource()
+            defer { if scoped { url.stopAccessingSecurityScopedResource() } }
+            return try Data(contentsOf: url)
+        }
+
+        guard let wrappedContentKey = node.wrappedContentKey else {
+            throw ClientError.badServer("That file has no contents.")
+        }
+        let key = labelKey(node.label)
+        let nodeKey = try Keys.unwrapNodeKey(node.wrappedNodeKey, labelKey: key, label: node.label)
+        let contentKey = try Keys.unwrapContentKey(
+            wrappedContentKey, nodeKey: nodeKey, label: node.label)
+        let blob = try Data(contentsOf: blobURL(node.id))
+        return try Content.decrypt(blob, contentKey: contentKey, label: node.label)
+    }
+
+    // MARK: - Writing
+
+    @discardableResult
+    public func add(
+        _ bytes: Data, named name: String, label: Label,
+        parentID: UUID? = nil
+    ) throws -> Node {
+        let node = try makeNode(
+            named: name, label: label, parentID: parentID,
+            isFolder: false, byteCount: bytes.count)
+        let key = labelKey(label)
+        let nodeKey = try Keys.unwrapNodeKey(node.wrappedNodeKey, labelKey: key, label: label)
+        var contentKey = Data(count: 32)
+        contentKey.withUnsafeMutableBytes {
+            _ = SecRandomCopyBytes(kSecRandomDefault, 32, $0.baseAddress!)
+        }
+
+        // Bytes to disk BEFORE the index.
+        try Content.encrypt(bytes, contentKey: contentKey, label: label)
+            .write(to: blobURL(node.id), options: .atomic)
+
+        var stored = node
+        stored.wrappedContentKey = try Keys.wrapContentKey(
+            contentKey, nodeKey: nodeKey, label: label)
+        index.nodes.append(stored)
+        try save()
+        return stored
+    }
+
+    @discardableResult
+    public func createFolder(_ name: String, label: Label, parentID: UUID? = nil) throws -> Node {
+        let node = try makeNode(
+            named: name, label: label, parentID: parentID,
+            isFolder: true, byteCount: 0)
+        index.nodes.append(node)
+        try save()
+        return node
+    }
+
+    private func makeNode(
+        named name: String, label: Label, parentID: UUID?,
+        isFolder: Bool, byteCount: Int
+    ) throws -> Node {
+        var nodeKey = Data(count: 32)
+        nodeKey.withUnsafeMutableBytes {
+            _ = SecRandomCopyBytes(kSecRandomDefault, 32, $0.baseAddress!)
+        }
+        let key = labelKey(label)
+        let named = try Names.encrypt(folderKey: nodeKey, name: name, label: label)
+        return Node(
+            id: UUID(), parentID: parentID, isFolder: isFolder,
+            classification: label.classification,
+            compartments: label.compartments.sorted(),
+            // Wrapped to the node's OWN label key, never the parent's.
+            wrappedNodeKey: try Keys.wrapNodeKey(nodeKey, labelKey: key, label: label),
+            nameDigest: named.digest,
+            wrappedName: named.ciphertext,
+            wrappedContentKey: nil,
+            byteCount: byteCount,
+            addedAt: Date()
+        )
+    }
+
+    /// Removes a node and its bytes.
+    public func remove(_ id: UUID) throws {
+        guard let position = index.nodes.firstIndex(where: { $0.id == id }) else { return }
+        if index.nodes[position].isFolder,
+            index.nodes.contains(where: { $0.parentID == id })
+        {
+            throw ClientError.badServer("That folder isn't empty.")
+        }
+        let wasVaulted = index.nodes[position].storage == .vault
+        index.nodes.remove(at: position)
+        try save()
+        // Never the person's own file, see the note in `remove(ids:)`.
+        if wasVaulted { try? FileManager.default.removeItem(at: blobURL(id)) }
+    }
+
+    /// What a bulk delete actually did.
+    public struct Removal: Sendable {
+        public var removed: [UUID] = []
+        /// Folders left alone because something inside them was not selected.
+        public var keptNonEmpty: [UUID] = []
+        public var isCompletelyDone: Bool { keptNonEmpty.isEmpty }
+    }
+
+    /// Delete several things at once.
+    @discardableResult
+    public func remove(ids: [UUID]) throws -> Removal {
+        var result = Removal()
+        var removedVaultIDs: [UUID] = []
+        let wanted = Set(ids)
+
+        // Depth first: a child must go before the parent that contains it.
+        func depth(_ id: UUID) -> Int {
+            var steps = 0
+            var current = index.nodes.first { $0.id == id }?.parentID
+            while let parent = current, steps < 64 {
+                steps += 1
+                current = index.nodes.first { $0.id == parent }?.parentID
+            }
+            return steps
+        }
+        let ordered = ids.filter { id in index.nodes.contains { $0.id == id } }
+            .sorted { depth($0) > depth($1) }
+
+        for id in ordered {
+            guard let position = index.nodes.firstIndex(where: { $0.id == id }) else { continue }
+            let node = index.nodes[position]
+            if node.isFolder {
+                // Anything left inside that was not itself selected?
+                let survivors = index.nodes.filter { $0.parentID == id && !wanted.contains($0.id) }
+                if !survivors.isEmpty {
+                    result.keptNonEmpty.append(id)
+                    continue
+                }
+            }
+            if node.storage == .vault { removedVaultIDs.append(id) }
+            index.nodes.remove(at: position)
+            result.removed.append(id)
+        }
+
+        // One save for the whole batch, after the index is consistent.
+        try save()
+        // Only ever our own blobs.
+        for id in removedVaultIDs {
+            try? FileManager.default.removeItem(at: blobURL(id))
+        }
+        return result
+    }
+
+    /// Every id in a subtree, so a screen can offer "and everything in it".
+    public func descendants(of id: UUID) -> [UUID] {
+        var found: [UUID] = []
+        var seen: Set<UUID> = [id]
+        var frontier = [id]
+        while let next = frontier.popLast() {
+            for child in index.nodes where child.parentID == next {
+                guard seen.insert(child.id).inserted else { continue }
+                found.append(child.id)
+                frontier.append(child.id)
+            }
+        }
+        return found
+    }
+
+    /// Every file in the whole tree, for a picker that has no business showing
+    /// folders.
+    public func allFiles() -> [Entry] {
+        index.nodes
+            .filter { !$0.isFolder }
+            .map {
+                Entry(
+                    node: $0, name: try? name(of: $0),
+                    isMissing: $0.storage == .reference && resolve($0) == nil)
+            }
+            .filter { $0.name != nil && !$0.isMissing }
+            .sorted {
+                ($0.name ?? "").localizedCaseInsensitiveCompare($1.name ?? "") == .orderedAscending
+            }
+    }
+
+    public func node(_ id: UUID) -> Node? { index.nodes.first { $0.id == id } }
+    public var count: Int { index.nodes.count }
+}
@@ -0,0 +1,52 @@
+import FilesEngine
+import Foundation
+
+/// The clearance claims, read out of the token the account service minted.
+public struct TokenClaims: Sendable {
+    public let pseudonym: UUID?
+    public let tenant: String
+    public let clearance: Clearance
+    public let expiresAt: Date?
+
+    private struct Payload: Decodable {
+        let sub: String?
+        let exp: Double?
+        let ten: String?
+        let mxc: Int16?
+        let mxk: Int64?
+        let mnc: Int16?
+        let mnk: Int64?
+    }
+
+    public init(token: String) throws {
+        let parts = token.split(separator: ".", omittingEmptySubsequences: false)
+        guard parts.count == 3 else {
+            throw ClientError.badServer("The server issued a token this app cannot read.")
+        }
+        var body = String(parts[1])
+            .replacingOccurrences(of: "-", with: "+")
+            .replacingOccurrences(of: "_", with: "/")
+        body += String(repeating: "=", count: (4 - body.count % 4) % 4)
+        guard let data = Data(base64Encoded: body),
+            let payload = try? JSONDecoder().decode(Payload.self, from: data)
+        else { throw ClientError.badServer("The server issued a token this app cannot read.") }
+
+        self.pseudonym = payload.sub.flatMap(UUID.init(uuidString:))
+        self.tenant = payload.ten ?? "default"
+        self.expiresAt = payload.exp.map { Date(timeIntervalSince1970: $0) }
+        self.clearance = Clearance(
+            maximum: Label(
+                classification: payload.mxc ?? 0,
+                compartments: Self.bits(payload.mxk ?? 0)),
+            minimum: Label(
+                classification: payload.mnc ?? 0,
+                compartments: Self.bits(payload.mnk ?? 0)))
+    }
+
+    /// Postgres has no unsigned 64-bit integer, so the mask travels as a signed
+    /// one and bit 63 arrives negative.
+    static func bits(_ pattern: Int64) -> Set<Int> {
+        let mask = UInt64(bitPattern: pattern)
+        return Set((0..<64).filter { mask & (1 << UInt64($0)) != 0 })
+    }
+}
@@ -0,0 +1,188 @@
+import FilesEngine
+import Foundation
+
+/// The wire types, spelled out rather than decoded loosely.
+public enum Wire {
+    /// What a server says about itself, before anyone has signed in.
+    public struct ServerConfig: Codable, Sendable {
+        public let accountsURL: String
+        public let tenant: String
+        public let siteURL: String
+        public let sourceURL: String
+        /// The largest ciphertext this deployment accepts.
+        public let maxUploadBytes: Int?
+        public let protocolVersion: Int
+    }
+
+    public struct KDFParams: Codable, Sendable {
+        public let kdfSalt: Data
+        public let kdfID: Int16
+        public let kdfIterations: Int
+    }
+
+    public struct Session: Codable, Sendable {
+        public let token: String
+        public let pseudonym: UUID
+        public let expiresAt: Date
+    }
+
+    public struct Identity: Codable, Sendable {
+        public let principalID: UUID
+        public let publicKey: Data
+        public let protectedRecord: String?
+        public let recoveryRecord: String?
+    }
+
+    public struct NewIdentity: Codable, Sendable {
+        public let product: String
+        public let publicKey: Data
+        public let protectedRecord: String
+        public let recoveryRecord: String?
+
+        public init(
+            product: String = "files", publicKey: Data,
+            protectedRecord: String, recoveryRecord: String?
+        ) {
+            self.product = product
+            self.publicKey = publicKey
+            self.protectedRecord = protectedRecord
+            self.recoveryRecord = recoveryRecord
+        }
+    }
+
+    /// A node as the server sees it: a label, two opaque name blobs, and
+    /// nothing it can read.
+    public struct Node: Codable, Sendable, Identifiable, Hashable {
+        public let id: UUID
+        public let parentID: UUID?
+        public let classification: Int16
+        public let compartments: [Int]
+        public let nameDigest: Data
+        public let nameCiphertext: Data
+        public let isFolder: Bool
+        public let blobID: UUID?
+        public let contentKey: Data?
+        public let sizeBytes: Int64?
+
+        public var label: Label {
+            Label(classification: classification, compartments: Set(compartments))
+        }
+    }
+
+    public struct LabelGrant: Codable, Sendable {
+        public let classification: Int16
+        public let compartments: [Int]
+        public let wrappedKey: Data
+
+        public var label: Label {
+            Label(classification: classification, compartments: Set(compartments))
+        }
+    }
+
+    /// A recipient the account service confirmed is cleared for a label.
+    public struct Recipient: Codable, Sendable {
+        public let pseudonym: UUID
+        public let publicKey: Data
+    }
+
+    public struct NodeKey: Codable, Sendable {
+        public let wrappedKey: Data
+    }
+
+    public struct BlobCreated: Codable, Sendable {
+        public let id: UUID
+    }
+
+    /// What this deployment calls its levels and areas.
+    public struct Vocabulary: Codable, Sendable {
+        public struct Level: Codable, Sendable, Hashable {
+            public let ordinal: Int16
+            public let name: String
+            public init(ordinal: Int16, name: String) {
+                self.ordinal = ordinal
+                self.name = name
+            }
+        }
+        public struct Compartment: Codable, Sendable, Hashable {
+            public let bit: Int
+            public let name: String
+            public init(bit: Int, name: String) {
+                self.bit = bit
+                self.name = name
+            }
+        }
+        public let levels: [Level]
+        public let compartments: [Compartment]
+        public let canEdit: Bool?
+
+        public init(levels: [Level] = [], compartments: [Compartment] = [], canEdit: Bool? = nil) {
+            self.levels = levels
+            self.compartments = compartments
+            self.canEdit = canEdit
+        }
+
+        public func name(for label: Label) -> String {
+            let level =
+                levels.first { $0.ordinal == label.classification }?.name
+                ?? "Level \(label.classification)"
+            let areas = label.compartments.sorted().compactMap { bit in
+                compartments.first { $0.bit == bit }?.name ?? "Area \(bit)"
+            }
+            return areas.isEmpty ? level : "\(level) // \(areas.joined(separator: ", "))"
+        }
+    }
+
+    public struct Share: Codable, Sendable {
+        public let id: UUID
+        public let expiresAt: Date?
+        public let classification: Int16?
+        public let compartments: [Int]?
+        public let wrappedContentKey: Data?
+        public let wrappedName: Data?
+        public let passwordSalt: Data?
+        public let passwordIterations: Int?
+        public let needsPassword: Bool?
+        public let blobID: UUID?
+    }
+}
+
+/// What went wrong, in terms the interface can actually say out loud.
+public enum ClientError: LocalizedError, Equatable {
+    case http(status: Int, detail: String)
+    case notCleared
+    /// Not the same thing as being uncleared, and saying so matters: the first
+    /// is a permission the server decides, the second is a key this device has
+    /// simply not minted yet, which happens to every account before it first
+    /// writes anywhere.
+    case noKeyForArea
+    case badServer(String)
+    case wrongPassphrase
+    /// Refused before reading, not after uploading.
+    case tooLarge(limit: Int, actual: Int)
+
+    public var errorDescription: String? {
+        switch self {
+        case .tooLarge(let limit, let actual):
+            let formatter = ByteCountFormatter()
+            formatter.countStyle = .file
+            return "That file is \(formatter.string(fromByteCount: Int64(actual))). "
+                + "This server accepts up to \(formatter.string(fromByteCount: Int64(limit)))."
+        case .wrongPassphrase:
+            return "That handle and passphrase don't match."
+        case .notCleared:
+            return "You aren't cleared for this."
+        case .noKeyForArea:
+            return "You don't have a key for this area yet. Put something in it, "
+                + "or ask somebody who works there to give you theirs."
+        case .badServer(let why):
+            return why
+        case .http(let status, let detail):
+            // 404 is deliberate on this server: a row you are not cleared to
+            // see is missing, not forbidden.
+            if status == 404 { return "Not found." }
+            if status == 401 { return "Your session has expired. Sign in again." }
+            if status == 403 { return "That's outside your clearance." }
+            return detail.isEmpty ? "The server returned \(status)." : detail
+        }
+    }
+}
@@ -0,0 +1,125 @@
+import CryptoKit
+import Foundation
+
+/// BIP-39 mnemonics, for the wallet only.
+public enum BIP39 {
+
+    public enum Failure: Error, LocalizedError, Equatable {
+        case badEntropySize(Int)
+        case badPhraseLength(Int)
+        case unknownWord(String)
+        case checksumFailed
+        case wordlistDigestMismatch(String)
+        case wordlistWrongLength(Int)
+
+        public var errorDescription: String? {
+            switch self {
+            case .badEntropySize(let n):
+                return "Entropy must be 16, 20, 24, 28 or 32 bytes, not \(n)."
+            case .badPhraseLength(let n):
+                return "A recovery phrase is 12, 15, 18, 21 or 24 words, not \(n)."
+            case .unknownWord(let w):
+                return "“\(w)” is not a recovery phrase word."
+            case .checksumFailed:
+                return "That phrase does not check out, look for a mistyped word."
+            case .wordlistDigestMismatch:
+                return "The word list does not match its published fingerprint."
+            case .wordlistWrongLength(let n):
+                return "A word list has exactly 2048 words, not \(n)."
+            }
+        }
+    }
+
+    /// The published SHA-256 of the BIP-39 English word list.
+    public static let englishDigest =
+        "2f5eed53a4727b4bf8880d8f3f199efc90e58503646d9ff8eff3a2ed3b24dbda"
+
+    /// The whole mitigation.
+    public static func verify(_ words: [String], digest: String = englishDigest) throws {
+        guard words.count == 2048 else { throw Failure.wordlistWrongLength(words.count) }
+        let canonical = words.joined(separator: "\n") + "\n"
+        let hex = SHA256.hash(data: Data(canonical.utf8))
+            .map { String(format: "%02x", $0) }.joined()
+        guard hex == digest else { throw Failure.wordlistDigestMismatch(hex) }
+    }
+
+    private static let permitted: [Int: Int] = [16: 12, 20: 15, 24: 18, 28: 21, 32: 24]
+
+    /// Entropy to phrase.
+    public static func phrase(from entropy: Data, words: [String]) throws -> String {
+        guard permitted[entropy.count] != nil else {
+            throw Failure.badEntropySize(entropy.count)
+        }
+        var bits = entropy.map { String($0, radix: 2).leftPadded(to: 8) }.joined()
+        bits += SHA256.hash(data: entropy)
+            .map { String($0, radix: 2).leftPadded(to: 8) }.joined()
+        bits = String(bits.prefix(entropy.count * 8 + entropy.count / 4))
+
+        var out: [String] = []
+        var index = bits.startIndex
+        while index < bits.endIndex {
+            let end = bits.index(index, offsetBy: 11)
+            out.append(words[Int(bits[index..<end], radix: 2)!])
+            index = end
+        }
+        return out.joined(separator: " ")
+    }
+
+    /// Phrase back to entropy, refusing anything that does not check out.
+    public static func entropy(from phrase: String, words: [String]) throws -> Data {
+        let given = phrase.precomposedStringWithCompatibilityMapping
+            .trimmingCharacters(in: .whitespacesAndNewlines)
+            .split(whereSeparator: \.isWhitespace).map(String.init)
+        guard [12, 15, 18, 21, 24].contains(given.count) else {
+            throw Failure.badPhraseLength(given.count)
+        }
+        var lookup: [String: Int] = [:]
+        for (i, w) in words.enumerated() { lookup[w] = i }
+
+        var bits = ""
+        for word in given {
+            guard let at = lookup[word] else { throw Failure.unknownWord(word) }
+            bits += String(at, radix: 2).leftPadded(to: 11)
+        }
+
+        let entropyBits = given.count * 11 * 32 / 33
+        var entropy = Data()
+        var index = bits.startIndex
+        for _ in 0..<(entropyBits / 8) {
+            let end = bits.index(index, offsetBy: 8)
+            entropy.append(UInt8(bits[index..<end], radix: 2)!)
+            index = end
+        }
+        let expected = SHA256.hash(data: entropy)
+            .map { String($0, radix: 2).leftPadded(to: 8) }.joined()
+        guard String(bits.suffix(from: index)) == String(expected.prefix(entropyBits / 32)) else {
+            throw Failure.checksumFailed
+        }
+        return entropy
+    }
+
+    /// Phrase to the 64-byte seed everything derives from.
+    public static func seed(from phrase: String, passphrase: String = "") throws -> Data {
+        try KDF.pbkdf2SHA512(
+            password: Data(phrase.precomposedStringWithCompatibilityMapping.utf8),
+            salt: Data(("mnemonic" + passphrase).precomposedStringWithCompatibilityMapping.utf8),
+            iterations: 2048, length: 64)
+    }
+
+    /// The vendored list, read from the bundled resource.
+    public static func englishWordlist() throws -> [String] {
+        guard let url = Bundle.module.url(forResource: "english", withExtension: "txt"),
+            let text = try? String(contentsOf: url, encoding: .utf8)
+        else { throw Failure.wordlistWrongLength(0) }
+        let words = text.trimmingCharacters(in: .whitespacesAndNewlines)
+            .split(separator: "\n").map(String.init)
+        try verify(words)
+        return words
+    }
+}
+
+extension String {
+    fileprivate func leftPadded(to width: Int) -> String {
+        count >= width ? self : String(repeating: "0", count: width - count) + self
+    }
+}
@@ -0,0 +1,59 @@
+import Foundation
+
+/// Base58, the alphabet every ed25519 chain prints addresses in.
+public enum Base58 {
+    static let alphabet = Array("123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz")
+
+    /// Not the Bitcoin alphabet's cousins: `0`, `O`, `I` and `l` are absent
+    /// deliberately, so an address read aloud or copied by hand cannot become a
+    /// different valid one.
+    static let values: [Character: UInt8] = {
+        var map: [Character: UInt8] = [:]
+        for (index, character) in alphabet.enumerated() { map[character] = UInt8(index) }
+        return map
+    }()
+
+    public static func encode(_ data: Data) -> String {
+        guard !data.isEmpty else { return "" }
+        // Starts EMPTY, not [0].
+        var digits: [UInt8] = []
+        for byte in data {
+            var carry = Int(byte)
+            for position in digits.indices {
+                carry += Int(digits[position]) << 8
+                digits[position] = UInt8(carry % 58)
+                carry /= 58
+            }
+            while carry > 0 {
+                digits.append(UInt8(carry % 58))
+                carry /= 58
+            }
+        }
+        // One '1' per leading zero byte, see the note above.
+        let leadingZeros = data.prefix { $0 == 0 }.count
+        return String(repeating: "1", count: leadingZeros)
+            + String(digits.reversed().map { alphabet[Int($0)] })
+    }
+
+    /// Nil for any character outside the alphabet, rather than a best guess: a
+    /// mistyped address must fail here, not resolve to somebody else's.
+    public static func decode(_ string: String) -> Data? {
+        guard !string.isEmpty else { return Data() }
+        var bytes: [UInt8] = []
+        for character in string {
+            guard let value = values[character] else { return nil }
+            var carry = Int(value)
+            for position in bytes.indices {
+                carry += Int(bytes[position]) * 58
+                bytes[position] = UInt8(carry & 0xff)
+                carry >>= 8
+            }
+            while carry > 0 {
+                bytes.append(UInt8(carry & 0xff))
+                carry >>= 8
+            }
+        }
+        let leadingOnes = string.prefix { $0 == "1" }.count
+        return Data(repeating: 0, count: leadingOnes) + Data(bytes.reversed())
+    }
+}
@@ -0,0 +1,48 @@
+import Foundation
+
+enum Bytes {
+    static func u32be(_ value: UInt32) -> Data {
+        Data([
+            UInt8(truncatingIfNeeded: value >> 24), UInt8(truncatingIfNeeded: value >> 16),
+            UInt8(truncatingIfNeeded: value >> 8), UInt8(truncatingIfNeeded: value),
+        ])
+    }
+
+    static func readU32be(_ data: Data, at offset: Int) -> UInt32 {
+        let b = [UInt8](data[data.startIndex + offset..<data.startIndex + offset + 4])
+        return (UInt32(b[0]) << 24) | (UInt32(b[1]) << 16) | (UInt32(b[2]) << 8) | UInt32(b[3])
+    }
+
+    static func random(_ count: Int) -> Data {
+        var data = Data(count: count)
+        _ = data.withUnsafeMutableBytes {
+            SecRandomCopyBytes(kSecRandomDefault, count, $0.baseAddress!)
+        }
+        return data
+    }
+}
+
+/// Random bytes, from the system CSPRNG.
+public enum Random {
+    public static func bytes(_ count: Int) -> Data { Bytes.random(count) }
+}
+
+public enum EngineError: Error, Equatable, LocalizedError {
+    case unsupportedVersion(UInt8)
+    case malformed(String)
+    case notCleared
+
+    /// Without this every one of these reaches a person as "The operation
+    /// couldn't be completed.
+    public var errorDescription: String? {
+        switch self {
+        case .unsupportedVersion(let version):
+            return
+                "This was written in a newer format (version \(version)) than this app understands."
+        case .malformed(let why):
+            return why
+        case .notCleared:
+            return "You aren't cleared for this."
+        }
+    }
+}
@@ -0,0 +1,205 @@
+import Foundation
+
+/// Reading a public chain, without handing it your whole wallet.
+public struct ChainRPC: Sendable {
+    public let endpoint: URL
+    /// Injected so tests drive it without a network, and so the app can hand it
+    /// a session with its own configuration.
+    private let perform: @Sendable (URLRequest) async throws -> (Data, URLResponse)
+
+    public init(
+        endpoint: URL,
+        perform: @escaping @Sendable (URLRequest) async throws -> (Data, URLResponse) = {
+            try await URLSession.shared.data(for: $0)
+        }
+    ) {
+        self.endpoint = endpoint
+        self.perform = perform
+    }
+
+    public enum Failure: LocalizedError, Equatable {
+        case http(Int)
+        case node(String)
+        case malformed(String)
+
+        public var errorDescription: String? {
+            switch self {
+            case .http(let code):
+                return "The node answered with \(code)."
+            case .node(let message):
+                // The node's own words.
+                return message
+            case .malformed:
+                return "That node's answer wasn't something this app understands."
+            }
+        }
+    }
+
+    // MARK: - Wire
+
+    struct Request: Encodable {
+        let jsonrpc = "2.0"
+        let id = 1
+        let method: String
+        let params: [AnyEncodable]
+    }
+
+    /// Minimal type erasure.
+    struct AnyEncodable: Encodable {
+        private let encode: (Encoder) throws -> Void
+        init<T: Encodable>(_ value: T) { encode = { try value.encode(to: $0) } }
+        func encode(to encoder: Encoder) throws { try encode(encoder) }
+    }
+
+    func call(_ method: String, _ params: [AnyEncodable]) async throws -> Any {
+        var request = URLRequest(url: endpoint)
+        request.httpMethod = "POST"
+        request.setValue("application/json", forHTTPHeaderField: "Content-Type")
+        request.httpBody = try JSONEncoder().encode(Request(method: method, params: params))
+
+        let (data, response) = try await perform(request)
+        if let http = response as? HTTPURLResponse, !(200...299).contains(http.statusCode) {
+            throw Failure.http(http.statusCode)
+        }
+        guard let object = try? JSONSerialization.jsonObject(with: data) as? [String: Any] else {
+            throw Failure.malformed("not an object")
+        }
+        // A JSON-RPC error arrives with HTTP 200.
+        if let error = object["error"] as? [String: Any] {
+            throw Failure.node((error["message"] as? String) ?? "The node refused.")
+        }
+        guard let result = object["result"] else { throw Failure.malformed("no result") }
+        return result
+    }
+
+    // MARK: - Reading
+
+    /// The balance in the chain's smallest unit.
+    public func balance(of address: String) async throws -> UInt64 {
+        let result = try await call("getBalance", [AnyEncodable(address)])
+        guard let wrapper = result as? [String: Any],
+            let value = wrapper["value"] as? NSNumber
+        else {
+            throw Failure.malformed("balance")
+        }
+        return value.uint64Value
+    }
+
+    /// What has happened to an address, newest first.
+    public func history(for address: String, limit: Int = 25) async throws -> [Signature] {
+        let result = try await call(
+            "getSignaturesForAddress",
+            [
+                AnyEncodable(address),
+                AnyEncodable(["limit": limit]),
+            ])
+        guard let rows = result as? [[String: Any]] else { throw Failure.malformed("history") }
+        return rows.compactMap(Signature.init(json:))
+    }
+
+    // MARK: - Sending
+
+    /// A blockhash to build a transaction against, and the height past which it
+    /// can no longer be accepted.
+    public struct Blockhash: Sendable, Hashable {
+        public let value: Data
+        public let lastValidBlockHeight: UInt64
+    }
+
+    public func latestBlockhash() async throws -> Blockhash {
+        let result = try await call("getLatestBlockhash", [])
+        guard let wrapper = result as? [String: Any],
+            let value = wrapper["value"] as? [String: Any],
+            let text = value["blockhash"] as? String,
+            let raw = Base58.decode(text), raw.count == 32
+        else {
+            throw Failure.malformed("blockhash")
+        }
+        let height = (value["lastValidBlockHeight"] as? NSNumber)?.uint64Value ?? 0
+        return Blockhash(value: raw, lastValidBlockHeight: height)
+    }
+
+    /// Submit a signed transaction.
+    public func send(transaction: Data) async throws -> String {
+        // A declared struct rather than a dictionary: the options are
+        // heterogeneous, and a `[String: Any]` is not `Encodable`, reaching for
+        // one anyway is how the encoding silently reverts to the node's base58
+        // default and every send comes back reported as malformed.
+        struct SendOptions: Encodable {
+            let encoding = "base64"
+            let skipPreflight = false
+            let preflightCommitment = "confirmed"
+        }
+        let result = try await call(
+            "sendTransaction",
+            [
+                AnyEncodable(transaction.base64EncodedString()),
+                AnyEncodable(SendOptions()),
+            ])
+        guard let signature = result as? String else { throw Failure.malformed("signature") }
+        return signature
+    }
+
+    /// What became of a transaction, by signature.
+    public func status(of signature: String) async throws -> Status? {
+        struct StatusOptions: Encodable { let searchTransactionHistory = true }
+        let result = try await call(
+            "getSignatureStatuses",
+            [
+                AnyEncodable([signature]),
+                AnyEncodable(StatusOptions()),
+            ])
+        guard let wrapper = result as? [String: Any],
+            let values = wrapper["value"] as? [Any]
+        else {
+            throw Failure.malformed("status")
+        }
+        guard let first = values.first, !(first is NSNull),
+            let row = first as? [String: Any]
+        else { return nil }
+        let failed = !(row["err"] is NSNull) && row["err"] != nil
+        let confirmations = (row["confirmations"] as? NSNumber)?.intValue
+        let level = row["confirmationStatus"] as? String
+        return Status(failed: failed, confirmations: confirmations, level: level)
+    }
+
+    public struct Status: Sendable, Hashable {
+        /// A transaction can be ON the chain and have failed.
+        public let failed: Bool
+        /// Nil once it is rooted, which means finalised, not unknown.
+        public let confirmations: Int?
+        public let level: String?
+        public var isFinal: Bool { level == "finalized" || confirmations == nil }
+    }
+
+    /// One entry in an address's history.
+    public struct Signature: Sendable, Hashable, Identifiable {
+        public let signature: String
+        public let slot: UInt64
+        /// Absent while a transaction is very new, the node has it but has not
+        /// dated it yet.
+        public let blockTime: Date?
+        /// A FAILED transaction still appears in an address's history.
+        public let failed: Bool
+        public var id: String { signature }
+
+        init?(json: [String: Any]) {
+            guard let signature = json["signature"] as? String else { return nil }
+            self.signature = signature
+            self.slot = (json["slot"] as? NSNumber)?.uint64Value ?? 0
+            if let seconds = json["blockTime"] as? NSNumber {
+                self.blockTime = Date(timeIntervalSince1970: seconds.doubleValue)
+            } else {
+                self.blockTime = nil
+            }
+            self.failed = json["err"] is [String: Any] || json["err"] is [Any]
+        }
+
+        public init(signature: String, slot: UInt64, blockTime: Date?, failed: Bool) {
+            self.signature = signature
+            self.slot = slot
+            self.blockTime = blockTime
+            self.failed = failed
+        }
+    }
+}
@@ -0,0 +1,91 @@
+import CryptoKit
+import Foundation
+
+/// File contents.
+public enum Content {
+    static let magic = Data("ENCL".utf8)
+    static let version: UInt8 = 1
+    static let tagBytes = 16
+    static let headerBytes = 17
+    public static let defaultChunkSize = 64 * 1024
+
+    static func nonce(base: Data, index: UInt32) throws -> AES.GCM.Nonce {
+        try AES.GCM.Nonce(data: base + Bytes.u32be(index))
+    }
+
+    static func aad(label: Label, index: UInt32, isLast: Bool) -> Data {
+        label.bytes + Bytes.u32be(index) + Data([isLast ? 1 : 0])
+    }
+
+    public static func encrypt(
+        _ plaintext: Data, contentKey: Data, label: Label,
+        chunkSize: Int = defaultChunkSize
+    ) throws -> Data {
+        guard chunkSize > 0, chunkSize <= Int(UInt32.max) else {
+            throw EngineError.malformed("chunk size out of range")
+        }
+        let key = SymmetricKey(data: contentKey)
+        let baseNonce = Bytes.random(8)
+        // An empty file is still one chunk, so it too carries an authenticated
+        // end marker and cannot be confused with one truncated to nothing.
+        let count = max(1, (plaintext.count + chunkSize - 1) / chunkSize)
+
+        var out = magic + Data([version]) + Bytes.u32be(UInt32(chunkSize)) + baseNonce
+        for index in 0..<count {
+            let start = plaintext.startIndex + index * chunkSize
+            let end = min(start + chunkSize, plaintext.endIndex)
+            let sealed = try AES.GCM.seal(
+                plaintext[start..<end], using: key,
+                nonce: try nonce(base: baseNonce, index: UInt32(index)),
+                authenticating: aad(label: label, index: UInt32(index), isLast: index == count - 1)
+            )
+            out += sealed.ciphertext + sealed.tag
+        }
+        return out
+    }
+
+    public static func decrypt(_ blob: Data, contentKey: Data, label: Label) throws -> Data {
+        guard blob.count >= headerBytes else { throw EngineError.malformed("truncated header") }
+        let bytes = [UInt8](blob)
+        guard Data(bytes[0..<4]) == magic else {
+            throw EngineError.malformed("not an Enclave content blob")
+        }
+        guard bytes[4] == version else { throw EngineError.unsupportedVersion(bytes[4]) }
+
+        let chunkSize = Int(Bytes.readU32be(blob, at: 5))
+        guard chunkSize > 0 else { throw EngineError.malformed("invalid chunk size") }
+        let baseNonce = Data(bytes[9..<17])
+        let body = Data(bytes[headerBytes...])
+
+        let stored = chunkSize + tagBytes
+        let remainder = body.count % stored
+        // A remainder of exactly the tag length is a legitimate empty final
+        // chunk.
+        guard remainder == 0 || remainder >= tagBytes else {
+            throw EngineError.malformed("malformed final chunk")
+        }
+        let count = body.count / stored + (remainder == 0 ? 0 : 1)
+        guard count > 0 else { throw EngineError.malformed("no chunks") }
+
+        let key = SymmetricKey(data: contentKey)
+        var out = Data()
+        for index in 0..<count {
+            let start = body.startIndex + index * stored
+            let end = min(start + stored, body.endIndex)
+            let slice = body[start..<end]
+            // Authentication fails here on truncation, reordering or
+            // relabelling.
+            let box = try AES.GCM.SealedBox(
+                nonce: try nonce(base: baseNonce, index: UInt32(index)),
+                ciphertext: slice.dropLast(tagBytes),
+                tag: slice.suffix(tagBytes)
+            )
+            out += try AES.GCM.open(
+                box, using: key,
+                authenticating: aad(
+                    label: label, index: UInt32(index),
+                    isLast: index == count - 1))
+        }
+        return out
+    }
+}
@@ -0,0 +1,135 @@
+import CryptoKit
+import Foundation
+
+/// Hierarchical key derivation from a wallet seed.
+public struct HDKey: Sendable, Equatable {
+    /// 32 bytes.
+    public let privateKey: Data
+    /// 32 bytes.
+    public let chainCode: Data
+
+    /// SLIP-0010 fixes this string; changing it changes every key.
+    static let curve = Data("ed25519 seed".utf8)
+
+    /// Anything at or above this is hardened.
+    public static let hardened: UInt32 = 0x8000_0000
+
+    public enum Failure: LocalizedError, Equatable {
+        case seedOutOfRange(Int)
+        case unhardened(UInt32)
+        case malformedPath(String)
+
+        public var errorDescription: String? {
+            switch self {
+            case .seedOutOfRange:
+                // Not a user-facing situation: a seed always comes from BIP-39
+                // here, which cannot produce a wrong length.
+                return "That wallet seed is the wrong size."
+            case .unhardened:
+                return "This wallet only derives hardened keys."
+            case .malformedPath(let path):
+                return "\(path) isn't a derivation path."
+            }
+        }
+    }
+
+    /// The master key.
+    public static func master(seed: Data) throws -> HDKey {
+        // The standard's own bound.
+        guard (16...64).contains(seed.count) else { throw Failure.seedOutOfRange(seed.count) }
+        let digest = HMAC<SHA512>.authenticationCode(
+            for: seed, using: SymmetricKey(data: curve))
+        let bytes = Data(digest)
+        // ed25519 needs no retry loop.
+        return HDKey(privateKey: bytes.prefix(32), chainCode: bytes.suffix(32))
+    }
+
+    /// One hardened step.
+    public func derive(_ index: UInt32) throws -> HDKey {
+        let hardenedIndex = index >= Self.hardened ? index : index | Self.hardened
+        guard hardenedIndex >= Self.hardened else { throw Failure.unhardened(index) }
+
+        // 0x00 || private key || index, big-endian.
+        var data = Data([0x00])
+        data.append(privateKey)
+        data.append(contentsOf: [
+            UInt8(truncatingIfNeeded: hardenedIndex >> 24),
+            UInt8(truncatingIfNeeded: hardenedIndex >> 16),
+            UInt8(truncatingIfNeeded: hardenedIndex >> 8),
+            UInt8(truncatingIfNeeded: hardenedIndex),
+        ])
+        let digest = HMAC<SHA512>.authenticationCode(
+            for: data, using: SymmetricKey(data: chainCode))
+        let bytes = Data(digest)
+        return HDKey(privateKey: bytes.prefix(32), chainCode: bytes.suffix(32))
+    }
+
+    /// Walk a path such as `m/44H/501H/0H/0H`.
+    public func derive(path: String) throws -> HDKey {
+        var components = path.split(separator: "/").map(String.init)
+        if let first = components.first, first == "m" || first == "M" {
+            components.removeFirst()
+        }
+        var key = self
+        for component in components {
+            guard
+                component.hasSuffix("H") || component.hasSuffix("h")
+                    || component.hasSuffix("'")
+            else {
+                throw Failure.unhardened(0)
+            }
+            let digits = String(component.dropLast())
+            guard let index = UInt32(digits), index < Self.hardened else {
+                throw Failure.malformedPath(path)
+            }
+            key = try key.derive(index)
+        }
+        return key
+    }
+
+    public static func master(seed: Data, path: String) throws -> HDKey {
+        try master(seed: seed).derive(path: path)
+    }
+
+    /// The 32-byte ed25519 public key.
+    public func publicKey() throws -> Data {
+        try Curve25519.Signing.PrivateKey(rawRepresentation: privateKey)
+            .publicKey.rawRepresentation
+    }
+
+    /// The public key as SLIP-0010 prints it: `0x00 || key`.
+    public func slip10PublicKey() throws -> Data { Data([0x00]) + (try publicKey()) }
+}
+
+/// An account's receive keys.
+public struct HDAccount: Sendable {
+    public let seed: Data
+    /// SLIP-44 coin type. 501 is Solana's; ed25519 chains each have their own.
+    public let coinType: UInt32
+    public let account: UInt32
+    public private(set) var nextIndex: UInt32
+
+    public init(seed: Data, coinType: UInt32, account: UInt32 = 0, nextIndex: UInt32 = 0) {
+        self.seed = seed
+        self.coinType = coinType
+        self.account = account
+        self.nextIndex = nextIndex
+    }
+
+    /// BIP-44 shape, every level hardened as this curve requires.
+    public func path(index: UInt32) -> String {
+        "m/44H/\(coinType)H/\(account)H/0H/\(index)H"
+    }
+
+    public func key(index: UInt32) throws -> HDKey {
+        try HDKey.master(seed: seed, path: path(index: index))
+    }
+
+    /// The next unused receive key, advancing the counter.
+    public mutating func next() throws -> (index: UInt32, key: HDKey) {
+        let index = nextIndex
+        let key = try self.key(index: index)
+        nextIndex = index + 1
+        return (index, key)
+    }
+}
@@ -0,0 +1,146 @@
+import CryptoKit
+import Foundation
+
+/// The identity keypair.
+public enum Identity {
+    /// RFC 8410 PrivateKeyInfo for X25519: version, algorithm id, and an OCTET
+    /// STRING wrapping a 32-byte OCTET STRING.
+    static let pkcs8Prefix = Data([
+        0x30, 0x2E, 0x02, 0x01, 0x00, 0x30, 0x05, 0x06,
+        0x03, 0x2B, 0x65, 0x6E, 0x04, 0x22, 0x04, 0x20,
+    ])
+
+    public static func rawFromPKCS8(_ pkcs8: Data) throws -> Data {
+        guard pkcs8.count == 48, pkcs8.prefix(16) == pkcs8Prefix else {
+            throw EngineError.malformed("not an X25519 PKCS#8 private key")
+        }
+        return Data(pkcs8.suffix(32))
+    }
+
+    public static func pkcs8FromRaw(_ raw: Data) throws -> Data {
+        guard raw.count == 32 else {
+            throw EngineError.malformed("X25519 private key must be 32 bytes")
+        }
+        return pkcs8Prefix + raw
+    }
+
+    /// The stored record, as written by any FlameNet client.
+    public struct Record: Codable, Sendable {
+        public let v: Int
+        public let kdf: Int
+        public let iterations: Int
+        public let context: String
+        public let salt: String
+        public let nonce: String
+        public let privateKey: String
+
+        /// The stored form.
+        public var json: String {
+            String(decoding: (try? JSONEncoder().encode(self)) ?? Data(), as: UTF8.self)
+        }
+
+        public static func parse(_ text: String) throws -> Record {
+            guard let data = text.data(using: .utf8),
+                let record = try? JSONDecoder().decode(Record.self, from: data)
+            else { throw EngineError.malformed("identity record is not valid JSON") }
+            return record
+        }
+
+        public init(
+            v: Int, kdf: Int, iterations: Int, context: String,
+            salt: String, nonce: String, privateKey: String
+        ) {
+            self.v = v
+            self.kdf = kdf
+            self.iterations = iterations
+            self.context = context
+            self.salt = salt
+            self.nonce = nonce
+            self.privateKey = privateKey
+        }
+    }
+
+    public static func generate() -> Curve25519.KeyAgreement.PrivateKey {
+        Curve25519.KeyAgreement.PrivateKey()
+    }
+
+    /// Raw 32 bytes, which is what every FlameNet server stores and what a
+    /// label key is wrapped to.
+    public static func exportPublicKey(_ key: Curve25519.KeyAgreement.PublicKey) -> Data {
+        key.rawRepresentation
+    }
+
+    /// Encrypt a private key for storage.
+    public static func protect(
+        _ privateKey: Curve25519.KeyAgreement.PrivateKey,
+        passphrase: String,
+        parameters: KDF.Parameters = .v1,
+        context: String = KDF.Context.filesIdentity
+    ) throws -> Record {
+        let salt = Bytes.random(16)
+        let kek = try KDF.derive(
+            passphrase: passphrase, salt: salt, context: context, parameters: parameters)
+        let nonce = Bytes.random(12)
+        // PKCS#8, not raw: the browser writes this format and both must read
+        // each other's records.
+        let sealed = try AES.GCM.seal(
+            try pkcs8FromRaw(privateKey.rawRepresentation),
+            using: SymmetricKey(data: kek),
+            nonce: try AES.GCM.Nonce(data: nonce),
+            authenticating: Data(context.utf8)
+        )
+        return Record(
+            v: 1, kdf: parameters.id, iterations: parameters.iterations, context: context,
+            salt: salt.base64EncodedString(),
+            nonce: nonce.base64EncodedString(),
+            // Ciphertext and tag concatenated: WebCrypto's AES-GCM output is
+            // the two joined, while CryptoKit keeps them apart.
+            privateKey: (sealed.ciphertext + sealed.tag).base64EncodedString()
+        )
+    }
+
+    /// Wrap the same private key under a recovery code.
+    public static func protectWithRecovery(
+        _ privateKey: Curve25519.KeyAgreement.PrivateKey,
+        entropy: Data,
+        parameters: KDF.Parameters = .v1
+    ) throws -> Record {
+        try protect(
+            privateKey, passphrase: Recovery.kdfSecret(entropy),
+            parameters: parameters, context: KDF.Context.filesRecovery)
+    }
+
+    public static func unlockWithRecovery(_ record: Record, entropy: Data) throws
+        -> Curve25519.KeyAgreement.PrivateKey
+    {
+        try unlock(record, passphrase: Recovery.kdfSecret(entropy))
+    }
+
+    /// Unlock a record produced by this engine or by the browser.
+    public static func unlock(_ record: Record, passphrase: String) throws
+        -> Curve25519.KeyAgreement.PrivateKey
+    {
+        guard record.v == 1 else { throw EngineError.unsupportedVersion(UInt8(record.v)) }
+        guard let salt = Data(base64Encoded: record.salt),
+            let sealedKey = Data(base64Encoded: record.privateKey)
+        else { throw EngineError.malformed("identity record is not valid base64") }
+
+        let kek = try KDF.derive(
+            passphrase: passphrase, salt: salt, context: record.context,
+            parameters: .init(id: record.kdf, iterations: record.iterations)
+        )
+        // The record stores the nonce separately; CryptoKit's `combined` form
+        // expects it prepended to the ciphertext.
+        guard let nonce = Data(base64Encoded: record.nonce) else {
+            throw EngineError.malformed("identity nonce is not valid base64")
+        }
+        // The context is the authenticated data as well as the KDF separator,
+        // so a record made for one product will not open as another's.
+        let pkcs8 = try AES.GCM.open(
+            try AES.GCM.SealedBox(combined: nonce + sealedKey),
+            using: SymmetricKey(data: kek),
+            authenticating: Data(record.context.utf8)
+        )
+        return try Curve25519.KeyAgreement.PrivateKey(rawRepresentation: try rawFromPKCS8(pkcs8))
+    }
+}
@@ -0,0 +1,105 @@
+import CommonCrypto
+import CryptoKit
+import Foundation
+
+/// Key derivation.
+public enum KDF {
+    public struct Parameters: Sendable, Equatable {
+        public let id: Int
+        public let iterations: Int
+        public static let v1 = Parameters(id: 1, iterations: 650_000)
+
+        public init(id: Int = 1, iterations: Int) {
+            self.id = id
+            self.iterations = iterations
+        }
+    }
+
+    /// Per-product context strings.
+    public enum Context {
+        public static let filesIdentity = "flamenet/files/identity/v1"
+        public static let filesAuth = "flamenet/files/auth/v1"
+        public static let filesRecovery = "flamenet/files/recovery/v1"
+        /// The account-side half of a recovery code.
+        public static let filesAuthRecovery = "flamenet/files/auth-recovery/v1"
+        public static let messengerIdentity = "flamenet/messenger/identity/v1"
+        /// The wallet seed is NOT derived from the passphrase, see SPEC §8.1.
+        public static let walletSeed = "flamenet/wallet/seed/v1"
+
+        /// The key the wallet record is wrapped under.
+        public static let walletKEK = "flamenet/wallet/kek/v1"
+    }
+
+    /// Stage one.
+    static func master(passphrase: String, salt: Data, parameters: Parameters) throws -> Data {
+        let passwordBytes = Array(passphrase.utf8)
+        var derived = [UInt8](repeating: 0, count: 32)
+        let status = salt.withUnsafeBytes { saltBuffer -> Int32 in
+            CCKeyDerivationPBKDF(
+                CCPBKDFAlgorithm(kCCPBKDF2),
+                passwordBytes.map { Int8(bitPattern: $0) }, passwordBytes.count,
+                saltBuffer.bindMemory(to: UInt8.self).baseAddress, salt.count,
+                CCPseudoRandomAlgorithm(kCCPRFHmacAlgSHA256),
+                UInt32(parameters.iterations),
+                &derived, derived.count
+            )
+        }
+        guard status == kCCSuccess else { throw EngineError.malformed("PBKDF2 failed") }
+        return Data(derived)
+    }
+
+    /// PBKDF2-HMAC-SHA512, for BIP-39 seeds only.
+    public static func pbkdf2SHA512(
+        password: Data, salt: Data, iterations: Int, length: Int
+    ) throws -> Data {
+        let passwordBytes = Array(password)
+        var derived = [UInt8](repeating: 0, count: length)
+        let status = salt.withUnsafeBytes { saltBuffer -> Int32 in
+            CCKeyDerivationPBKDF(
+                CCPBKDFAlgorithm(kCCPBKDF2),
+                passwordBytes.map { Int8(bitPattern: $0) }, passwordBytes.count,
+                saltBuffer.bindMemory(to: UInt8.self).baseAddress, salt.count,
+                CCPseudoRandomAlgorithm(kCCPRFHmacAlgSHA512),
+                UInt32(iterations),
+                &derived, derived.count
+            )
+        }
+        guard status == kCCSuccess else { throw EngineError.malformed("PBKDF2-SHA512 failed") }
+        return Data(derived)
+    }
+
+    /// Stage two: raw bytes for a context.
+    public static func derive(
+        passphrase: String, salt: Data, context: String,
+        parameters: Parameters = .v1, length: Int = 32
+    ) throws -> Data {
+        let secret = SymmetricKey(
+            data: try master(passphrase: passphrase, salt: salt, parameters: parameters))
+        let key = HKDF<SHA256>.deriveKey(
+            inputKeyMaterial: secret,
+            salt: Data(),
+            info: Data(context.utf8),
+            outputByteCount: length
+        )
+        return key.withUnsafeBytes { Data($0) }
+    }
+
+    /// The secret sent to the account service.
+    public static func authSecret(passphrase: String, salt: Data, parameters: Parameters = .v1)
+        throws -> Data
+    {
+        try derive(
+            passphrase: passphrase, salt: salt, context: Context.filesAuth, parameters: parameters)
+    }
+
+    /// The account-side proof of a recovery code.
+    public static func recoveryAuthSecret(entropy: Data) -> Data {
+        let key = HKDF<SHA256>.deriveKey(
+            inputKeyMaterial: SymmetricKey(data: Data(Recovery.kdfSecret(entropy).utf8)),
+            salt: Data(),
+            info: Data(Context.filesAuthRecovery.utf8),
+            outputByteCount: 32
+        )
+        return key.withUnsafeBytes { Data($0) }
+    }
+}
@@ -0,0 +1,38 @@
+import Foundation
+
+/// The security lattice.
+public struct Label: Hashable, Sendable {
+    public var classification: Int16
+    /// Bit positions 0...63.
+    public var compartments: Set<Int>
+
+    public init(classification: Int16, compartments: Set<Int> = []) {
+        precondition(
+            compartments.allSatisfy { (0...63).contains($0) },
+            "compartment bits must be 0...63")
+        self.classification = classification
+        self.compartments = compartments
+    }
+
+    public var mask: UInt64 {
+        compartments.reduce(into: UInt64(0)) { $0 |= (1 << UInt64($1)) }
+    }
+
+    /// `self ⊒ other`: at least as high, and a superset of areas.
+    public func dominates(_ other: Label) -> Bool {
+        classification >= other.classification && compartments.isSuperset(of: other.compartments)
+    }
+
+    /// int16be classification || uint64be compartment mask.
+    public var bytes: Data {
+        var out = Data(capacity: 10)
+        out.append(UInt8(truncatingIfNeeded: classification >> 8))
+        out.append(UInt8(truncatingIfNeeded: classification))
+        let mask = self.mask
+        for shift in stride(from: 56, through: 0, by: -8) {
+            out.append(UInt8(truncatingIfNeeded: mask >> UInt64(shift)))
+        }
+        _ = mask
+        return out
+    }
+}
@@ -0,0 +1,49 @@
+import CryptoKit
+import Foundation
+
+/// Filenames.
+public enum Names {
+    static let version: UInt8 = 1
+
+    /// Unicode normalisation only.
+    static func normalize(_ name: String) -> Data {
+        Data(name.precomposedStringWithCanonicalMapping.utf8)
+    }
+
+    public static func digest(folderKey: Data, name: String) -> Data {
+        var mac = HMAC<SHA256>(key: SymmetricKey(data: folderKey))
+        mac.update(data: normalize(name))
+        return Data(mac.finalize())
+    }
+
+    /// The label *and* the digest are authenticated, so a name ciphertext
+    /// cannot be moved onto another row to learn which plaintext belongs to it.
+    public static func encrypt(folderKey: Data, name: String, label: Label) throws -> (
+        digest: Data, ciphertext: Data
+    ) {
+        let nameDigest = digest(folderKey: folderKey, name: name)
+        let sealed = try AES.GCM.seal(
+            normalize(name), using: SymmetricKey(data: folderKey),
+            authenticating: label.bytes + nameDigest)
+        guard let combined = sealed.combined else {
+            throw EngineError.malformed("seal produced no output")
+        }
+        return (nameDigest, Data([version]) + combined)
+    }
+
+    public static func decrypt(folderKey: Data, blob: Data, digest: Data, label: Label) throws
+        -> String
+    {
+        guard blob.count > 13 else { throw EngineError.malformed("name too short") }
+        let bytes = [UInt8](blob)
+        guard bytes[0] == version else { throw EngineError.unsupportedVersion(bytes[0]) }
+        let plaintext = try AES.GCM.open(
+            try AES.GCM.SealedBox(combined: Data(bytes[1...])),
+            using: SymmetricKey(data: folderKey),
+            authenticating: label.bytes + digest)
+        guard let name = String(data: plaintext, encoding: .utf8) else {
+            throw EngineError.malformed("name is not valid UTF-8")
+        }
+        return name
+    }
+}
@@ -0,0 +1,121 @@
+import CryptoKit
+import Foundation
+
+/// Recovery codes.
+public enum Recovery {
+    static let alphabet = Array("0123456789ABCDEFGHJKMNPQRSTVWXYZ")
+    public static let entropyBytes = 16
+    static let checksumBits = 12
+    static let codeLength = 28
+
+    static func checksum(_ entropy: Data) -> UInt16 {
+        let digest = Array(SHA256.hash(data: entropy))
+        // Top 12 bits.
+        return (UInt16(digest[0]) << 4) | (UInt16(digest[1]) >> 4)
+    }
+
+    /// Fold the ambiguous glyphs and drop formatting, so a code read off paper
+    /// as "O" for zero or "l" for one still decodes.
+    public static func normalize(_ text: String) -> String {
+        String(
+            text.uppercased().compactMap { character -> Character? in
+                switch character {
+                case "O": return "0"
+                case "I", "L": return "1"
+                case "0"..."9", "A"..."Z": return character
+                default: return nil
+                }
+            })
+    }
+
+    public static func generate() -> (entropy: Data, code: String) {
+        let entropy = Bytes.random(entropyBytes)
+        return (entropy, try! encode(entropy))
+    }
+
+    public static func encode(_ entropy: Data) throws -> String {
+        guard entropy.count == entropyBytes else {
+            throw EngineError.malformed("entropy must be \(entropyBytes) bytes")
+        }
+        // 140 bits does not fit a fixed-width integer, so the value is carried
+        // as a little-endian digit array and shifted by hand.
+        var digits = [UInt8](repeating: 0, count: codeLength)
+        // Right-aligned in 18 bytes: 128 bits of entropy shifted up by the 12
+        // checksum bits is 140, which needs the extra two bytes of headroom.
+        var accumulator = [UInt8](repeating: 0, count: 2) + [UInt8](entropy)
+        // Append the 12-bit checksum: shift the 128 bits left by 12 and or it
+        // in.
+        let check = checksum(entropy)
+        shiftLeft(&accumulator, bits: checksumBits)
+        accumulator[accumulator.count - 1] |= UInt8(check & 0xFF)
+        accumulator[accumulator.count - 2] |= UInt8((check >> 8) & 0x0F)
+
+        for index in stride(from: codeLength - 1, through: 0, by: -1) {
+            digits[index] = accumulator[accumulator.count - 1] & 31
+            shiftRight(&accumulator, bits: 5)
+        }
+        let raw = String(digits.map { alphabet[Int($0)] })
+        return stride(from: 0, to: raw.count, by: 4).map {
+            let start = raw.index(raw.startIndex, offsetBy: $0)
+            let end = raw.index(start, offsetBy: min(4, raw.count - $0))
+            return String(raw[start..<end])
+        }.joined(separator: "-")
+    }
+
+    public static func decode(_ text: String) throws -> Data {
+        let normalized = normalize(text)
+        guard normalized.count == codeLength else {
+            throw EngineError.malformed(
+                "recovery code must be \(codeLength) characters, got \(normalized.count)")
+        }
+
+        var accumulator = [UInt8](repeating: 0, count: entropyBytes + 2)
+        for character in normalized {
+            guard let index = alphabet.firstIndex(of: character) else {
+                throw EngineError.malformed("invalid character '\(character)' in recovery code")
+            }
+            shiftLeft(&accumulator, bits: 5)
+            accumulator[accumulator.count - 1] |= UInt8(index)
+        }
+
+        let provided =
+            (UInt16(accumulator[accumulator.count - 2] & 0x0F) << 8)
+            | UInt16(accumulator[accumulator.count - 1])
+        shiftRight(&accumulator, bits: checksumBits)
+        let entropy = Data(accumulator.suffix(entropyBytes))
+
+        guard checksum(entropy) == provided else {
+            throw EngineError.malformed("recovery code checksum does not match, check for a typo")
+        }
+        return entropy
+    }
+
+    /// The string fed to the KDF.
+    public static func kdfSecret(_ entropy: Data) -> String {
+        entropy.map { String(format: "%02x", $0) }.joined()
+    }
+
+    // MARK: big-endian bit shifts over a byte array
+
+    private static func shiftLeft(_ bytes: inout [UInt8], bits: Int) {
+        for _ in 0..<bits {
+            var carry: UInt8 = 0
+            for index in stride(from: bytes.count - 1, through: 0, by: -1) {
+                let next = bytes[index] >> 7
+                bytes[index] = (bytes[index] << 1) | carry
+                carry = next
+            }
+        }
+    }
+
+    private static func shiftRight(_ bytes: inout [UInt8], bits: Int) {
+        for _ in 0..<bits {
+            var carry: UInt8 = 0
+            for index in 0..<bytes.count {
+                let next = bytes[index] & 1
+                bytes[index] = (bytes[index] >> 1) | (carry << 7)
+                carry = next
+            }
+        }
+    }
+}
@@ -0,0 +1,111 @@
+import CommonCrypto
+import CryptoKit
+import Foundation
+
+/// Share links that still respect the lattice.
+public enum Shares {
+    static let info = "enclave/share/v1"
+    static let infoPassword = "enclave/share/v2"
+    public static let passwordIterations = 250_000
+
+    public struct Sealed: Sendable {
+        public let wrappedContentKey: Data
+        public let wrappedName: Data
+        /// Public.
+        public let passwordSalt: Data?
+        public let passwordIterations: Int?
+    }
+
+    public static func createSecret() -> Data { Bytes.random(32) }
+
+    static func passwordKey(_ password: String, salt: Data, iterations: Int) throws -> Data {
+        let passwordBytes = Array(password.utf8)
+        var derived = [UInt8](repeating: 0, count: 32)
+        let status = salt.withUnsafeBytes { saltBuffer -> Int32 in
+            CCKeyDerivationPBKDF(
+                CCPBKDFAlgorithm(kCCPBKDF2),
+                passwordBytes.map { Int8(bitPattern: $0) }, passwordBytes.count,
+                saltBuffer.bindMemory(to: UInt8.self).baseAddress, salt.count,
+                CCPseudoRandomAlgorithm(kCCPRFHmacAlgSHA256),
+                UInt32(iterations), &derived, derived.count
+            )
+        }
+        guard status == kCCSuccess else { throw EngineError.malformed("PBKDF2 failed") }
+        return Data(derived)
+    }
+
+    /// Two factors always; three when a password is set.
+    static func shareKey(labelKey: Data, secret: Data, passwordKey: Data?) -> Data {
+        let material = passwordKey.map { labelKey + secret + $0 } ?? (labelKey + secret)
+        let key = HKDF<SHA256>.deriveKey(
+            inputKeyMaterial: SymmetricKey(data: material),
+            salt: Data(),
+            info: Data((passwordKey == nil ? info : infoPassword).utf8),
+            outputByteCount: 32
+        )
+        return key.withUnsafeBytes { Data($0) }
+    }
+
+    /// Both the key and the name carry the label as authenticated data, exactly
+    /// as everything else does, so a share cannot be replayed against a row the
+    /// server has since relabelled.
+    public static func seal(
+        labelKey: Data, label: Label, secret: Data,
+        contentKey: Data, name: String, password: String? = nil
+    ) throws -> Sealed {
+        let salt = password == nil ? nil : Bytes.random(16)
+        let pwKey = try password.map {
+            try passwordKey($0, salt: salt!, iterations: passwordIterations)
+        }
+        let key = shareKey(labelKey: labelKey, secret: secret, passwordKey: pwKey)
+        let aad = label.bytes
+        return Sealed(
+            wrappedContentKey: try Wrap.withKey(key, key: contentKey, aad: aad),
+            wrappedName: try Wrap.withKey(key, key: Data(name.utf8), aad: aad),
+            passwordSalt: salt,
+            passwordIterations: password == nil ? nil : passwordIterations
+        )
+    }
+
+    public static func open(
+        labelKey: Data, label: Label, secret: Data,
+        wrappedContentKey: Data, wrappedName: Data,
+        password: String? = nil, passwordSalt: Data? = nil,
+        passwordIterations iterations: Int = passwordIterations
+    ) throws -> (contentKey: Data, name: String) {
+        if passwordSalt != nil && password == nil {
+            throw EngineError.malformed("This link needs the password it was sent with.")
+        }
+        let pwKey = try passwordSalt.map {
+            try passwordKey(password!, salt: $0, iterations: iterations)
+        }
+        let key = shareKey(labelKey: labelKey, secret: secret, passwordKey: pwKey)
+        let aad = label.bytes
+        let contentKey = try Wrap.openWithKey(key, blob: wrappedContentKey, aad: aad)
+        let nameBytes = try Wrap.openWithKey(key, blob: wrappedName, aad: aad)
+        guard let name = String(data: nameBytes, encoding: .utf8) else {
+            throw EngineError.malformed("share name is not valid UTF-8")
+        }
+        return (contentKey, name)
+    }
+
+    /// The fragment form.
+    public static func encodeSecret(_ secret: Data) -> String {
+        secret.base64EncodedString()
+            .replacingOccurrences(of: "+", with: "-")
+            .replacingOccurrences(of: "/", with: "_")
+            .replacingOccurrences(of: "=", with: "")
+    }
+
+    public static func decodeSecret(_ text: String) throws -> Data {
+        var padded =
+            text
+            .replacingOccurrences(of: "-", with: "+")
+            .replacingOccurrences(of: "_", with: "/")
+        padded += String(repeating: "=", count: (4 - padded.count % 4) % 4)
+        guard let data = Data(base64Encoded: padded) else {
+            throw EngineError.malformed("share secret is not valid base64url")
+        }
+        return data
+    }
+}
@@ -0,0 +1,129 @@
+import CryptoKit
+import Foundation
+
+/// Building, signing and encoding a transfer.
+public enum SolanaTransaction {
+
+    /// The System Program's address is thirty-two zero bytes, which base58
+    /// prints as thirty-two `1`s.
+    public static let systemProgramID = Data(repeating: 0, count: 32)
+
+    /// `SystemInstruction::Transfer`, as a little-endian `u32`.
+    static let transferDiscriminator: UInt32 = 2
+
+    public enum Failure: LocalizedError, Equatable {
+        case badAddress(String)
+        case badBlockhash
+        case amountNotPositive
+        case sendingToYourself
+
+        public var errorDescription: String? {
+            switch self {
+            case .badAddress:
+                return "That isn't a valid address. Check it against where you "
+                    + "copied it from, an address with a typo in it is very "
+                    + "often still a valid address, and there is no undo."
+            case .badBlockhash:
+                return "The node gave an answer this app couldn't use. Try again."
+            case .amountNotPositive:
+                return "Enter an amount greater than zero."
+            case .sendingToYourself:
+                return "That's this wallet's own address."
+            }
+        }
+    }
+
+    // MARK: - Addresses
+
+    /// A 32-byte public key from a base58 address.
+    public static func publicKey(fromAddress address: String) throws -> Data {
+        let trimmed = address.trimmingCharacters(in: .whitespacesAndNewlines)
+        guard let raw = Base58.decode(trimmed), raw.count == 32 else {
+            throw Failure.badAddress(trimmed)
+        }
+        return raw
+    }
+
+    // MARK: - Compact-u16
+
+    /// Solana's length prefix: seven bits a byte, high bit meaning "more".
+    static func compactU16(_ value: Int) -> Data {
+        precondition(value >= 0 && value <= 0xffff, "compact-u16 out of range")
+        var remaining = value
+        var out = Data()
+        repeat {
+            var byte = UInt8(remaining & 0x7f)
+            remaining >>= 7
+            if remaining != 0 { byte |= 0x80 }
+            out.append(byte)
+        } while remaining != 0
+        return out
+    }
+
+    static func compactArray(_ items: [Data]) -> Data {
+        var out = compactU16(items.count)
+        for item in items { out.append(item) }
+        return out
+    }
+
+    // MARK: - The message
+
+    /// The bytes a signature covers.
+    public static func transferMessage(
+        from sender: Data,
+        to recipient: Data,
+        lamports: UInt64,
+        recentBlockhash: Data
+    ) throws -> Data {
+        guard sender.count == 32, recipient.count == 32 else {
+            throw Failure.badAddress("")
+        }
+        guard recentBlockhash.count == 32 else { throw Failure.badBlockhash }
+        guard lamports > 0 else { throw Failure.amountNotPositive }
+        guard sender != recipient else { throw Failure.sendingToYourself }
+
+        var out = Data()
+        // Header: one signature required, no read-only signers, and the System
+        // Program is the single read-only unsigned account.
+        out.append(contentsOf: [1, 0, 1])
+        out.append(compactArray([sender, recipient, systemProgramID]))
+        out.append(recentBlockhash)
+
+        // One instruction: the program at account index 2, touching accounts 0
+        // and 1, carrying the transfer payload.
+        let payload = transferData(lamports: lamports)
+        var instruction = Data()
+        instruction.append(2)  // program id index
+        instruction.append(compactU16(2))  // two account indices
+        instruction.append(contentsOf: [0, 1])  // from, to
+        instruction.append(compactU16(payload.count))
+        instruction.append(payload)
+
+        out.append(compactU16(1))  // one instruction
+        out.append(instruction)
+        return out
+    }
+
+    /// The instruction payload: a 4-byte discriminant then 8 bytes of amount,
+    /// both little-endian.
+    static func transferData(lamports: UInt64) -> Data {
+        var out = Data()
+        withUnsafeBytes(of: transferDiscriminator.littleEndian) { out.append(contentsOf: $0) }
+        withUnsafeBytes(of: lamports.littleEndian) { out.append(contentsOf: $0) }
+        return out
+    }
+
+    // MARK: - Signing
+
+    /// A signed transaction, ready to be base64'd and posted.
+    public static func signed(
+        message: Data,
+        key: Curve25519.Signing.PrivateKey
+    ) throws -> Data {
+        let signature = try key.signature(for: message)
+        var out = compactU16(1)
+        out.append(signature)
+        out.append(message)
+        return out
+    }
+}
@@ -0,0 +1,80 @@
+import CryptoKit
+import Foundation
+
+/// A wallet seed, and the two independent ways back to it.
+public enum Wallet {
+
+    /// AAD for the wrapped record, exactly as an identity record uses its
+    /// context.
+    static let aad = Data(KDF.Context.walletSeed.utf8)
+
+    /// A new wallet: the phrase to write down, and the record to store. 256
+    /// bits by default, 24 words.
+    public static func create(
+        walletKEK: Data, words: [String], entropyBytes: Int = 32
+    ) throws -> (phrase: String, record: Data) {
+        var entropy = Data(count: entropyBytes)
+        let status = entropy.withUnsafeMutableBytes {
+            SecRandomCopyBytes(kSecRandomDefault, entropyBytes, $0.baseAddress!)
+        }
+        guard status == errSecSuccess else {
+            throw EngineError.malformed("the system would not provide random bytes")
+        }
+        return (
+            try BIP39.phrase(from: entropy, words: words),
+            try wrap(entropy: entropy, walletKEK: walletKEK)
+        )
+    }
+
+    /// Wrap the ENTROPY, not the seed.
+    public static func wrap(entropy: Data, walletKEK: Data) throws -> Data {
+        try Wrap.withKey(walletKEK, key: entropy, aad: aad)
+    }
+
+    public static func unwrap(record: Data, walletKEK: Data) throws -> Data {
+        try Wrap.openWithKey(walletKEK, blob: record, aad: aad)
+    }
+
+    /// The phrase, from the stored record, for showing it again later.
+    public static func phrase(record: Data, walletKEK: Data, words: [String]) throws -> String {
+        try BIP39.phrase(from: try unwrap(record: record, walletKEK: walletKEK), words: words)
+    }
+
+    /// Adopt a phrase that came from somewhere else.
+    public static func `import`(
+        phrase: String, walletKEK: Data, words: [String]
+    ) throws -> Data {
+        try wrap(entropy: try BIP39.entropy(from: phrase, words: words), walletKEK: walletKEK)
+    }
+
+    /// The key a wallet record is wrapped under, from the Files identity key.
+    public static func kek(identity: Curve25519.KeyAgreement.PrivateKey) -> Data {
+        let key = HKDF<SHA256>.deriveKey(
+            inputKeyMaterial: SymmetricKey(data: identity.rawRepresentation),
+            salt: Data(),
+            info: Data(KDF.Context.walletKEK.utf8),
+            outputByteCount: 32
+        )
+        return key.withUnsafeBytes { Data($0) }
+    }
+
+    /// Move a record from one identity key to another.
+    public static func rewrap(
+        record: Data,
+        from old: Curve25519.KeyAgreement.PrivateKey,
+        to new: Curve25519.KeyAgreement.PrivateKey
+    ) throws -> Data {
+        try wrap(
+            entropy: try unwrap(record: record, walletKEK: kek(identity: old)),
+            walletKEK: kek(identity: new))
+    }
+
+    /// The 64-byte seed everything derives from.
+    public static func seed(
+        record: Data, walletKEK: Data, words: [String], passphrase: String = ""
+    ) throws -> Data {
+        try BIP39.seed(
+            from: try phrase(record: record, walletKEK: walletKEK, words: words),
+            passphrase: passphrase)
+    }
+}
@@ -0,0 +1,114 @@
+import CryptoKit
+import Foundation
+
+/// Key wrapping.
+public enum Wrap {
+    static let asymmetricVersion: UInt8 = 1
+    static let symmetricVersion: UInt8 = 17
+    static let info = Data("enclave/wrap/v1".utf8)
+
+    private static func sharedKey(
+        privateKey: Curve25519.KeyAgreement.PrivateKey,
+        publicKey: Curve25519.KeyAgreement.PublicKey,
+        ephemeralPublic: Data, recipientPublic: Data
+    ) throws -> SymmetricKey {
+        let shared = try privateKey.sharedSecretFromKeyAgreement(with: publicKey)
+        // Both public keys in the salt bind the derived key to this exact pair,
+        // so a wrap cannot be replayed at a different recipient.
+        return shared.hkdfDerivedSymmetricKey(
+            using: SHA256.self,
+            salt: ephemeralPublic + recipientPublic,
+            sharedInfo: info,
+            outputByteCount: 32
+        )
+    }
+
+    /// version(1) || ephemeral public key(32) || nonce(12) || ciphertext ||
+    /// tag.
+    public static func toPublicKey(
+        _ recipient: Curve25519.KeyAgreement.PublicKey, key: Data, aad: Data
+    ) throws -> Data {
+        let ephemeral = Curve25519.KeyAgreement.PrivateKey()
+        let ephemeralPublic = ephemeral.publicKey.rawRepresentation
+        let recipientPublic = recipient.rawRepresentation
+        let kek = try sharedKey(
+            privateKey: ephemeral, publicKey: recipient,
+            ephemeralPublic: ephemeralPublic, recipientPublic: recipientPublic)
+        let sealed = try AES.GCM.seal(key, using: kek, authenticating: aad)
+        guard let combined = sealed.combined else {
+            throw EngineError.malformed("seal produced no output")
+        }
+        return Data([asymmetricVersion]) + ephemeralPublic + combined
+    }
+
+    public static func fromPrivateKey(
+        _ privateKey: Curve25519.KeyAgreement.PrivateKey, blob: Data, aad: Data
+    ) throws -> Data {
+        guard blob.count > 45 else { throw EngineError.malformed("wrap too short") }
+        let bytes = [UInt8](blob)
+        guard bytes[0] == asymmetricVersion else { throw EngineError.unsupportedVersion(bytes[0]) }
+
+        let ephemeralPublic = Data(bytes[1..<33])
+        let ephemeral = try Curve25519.KeyAgreement.PublicKey(rawRepresentation: ephemeralPublic)
+        let kek = try sharedKey(
+            privateKey: privateKey, publicKey: ephemeral,
+            ephemeralPublic: ephemeralPublic,
+            recipientPublic: privateKey.publicKey.rawRepresentation)
+        return try AES.GCM.open(
+            try AES.GCM.SealedBox(combined: Data(bytes[33...])),
+            using: kek, authenticating: aad)
+    }
+
+    /// version(17) || nonce(12) || ciphertext || tag.
+    public static func withKey(_ kek: Data, key: Data, aad: Data) throws -> Data {
+        let sealed = try AES.GCM.seal(key, using: SymmetricKey(data: kek), authenticating: aad)
+        guard let combined = sealed.combined else {
+            throw EngineError.malformed("seal produced no output")
+        }
+        return Data([symmetricVersion]) + combined
+    }
+
+    public static func openWithKey(_ kek: Data, blob: Data, aad: Data) throws -> Data {
+        guard blob.count > 13 else { throw EngineError.malformed("wrap too short") }
+        let bytes = [UInt8](blob)
+        guard bytes[0] == symmetricVersion else { throw EngineError.unsupportedVersion(bytes[0]) }
+        return try AES.GCM.open(
+            try AES.GCM.SealedBox(combined: Data(bytes[1...])),
+            using: SymmetricKey(data: kek), authenticating: aad)
+    }
+}
+
+/// The key hierarchy.
+public enum Keys {
+    public static func grantLabelKey(
+        _ labelKey: Data, label: Label,
+        to recipient: Curve25519.KeyAgreement.PublicKey
+    ) throws -> Data {
+        try Wrap.toPublicKey(recipient, key: labelKey, aad: label.bytes)
+    }
+
+    public static func acceptLabelKey(
+        _ blob: Data, label: Label,
+        privateKey: Curve25519.KeyAgreement.PrivateKey
+    ) throws -> Data {
+        try Wrap.fromPrivateKey(privateKey, blob: blob, aad: label.bytes)
+    }
+
+    public static func wrapNodeKey(_ nodeKey: Data, labelKey: Data, label: Label) throws -> Data {
+        try Wrap.withKey(labelKey, key: nodeKey, aad: label.bytes)
+    }
+
+    public static func unwrapNodeKey(_ blob: Data, labelKey: Data, label: Label) throws -> Data {
+        try Wrap.openWithKey(labelKey, blob: blob, aad: label.bytes)
+    }
+
+    public static func wrapContentKey(_ contentKey: Data, nodeKey: Data, label: Label) throws
+        -> Data
+    {
+        try Wrap.withKey(nodeKey, key: contentKey, aad: label.bytes)
+    }
+
+    public static func unwrapContentKey(_ blob: Data, nodeKey: Data, label: Label) throws -> Data {
+        try Wrap.openWithKey(nodeKey, blob: blob, aad: label.bytes)
+    }
+}
@@ -0,0 +1,52 @@
+import FilesEngine
+import XCTest
+
+@testable import FilesClient
+
+/// The two halves of the model, and which one is enforced.
+///
+/// The mirror of `LabelTest` on the Kotlin side. Both engines must answer the
+/// same way: a rule enforced on one client and not the other is worse than the
+/// gap, because a file that saves on one phone and is refused on the other
+/// reads as a bug and gets worked around.
+final class ClearanceTests: XCTestCase {
+
+    /// No read up. Nothing above the clearance, and nothing outside its areas.
+    func testReadingStopsAtTheClearance() {
+        let cleared = Clearance(maximum: Label(classification: 5), minimum: Label(classification: 0))
+        XCTAssertTrue(cleared.mayRead(Label(classification: 5)))
+        XCTAssertTrue(cleared.mayRead(Label(classification: 1)))
+        XCTAssertFalse(cleared.mayRead(Label(classification: 8)))
+    }
+
+    /// Writing uses the same range check as reading, so the second rule of the
+    /// model is NOT enforced. Pinned, so the day it changes this fails and the
+    /// Kotlin test next to it has to change in the same commit.
+    func testWritingUsesTheSameCheckAsReading() {
+        let cleared = Clearance(maximum: Label(classification: 5), minimum: Label(classification: 0))
+        XCTAssertTrue(cleared.mayWrite(Label(classification: 5)))
+        XCTAssertTrue(
+            cleared.mayWrite(Label(classification: 1)),
+            "no-write-down is now enforced: see ios#65, and change the Kotlin "
+                + "LabelTest and this test together")
+        XCTAssertFalse(cleared.mayWrite(Label(classification: 8)))
+    }
+
+    /// A floor bounds writing as well as reading.
+    func testAFloorBoundsBothDirections() {
+        let cleared = Clearance(maximum: Label(classification: 5), minimum: Label(classification: 2))
+        XCTAssertTrue(cleared.mayWrite(Label(classification: 3)))
+        XCTAssertFalse(cleared.mayWrite(Label(classification: 1)))
+        XCTAssertFalse(cleared.mayRead(Label(classification: 1)))
+    }
+
+    /// Areas, not only levels: a clearance without the area does not reach it.
+    func testAreasAreCheckedTooBothWays() {
+        let cleared = Clearance(
+            maximum: Label(classification: 5, compartments: [1]),
+            minimum: Label(classification: 0))
+        XCTAssertTrue(cleared.mayRead(Label(classification: 3, compartments: [1])))
+        XCTAssertFalse(cleared.mayRead(Label(classification: 3, compartments: [2])))
+        XCTAssertFalse(cleared.mayWrite(Label(classification: 3, compartments: [2])))
+    }
+}
@@ -0,0 +1,594 @@
+import CryptoKit
+import FilesEngine
+import XCTest
+
+@testable import FilesClient
+
+final class LocalVaultTests: XCTestCase {
+
+    private var root: URL!
+    private let identity = Identity.generate()
+
+    override func setUpWithError() throws {
+        root = FileManager.default.temporaryDirectory
+            .appendingPathComponent("vault-\(UUID().uuidString)")
+        try FileManager.default.createDirectory(at: root, withIntermediateDirectories: true)
+    }
+
+    override func tearDownWithError() throws {
+        try? FileManager.default.removeItem(at: root)
+    }
+
+    private func open(_ key: Curve25519.KeyAgreement.PrivateKey? = nil) async throws -> LocalVault {
+        let vault = LocalVault(root: root, identity: key ?? identity)
+        try await vault.load()
+        return vault
+    }
+
+    private let confidentialLegal = Label(classification: 2, compartments: [0])
+
+    func testAFileGoesInAndComesBackOut() async throws {
+        let vault = try await open()
+        let bytes = Data("the quick brown fox".utf8)
+        let node = try await vault.add(bytes, named: "notes.txt", label: confidentialLegal)
+
+        let rows = await vault.list(nil)
+        XCTAssertEqual(rows.count, 1)
+        XCTAssertEqual(rows.first?.name, "notes.txt")
+        XCTAssertEqual(rows.first?.label, confidentialLegal)
+        XCTAssertEqual(rows.first?.byteCount, bytes.count)
+        let read = try await vault.contents(of: node)
+        XCTAssertEqual(read, bytes)
+    }
+
+    /// The point of local-first: it is still there with no network and no
+    /// process that saw it created.
+    func testTheVaultSurvivesBeingClosedAndReopened() async throws {
+        let first = try await open()
+        let node = try await first.add(
+            Data("keep me".utf8), named: "keep.txt",
+            label: confidentialLegal)
+
+        let second = try await open()
+        let reopened = await second.count
+        let firstName = await second.list(nil).first?.name
+        XCTAssertEqual(reopened, 1)
+        XCTAssertEqual(firstName, "keep.txt")
+        let readBack = try await second.contents(of: node)
+        XCTAssertEqual(readBack, Data("keep me".utf8))
+    }
+
+    /// Nothing readable is written to disk.
+    func testNothingOnDiskIsReadable() async throws {
+        let vault = try await open()
+        let node = try await vault.add(
+            Data("the salary figures".utf8),
+            named: "payroll.csv", label: confidentialLegal)
+
+        let index = try String(
+            decoding: Data(contentsOf: root.appendingPathComponent("index.json")),
+            as: UTF8.self)
+        XCTAssertFalse(index.contains("payroll"), "the file name is in the clear on disk")
+
+        let blob = try Data(
+            contentsOf: root.appendingPathComponent("blobs")
+                .appendingPathComponent(node.id.uuidString))
+        XCTAssertFalse(
+            String(decoding: blob, as: UTF8.self).contains("salary"),
+            "the contents are in the clear on disk")
+
+        // But the LABEL is, deliberately, it has to be readable to show a
+        // classification on a row you cannot open.
+        XCTAssertTrue(index.contains("\"classification\":2"))
+    }
+
+    /// The property the whole lattice rests on: a different identity derives
+    /// different label keys, so another account's vault does not open.
+    func testAnotherIdentityCannotReadIt() async throws {
+        let mine = try await open()
+        let node = try await mine.add(
+            Data("mine".utf8), named: "secret.txt",
+            label: confidentialLegal)
+
+        let theirs = try await open(Identity.generate())
+        let theirName = await theirs.list(nil).first?.name
+        XCTAssertNil(theirName, "another identity read the name")
+        await XCTAssertThrowsErrorAsync { try await theirs.contents(of: node) }
+    }
+
+    /// A row filed under a label this device has no key for is LISTED, with its
+    /// classification, and refuses to open.
+    func testAnUnreadableRowIsStillListedWithItsClassification() async throws {
+        let mine = try await open()
+        _ = try await mine.add(Data("x".utf8), named: "theirs.txt", label: confidentialLegal)
+
+        let theirs = try await open(Identity.generate())
+        let rows = await theirs.list(nil)
+        XCTAssertEqual(rows.count, 1)
+        XCTAssertNil(rows[0].name)
+        XCTAssertEqual(rows[0].label, confidentialLegal)
+    }
+
+    /// A node key is wrapped to its own label, never the folder's, so a
+    /// Restricted file inside a Confidential folder does not open to somebody
+    /// holding only the folder's key.
+    func testAHigherFileInsideALowerFolderKeepsItsOwnKey() async throws {
+        let vault = try await open()
+        let folder = try await vault.createFolder(
+            "Cases", label: confidentialLegal,
+            parentID: nil)
+        let restricted = Label(classification: 3, compartments: [0])
+        let file = try await vault.add(
+            Data("sealed".utf8), named: "sealed.pdf",
+            label: restricted, parentID: folder.id)
+
+        XCTAssertEqual(file.classification, 3)
+        let folderKey = await vault.labelKey(confidentialLegal)
+        XCTAssertThrowsError(
+            try Keys.unwrapNodeKey(file.wrappedNodeKey, labelKey: folderKey, label: restricted),
+            "the folder's key opened a file filed above it")
+    }
+
+    /// Compartments separate, not just levels.
+    func testTwoAreasAtTheSameLevelDoNotShareAKey() async throws {
+        let vault = try await open()
+        let legal = await vault.labelKey(Label(classification: 2, compartments: [0]))
+        let finance = await vault.labelKey(Label(classification: 2, compartments: [1]))
+        XCTAssertNotEqual(legal, finance)
+    }
+
+    func testAFolderWithSomethingInItWillNotBeDeleted() async throws {
+        let vault = try await open()
+        let folder = try await vault.createFolder("Cases", label: confidentialLegal)
+        _ = try await vault.add(
+            Data("x".utf8), named: "a.txt",
+            label: confidentialLegal, parentID: folder.id)
+
+        await XCTAssertThrowsErrorAsync { try await vault.remove(folder.id) }
+        let afterRefusal = await vault.count
+        XCTAssertEqual(afterRefusal, 2)
+    }
+
+    func testDeletingAFileTakesItsBytesWithIt() async throws {
+        let vault = try await open()
+        let node = try await vault.add(Data("bye".utf8), named: "bye.txt", label: confidentialLegal)
+        let blob = root.appendingPathComponent("blobs").appendingPathComponent(node.id.uuidString)
+        XCTAssertTrue(FileManager.default.fileExists(atPath: blob.path))
+
+        try await vault.remove(node.id)
+        let afterDelete = await vault.count
+        XCTAssertEqual(afterDelete, 0)
+        XCTAssertFalse(
+            FileManager.default.fileExists(atPath: blob.path),
+            "the bytes outlived the row that referenced them")
+    }
+
+    // MARK: - References
+
+    private func writeLoose(_ text: String, named name: String) throws -> URL {
+        let url = root.appendingPathComponent("outside-\(name)")
+        try Data(text.utf8).write(to: url)
+        return url
+    }
+
+    func testAReferencedFileReadsThroughToTheOriginal() async throws {
+        let vault = try await open()
+        let original = try writeLoose("on the phone already", named: "photo.txt")
+        let node = try await vault.reference(
+            original, named: "photo.txt",
+            label: confidentialLegal)
+
+        XCTAssertEqual(node.storage, .reference)
+        let read = try await vault.contents(of: node)
+        XCTAssertEqual(read, Data("on the phone already".utf8))
+
+        let rows = await vault.list(nil)
+        XCTAssertEqual(rows.first?.name, "photo.txt")
+        XCTAssertEqual(rows.first?.storage, .reference)
+        XCTAssertFalse(rows.first?.isMissing ?? true)
+    }
+
+    /// The honest cost of referencing, pinned as a test so nobody claims
+    /// otherwise: nothing was copied and nothing was encrypted, so the bytes
+    /// are still readable on disk to anyone who has the file.
+    func testAReferencedFileIsNotEncryptedByUs() async throws {
+        let vault = try await open()
+        let original = try writeLoose("the salary figures", named: "payroll.csv")
+        _ = try await vault.reference(original, named: "payroll.csv", label: confidentialLegal)
+
+        let onDisk = try String(decoding: Data(contentsOf: original), as: UTF8.self)
+        XCTAssertEqual(
+            onDisk, "the salary figures",
+            "referencing must leave the original exactly as it was")
+
+        // No blob was written for it.
+        let blobs = try FileManager.default.contentsOfDirectory(
+            atPath: root.appendingPathComponent("blobs").path)
+        XCTAssertTrue(blobs.isEmpty, "referencing wrote a copy")
+    }
+
+    /// Where a referenced file DOES become ciphertext: at send time.
+    func testSendingAReferencedFileSealsItUnderItsLabel() async throws {
+        let vault = try await open()
+        let original = try writeLoose("the salary figures", named: "payroll.csv")
+        let node = try await vault.reference(
+            original, named: "payroll.csv",
+            label: confidentialLegal)
+
+        let sealed = try await vault.sealedForSending(node)
+        XCTAssertFalse(
+            String(decoding: sealed.blob, as: UTF8.self).contains("salary"),
+            "the courier would have carried plaintext")
+
+        // And it opens again only with that key AND that label.
+        let back = try Content.decrypt(
+            sealed.blob, contentKey: sealed.contentKey,
+            label: confidentialLegal)
+        XCTAssertEqual(back, Data("the salary figures".utf8))
+        XCTAssertThrowsError(
+            try Content.decrypt(
+                sealed.blob, contentKey: sealed.contentKey,
+                label: Label(classification: 3, compartments: [0])),
+            "a relabelled blob opened anyway, the label is not bound as AAD")
+    }
+
+    func testAVaultedFileAlsoSealsForSending() async throws {
+        let vault = try await open()
+        let node = try await vault.add(
+            Data("copied in".utf8), named: "c.txt",
+            label: confidentialLegal)
+        let sealed = try await vault.sealedForSending(node)
+        let back = try Content.decrypt(
+            sealed.blob, contentKey: sealed.contentKey,
+            label: confidentialLegal)
+        XCTAssertEqual(back, Data("copied in".utf8))
+    }
+
+    /// The failure mode referencing brings with it.
+    func testAReferenceWhoseFileMovedReportsItselfMissing() async throws {
+        let vault = try await open()
+        let original = try writeLoose("here for now", named: "temp.txt")
+        let node = try await vault.reference(
+            original, named: "temp.txt",
+            label: confidentialLegal)
+        try FileManager.default.removeItem(at: original)
+
+        let rows = await vault.list(nil)
+        XCTAssertEqual(rows.count, 1, "a broken reference must still be listed")
+        XCTAssertTrue(rows.first?.isMissing ?? false)
+        await XCTAssertThrowsErrorAsync { try await vault.contents(of: node) }
+    }
+
+    /// Deleting a referenced row must NEVER delete the person's own file.
+    func testDeletingAReferenceLeavesTheOriginalAlone() async throws {
+        let vault = try await open()
+        let original = try writeLoose("still mine", named: "keep.txt")
+        let node = try await vault.reference(
+            original, named: "keep.txt",
+            label: confidentialLegal)
+
+        try await vault.remove(node.id)
+        XCTAssertTrue(
+            FileManager.default.fileExists(atPath: original.path),
+            "deleting the row deleted the person's own file")
+        let left = await vault.count
+        XCTAssertEqual(left, 0)
+    }
+
+    func testBulkDeletingReferencesLeavesTheOriginalsAlone() async throws {
+        let vault = try await open()
+        let one = try writeLoose("a", named: "a.txt")
+        let two = try writeLoose("b", named: "b.txt")
+        let first = try await vault.reference(one, named: "a.txt", label: confidentialLegal)
+        let second = try await vault.reference(two, named: "b.txt", label: confidentialLegal)
+
+        _ = try await vault.remove(ids: [first.id, second.id])
+        XCTAssertTrue(FileManager.default.fileExists(atPath: one.path))
+        XCTAssertTrue(FileManager.default.fileExists(atPath: two.path))
+    }
+
+    /// An index written before referencing existed must still decode, and must
+    /// decode as vaulted rather than as a reference with no bookmark.
+    func testAnOlderIndexDecodesAsVaulted() async throws {
+        let vault = try await open()
+        _ = try await vault.add(Data("old".utf8), named: "old.txt", label: confidentialLegal)
+
+        // Strip the field the way an older writer would have left it.
+        let url = root.appendingPathComponent("index.json")
+        var text = try String(decoding: Data(contentsOf: url), as: UTF8.self)
+        text = text.replacingOccurrences(of: "\"storage\":\"vault\",", with: "")
+        try Data(text.utf8).write(to: url)
+
+        let reopened = try await open()
+        let rows = await reopened.list(nil)
+        XCTAssertEqual(rows.first?.storage, .vault)
+        XCTAssertEqual(rows.first?.name, "old.txt")
+    }
+
+    // MARK: - Promoting a reference
+
+    func testEncryptingAReferenceMakesItAVaultedCopy() async throws {
+        let vault = try await open()
+        let original = try writeLoose("the salary figures", named: "payroll.csv")
+        let node = try await vault.reference(
+            original, named: "payroll.csv",
+            label: confidentialLegal)
+
+        let origin = try await vault.encrypt(node.id)
+        XCTAssertEqual(origin?.lastPathComponent, original.lastPathComponent)
+
+        let rows = await vault.list(nil)
+        XCTAssertEqual(rows.first?.storage, .vault)
+        XCTAssertEqual(rows.first?.name, "payroll.csv")
+
+        // It reads back through the vault, and the blob on disk is ciphertext.
+        guard let promoted = await vault.node(node.id) else { return XCTFail("row vanished") }
+        let read = try await vault.contents(of: promoted)
+        XCTAssertEqual(read, Data("the salary figures".utf8))
+
+        let blob = try Data(
+            contentsOf: root.appendingPathComponent("blobs")
+                .appendingPathComponent(node.id.uuidString))
+        XCTAssertFalse(String(decoding: blob, as: UTF8.self).contains("salary"))
+    }
+
+    /// The bookmark must go, or the "encrypted" copy is not the only way in.
+    func testAPromotedRowStopsReadingThroughToThePlaintext() async throws {
+        let vault = try await open()
+        let original = try writeLoose("secret", named: "s.txt")
+        let node = try await vault.reference(original, named: "s.txt", label: confidentialLegal)
+        _ = try await vault.encrypt(node.id)
+
+        guard let promoted = await vault.node(node.id) else { return XCTFail("row vanished") }
+        XCTAssertNil(promoted.bookmark, "a vaulted row kept a path to the plaintext")
+
+        // Deleting the original now changes nothing, the vault holds it.
+        try FileManager.default.removeItem(at: original)
+        let read = try await vault.contents(of: promoted)
+        XCTAssertEqual(read, Data("secret".utf8))
+    }
+
+    /// Promoting does not delete the person's file.
+    func testEncryptingLeavesTheOriginalWhereItIs() async throws {
+        let vault = try await open()
+        let original = try writeLoose("mine", named: "m.txt")
+        let node = try await vault.reference(original, named: "m.txt", label: confidentialLegal)
+        _ = try await vault.encrypt(node.id)
+        XCTAssertTrue(FileManager.default.fileExists(atPath: original.path))
+    }
+
+    func testEncryptingSomethingAlreadyVaultedDoesNothing() async throws {
+        let vault = try await open()
+        let node = try await vault.add(
+            Data("already".utf8), named: "a.txt",
+            label: confidentialLegal)
+        let origin = try await vault.encrypt(node.id)
+        XCTAssertNil(origin)
+        let read = try await vault.contents(of: node)
+        XCTAssertEqual(read, Data("already".utf8))
+    }
+
+    func testEncryptingAReferenceWhoseFileIsGoneSaysSo() async throws {
+        let vault = try await open()
+        let original = try writeLoose("here", named: "h.txt")
+        let node = try await vault.reference(original, named: "h.txt", label: confidentialLegal)
+        try FileManager.default.removeItem(at: original)
+        await XCTAssertThrowsErrorAsync { try await vault.encrypt(node.id) }
+    }
+
+    // MARK: - Bulk delete
+
+    func testBulkDeleteRemovesEverythingSelected() async throws {
+        let vault = try await open()
+        let a = try await vault.add(Data("a".utf8), named: "a.txt", label: confidentialLegal)
+        let b = try await vault.add(Data("b".utf8), named: "b.txt", label: confidentialLegal)
+        let c = try await vault.add(Data("c".utf8), named: "c.txt", label: confidentialLegal)
+
+        let result = try await vault.remove(ids: [a.id, b.id])
+        XCTAssertEqual(result.removed.count, 2)
+        XCTAssertTrue(result.isCompletelyDone)
+
+        let left = await vault.list(nil)
+        XCTAssertEqual(left.map(\.id), [c.id])
+    }
+
+    /// Selecting a folder AND its contents works, the folder goes last.
+    func testAFolderGoesWhenItsContentsAreSelectedToo() async throws {
+        let vault = try await open()
+        let folder = try await vault.createFolder("Cases", label: confidentialLegal)
+        let inside = try await vault.add(
+            Data("x".utf8), named: "x.txt",
+            label: confidentialLegal, parentID: folder.id)
+        let deeper = try await vault.createFolder(
+            "2026", label: confidentialLegal,
+            parentID: folder.id)
+
+        let result = try await vault.remove(ids: [folder.id, inside.id, deeper.id])
+        XCTAssertEqual(result.removed.count, 3)
+        XCTAssertTrue(result.isCompletelyDone)
+        let remaining = await vault.count
+        XCTAssertEqual(remaining, 0)
+    }
+
+    /// A folder whose contents were NOT selected is kept, and SAID.
+    func testAFolderWithUnselectedContentsIsKeptAndReported() async throws {
+        let vault = try await open()
+        let folder = try await vault.createFolder("Cases", label: confidentialLegal)
+        let keep = try await vault.add(
+            Data("keep".utf8), named: "keep.txt",
+            label: confidentialLegal, parentID: folder.id)
+
+        let result = try await vault.remove(ids: [folder.id])
+        XCTAssertTrue(result.removed.isEmpty)
+        XCTAssertEqual(result.keptNonEmpty, [folder.id])
+        XCTAssertFalse(result.isCompletelyDone)
+
+        let stillThere = await vault.count
+        XCTAssertEqual(stillThere, 2)
+        let readBack = try await vault.contents(of: keep)
+        XCTAssertEqual(readBack, Data("keep".utf8))
+    }
+
+    func testBulkDeleteTakesTheBytesWithIt() async throws {
+        let vault = try await open()
+        let a = try await vault.add(Data("a".utf8), named: "a.txt", label: confidentialLegal)
+        let b = try await vault.add(Data("b".utf8), named: "b.txt", label: confidentialLegal)
+        let blobs = root.appendingPathComponent("blobs")
+
+        _ = try await vault.remove(ids: [a.id, b.id])
+        for id in [a.id, b.id] {
+            XCTAssertFalse(
+                FileManager.default.fileExists(
+                    atPath: blobs.appendingPathComponent(id.uuidString).path),
+                "bytes outlived the row")
+        }
+    }
+
+    func testDescendantsFindsTheWholeSubtree() async throws {
+        let vault = try await open()
+        let top = try await vault.createFolder("Top", label: confidentialLegal)
+        let mid = try await vault.createFolder("Mid", label: confidentialLegal, parentID: top.id)
+        let leaf = try await vault.add(
+            Data("l".utf8), named: "l.txt",
+            label: confidentialLegal, parentID: mid.id)
+        _ = try await vault.add(Data("o".utf8), named: "outside.txt", label: confidentialLegal)
+
+        let found = Set(await vault.descendants(of: top.id))
+        XCTAssertEqual(found, Set([mid.id, leaf.id]))
+    }
+
+    /// An id that is not there is skipped, not an error: two screens racing on
+    /// the same selection should not turn into a failure dialog.
+    func testDeletingSomethingAlreadyGoneIsNotAnError() async throws {
+        let vault = try await open()
+        let a = try await vault.add(Data("a".utf8), named: "a.txt", label: confidentialLegal)
+        _ = try await vault.remove(ids: [a.id])
+
+        let again = try await vault.remove(ids: [a.id, UUID()])
+        XCTAssertTrue(again.removed.isEmpty)
+        XCTAssertTrue(again.isCompletelyDone)
+    }
+
+    func testTheIndexSurvivesABulkDeleteAndReopens() async throws {
+        let first = try await open()
+        let a = try await first.add(Data("a".utf8), named: "a.txt", label: confidentialLegal)
+        let b = try await first.add(Data("b".utf8), named: "b.txt", label: confidentialLegal)
+        _ = try await first.remove(ids: [a.id])
+
+        let second = try await open()
+        let names = await second.list(nil).map(\.name)
+        XCTAssertEqual(names, ["b.txt"])
+        let readBack = try await second.contents(of: b)
+        XCTAssertEqual(readBack, Data("b".utf8))
+    }
+
+    func testFoldersSortFirstAndUnreadableRowsSortLast() async throws {
+        let vault = try await open()
+        _ = try await vault.add(Data("a".utf8), named: "zebra.txt", label: confidentialLegal)
+        _ = try await vault.add(Data("b".utf8), named: "apple.txt", label: confidentialLegal)
+        _ = try await vault.createFolder("Misc", label: confidentialLegal)
+
+        let rows = await vault.list(nil)
+        XCTAssertEqual(rows.map(\.name), ["Misc", "apple.txt", "zebra.txt"])
+    }
+
+    // MARK: - Walking the tree (ios#66) and the send picker (ios#68)
+
+    /// A cycle cannot be built through this API, and the index is still a file
+    /// on disk that something else could write.
+    func testACycleInTheIndexReturnsEachNodeOnce() async throws {
+        let vault = try await open()
+        let a = try await vault.createFolder("A", label: confidentialLegal)
+        let b = try await vault.createFolder("B", label: confidentialLegal, parentID: a.id)
+
+        // The cycle written straight into the index, as a corrupt file would.
+        let url = root.appendingPathComponent("index.json")
+        var json = try XCTUnwrap(
+            JSONSerialization.jsonObject(
+                with: try Data(contentsOf: url)) as? [String: Any])
+        var nodes = try XCTUnwrap(json["nodes"] as? [[String: Any]])
+        for i in nodes.indices where (nodes[i]["id"] as? String) == a.id.uuidString {
+            nodes[i]["parentID"] = b.id.uuidString
+        }
+        json["nodes"] = nodes
+        try JSONSerialization.data(withJSONObject: json).write(to: url)
+
+        let reopened = try await open()
+        // Not merely "it terminated": each node exactly once.
+        let fromA = await reopened.descendants(of: a.id)
+        let fromB = await reopened.descendants(of: b.id)
+        XCTAssertEqual(fromA, [b.id])
+        XCTAssertEqual(fromB, [a.id])
+    }
+
+    func testDescendantsWalksTheWholeSubtree() async throws {
+        let vault = try await open()
+        let folder = try await vault.createFolder("Reports", label: confidentialLegal)
+        let inner = try await vault.createFolder(
+            "2026", label: confidentialLegal,
+            parentID: folder.id)
+        let file = try await vault.add(
+            Data("x".utf8), named: "q3.txt",
+            label: confidentialLegal, parentID: inner.id)
+        _ = try await vault.add(Data("y".utf8), named: "other.txt", label: confidentialLegal)
+
+        let found = Set(await vault.descendants(of: folder.id))
+        XCTAssertEqual(found, Set([inner.id, file.id]))
+    }
+
+    /// The send picker listed the ROOT only, so a document filed into a folder
+    /// could not be sent from a conversation at all, absent from the list, with
+    /// nothing saying why.
+    func testEverythingSendableIsOfferedHoweverDeepItIsFiled() async throws {
+        let vault = try await open()
+        let folder = try await vault.createFolder("Reports", label: confidentialLegal)
+        let inner = try await vault.createFolder(
+            "2026", label: confidentialLegal,
+            parentID: folder.id)
+        _ = try await vault.add(Data("a".utf8), named: "top.txt", label: confidentialLegal)
+        _ = try await vault.add(
+            Data("b".utf8), named: "buried.txt",
+            label: confidentialLegal, parentID: inner.id)
+
+        let offered = await vault.allFiles().compactMap(\.name)
+        XCTAssertEqual(offered, ["buried.txt", "top.txt"])
+    }
+
+    /// Folders are places, not files.
+    func testFoldersAreNotOffered() async throws {
+        let vault = try await open()
+        _ = try await vault.createFolder("Reports", label: confidentialLegal)
+        let offered = await vault.allFiles()
+        XCTAssertTrue(offered.isEmpty)
+    }
+
+    /// The one place this class hides a row it cannot read: a picker exists
+    /// only for choosing something to send, and a row that can never be chosen
+    /// is furniture.
+    func testRowsThatCouldNeverBeSentAreLeftOutOfThePicker() async throws {
+        let vault = try await open()
+        _ = try await vault.add(
+            Data("mine".utf8), named: "readable.txt",
+            label: confidentialLegal)
+
+        let stranger = LocalVault(root: root, identity: Identity.generate())
+        try await stranger.load()
+        let offered = await stranger.allFiles()
+        XCTAssertTrue(
+            offered.isEmpty,
+            "a row this device cannot decrypt was offered as sendable")
+    }
+
+}
+
+/// XCTest has no async throwing assertion of its own.
+func XCTAssertThrowsErrorAsync<T>(
+    _ message: String = "expected an error",
+    file: StaticString = #filePath, line: UInt = #line,
+    _ expression: () async throws -> T
+) async {
+    do {
+        _ = try await expression()
+        XCTFail(message, file: file, line: line)
+    } catch {}
+}
@@ -0,0 +1,103 @@
+import XCTest
+
+@testable import FilesEngine
+
+/// The official BIP-39 vectors, against the vendored list.
+final class BIP39Tests: XCTestCase {
+
+    private func words() throws -> [String] { try BIP39.englishWordlist() }
+    private func hex(_ s: String) -> Data {
+        let c = Array(s)
+        var out = Data()
+        for i in stride(from: 0, to: c.count, by: 2) {
+            out.append(UInt8(String(c[i...i + 1]), radix: 16)!)
+        }
+        return out
+    }
+    private func toHex(_ d: Data) -> String {
+        d.map { String(format: "%02x", $0) }.joined()
+    }
+
+    func testTheBundledWordlistMatchesItsDigest() throws {
+        let list = try words()
+        XCTAssertEqual(list.count, 2048)
+        XCTAssertEqual(list.first, "abandon")
+        XCTAssertEqual(list.last, "zoo")
+        XCTAssertNoThrow(try BIP39.verify(list))
+    }
+
+    func testEntropyProducesThePublishedPhrase() throws {
+        let list = try words()
+        XCTAssertEqual(
+            try BIP39.phrase(from: hex("00000000000000000000000000000000"), words: list),
+            "abandon abandon abandon abandon abandon abandon abandon abandon "
+                + "abandon abandon abandon about")
+        XCTAssertEqual(
+            try BIP39.phrase(from: hex("7f7f7f7f7f7f7f7f7f7f7f7f7f7f7f7f"), words: list),
+            "legal winner thank year wave sausage worth useful legal winner "
+                + "thank yellow")
+        XCTAssertEqual(
+            try BIP39.phrase(from: hex("ffffffffffffffffffffffffffffffff"), words: list),
+            "zoo zoo zoo zoo zoo zoo zoo zoo zoo zoo zoo wrong")
+    }
+
+    /// The assertion that settles interoperability.
+    func testTheSeedMatchesThePublishedVector() throws {
+        let phrase =
+            "abandon abandon abandon abandon abandon abandon abandon "
+            + "abandon abandon abandon abandon about"
+        XCTAssertEqual(
+            toHex(try BIP39.seed(from: phrase, passphrase: "TREZOR")),
+            "c55257c360c07c72029aebc1b53c05ed0362ada38ead3e3e9efa3708e5349553"
+                + "1f09a6987599d18264c1e1c92f2cf141630c7a3c4ab7c81b2f001698e7463b04")
+    }
+
+    func testPhrasesDecodeBackToTheirEntropy() throws {
+        let list = try words()
+        for size in [16, 20, 24, 28, 32] {
+            var entropy = Data(count: size)
+            entropy.withUnsafeMutableBytes {
+                _ = SecRandomCopyBytes(kSecRandomDefault, size, $0.baseAddress!)
+            }
+            let phrase = try BIP39.phrase(from: entropy, words: list)
+            XCTAssertEqual(try BIP39.entropy(from: phrase, words: list), entropy, "\(size) bytes")
+        }
+    }
+
+    func testAMistypedWordFailsTheChecksum() throws {
+        let list = try words()
+        // "about" swapped for another real word: right length, all real words.
+        let phrase =
+            "abandon abandon abandon abandon abandon abandon abandon "
+            + "abandon abandon abandon abandon abandon"
+        XCTAssertThrowsError(try BIP39.entropy(from: phrase, words: list)) {
+            XCTAssertEqual($0 as? BIP39.Failure, .checksumFailed)
+        }
+    }
+
+    func testAWordNotOnTheListIsNamed() throws {
+        let list = try words()
+        let phrase =
+            "abandon abandon abandon abandon abandon abandon abandon "
+            + "abandon abandon abandon abandon notaword"
+        XCTAssertThrowsError(try BIP39.entropy(from: phrase, words: list)) {
+            XCTAssertEqual($0 as? BIP39.Failure, .unknownWord("notaword"))
+        }
+    }
+
+    func testAWordlistThatDoesNotMatchIsRefused() {
+        let fake = (0..<2048).map { "w\($0)" }
+        XCTAssertThrowsError(try BIP39.verify(fake))
+    }
+
+    /// The standard's sharp edge, pinned so nobody "fixes" it: a different
+    /// BIP-39 passphrase is a different valid wallet, silently.
+    func testABIP39PassphraseChangesTheWallet() throws {
+        let phrase =
+            "abandon abandon abandon abandon abandon abandon abandon "
+            + "abandon abandon abandon abandon about"
+        XCTAssertNotEqual(
+            try BIP39.seed(from: phrase),
+            try BIP39.seed(from: phrase, passphrase: "second factor"))
+    }
+}
@@ -0,0 +1,96 @@
+import XCTest
+
+@testable import FilesEngine
+
+final class Base58Tests: XCTestCase {
+
+    private func hex(_ s: String) -> Data {
+        let c = Array(s)
+        var out = Data()
+        for i in stride(from: 0, to: c.count, by: 2) {
+            out.append(UInt8(String(c[i...i + 1]), radix: 16)!)
+        }
+        return out
+    }
+
+    /// The vectors everyone uses, from the Bitcoin reference tests.
+    func testKnownValuesEncode() {
+        let cases: [(String, String)] = [
+            ("", ""),
+            ("61", "2g"),
+            ("626262", "a3gV"),
+            ("636363", "aPEr"),
+            ("73696d706c792061206c6f6e6720737472696e67", "2cFupjhnEsSn59qHXstmK2ffpLv2"),
+            (
+                "00eb15231dfceb60925886b67d065299925915aeb172c06647",
+                "1NS17iag9jJgTHD1VXjvLCEnZuQ3rJDE9L"
+            ),
+            ("516b6fcd0f", "ABnLTmg"),
+            ("bf4f89001e670274dd", "3SEo3LWLoPntC"),
+            ("572e4794", "3EFU7m"),
+            ("ecac89cad93923c02321", "EJDM8drfXA6uyA"),
+            ("10c8511e", "Rt5zm"),
+        ]
+        for (input, expected) in cases {
+            XCTAssertEqual(Base58.encode(hex(input)), expected, "encoding \(input)")
+            XCTAssertEqual(Base58.decode(expected), hex(input), "decoding \(expected)")
+        }
+    }
+
+    /// The rule that goes wrong: one '1' per leading zero BYTE, and it must
+    /// survive the round trip.
+    func testLeadingZeroBytesBecomeLeadingOnes() {
+        XCTAssertEqual(Base58.encode(Data([0x00])), "1")
+        XCTAssertEqual(Base58.encode(Data([0x00, 0x00])), "11")
+        XCTAssertEqual(Base58.encode(Data([0x00, 0x00, 0x00])), "111")
+        XCTAssertEqual(Base58.encode(Data([0x00, 0x01])), "12")
+
+        for count in 0...5 {
+            let data = Data(repeating: 0, count: count) + Data([0x2a])
+            XCTAssertEqual(
+                Base58.decode(Base58.encode(data)), data,
+                "\(count) leading zeros did not survive")
+        }
+    }
+
+    /// Two keys differing only by a leading zero must not collide.
+    func testAKeyWithALeadingZeroIsDistinct() {
+        let withZero = Data([0x00]) + Data(repeating: 0xab, count: 31)
+        let without = Data(repeating: 0xab, count: 31)
+        XCTAssertNotEqual(Base58.encode(withZero), Base58.encode(without))
+    }
+
+    func testAnAddressRoundTripsForEveryLength() {
+        for size in [1, 20, 31, 32, 33, 64] {
+            var data = Data(count: size)
+            data.withUnsafeMutableBytes {
+                _ = SecRandomCopyBytes(kSecRandomDefault, size, $0.baseAddress!)
+            }
+            XCTAssertEqual(Base58.decode(Base58.encode(data)), data, "\(size) bytes")
+        }
+    }
+
+    /// The characters left out on purpose.
+    func testTheAmbiguousCharactersAreNotInTheAlphabet() {
+        for character in "0OIl" {
+            XCTAssertFalse(
+                Base58.alphabet.contains(character),
+                "\(character) is in the alphabet")
+            XCTAssertNil(
+                Base58.decode("abc\(character)def"),
+                "\(character) decoded instead of failing")
+        }
+    }
+
+    func testAnAddressIsTheUsualLength() throws {
+        // A 32-byte ed25519 public key base58-encodes to 43 or 44 characters,
+        // which is what an address from any other wallet looks like.
+        let key = try HDKey.master(
+            seed: Data(repeating: 3, count: 64),
+            path: "m/44H/501H/0H/0H/0H"
+        ).publicKey()
+        let address = Base58.encode(key)
+        XCTAssertTrue((43...44).contains(address.count), "got \(address.count): \(address)")
+        XCTAssertEqual(Base58.decode(address), key)
+    }
+}
@@ -0,0 +1,138 @@
+import XCTest
+
+@testable import FilesEngine
+
+/// Reading a chain, driven against canned node answers.
+final class ChainRPCTests: XCTestCase {
+
+    private func rpc(_ body: String, status: Int = 200) -> ChainRPC {
+        ChainRPC(endpoint: URL(string: "https://node.example")!) { request in
+            let response = HTTPURLResponse(
+                url: request.url!, statusCode: status,
+                httpVersion: nil, headerFields: nil)!
+            return (Data(body.utf8), response)
+        }
+    }
+
+    func testABalanceIsRead() async throws {
+        let value = try await rpc(#"{"jsonrpc":"2.0","result":{"value":1234567890},"id":1}"#)
+            .balance(of: "abc")
+        XCTAssertEqual(value, 1_234_567_890)
+    }
+
+    func testAZeroBalanceIsABalanceAndNotAnError() async throws {
+        let value = try await rpc(#"{"jsonrpc":"2.0","result":{"value":0},"id":1}"#)
+            .balance(of: "abc")
+        XCTAssertEqual(value, 0)
+    }
+
+    /// A JSON-RPC error arrives with HTTP 200.
+    func testANodeErrorIsNotReadAsSuccess() async {
+        do {
+            _ = try await rpc(
+                #"{"jsonrpc":"2.0","error":{"code":-32602,"message":"Invalid param: WrongSize"},"id":1}"#
+            )
+            .balance(of: "nonsense")
+            XCTFail("a node error was treated as a balance")
+        } catch let failure as ChainRPC.Failure {
+            // The node's own words reach the person.
+            XCTAssertEqual(failure, .node("Invalid param: WrongSize"))
+        } catch {
+            XCTFail("wrong error: \(error)")
+        }
+    }
+
+    func testAnHTTPFailureIsReported() async {
+        do {
+            _ = try await rpc("gateway down", status: 502).balance(of: "abc")
+            XCTFail("a 502 was treated as an answer")
+        } catch let failure as ChainRPC.Failure {
+            XCTAssertEqual(failure, .http(502))
+        } catch { XCTFail("wrong error: \(error)") }
+    }
+
+    func testGarbageIsRefusedRatherThanGuessedAt() async {
+        do {
+            _ = try await rpc("<html>not json</html>").balance(of: "abc")
+            XCTFail("garbage parsed as a balance")
+        } catch let failure as ChainRPC.Failure {
+            XCTAssertEqual(failure, .malformed("not an object"))
+        } catch { XCTFail("wrong error: \(error)") }
+    }
+
+    // MARK: - History
+
+    func testHistoryIsReadNewestFirst() async throws {
+        let body = """
+            {"jsonrpc":"2.0","result":[
+              {"signature":"sigA","slot":300,"blockTime":1750000000,"err":null},
+              {"signature":"sigB","slot":200,"blockTime":1740000000,"err":null}
+            ],"id":1}
+            """
+        let rows = try await rpc(body).history(for: "abc")
+        XCTAssertEqual(rows.map(\.signature), ["sigA", "sigB"])
+        XCTAssertEqual(rows[0].slot, 300)
+        XCTAssertEqual(rows[0].blockTime?.timeIntervalSince1970, 1_750_000_000)
+    }
+
+    /// A FAILED transaction still appears in an address's history.
+    func testAFailedTransactionIsMarkedFailed() async throws {
+        let body = """
+            {"jsonrpc":"2.0","result":[
+              {"signature":"bad","slot":1,"blockTime":1750000000,"err":{"InstructionError":[0,{"Custom":1}]}},
+              {"signature":"good","slot":2,"blockTime":1750000001,"err":null}
+            ],"id":1}
+            """
+        let rows = try await rpc(body).history(for: "abc")
+        XCTAssertTrue(rows[0].failed, "a failed transaction was shown as successful")
+        XCTAssertFalse(rows[1].failed)
+    }
+
+    /// A very new transaction has no time yet.
+    func testATransactionWithNoTimeYetHasNoDate() async throws {
+        let body =
+            #"{"jsonrpc":"2.0","result":[{"signature":"new","slot":9,"blockTime":null,"err":null}],"id":1}"#
+        let rows = try await rpc(body).history(for: "abc")
+        XCTAssertNil(rows[0].blockTime)
+    }
+
+    func testAnEmptyHistoryIsEmptyAndNotAnError() async throws {
+        let rows = try await rpc(#"{"jsonrpc":"2.0","result":[],"id":1}"#).history(for: "abc")
+        XCTAssertTrue(rows.isEmpty)
+    }
+
+    func testARowWithNoSignatureIsSkippedRatherThanCrashing() async throws {
+        let body = """
+            {"jsonrpc":"2.0","result":[{"slot":1},{"signature":"ok","slot":2,"err":null}],"id":1}
+            """
+        let rows = try await rpc(body).history(for: "abc")
+        XCTAssertEqual(rows.map(\.signature), ["ok"])
+    }
+
+    /// The request is shaped the way a node expects.
+    func testTheRequestIsWellFormedJSONRPC() async throws {
+        actor Captured {
+            var body: Data?
+            func set(_ d: Data?) { body = d }
+        }
+        let captured = Captured()
+        let client = ChainRPC(endpoint: URL(string: "https://node.example")!) { request in
+            await captured.set(request.httpBody)
+            let response = HTTPURLResponse(
+                url: request.url!, statusCode: 200,
+                httpVersion: nil, headerFields: nil)!
+            return (Data(#"{"result":{"value":1}}"#.utf8), response)
+        }
+        _ = try await client.balance(of: "someaddress")
+
+        // Hoisted: XCTUnwrap takes an autoclosure, which is nonisolated, so an
+        // actor read cannot happen inside it.
+        let sent = await captured.body
+        let body = try XCTUnwrap(sent)
+        let json = try XCTUnwrap(
+            try JSONSerialization.jsonObject(with: body) as? [String: Any])
+        XCTAssertEqual(json["jsonrpc"] as? String, "2.0")
+        XCTAssertEqual(json["method"] as? String, "getBalance")
+        XCTAssertEqual((json["params"] as? [Any])?.first as? String, "someaddress")
+    }
+}
@@ -0,0 +1,136 @@
+import Foundation
+import XCTest
+
+@testable import FilesEngine
+
+/// Submitting a transaction, and finding out what became of it.
+final class ChainSendTests: XCTestCase {
+
+    private func node(
+        _ answer: @escaping @Sendable (String) -> String,
+        status: Int = 200
+    ) -> ChainRPC {
+        ChainRPC(endpoint: URL(string: "https://node.example")!) { request in
+            let sent = request.httpBody.flatMap {
+                try? JSONSerialization.jsonObject(with: $0) as? [String: Any]
+            }
+            let method = (sent?["method"] as? String) ?? ""
+            let response = HTTPURLResponse(
+                url: URL(string: "https://node.example")!,
+                statusCode: status,
+                httpVersion: nil, headerFields: nil)!
+            return (Data(answer(method).utf8), response)
+        }
+    }
+
+    private let hash32 = String(repeating: "1", count: 32)  // 32 zero bytes
+
+    // MARK: - Blockhash
+
+    func testABlockhashIsThirtyTwoBytesAndCarriesItsExpiry() async throws {
+        let rpc = node { _ in
+            #"{"jsonrpc":"2.0","id":1,"result":{"value":{"blockhash":"\#(String(repeating: "1", count: 32))","lastValidBlockHeight":250}}}"#
+        }
+        let hash = try await rpc.latestBlockhash()
+        XCTAssertEqual(hash.value.count, 32)
+        XCTAssertEqual(hash.lastValidBlockHeight, 250)
+    }
+
+    /// A blockhash of the wrong length would be signed over and rejected after
+    /// the fact.
+    func testAMalformedBlockhashIsRefused() async {
+        let rpc = node { _ in #"{"jsonrpc":"2.0","id":1,"result":{"value":{"blockhash":"abc"}}}"# }
+        do {
+            _ = try await rpc.latestBlockhash()
+            XCTFail("a short blockhash was accepted")
+        } catch {}
+    }
+
+    // MARK: - Sending
+
+    func testASendReturnsItsSignature() async throws {
+        let rpc = node { _ in #"{"jsonrpc":"2.0","id":1,"result":"5j7sSignature"}"# }
+        let signature = try await rpc.send(transaction: Data([1, 2, 3]))
+        XCTAssertEqual(signature, "5j7sSignature")
+    }
+
+    /// A JSON-RPC refusal arrives with HTTP 200, and the node's own words are
+    /// the only explanation there will be.
+    func testARefusalCarriesTheNodesOwnWords() async {
+        let rpc = node { _ in
+            #"{"jsonrpc":"2.0","id":1,"error":{"code":-32002,"message":"Transaction simulation failed: Insufficient funds"}}"#
+        }
+        do {
+            _ = try await rpc.send(transaction: Data([1]))
+            XCTFail("a refusal was read as a success")
+        } catch let failure as ChainRPC.Failure {
+            XCTAssertEqual(failure, .node("Transaction simulation failed: Insufficient funds"))
+        } catch { XCTFail("wrong error: \(error)") }
+    }
+
+    // MARK: - Status
+
+    /// Nil is "the network has not heard of it", which within the blockhash's
+    /// lifetime means *not yet*, never a licence to send again.
+    func testAnUnknownSignatureIsNotAFailure() async throws {
+        let rpc = node { _ in #"{"jsonrpc":"2.0","id":1,"result":{"value":[null]}}"# }
+        let status = try await rpc.status(of: "sig")
+        XCTAssertNil(status)
+    }
+
+    func testAConfirmedTransactionReportsItsLevel() async throws {
+        let rpc = node { _ in
+            #"{"jsonrpc":"2.0","id":1,"result":{"value":[{"err":null,"confirmations":12,"confirmationStatus":"confirmed"}]}}"#
+        }
+        let status = try await rpc.status(of: "sig")
+        XCTAssertEqual(status?.failed, false)
+        XCTAssertEqual(status?.confirmations, 12)
+        XCTAssertEqual(status?.level, "confirmed")
+    }
+
+    /// On the chain and failed is not the same as sent.
+    func testAFailedTransactionIsNotASuccess() async throws {
+        let rpc = node { _ in
+            #"{"jsonrpc":"2.0","id":1,"result":{"value":[{"err":{"InstructionError":[0,"Custom"]},"confirmations":null,"confirmationStatus":"finalized"}]}}"#
+        }
+        let status = try await rpc.status(of: "sig")
+        XCTAssertEqual(status?.failed, true, "a failed transaction read as confirmed")
+        XCTAssertEqual(status?.isFinal, true)
+    }
+
+    /// Null confirmations means rooted, finalised, not unknown.
+    func testNullConfirmationsMeansFinalised() async throws {
+        let rpc = node { _ in
+            #"{"jsonrpc":"2.0","id":1,"result":{"value":[{"err":null,"confirmations":null,"confirmationStatus":"finalized"}]}}"#
+        }
+        let status = try await rpc.status(of: "sig")
+        XCTAssertEqual(status?.failed, false)
+        XCTAssertEqual(status?.isFinal, true)
+    }
+
+    // MARK: - The request itself
+
+    /// The node's default encoding is base58.
+    func testASendDeclaresBase64AndKeepsPreflight() async throws {
+        final class Box: @unchecked Sendable { var body: [String: Any]? }
+        let box = Box()
+        let rpc = ChainRPC(endpoint: URL(string: "https://node.example")!) { request in
+            box.body = request.httpBody.flatMap {
+                try? JSONSerialization.jsonObject(with: $0) as? [String: Any]
+            }
+            let response = HTTPURLResponse(
+                url: URL(string: "https://node.example")!,
+                statusCode: 200, httpVersion: nil, headerFields: nil)!
+            return (Data(#"{"jsonrpc":"2.0","id":1,"result":"sig"}"#.utf8), response)
+        }
+        _ = try await rpc.send(transaction: Data([9, 9, 9]))
+
+        let params = box.body?["params"] as? [Any]
+        XCTAssertEqual(params?.first as? String, Data([9, 9, 9]).base64EncodedString())
+        let options = params?.last as? [String: Any]
+        XCTAssertEqual(options?["encoding"] as? String, "base64")
+        // Preflight simulates against current state and refuses the obvious
+        // failures before a fee is taken.
+        XCTAssertEqual(options?["skipPreflight"] as? Bool, false)
+    }
+}
@@ -0,0 +1,153 @@
+import XCTest
+
+@testable import FilesEngine
+
+/// SLIP-0010 ed25519, against the published vectors.
+final class HDKeyTests: XCTestCase {
+
+    private struct Vectors: Decodable {
+        struct Step: Decodable {
+            let path: String
+            let chainCode: String
+            let privateKey: String
+            let publicKey: String
+        }
+        struct Case: Decodable {
+            let seed: String
+            let steps: [Step]
+        }
+        let vectors: [Case]
+    }
+
+    private var loaded: Vectors!
+
+    override func setUpWithError() throws {
+        let url = try XCTUnwrap(
+            Bundle.module.url(
+                forResource: "vectors/slip10-ed25519",
+                withExtension: "json"))
+        loaded = try JSONDecoder().decode(Vectors.self, from: try Data(contentsOf: url))
+    }
+
+    private func hex(_ s: String) -> Data {
+        let c = Array(s)
+        var out = Data()
+        for i in stride(from: 0, to: c.count, by: 2) {
+            out.append(UInt8(String(c[i...i + 1]), radix: 16)!)
+        }
+        return out
+    }
+    private func toHex(_ d: Data) -> String { d.map { String(format: "%02x", $0) }.joined() }
+
+    func testEveryPublishedVectorStepMatches() throws {
+        for (n, testCase) in loaded.vectors.enumerated() {
+            let seed = hex(testCase.seed)
+            for step in testCase.steps {
+                let key = try HDKey.master(seed: seed, path: step.path)
+                XCTAssertEqual(
+                    toHex(key.privateKey), step.privateKey,
+                    "vector \(n + 1) \(step.path): private key")
+                XCTAssertEqual(
+                    toHex(key.chainCode), step.chainCode,
+                    "vector \(n + 1) \(step.path): chain code")
+                XCTAssertEqual(
+                    toHex(try key.slip10PublicKey()), step.publicKey,
+                    "vector \(n + 1) \(step.path): public key")
+            }
+        }
+    }
+
+    /// `'` and `H` are both written in the wild for hardened.
+    func testApostropheAndHMeanTheSameThing() throws {
+        let seed = hex(loaded.vectors[0].seed)
+        XCTAssertEqual(
+            try HDKey.master(seed: seed, path: "m/0H/1H"),
+            try HDKey.master(seed: seed, path: "m/0'/1'"))
+    }
+
+    /// An unhardened index is REFUSED, not silently hardened.
+    func testAnUnhardenedPathIsRefused() throws {
+        let seed = hex(loaded.vectors[0].seed)
+        XCTAssertThrowsError(try HDKey.master(seed: seed, path: "m/44/501H/0H"))
+        XCTAssertThrowsError(try HDKey.master(seed: seed, path: "m/0"))
+    }
+
+    func testAnUnparseablePathIsRefused() throws {
+        let seed = hex(loaded.vectors[0].seed)
+        XCTAssertThrowsError(try HDKey.master(seed: seed, path: "m/notanumberH"))
+        XCTAssertThrowsError(try HDKey.master(seed: seed, path: "m/99999999999H"))
+    }
+
+    func testDerivationIsDeterministic() throws {
+        let seed = hex(loaded.vectors[0].seed)
+        XCTAssertEqual(
+            try HDKey.master(seed: seed, path: "m/44H/501H/0H/0H/7H"),
+            try HDKey.master(seed: seed, path: "m/44H/501H/0H/0H/7H"))
+    }
+
+    /// A different seed must move every key in the tree.
+    func testADifferentSeedGivesADifferentTree() throws {
+        let a = try HDKey.master(seed: hex(loaded.vectors[0].seed), path: "m/44H/501H/0H/0H/0H")
+        let b = try HDKey.master(seed: hex(loaded.vectors[1].seed), path: "m/44H/501H/0H/0H/0H")
+        XCTAssertNotEqual(a.privateKey, b.privateKey)
+        XCTAssertNotEqual(a.chainCode, b.chainCode)
+    }
+
+    func testASeedOfTheWrongSizeIsRefused() {
+        XCTAssertThrowsError(try HDKey.master(seed: Data(repeating: 0, count: 8)))
+        XCTAssertThrowsError(try HDKey.master(seed: Data(repeating: 0, count: 65)))
+        XCTAssertNoThrow(try HDKey.master(seed: Data(repeating: 0, count: 64)))
+    }
+
+    // MARK: - Accounts
+
+    /// The privacy property: every receive gets its own key.
+    func testEachReceiveKeyIsNew() throws {
+        var account = HDAccount(seed: Data(repeating: 7, count: 64), coinType: 501)
+        var seen = Set<Data>()
+        for expected in UInt32(0)..<UInt32(8) {
+            let (index, key) = try account.next()
+            XCTAssertEqual(index, expected)
+            XCTAssertTrue(
+                seen.insert(key.privateKey).inserted,
+                "receive key \(index) repeated an earlier one")
+        }
+        XCTAssertEqual(account.nextIndex, 8)
+    }
+
+    /// And they are recoverable: the phrase restores every one of them, so
+    /// handing out a fresh address costs no new backup.
+    func testAReceiveKeyIsRederivableFromTheSeedAlone() throws {
+        var account = HDAccount(seed: Data(repeating: 7, count: 64), coinType: 501)
+        _ = try account.next()
+        _ = try account.next()
+        let (index, key) = try account.next()
+
+        let fresh = HDAccount(seed: Data(repeating: 7, count: 64), coinType: 501)
+        XCTAssertEqual(try fresh.key(index: index).privateKey, key.privateKey)
+    }
+
+    func testThePathIsTheOrdinaryBIP44Shape() {
+        let account = HDAccount(seed: Data(repeating: 7, count: 64), coinType: 501, account: 2)
+        XCTAssertEqual(account.path(index: 5), "m/44H/501H/2H/0H/5H")
+    }
+
+    /// Nothing identifying is an input.
+    func testTwoAccountsAtTheSamePathDifferOnlyBySeed() throws {
+        let one = HDAccount(seed: Data(repeating: 1, count: 64), coinType: 501)
+        let two = HDAccount(seed: Data(repeating: 2, count: 64), coinType: 501)
+        XCTAssertNotEqual(try one.key(index: 0).privateKey, try two.key(index: 0).privateKey)
+
+        let same = HDAccount(seed: Data(repeating: 1, count: 64), coinType: 501)
+        XCTAssertEqual(try one.key(index: 0).privateKey, try same.key(index: 0).privateKey)
+    }
+
+    func testDifferentCoinsAndAccountsDoNotCollide() throws {
+        let seed = Data(repeating: 9, count: 64)
+        let solana = HDAccount(seed: seed, coinType: 501)
+        let other = HDAccount(seed: seed, coinType: 397)
+        let second = HDAccount(seed: seed, coinType: 501, account: 1)
+        XCTAssertNotEqual(try solana.key(index: 0).privateKey, try other.key(index: 0).privateKey)
+        XCTAssertNotEqual(try solana.key(index: 0).privateKey, try second.key(index: 0).privateKey)
+    }
+}
@@ -0,0 +1,298 @@
+import CryptoKit
+import Foundation
+import XCTest
+
+@testable import FilesEngine
+
+/// Interop against the published reference implementation.
+final class InteropTests: XCTestCase {
+    private struct Vectors: Decodable {
+        let version: Int
+        let cases: Cases
+
+        struct Cases: Decodable {
+            let labelBytes: [LabelCase]
+            let kdf: KDFCase
+            let hierarchy: Hierarchy
+            let nameDigest: [DigestCase]
+            let recovery: Recovery
+        }
+        struct LabelCase: Decodable {
+            let classification: Int16
+            let compartments: [Int]
+            let expected: String
+        }
+        struct KDFCase: Decodable {
+            let passphrase: String
+            let salt: String
+            let iterations: Int
+            let authSecret: String
+        }
+        struct DigestCase: Decodable {
+            let folderKey: String
+            let name: String
+            let expected: String
+        }
+        struct Recovery: Decodable {
+            let code: String
+            let entropy: String
+        }
+        struct Hierarchy: Decodable {
+            let label: LabelSpec
+            let identityPublicKey: String
+            let identityRecord: Identity.Record
+            let labelKey: String
+            let nodeKey: String
+            let contentKey: String
+            let labelKeyGrant: String
+            let wrappedNodeKey: String
+            let wrappedContentKey: String
+            let nameDigest: String
+            let nameCiphertext: String
+            let expectedName: String
+            let content: String
+            let expectedContent: String
+            let contentChunkSize: Int
+            struct LabelSpec: Decodable {
+                let classification: Int16
+                let compartments: [Int]
+            }
+        }
+    }
+
+    private var vectors: Vectors!
+
+    override func setUpWithError() throws {
+        let url = try XCTUnwrap(Bundle.module.url(forResource: "vectors/v1", withExtension: "json"))
+        vectors = try JSONDecoder().decode(Vectors.self, from: try Data(contentsOf: url))
+    }
+
+    private func b64(_ s: String) throws -> Data { try XCTUnwrap(Data(base64Encoded: s)) }
+    private var hierarchyLabel: Label {
+        Label(
+            classification: vectors.cases.hierarchy.label.classification,
+            compartments: Set(vectors.cases.hierarchy.label.compartments))
+    }
+
+    // MARK: §1
+
+    func testLabelEncodingMatchesTheReference() throws {
+        for entry in vectors.cases.labelBytes {
+            let label = Label(
+                classification: entry.classification, compartments: Set(entry.compartments))
+            XCTAssertEqual(
+                label.bytes, try b64(entry.expected),
+                "classification \(entry.classification) compartments \(entry.compartments)")
+        }
+    }
+
+    // MARK: §2
+
+    func testAuthSecretDerivationMatches() throws {
+        let c = vectors.cases.kdf
+        let derived = try KDF.authSecret(
+            passphrase: c.passphrase, salt: try b64(c.salt),
+            parameters: .init(id: 1, iterations: c.iterations)
+        )
+        XCTAssertEqual(derived, try b64(c.authSecret))
+    }
+
+    // MARK: §6
+
+    func testNameDigestsMatch() throws {
+        for entry in vectors.cases.nameDigest {
+            XCTAssertEqual(
+                Names.digest(folderKey: try b64(entry.folderKey), name: entry.name),
+                try b64(entry.expected), entry.name)
+        }
+    }
+
+    // MARK: §3-§7, the whole chain
+
+    func testUnlocksAnIdentityWrittenByTheBrowser() throws {
+        let h = vectors.cases.hierarchy
+        let identity = try Identity.unlock(
+            h.identityRecord, passphrase: vectors.cases.kdf.passphrase)
+        // The public half must match what the browser published for it.
+        XCTAssertEqual(identity.publicKey.rawRepresentation, try b64(h.identityPublicKey))
+    }
+
+    func testAcceptsALabelKeyGrantFromTheBrowser() throws {
+        let h = vectors.cases.hierarchy
+        let identity = try Identity.unlock(
+            h.identityRecord, passphrase: vectors.cases.kdf.passphrase)
+        let labelKey = try Keys.acceptLabelKey(
+            try b64(h.labelKeyGrant), label: hierarchyLabel,
+            privateKey: identity)
+        XCTAssertEqual(labelKey, try b64(h.labelKey))
+    }
+
+    func testUnwrapsTheKeyHierarchy() throws {
+        let h = vectors.cases.hierarchy
+        let nodeKey = try Keys.unwrapNodeKey(
+            try b64(h.wrappedNodeKey),
+            labelKey: try b64(h.labelKey), label: hierarchyLabel)
+        XCTAssertEqual(nodeKey, try b64(h.nodeKey))
+
+        let contentKey = try Keys.unwrapContentKey(
+            try b64(h.wrappedContentKey),
+            nodeKey: nodeKey, label: hierarchyLabel)
+        XCTAssertEqual(contentKey, try b64(h.contentKey))
+    }
+
+    func testDecryptsAFilenameFromTheBrowser() throws {
+        let h = vectors.cases.hierarchy
+        let name = try Names.decrypt(
+            folderKey: try b64(h.nodeKey), blob: try b64(h.nameCiphertext),
+            digest: try b64(h.nameDigest), label: hierarchyLabel)
+        XCTAssertEqual(name, h.expectedName)
+    }
+
+    func testDecryptsContentFromTheBrowser() throws {
+        let h = vectors.cases.hierarchy
+        let plaintext = try Content.decrypt(
+            try b64(h.content), contentKey: try b64(h.contentKey),
+            label: hierarchyLabel)
+        XCTAssertEqual(plaintext, try b64(h.expectedContent))
+    }
+
+    /// The label is authenticated everywhere, so a relabelled row must fail.
+    func testContentDoesNotOpenUnderADifferentLabel() throws {
+        let h = vectors.cases.hierarchy
+        let wrong = Label(classification: hierarchyLabel.classification, compartments: [])
+        XCTAssertThrowsError(
+            try Content.decrypt(
+                try b64(h.content),
+                contentKey: try b64(h.contentKey), label: wrong))
+    }
+}
+
+/// Recovery codes and identity protection.
+final class RecoveryTests: XCTestCase {
+    private struct RecoveryVectors: Decodable {
+        struct Case: Decodable {
+            let entropy: String
+            let code: String
+            let kdfSecret: String
+        }
+        let recovery: [Case]
+        let recoveryWithQ: Case
+    }
+
+    private var vectors: RecoveryVectors!
+
+    override func setUpWithError() throws {
+        let url = try XCTUnwrap(Bundle.module.url(forResource: "vectors/v1", withExtension: "json"))
+        vectors = try JSONDecoder().decode(RecoveryVectors.self, from: try Data(contentsOf: url))
+    }
+
+    /// The one that matters: codes written by the browser must decode here, and
+    /// this engine must produce the identical string from the same entropy.
+    func testAgreesWithTheBrowser() throws {
+        for expected in vectors.recovery + [vectors.recoveryWithQ] {
+            let entropy = try XCTUnwrap(Data(base64Encoded: expected.entropy))
+            XCTAssertEqual(try Recovery.encode(entropy), expected.code)
+            XCTAssertEqual(try Recovery.decode(expected.code), entropy)
+            XCTAssertEqual(Recovery.kdfSecret(entropy), expected.kdfSecret)
+        }
+    }
+
+    /// A code containing Q, decoded from paper: lower-cased, spaces instead of
+    /// dashes.
+    func testTheQCaseSurvivesTranscription() throws {
+        let expected = vectors.recoveryWithQ
+        XCTAssertTrue(expected.code.contains("Q"), "vector should contain a Q")
+        let mangled = expected.code.lowercased().replacingOccurrences(of: "-", with: " ")
+        XCTAssertEqual(
+            try Recovery.decode(mangled),
+            try XCTUnwrap(Data(base64Encoded: expected.entropy)))
+    }
+
+    func testCodeRoundTrips() throws {
+        for _ in 0..<200 {
+            let (entropy, code) = Recovery.generate()
+            XCTAssertEqual(code.replacingOccurrences(of: "-", with: "").count, 28)
+            XCTAssertEqual(try Recovery.decode(code), entropy)
+        }
+    }
+
+    /// The failure that shipped once: `Q` is a valid Crockford character, and
+    /// folding it to `0` corrupted roughly a third of all codes.
+    func testQIsNotFolded() throws {
+        XCTAssertEqual(Recovery.normalize("Q"), "Q")
+        XCTAssertEqual(Recovery.normalize("O"), "0")
+        XCTAssertEqual(Recovery.normalize("I"), "1")
+        XCTAssertEqual(Recovery.normalize("L"), "1")
+        // A code containing Q must still decode after a round trip through
+        // normalisation, which is what the fold used to break.
+        var found = false
+        for _ in 0..<500 where !found {
+            let (entropy, code) = Recovery.generate()
+            if code.contains("Q") {
+                found = true
+                XCTAssertEqual(try Recovery.decode(code.lowercased()), entropy)
+            }
+        }
+        XCTAssertTrue(found, "expected at least one code containing Q in 500 draws")
+    }
+
+    func testFormattingDoesNotChangeTheKey() throws {
+        let (entropy, code) = Recovery.generate()
+        let mangled = code.lowercased().replacingOccurrences(of: "-", with: " ")
+        XCTAssertEqual(try Recovery.decode(mangled), entropy)
+    }
+
+    func testChecksumCatchesATypo() throws {
+        let (_, code) = Recovery.generate()
+        var characters = Array(Recovery.normalize(code))
+        // Change one character to a different valid one.
+        characters[3] = characters[3] == "7" ? "8" : "7"
+        XCTAssertThrowsError(try Recovery.decode(String(characters)))
+    }
+
+    func testIdentityRecordRoundTrips() throws {
+        // A low iteration count: this asserts the format, not the work factor,
+        // and 650,000 rounds per case would make the suite unbearable.
+        let fast = KDF.Parameters(id: 1, iterations: 1_000)
+        let key = Identity.generate()
+        let record = try Identity.protect(key, passphrase: "correct horse", parameters: fast)
+        let opened = try Identity.unlock(record, passphrase: "correct horse")
+        XCTAssertEqual(opened.rawRepresentation, key.rawRepresentation)
+    }
+
+    func testTheWrongPassphraseDoesNotOpenIt() throws {
+        let fast = KDF.Parameters(id: 1, iterations: 1_000)
+        let record = try Identity.protect(Identity.generate(), passphrase: "one", parameters: fast)
+        XCTAssertThrowsError(try Identity.unlock(record, passphrase: "two"))
+    }
+
+    /// The passphrase and the recovery code wrap the same key independently, so
+    /// changing one must not disturb the other.
+    func testRecoveryOpensTheSameKey() throws {
+        let fast = KDF.Parameters(id: 1, iterations: 1_000)
+        let key = Identity.generate()
+        let (entropy, _) = Recovery.generate()
+        let byRecovery = try Identity.protectWithRecovery(key, entropy: entropy, parameters: fast)
+        let opened = try Identity.unlockWithRecovery(byRecovery, entropy: entropy)
+        XCTAssertEqual(opened.rawRepresentation, key.rawRepresentation)
+    }
+
+    /// Different contexts, so a record made for one secret cannot be opened as
+    /// the other's even when the derived material would otherwise line up.
+    func testRecoveryRecordIsNotAPassphraseRecord() throws {
+        let fast = KDF.Parameters(id: 1, iterations: 1_000)
+        let key = Identity.generate()
+        let (entropy, _) = Recovery.generate()
+        let byRecovery = try Identity.protectWithRecovery(key, entropy: entropy, parameters: fast)
+        XCTAssertEqual(byRecovery.context, KDF.Context.filesRecovery)
+        // Same secret material, wrong context: must not open.
+        XCTAssertThrowsError(
+            try Identity.unlock(
+                Identity.Record(
+                    v: 1, kdf: byRecovery.kdf, iterations: byRecovery.iterations,
+                    context: KDF.Context.filesIdentity,
+                    salt: byRecovery.salt, nonce: byRecovery.nonce,
+                    privateKey: byRecovery.privateKey),
+                passphrase: Recovery.kdfSecret(entropy)))
+    }
+}
@@ -0,0 +1,232 @@
+import CryptoKit
+import XCTest
+
+@testable import FilesEngine
+
+/// The bytes a signature covers.
+final class SolanaTransactionTests: XCTestCase {
+
+    // MARK: - Compact-u16
+
+    /// Published boundary values.
+    func testCompactU16MatchesTheDocumentedEncoding() {
+        XCTAssertEqual(Array(SolanaTransaction.compactU16(0)), [0x00])
+        XCTAssertEqual(Array(SolanaTransaction.compactU16(1)), [0x01])
+        XCTAssertEqual(Array(SolanaTransaction.compactU16(127)), [0x7f])
+        XCTAssertEqual(Array(SolanaTransaction.compactU16(128)), [0x80, 0x01])
+        XCTAssertEqual(Array(SolanaTransaction.compactU16(255)), [0xff, 0x01])
+        XCTAssertEqual(Array(SolanaTransaction.compactU16(256)), [0x80, 0x02])
+        XCTAssertEqual(Array(SolanaTransaction.compactU16(32767)), [0xff, 0xff, 0x01])
+    }
+
+    // MARK: - The transfer payload
+
+    /// Four bytes of discriminant, then eight of amount, both little-endian.
+    func testTheTransferPayloadIsTwelveBytes() {
+        let data = SolanaTransaction.transferData(lamports: 1)
+        XCTAssertEqual(data.count, 12)
+        XCTAssertEqual(Array(data.prefix(4)), [2, 0, 0, 0], "wrong discriminant")
+        XCTAssertEqual(Array(data.suffix(8)), [1, 0, 0, 0, 0, 0, 0, 0])
+    }
+
+    func testTheAmountIsLittleEndianAndExact() {
+        // A round number in decimal is not a round number in bytes.
+        let data = SolanaTransaction.transferData(lamports: 1_000_000_000)
+        XCTAssertEqual(Array(data.suffix(8)), [0x00, 0xca, 0x9a, 0x3b, 0, 0, 0, 0])
+    }
+
+    func testTheLargestAmountDoesNotOverflow() {
+        let data = SolanaTransaction.transferData(lamports: .max)
+        XCTAssertEqual(Array(data.suffix(8)), Array(repeating: 0xff, count: 8))
+    }
+
+    // MARK: - Addresses
+
+    /// The System Program is thirty-two zero bytes, which base58 prints as
+    /// thirty-two `1`s.
+    func testTheSystemProgramIsThirtyTwoZeroBytes() {
+        XCTAssertEqual(SolanaTransaction.systemProgramID.count, 32)
+        XCTAssertTrue(SolanaTransaction.systemProgramID.allSatisfy { $0 == 0 })
+        XCTAssertEqual(
+            Base58.encode(SolanaTransaction.systemProgramID),
+            String(repeating: "1", count: 32))
+    }
+
+    func testAnAddressRoundTrips() throws {
+        let key = Curve25519.Signing.PrivateKey().publicKey.rawRepresentation
+        let address = Base58.encode(key)
+        XCTAssertEqual(try SolanaTransaction.publicKey(fromAddress: address), key)
+    }
+
+    func testSurroundingWhitespaceIsForgiven() throws {
+        let key = Curve25519.Signing.PrivateKey().publicKey.rawRepresentation
+        let address = "  " + Base58.encode(key) + "\n"
+        XCTAssertEqual(try SolanaTransaction.publicKey(fromAddress: address), key)
+    }
+
+    func testAnAddressOfTheWrongLengthIsRefused() {
+        XCTAssertThrowsError(try SolanaTransaction.publicKey(fromAddress: "abc"))
+    }
+
+    /// `0`, `O`, `I` and `l` are outside the alphabet precisely so a hand-
+    /// copied address cannot become a different valid one.
+    func testACharacterOutsideTheAlphabetIsRefused() {
+        let key = Curve25519.Signing.PrivateKey().publicKey.rawRepresentation
+        let broken = Base58.encode(key).dropLast() + "0"
+        XCTAssertThrowsError(try SolanaTransaction.publicKey(fromAddress: String(broken)))
+    }
+
+    // MARK: - Refusals
+
+    func testZeroIsNotAnAmount() {
+        XCTAssertThrowsError(
+            try SolanaTransaction.transferMessage(
+                from: Data(repeating: 1, count: 32), to: Data(repeating: 2, count: 32),
+                lamports: 0, recentBlockhash: Data(repeating: 3, count: 32)))
+    }
+
+    func testSendingToYourselfIsRefused() {
+        let me = Data(repeating: 1, count: 32)
+        XCTAssertThrowsError(
+            try SolanaTransaction.transferMessage(
+                from: me, to: me, lamports: 1, recentBlockhash: Data(repeating: 3, count: 32)))
+    }
+
+    func testAShortBlockhashIsRefused() {
+        XCTAssertThrowsError(
+            try SolanaTransaction.transferMessage(
+                from: Data(repeating: 1, count: 32), to: Data(repeating: 2, count: 32),
+                lamports: 1, recentBlockhash: Data(repeating: 3, count: 31)))
+    }
+
+    // MARK: - Reading the message back
+
+    /// An independent walk of the documented layout.
+    private struct Decoded {
+        var requiredSignatures: UInt8
+        var readonlySigned: UInt8
+        var readonlyUnsigned: UInt8
+        var accounts: [Data]
+        var blockhash: Data
+        var programIndex: UInt8
+        var accountIndices: [UInt8]
+        var data: Data
+    }
+
+    private func decode(_ message: Data) throws -> Decoded {
+        var i = message.startIndex
+        func byte() -> UInt8 {
+            defer { i += 1 }
+            return message[i]
+        }
+        func take(_ n: Int) -> Data {
+            defer { i += n }
+            return message[i..<(i + n)]
+        }
+        func length() -> Int {
+            var value = 0
+            var shift = 0
+            while true {
+                let b = byte()
+                value |= Int(b & 0x7f) << shift
+                if b & 0x80 == 0 { return value }
+                shift += 7
+            }
+        }
+        let required = byte()
+        let roSigned = byte()
+        let roUnsigned = byte()
+        let accountCount = length()
+        var accounts: [Data] = []
+        for _ in 0..<accountCount { accounts.append(Data(take(32))) }
+        let blockhash = Data(take(32))
+        let instructionCount = length()
+        XCTAssertEqual(instructionCount, 1, "a transfer is one instruction")
+        let program = byte()
+        let indexCount = length()
+        var indices: [UInt8] = []
+        for _ in 0..<indexCount { indices.append(byte()) }
+        let dataLength = length()
+        let data = Data(take(dataLength))
+        XCTAssertEqual(i, message.endIndex, "trailing bytes after the instruction")
+        return Decoded(
+            requiredSignatures: required, readonlySigned: roSigned,
+            readonlyUnsigned: roUnsigned, accounts: accounts,
+            blockhash: blockhash, programIndex: program,
+            accountIndices: indices, data: data)
+    }
+
+    /// The header counts account categories BY POSITION.
+    func testAMessageDecodesToExactlyWhatWasAskedFor() throws {
+        let from = Data(repeating: 0xa1, count: 32)
+        let to = Data(repeating: 0xb2, count: 32)
+        let blockhash = Data(repeating: 0xc3, count: 32)
+
+        let message = try SolanaTransaction.transferMessage(
+            from: from, to: to, lamports: 1_500_000_000, recentBlockhash: blockhash)
+        let read = try decode(message)
+
+        XCTAssertEqual(read.requiredSignatures, 1)
+        XCTAssertEqual(read.readonlySigned, 0)
+        XCTAssertEqual(read.readonlyUnsigned, 1, "the program must be read-only")
+        XCTAssertEqual(
+            read.accounts, [from, to, SolanaTransaction.systemProgramID],
+            "account order is what the header describes")
+        XCTAssertEqual(read.blockhash, blockhash)
+        XCTAssertEqual(read.programIndex, 2, "the program is the third account")
+        XCTAssertEqual(read.accountIndices, [0, 1], "from, then to")
+        XCTAssertEqual(read.data, SolanaTransaction.transferData(lamports: 1_500_000_000))
+    }
+
+    /// The amount the bytes carry is the amount that was asked for.
+    func testTheAmountInTheBytesIsTheAmountRequested() throws {
+        for lamports: UInt64 in [1, 999, 1_000_000_000, 123_456_789_012] {
+            let message = try SolanaTransaction.transferMessage(
+                from: Data(repeating: 1, count: 32), to: Data(repeating: 2, count: 32),
+                lamports: lamports, recentBlockhash: Data(repeating: 3, count: 32))
+            let read = try decode(message)
+            let carried = read.data.suffix(8).reversed().reduce(UInt64(0)) {
+                ($0 << 8) | UInt64($1)
+            }
+            XCTAssertEqual(carried, lamports)
+        }
+    }
+
+    // MARK: - Signing
+
+    /// The signature must cover the message bytes exactly.
+    func testTheSignatureCoversTheMessageAndVerifies() throws {
+        let key = Curve25519.Signing.PrivateKey()
+        let from = key.publicKey.rawRepresentation
+        let message = try SolanaTransaction.transferMessage(
+            from: from, to: Data(repeating: 2, count: 32),
+            lamports: 42, recentBlockhash: Data(repeating: 3, count: 32))
+
+        let transaction = try SolanaTransaction.signed(message: message, key: key)
+
+        XCTAssertEqual(transaction[transaction.startIndex], 1, "one signature")
+        let signature = transaction[(transaction.startIndex + 1)..<(transaction.startIndex + 65)]
+        let carried = transaction[(transaction.startIndex + 65)...]
+        XCTAssertEqual(Data(carried), message, "the signed message was altered")
+        XCTAssertTrue(key.publicKey.isValidSignature(Data(signature), for: message))
+    }
+
+    /// And it must NOT verify against a different message, the check above
+    /// would pass on a signature scheme that ignored its input.
+    func testTheSignatureDoesNotVerifyAgainstAnotherMessage() throws {
+        let key = Curve25519.Signing.PrivateKey()
+        let from = key.publicKey.rawRepresentation
+        let one = try SolanaTransaction.transferMessage(
+            from: from, to: Data(repeating: 2, count: 32),
+            lamports: 42, recentBlockhash: Data(repeating: 3, count: 32))
+        let two = try SolanaTransaction.transferMessage(
+            from: from, to: Data(repeating: 2, count: 32),
+            lamports: 43, recentBlockhash: Data(repeating: 3, count: 32))
+
+        let transaction = try SolanaTransaction.signed(message: one, key: key)
+        let signature = transaction[(transaction.startIndex + 1)..<(transaction.startIndex + 65)]
+        XCTAssertFalse(
+            key.publicKey.isValidSignature(Data(signature), for: two),
+            "a signature verified against an amount it did not cover")
+    }
+}
@@ -0,0 +1,80 @@
+import XCTest
+
+@testable import FilesEngine
+
+final class WalletTests: XCTestCase {
+
+    private let kek = Data(repeating: 0x2b, count: 32)
+    private func words() throws -> [String] { try BIP39.englishWordlist() }
+    private func hex(_ s: String) -> Data {
+        let c = Array(s)
+        var out = Data()
+        for i in stride(from: 0, to: c.count, by: 2) {
+            out.append(UInt8(String(c[i...i + 1]), radix: 16)!)
+        }
+        return out
+    }
+
+    /// A record wrapped by the JavaScript, opened here.
+    func testAWalletRecordFromTheBrowserOpensHere() throws {
+        let record = hex(
+            "110bf45333f9d869b6cedd3167dbab1a9eaf77383dc50c8fb9ad18ce58c24a3afdf14accd0da11185c9ef20f33"
+        )
+        XCTAssertEqual(
+            try Wallet.unwrap(record: record, walletKEK: kek),
+            hex("0c1e24e5917779d297e14d45f14e1a1a"))
+        XCTAssertEqual(
+            try Wallet.phrase(record: record, walletKEK: kek, words: try words()),
+            "army van defense carry jealous true garbage claim echo media make crunch")
+    }
+
+    func testANewWalletsPhraseAndRecordDescribeTheSameSeed() throws {
+        let list = try words()
+        let made = try Wallet.create(walletKEK: kek, words: list)
+        XCTAssertEqual(made.phrase.split(separator: " ").count, 24)
+        XCTAssertEqual(
+            try Wallet.phrase(record: made.record, walletKEK: kek, words: list), made.phrase)
+        XCTAssertEqual(
+            try Wallet.seed(record: made.record, walletKEK: kek, words: list),
+            try BIP39.seed(from: made.phrase))
+    }
+
+    func testTwelveWordsAreAvailableForAnyoneWhoWantsThem() throws {
+        let made = try Wallet.create(walletKEK: kek, words: try words(), entropyBytes: 16)
+        XCTAssertEqual(made.phrase.split(separator: " ").count, 12)
+    }
+
+    /// A phrase from any other wallet restores the same addresses here.
+    func testAnImportedPhraseComesBackUnchanged() throws {
+        let list = try words()
+        let phrase = "army van defense carry jealous true garbage claim echo media make crunch"
+        let record = try Wallet.import(phrase: phrase, walletKEK: kek, words: list)
+        XCTAssertEqual(try Wallet.phrase(record: record, walletKEK: kek, words: list), phrase)
+    }
+
+    func testAPhraseThatFailsItsChecksumIsRefusedBeforeItIsStored() throws {
+        let list = try words()
+        XCTAssertThrowsError(
+            try Wallet.import(
+                phrase: "army van defense carry jealous true garbage claim echo media make abandon",
+                walletKEK: kek, words: list)
+        ) { XCTAssertEqual($0 as? BIP39.Failure, .checksumFailed) }
+    }
+
+    /// The wrap is authenticated, so a different account cannot open it and the
+    /// record cannot be moved between accounts by editing a column.
+    func testAnotherAccountsKeyDoesNotOpenTheRecord() throws {
+        let made = try Wallet.create(walletKEK: kek, words: try words())
+        XCTAssertThrowsError(
+            try Wallet.unwrap(record: made.record, walletKEK: Data(repeating: 0x2c, count: 32)))
+    }
+
+    /// The context string is part of the stored bytes.
+    func testTheRecordIsBoundToTheWalletContext() throws {
+        XCTAssertEqual(String(decoding: Wallet.aad, as: UTF8.self), "flamenet/wallet/seed/v1")
+        let made = try Wallet.create(walletKEK: kek, words: try words())
+        XCTAssertThrowsError(
+            try Wrap.openWithKey(
+                kek, blob: made.record, aad: Data("flamenet/files/identity/v1".utf8)))
+    }
+}
@@ -0,0 +1,28 @@
+{
+  "_source": "https://github.com/satoshilabs/slips/blob/master/slip-0010.md",
+  "_note": "The published SLIP-0010 ed25519 vectors, verbatim. Public keys carry the standard's 0x00 prefix.",
+  "vectors": [
+    {
+      "seed": "000102030405060708090a0b0c0d0e0f",
+      "steps": [
+        { "path": "m", "chainCode": "90046a93de5380a72b5e45010748567d5ea02bbf6522f979e05c0d8d8ca9fffb", "privateKey": "2b4be7f19ee27bbf30c667b642d5f4aa69fd169872f8fc3059c08ebae2eb19e7", "publicKey": "00a4b2856bfec510abab89753fac1ac0e1112364e7d250545963f135f2a33188ed" },
+        { "path": "m/0H", "chainCode": "8b59aa11380b624e81507a27fedda59fea6d0b779a778918a2fd3590e16e9c69", "privateKey": "68e0fe46dfb67e368c75379acec591dad19df3cde26e63b93a8e704f1dade7a3", "publicKey": "008c8a13df77a28f3445213a0f432fde644acaa215fc72dcdf300d5efaa85d350c" },
+        { "path": "m/0H/1H", "chainCode": "a320425f77d1b5c2505a6b1b27382b37368ee640e3557c315416801243552f14", "privateKey": "b1d0bad404bf35da785a64ca1ac54b2617211d2777696fbffaf208f746ae84f2", "publicKey": "001932a5270f335bed617d5b935c80aedb1a35bd9fc1e31acafd5372c30f5c1187" },
+        { "path": "m/0H/1H/2H", "chainCode": "2e69929e00b5ab250f49c3fb1c12f252de4fed2c1db88387094a0f8c4c9ccd6c", "privateKey": "92a5b23c0b8a99e37d07df3fb9966917f5d06e02ddbd909c7e184371463e9fc9", "publicKey": "00ae98736566d30ed0e9d2f4486a64bc95740d89c7db33f52121f8ea8f76ff0fc1" },
+        { "path": "m/0H/1H/2H/2H", "chainCode": "8f6d87f93d750e0efccda017d662a1b31a266e4a6f5993b15f5c1f07f74dd5cc", "privateKey": "30d1dc7e5fc04c31219ab25a27ae00b50f6fd66622f6e9c913253d6511d1e662", "publicKey": "008abae2d66361c879b900d204ad2cc4984fa2aa344dd7ddc46007329ac76c429c" },
+        { "path": "m/0H/1H/2H/2H/1000000000H", "chainCode": "68789923a0cac2cd5a29172a475fe9e0fb14cd6adb5ad98a3fa70333e7afa230", "privateKey": "8f94d394a8e8fd6b1bc2f3f49f5c47e385281d5c17e65324b0f62483e37e8793", "publicKey": "003c24da049451555d51a7014a37337aa4e12d41e485abccfa46b47dfb2af54b7a" }
+      ]
+    },
+    {
+      "seed": "fffcf9f6f3f0edeae7e4e1dedbd8d5d2cfccc9c6c3c0bdbab7b4b1aeaba8a5a29f9c999693908d8a8784817e7b7875726f6c696663605d5a5754514e4b484542",
+      "steps": [
+        { "path": "m", "chainCode": "ef70a74db9c3a5af931b5fe73ed8e1a53464133654fd55e7a66f8570b8e33c3b", "privateKey": "171cb88b1b3c1db25add599712e36245d75bc65a1a5c9e18d76f9f2b1eab4012", "publicKey": "008fe9693f8fa62a4305a140b9764c5ee01e455963744fe18204b4fb948249308a" },
+        { "path": "m/0H", "chainCode": "0b78a3226f915c082bf118f83618a618ab6dec793752624cbeb622acb562862d", "privateKey": "1559eb2bbec5790b0c65d8693e4d0875b1747f4970ae8b650486ed7470845635", "publicKey": "0086fab68dcb57aa196c77c5f264f215a112c22a912c10d123b0d03c3c28ef1037" },
+        { "path": "m/0H/2147483647H", "chainCode": "138f0b2551bcafeca6ff2aa88ba8ed0ed8de070841f0c4ef0165df8181eaad7f", "privateKey": "ea4f5bfe8694d8bb74b7b59404632fd5968b774ed545e810de9c32a4fb4192f4", "publicKey": "005ba3b9ac6e90e83effcd25ac4e58a1365a9e35a3d3ae5eb07b9e4d90bcf7506d" },
+        { "path": "m/0H/2147483647H/1H", "chainCode": "73bd9fff1cfbde33a1b846c27085f711c0fe2d66fd32e139d3ebc28e5a4a6b90", "privateKey": "3757c7577170179c7868353ada796c839135b3d30554bbb74a4b1e4a5a58505c", "publicKey": "002e66aa57069c86cc18249aecf5cb5a9cebbfd6fadeab056254763874a9352b45" },
+        { "path": "m/0H/2147483647H/1H/2147483646H", "chainCode": "0902fe8a29f9140480a00ef244bd183e8a13288e4412d8389d140aac1794825a", "privateKey": "5837736c89570de861ebc173b1086da4f505d4adb387c6a1b1342d5e4ac9ec72", "publicKey": "00e33c0f7d81d843c572275f287498e8d408654fdf0d1e065b84e2e6f157aab09b" },
+        { "path": "m/0H/2147483647H/1H/2147483646H/2H", "chainCode": "5d70af781f3a37b829f0d060924d5e960bdc02e85423494afc0b1a41bbe196d4", "privateKey": "551d333177df541ad876a60ea71f00447931c0a9da16f227c11ea080d7391b8d", "publicKey": "0047150c75db263559a70d5778bf36abbab30fb061ad69f69ece61a72b0cfa4fc0" }
+      ]
+    }
+  ]
+}
@@ -0,0 +1,136 @@
+{
+  "version": 1,
+  "note": "Decrypt these. See docs/SPEC.md.",
+  "cases": {
+    "labelBytes": [
+      {
+        "classification": 3,
+        "compartments": [
+          0
+        ],
+        "expected": "AAMAAAAAAAAAAQ=="
+      },
+      {
+        "classification": 1,
+        "compartments": [],
+        "expected": "AAEAAAAAAAAAAA=="
+      },
+      {
+        "classification": 0,
+        "compartments": [
+          63
+        ],
+        "expected": "AACAAAAAAAAAAA=="
+      },
+      {
+        "classification": 2,
+        "compartments": [
+          0,
+          1,
+          63
+        ],
+        "expected": "AAKAAAAAAAAAAw=="
+      }
+    ],
+    "kdf": {
+      "passphrase": "correct horse battery staple",
+      "salt": "BwcHBwcHBwcHBwcHBwcHBw==",
+      "iterations": 1000,
+      "contexts": {
+        "filesIdentity": "flamenet/files/identity/v1",
+        "filesAuth": "flamenet/files/auth/v1",
+        "messengerIdentity": "flamenet/messenger/identity/v1"
+      },
+      "authSecret": "67XBl7YK3eWLxlwCsQfvGZKiokbcY8mEqCw1E8QDxaE="
+    },
+    "hierarchy": {
+      "label": {
+        "classification": 3,
+        "compartments": [
+          0,
+          1
+        ]
+      },
+      "identityPublicKey": "rx6FBwu0ekejPG/KuVDGUjDGgpk1KeuneLAjxSQ4Ul0=",
+      "identityRecord": {
+        "v": 1,
+        "kdf": 1,
+        "iterations": 1000,
+        "context": "flamenet/files/identity/v1",
+        "salt": "3nW9N41kTjy+XV4MTrZpBw==",
+        "nonce": "/RfcIYNdqzoJjFJ0",
+        "privateKey": "Cq0gk03SqDC0QrYMdhyz/KwdwRxAaG95Cow0sE2+nilEjAnbgeDZPDSkKoZKSVla5Jv2Tf0AsDwYmGS01EWVGQ=="
+      },
+      "labelKey": "mdghL5vAIw5DeSsY9/BwRARhADaDBQnCxZDqeRHxl20=",
+      "nodeKey": "Xlb5FpmFRr06pADUaHGW9+uXIqtbhcnEVy2Ht8om3lM=",
+      "contentKey": "WP2IXXEHgqN9B4LosOtkeQgbfNgaqmLPSm9t02XQkc0=",
+      "labelKeyGrant": "Acacc9qfWCLxyXcc6rRTEyUDJxwdc0wxqy4UW8NSHwlhv/rvokK6kYMRfcTyUfXoE8H68Sk6nvIuC3sBAYMIcGkX/El9tUms+c90ffr+EbRZqyR16dREwtPowST+",
+      "wrappedNodeKey": "EUITJmLQVJgoL8z+lcfoKXIxHsGDWGVXDsxqdQnoPghuMvbD3eyhCCVT3lkDOQJ2sOKrfm8aAgEpzUSGMw==",
+      "wrappedContentKey": "EUQ1b+IbuxUblsm1gKGp1GWk8Tw3IsNNCGvTVwfQBA8OHLWmiHgpDburxl3GweXMzo9rFbhPazZkYKBsmw==",
+      "nameDigest": "zEu1hnRTyD+91Vke88XDSSVa/jfVERPIbMLB2kul4hY=",
+      "nameCiphertext": "AZlKWc9giJcswo4Fva4Ez7BhdljC5MfIsUpeSYz4LxwlAl9bobFz6Te/jCQ=",
+      "expectedName": "Q3 Forecast.txt",
+      "content": "RU5DTAEAAAAQfPLZFLMzaHtthhTgPXIbF6Q5iDW4RM+x97t9Ggd4lEJ3V1xMmyKvg8ISLjEUixPNrNGpzhx58+qfkj0pXqqzZijC",
+      "expectedContent": "cmV2ZW51ZTogNDEKaGVhZGNvdW50OiAxMgo=",
+      "contentChunkSize": 16
+    },
+    "nameDigest": [
+      {
+        "folderKey": "Xlb5FpmFRr06pADUaHGW9+uXIqtbhcnEVy2Ht8om3lM=",
+        "name": "Q3 Forecast.txt",
+        "expected": "zEu1hnRTyD+91Vke88XDSSVa/jfVERPIbMLB2kul4hY="
+      },
+      {
+        "folderKey": "Xlb5FpmFRr06pADUaHGW9+uXIqtbhcnEVy2Ht8om3lM=",
+        "name": "café",
+        "expected": "yiuuJ6pdJeJX7gQ3YJFGWbtu10Qz4VvUwE2cdWhMLB4="
+      },
+      {
+        "folderKey": "Xlb5FpmFRr06pADUaHGW9+uXIqtbhcnEVy2Ht8om3lM=",
+        "name": "Payroll",
+        "expected": "NN1zYjaALbTzp1MAf8dUNbfd/DVQVQ8jN3cN0DiEZt8="
+      }
+    ],
+    "recovery": {
+      "code": "BKKR-SJXB-E8M8-1A6B-CN47-WNM7-6RQN",
+      "entropy": "XOeMy6tyKICoy2VIflaHNg=="
+    }
+  },
+  "recovery": [
+    {
+      "entropy": "AEeO1RxjqvE4f8YNVJviKQ==",
+      "code": "013R-XN8W-CENF-2E3Z-RR6N-96Z2-57K9",
+      "kdfSecret": "00478ed51c63aaf1387fc60d549be229"
+    },
+    {
+      "entropy": "JWyz+kGIzxZdpOsyecAHTg==",
+      "code": "4NPB-7YJ1-H37H-CQD4-XCS7-KG07-9RBA",
+      "kdfSecret": "256cb3fa4188cf165da4eb3279c0074e"
+    },
+    {
+      "entropy": "SpHYH2at9DuCyRBXnuUscw==",
+      "code": "9A8X-G7V6-NQT3-Q0P9-21BS-XS9C-EE7C",
+      "kdfSecret": "4a91d81f66adf43b82c910579ee52c73"
+    },
+    {
+      "entropy": "b7b9RIvSGWCn7jV8wwpRmA==",
+      "code": "DYVF-TH4B-T8CP-19ZE-6NYC-62JH-K3JD",
+      "kdfSecret": "6fb6fd448bd21960a7ee357cc30a5198"
+    },
+    {
+      "entropy": "lNsiabD3PoXME1qh6C92vQ==",
+      "code": "JKDJ-4TDG-YWZ8-BK0K-BAGY-GBVP-QN2Y",
+      "kdfSecret": "94db2269b0f73e85cc135aa1e82f76bd"
+    },
+    {
+      "entropy": "uQBHjtUcY6rxOH/GDVSb4g==",
+      "code": "Q404-F3PN-3HHT-NW9R-FZ30-TN4V-W87R",
+      "kdfSecret": "b900478ed51c63aaf1387fc60d549be2"
+    }
+  ],
+  "recoveryWithQ": {
+    "entropy": "AB06V3SRrsvoBSI/XHmWsw==",
+    "code": "00EK-MNVM-J6QC-QT05-48ZN-RYCP-PDSA",
+    "kdfSecret": "001d3a577491aecbe805223f5c7996b3"
+  }
+}
@@ -0,0 +1,22 @@
+// swift-tools-version:6.0
+import PackageDescription
+
+/// Rules for the games played inside chats: chess, checkers, reversi and tic-tac-toe.
+///
+/// Both apps rebuild every game from its move log, so this package and the Android `:games`
+/// module have to agree move for move. `games-v1.json` holds the vectors both suites run.
+let package = Package(
+    name: "FlamenetGames",
+    platforms: [.iOS("26.0"), .macOS(.v13)],
+    products: [
+        .library(name: "FlamenetGames", targets: ["FlamenetGames"])
+    ],
+    targets: [
+        .target(name: "FlamenetGames"),
+        .testTarget(
+            name: "FlamenetGamesTests",
+            dependencies: ["FlamenetGames"],
+            resources: [.copy("Resources/games-v1.json")]
+        ),
+    ]
+)
@@ -0,0 +1,267 @@
+/// An English draughts position on squares 1-32 in standard PDN numbering.
+///
+/// Keeps the plies since the last capture or man move and the positions in that stretch, for the
+/// 80-ply draw and threefold repetition.
+public struct CheckersPosition: Hashable, Sendable {
+    /// Index 0 is square 1. First's (dark) men are 1 and kings 2; second's are -1 and -2.
+    let squares: [Int8]
+    public let sideToMove: Side
+    let quietPlies: Int
+    /// The positions since the last capture or man move, oldest first, ending with this one.
+    let history: [Key]
+
+    struct Key: Hashable, Sendable {
+        let squares: [Int8]
+        let side: Side
+    }
+
+    struct Move: Hashable, Sendable {
+        /// The starting square, then every square the piece lands on (indexes, not numbers).
+        let path: [Int]
+        let captures: Bool
+    }
+
+    init(squares: [Int8], side: Side, quietPlies: Int, earlier: [Key]) {
+        self.squares = squares
+        self.sideToMove = side
+        self.quietPlies = quietPlies
+        self.history = earlier + [Key(squares: squares, side: side)]
+    }
+
+    static let start = CheckersPosition(
+        setup: "B:W21,22,23,24,25,26,27,28,29,30,31,32:B1,2,3,4,5,6,7,8,9,10,11,12")!
+
+    var repetitions: Int {
+        let current = history[history.count - 1]
+        return history.reduce(0) { $0 + ($1 == current ? 1 : 0) }
+    }
+
+    /// Every move the rules allow, without the automatic draws: all capturing sequences when any
+    /// capture exists (not only the longest), otherwise all steps.
+    func movesByTheRules() -> [Move] {
+        let us: Int8 = sideToMove == .first ? 1 : -1
+        var board = squares
+        var path: [Int] = []
+        var jumps: [Move] = []
+        for from in 0..<32 where squares[from] != 0 && (squares[from] > 0) == (us > 0) {
+            path = [from]
+            CheckersRules.collectJumps(&board, from, squares[from], &path, &jumps)
+        }
+        if !jumps.isEmpty { return jumps }
+        var steps: [Move] = []
+        for from in 0..<32 where squares[from] != 0 && (squares[from] > 0) == (us > 0) {
+            for heading in CheckersRules.headings(for: squares[from]) {
+                let to = CheckersRules.neighbour[from][heading]
+                if to >= 0 && squares[to] == 0 {
+                    steps.append(Move(path: [from, to], captures: false))
+                }
+            }
+        }
+        return steps
+    }
+}
+
+extension CheckersPosition: GameRules {
+    var outcome: Outcome {
+        if movesByTheRules().isEmpty { return .win(sideToMove.opponent, .noMoves) }
+        if quietPlies >= 80 { return .draw(.fortyMoves) }
+        if repetitions >= 3 { return .draw(.repetition) }
+        return .ongoing
+    }
+
+    func legalMoveList() -> [Move] {
+        quietPlies >= 80 || repetitions >= 3 ? [] : movesByTheRules()
+    }
+
+    func notation(_ move: Move) -> String {
+        move.path.map { String($0 + 1) }.joined(separator: move.captures ? "x" : "-")
+    }
+
+    func applying(_ move: Move) -> CheckersPosition {
+        var board = squares
+        let piece = board[move.path[0]]
+        board[move.path[0]] = 0
+        if move.captures {
+            for (from, to) in zip(move.path, move.path.dropFirst()) {
+                let heading = (0..<4).first { CheckersRules.landing[from][$0] == to }!
+                board[CheckersRules.neighbour[from][heading]] = 0
+            }
+        }
+        let end = move.path[move.path.count - 1]
+        board[end] = CheckersRules.crowns(piece, at: end) ? piece * 2 : piece
+        let reset = move.captures || abs(piece) == 1
+        return CheckersPosition(
+            squares: board, side: sideToMove.opponent, quietPlies: reset ? 0 : quietPlies + 1,
+            earlier: reset ? [] : history)
+    }
+
+    /// `11-15` for a step, `15x24` or `15x24x31` for captures, squares 1-32 without leading zeros.
+    static func isWellFormed(_ text: String) -> Bool {
+        let step = text.contains("-")
+        guard step != text.contains("x") else { return false }
+        let parts = text.split(separator: step ? "-" : "x", omittingEmptySubsequences: false)
+        guard step ? parts.count == 2 : parts.count >= 2 else { return false }
+        return parts.allSatisfy { CheckersRules.number($0) != nil }
+    }
+
+    var board: Board {
+        var cells: [Piece?] = []
+        var names: [String?] = []
+        for row in 0..<8 {
+            for column in 0..<8 {
+                // The first player sees the standard diagram turned round, own men at the bottom.
+                guard let index = CheckersRules.index(row: 7 - row, column: 7 - column) else {
+                    cells.append(nil)
+                    names.append(nil)
+                    continue
+                }
+                let piece = squares[index]
+                cells.append(
+                    piece == 0
+                        ? nil
+                        : Piece(
+                            side: piece > 0 ? .first : .second, kind: abs(piece) == 2 ? .king : .man
+                        )
+                )
+                names.append(String(index + 1))
+            }
+        }
+        return Board(rows: 8, columns: 8, cells: cells, squares: names)
+    }
+
+    /// PDN FEN with the second (W) list first, as in `B:W21,...,32:B1,...,12`.
+    var setup: String {
+        func list(_ sign: Int8) -> String {
+            (0..<32).compactMap { index -> String? in
+                let piece = squares[index]
+                guard piece != 0, (piece > 0) == (sign > 0) else { return nil }
+                return (abs(piece) == 2 ? "K" : "") + String(index + 1)
+            }.joined(separator: ",")
+        }
+        return "\(sideToMove == .first ? "B" : "W"):W\(list(-1)):B\(list(1))"
+    }
+
+    /// Reads PDN FEN: the side to move (B first, W second), then both piece lists in either
+    /// order, K marking a king. A man on the row where it would have been crowned is refused.
+    init?(setup: String) {
+        let fields = setup.split(separator: ":", omittingEmptySubsequences: false)
+        guard fields.count == 3 else { return nil }
+        let side: Side
+        switch fields[0] {
+        case "B": side = .first
+        case "W": side = .second
+        default: return nil
+        }
+        var board = [Int8](repeating: 0, count: 32)
+        var listed: Set<Character> = []
+        for field in fields[1...] {
+            guard let colour = field.first, colour == "B" || colour == "W",
+                listed.insert(colour).inserted
+            else { return nil }
+            let sign: Int8 = colour == "B" ? 1 : -1
+            let items = field.dropFirst()
+            if items.isEmpty { continue }
+            for item in items.split(separator: ",", omittingEmptySubsequences: false) {
+                let crowned = item.first == "K"
+                guard let number = CheckersRules.number(crowned ? item.dropFirst() : item),
+                    board[number - 1] == 0
+                else { return nil }
+                let piece = crowned ? sign * 2 : sign
+                guard !CheckersRules.crowns(piece, at: number - 1) else { return nil }
+                board[number - 1] = piece
+            }
+        }
+        self.init(squares: board, side: side, quietPlies: 0, earlier: [])
+    }
+}
+
+enum CheckersRules {
+    /// Rows as in the standard diagram: row 0 holds squares 1-4, row 7 holds 29-32.
+    static func row(_ index: Int) -> Int { index / 4 }
+
+    static func column(_ index: Int) -> Int {
+        row(index) % 2 == 0 ? 2 * (index % 4) + 1 : 2 * (index % 4)
+    }
+
+    static func index(row: Int, column: Int) -> Int? {
+        guard row >= 0 && row < 8 && column >= 0 && column < 8 && (row + column) % 2 == 1 else {
+            return nil
+        }
+        return row * 4 + column / 2
+    }
+
+    /// (row, column) steps. Headings 0 and 1 lead toward row 7, where first's men are crowned.
+    static let steps = [(1, -1), (1, 1), (-1, -1), (-1, 1)]
+
+    /// The square one step away in each heading, or -1 off the board.
+    static let neighbour: [[Int]] = (0..<32).map { index in
+        steps.map { step in
+            CheckersRules.index(row: row(index) + step.0, column: column(index) + step.1) ?? -1
+        }
+    }
+
+    /// Where a jump in each heading lands, or -1 off the board.
+    static let landing: [[Int]] = (0..<32).map { index in
+        (0..<4).map { heading in
+            let next = neighbour[index][heading]
+            return next < 0 ? -1 : neighbour[next][heading]
+        }
+    }
+
+    static func headings(for piece: Int8) -> [Int] {
+        switch piece {
+        case 1: return [0, 1]
+        case -1: return [2, 3]
+        default: return [0, 1, 2, 3]
+        }
+    }
+
+    /// Whether a man that ends on `index` is crowned there.
+    static func crowns(_ piece: Int8, at index: Int) -> Bool {
+        (piece == 1 && row(index) == 7) || (piece == -1 && row(index) == 0)
+    }
+
+    /// A square number 1-32 written without leading zeros.
+    static func number(_ text: Substring) -> Int? {
+        let bytes = Array(text.utf8)
+        guard (1...2).contains(bytes.count), bytes[0] != UInt8(ascii: "0"),
+            bytes.allSatisfy({ (UInt8(ascii: "0")...UInt8(ascii: "9")).contains($0) }),
+            let value = Int(text), (1...32).contains(value)
+        else { return nil }
+        return value
+    }
+
+    /// Adds every complete capturing sequence for the piece on `at`. A sequence goes on while
+    /// the piece can jump again, and stops where a man is crowned. Captured pieces come off as
+    /// they are jumped; with one-square kings that is the same as lifting them at the end.
+    static func collectJumps(
+        _ board: inout [Int8], _ at: Int, _ piece: Int8, _ path: inout [Int],
+        _ found: inout [CheckersPosition.Move]
+    ) {
+        var jumped = false
+        for heading in headings(for: piece) {
+            let over = neighbour[at][heading]
+            let to = landing[at][heading]
+            guard to >= 0, board[to] == 0, board[over] != 0, (board[over] > 0) != (piece > 0)
+            else { continue }
+            jumped = true
+            let taken = board[over]
+            board[over] = 0
+            board[at] = 0
+            board[to] = piece
+            path.append(to)
+            if crowns(piece, at: to) {
+                found.append(CheckersPosition.Move(path: path, captures: true))
+            } else {
+                collectJumps(&board, to, piece, &path, &found)
+            }
+            path.removeLast()
+            board[to] = 0
+            board[at] = piece
+            board[over] = taken
+        }
+        if !jumped && path.count > 1 {
+            found.append(CheckersPosition.Move(path: path, captures: true))
+        }
+    }
+}
@@ -0,0 +1,595 @@
+/// A chess position.
+///
+/// Besides the placement it keeps what the rules need: castling rights, the en passant square
+/// (only while an en passant capture is legal, which is also what repetition compares), the
+/// clocks, and the positions since the last capture or pawn move, for threefold repetition.
+public struct ChessPosition: Hashable, Sendable {
+    /// Square 0 is a1, 7 is h1, 63 is h8. First's (white) pieces are positive, second's negative.
+    let squares: [Int8]
+    public let sideToMove: Side
+    let castling: UInt8
+    /// -1 when no en passant capture is legal.
+    let enPassant: Int
+    let halfmoveClock: Int
+    let fullmoveNumber: Int
+    /// The positions since the last capture or pawn move, oldest first, ending with this one.
+    let history: [Key]
+
+    /// What makes two positions the same for repetition.
+    struct Key: Hashable, Sendable {
+        let squares: [Int8]
+        let side: Side
+        let castling: UInt8
+        let enPassant: Int
+    }
+
+    struct Move: Hashable, Sendable {
+        let from: Int
+        let to: Int
+        /// 0, or the code of the piece a pawn becomes.
+        let promotion: Int8
+    }
+
+    init(
+        squares: [Int8], side: Side, castling: UInt8, enPassant: Int, clock: Int, fullmove: Int,
+        earlier: [Key]
+    ) {
+        self.squares = squares
+        self.sideToMove = side
+        self.castling = castling
+        self.enPassant = enPassant
+        self.halfmoveClock = clock
+        self.fullmoveNumber = fullmove
+        self.history =
+            earlier + [Key(squares: squares, side: side, castling: castling, enPassant: enPassant)]
+    }
+
+    static let start = ChessPosition(
+        setup: "rnbqkbnr/pppppppp/8/8/8/8/PPPPPPPP/RNBQKBNR w KQkq - 0 1")!
+
+    /// Whether the side to move is in check.
+    public var inCheck: Bool {
+        ChessRules.isAttacked(squares, kingSquare(sign), by: -sign)
+    }
+
+    var sign: Int8 { sideToMove == .first ? 1 : -1 }
+
+    func kingSquare(_ sign: Int8) -> Int {
+        // Every position has exactly one king a side: setup refuses anything else.
+        squares.firstIndex(of: sign * ChessRules.king)!
+    }
+
+    var repetitions: Int {
+        let current = history[history.count - 1]
+        return history.reduce(0) { $0 + ($1 == current ? 1 : 0) }
+    }
+
+    /// K v K, K+B v K, K+N v K, and K+B v K+B with both bishops on one colour. Nothing else.
+    var insufficientMaterial: Bool {
+        var others: [(piece: Int8, square: Int)] = []
+        for (square, piece) in squares.enumerated()
+        where piece != 0 && abs(piece) != ChessRules.king {
+            others.append((piece, square))
+            if others.count > 2 { return false }
+        }
+        switch others.count {
+        case 0:
+            return true
+        case 1:
+            let kind = abs(others[0].piece)
+            return kind == ChessRules.bishop || kind == ChessRules.knight
+        default:
+            let (a, b) = (others[0], others[1])
+            return abs(a.piece) == ChessRules.bishop && abs(b.piece) == ChessRules.bishop
+                && (a.piece > 0) != (b.piece > 0)
+                && ChessRules.colour(a.square) == ChessRules.colour(b.square)
+        }
+    }
+
+    var drawnAutomatically: Bool {
+        insufficientMaterial || halfmoveClock >= 100 || repetitions >= 3
+    }
+
+    /// Every move the rules of movement allow, without the automatic draws.
+    func movesByTheRules() -> [Move] {
+        let us = sign
+        let king = kingSquare(us)
+        var board = squares
+        var legal: [Move] = []
+        for move in pseudoLegalMoves() {
+            let moving = board[move.from]
+            let taken = board[move.to]
+            board[move.to] = move.promotion != 0 ? us * move.promotion : moving
+            board[move.from] = 0
+            var victim = -1
+            if abs(moving) == ChessRules.pawn && move.to == enPassant && taken == 0
+                && move.to % 8 != move.from % 8
+            {
+                victim = move.to - 8 * Int(us)
+                board[victim] = 0
+            }
+            let guarded = abs(moving) == ChessRules.king ? move.to : king
+            if !ChessRules.isAttacked(board, guarded, by: -us) {
+                legal.append(move)
+            }
+            board[move.from] = moving
+            board[move.to] = taken
+            if victim >= 0 { board[victim] = -us * ChessRules.pawn }
+        }
+        return legal
+    }
+
+    /// Moves by the pieces' rules of movement, before checking the mover's king is safe.
+    private func pseudoLegalMoves() -> [Move] {
+        let us = sign
+        var moves: [Move] = []
+        moves.reserveCapacity(64)
+        for from in 0..<64 {
+            let piece = squares[from]
+            guard piece != 0, (piece > 0) == (us > 0) else { continue }
+            switch abs(piece) {
+            case ChessRules.pawn: addPawnMoves(&moves, from)
+            case ChessRules.knight: addSteps(&moves, from, ChessRules.knightSteps)
+            case ChessRules.bishop: addSlides(&moves, from, ChessRules.diagonal)
+            case ChessRules.rook: addSlides(&moves, from, ChessRules.straight)
+            case ChessRules.queen:
+                addSlides(&moves, from, ChessRules.straight)
+                addSlides(&moves, from, ChessRules.diagonal)
+            default:
+                addSteps(&moves, from, ChessRules.kingSteps)
+                addCastling(&moves, from)
+            }
+        }
+        return moves
+    }
+
+    private func addPawnMoves(_ moves: inout [Move], _ from: Int) {
+        let us = sign
+        let file = from % 8
+        let rank = from / 8
+        // A pawn never stands on its last rank, so the rank ahead is always on the board.
+        let ahead = rank + Int(us)
+        let promotes = ahead == (us > 0 ? 7 : 0)
+        func add(_ to: Int) {
+            if promotes {
+                for piece in ChessRules.promotions {
+                    moves.append(Move(from: from, to: to, promotion: piece))
+                }
+            } else {
+                moves.append(Move(from: from, to: to, promotion: 0))
+            }
+        }
+        let one = ahead * 8 + file
+        if squares[one] == 0 {
+            add(one)
+            let two = one + 8 * Int(us)
+            if rank == (us > 0 ? 1 : 6) && squares[two] == 0 {
+                moves.append(Move(from: from, to: two, promotion: 0))
+            }
+        }
+        for step in [-1, 1] {
+            let target = file + step
+            guard target >= 0 && target < 8 else { continue }
+            let to = ahead * 8 + target
+            let there = squares[to]
+            if there != 0 && (there > 0) != (us > 0) {
+                add(to)
+            } else if there == 0 && to == enPassant {
+                moves.append(Move(from: from, to: to, promotion: 0))
+            }
+        }
+    }
+
+    private func addSteps(_ moves: inout [Move], _ from: Int, _ steps: [(Int, Int)]) {
+        let file = from % 8
+        let rank = from / 8
+        for (df, dr) in steps {
+            let f = file + df
+            let r = rank + dr
+            guard f >= 0 && f < 8 && r >= 0 && r < 8 else { continue }
+            let there = squares[r * 8 + f]
+            if there == 0 || (there > 0) != (sign > 0) {
+                moves.append(Move(from: from, to: r * 8 + f, promotion: 0))
+            }
+        }
+    }
+
+    private func addSlides(_ moves: inout [Move], _ from: Int, _ directions: [(Int, Int)]) {
+        let file = from % 8
+        let rank = from / 8
+        for (df, dr) in directions {
+            var f = file + df
+            var r = rank + dr
+            while f >= 0 && f < 8 && r >= 0 && r < 8 {
+                let there = squares[r * 8 + f]
+                if there == 0 || (there > 0) != (sign > 0) {
+                    moves.append(Move(from: from, to: r * 8 + f, promotion: 0))
+                }
+                if there != 0 { break }
+                f += df
+                r += dr
+            }
+        }
+    }
+
+    private func addCastling(_ moves: inout [Move], _ home: Int) {
+        let us = sign
+        guard home == (us > 0 ? 4 : 60) else { return }
+        let kingside = us > 0 ? ChessRules.whiteKingside : ChessRules.blackKingside
+        let queenside = us > 0 ? ChessRules.whiteQueenside : ChessRules.blackQueenside
+        let rook = us * ChessRules.rook
+        func attacked(_ square: Int) -> Bool {
+            ChessRules.isAttacked(squares, square, by: -us)
+        }
+        // Not out of, through or into check. On the queen's side b1 (b8) only has to be empty.
+        if castling & kingside != 0 && squares[home + 1] == 0 && squares[home + 2] == 0
+            && squares[home + 3] == rook && !attacked(home) && !attacked(home + 1)
+            && !attacked(home + 2)
+        {
+            moves.append(Move(from: home, to: home + 2, promotion: 0))
+        }
+        if castling & queenside != 0 && squares[home - 1] == 0 && squares[home - 2] == 0
+            && squares[home - 3] == 0 && squares[home - 4] == rook && !attacked(home)
+            && !attacked(home - 1) && !attacked(home - 2)
+        {
+            moves.append(Move(from: home, to: home - 2, promotion: 0))
+        }
+    }
+}
+
+extension ChessPosition: GameRules {
+    var outcome: Outcome {
+        if movesByTheRules().isEmpty {
+            return inCheck ? .win(sideToMove.opponent, .checkmate) : .draw(.stalemate)
+        }
+        if insufficientMaterial { return .draw(.insufficientMaterial) }
+        if halfmoveClock >= 100 { return .draw(.fiftyMoves) }
+        if repetitions >= 3 { return .draw(.repetition) }
+        return .ongoing
+    }
+
+    func legalMoveList() -> [Move] {
+        drawnAutomatically ? [] : movesByTheRules()
+    }
+
+    func notation(_ move: Move) -> String {
+        var text = ChessRules.name(move.from) + ChessRules.name(move.to)
+        if move.promotion != 0 {
+            text.append(ChessRules.letters[Int(move.promotion) - 1])
+        }
+        return text
+    }
+
+    func applying(_ move: Move) -> ChessPosition {
+        let us = sign
+        var board = squares
+        let moving = board[move.from]
+        let kind = abs(moving)
+        var captured = board[move.to] != 0
+        board[move.to] = move.promotion != 0 ? us * move.promotion : moving
+        board[move.from] = 0
+        if kind == ChessRules.pawn && move.to == enPassant && !captured
+            && move.to % 8 != move.from % 8
+        {
+            board[move.to - 8 * Int(us)] = 0
+            captured = true
+        }
+        if kind == ChessRules.king && abs(move.to - move.from) == 2 {
+            // Castling: the rook lands on the square the king crossed.
+            let (rookFrom, rookTo) =
+                move.to > move.from
+                ? (move.from + 3, move.from + 1) : (move.from - 4, move.from - 1)
+            board[rookTo] = board[rookFrom]
+            board[rookFrom] = 0
+        }
+        var rights = castling
+        if kind == ChessRules.king {
+            rights &=
+                us > 0
+                ? ~(ChessRules.whiteKingside | ChessRules.whiteQueenside)
+                : ~(ChessRules.blackKingside | ChessRules.blackQueenside)
+        }
+        rights &= ~ChessRules.rightTiedTo(move.from) & ~ChessRules.rightTiedTo(move.to)
+        var target = -1
+        if kind == ChessRules.pawn && abs(move.to - move.from) == 16 {
+            let skipped = (move.from + move.to) / 2
+            if ChessRules.enPassantIsLegal(board, target: skipped, by: -us) {
+                target = skipped
+            }
+        }
+        let reset = captured || kind == ChessRules.pawn
+        return ChessPosition(
+            squares: board, side: sideToMove.opponent, castling: rights, enPassant: target,
+            clock: reset ? 0 : halfmoveClock + 1,
+            fullmove: fullmoveNumber + (sideToMove == .second ? 1 : 0),
+            earlier: reset ? [] : history)
+    }
+
+    static func isWellFormed(_ text: String) -> Bool {
+        let bytes = Array(text.utf8)
+        guard bytes.count == 4 || bytes.count == 5 else { return false }
+        let files = UInt8(ascii: "a")...UInt8(ascii: "h")
+        let ranks = UInt8(ascii: "1")...UInt8(ascii: "8")
+        guard files.contains(bytes[0]), ranks.contains(bytes[1]), files.contains(bytes[2]),
+            ranks.contains(bytes[3])
+        else { return false }
+        return bytes.count == 4 || "qrbn".utf8.contains(bytes[4])
+    }
+
+    var board: Board {
+        var cells: [Piece?] = []
+        var names: [String?] = []
+        for row in 0..<8 {
+            for column in 0..<8 {
+                let square = (7 - row) * 8 + column
+                let piece = squares[square]
+                cells.append(
+                    piece == 0
+                        ? nil
+                        : Piece(
+                            side: piece > 0 ? .first : .second,
+                            kind: ChessRules.kinds[Int(abs(piece)) - 1]))
+                names.append(ChessRules.name(square))
+            }
+        }
+        return Board(rows: 8, columns: 8, cells: cells, squares: names)
+    }
+
+    /// FEN, with the en passant square shown only while the capture is legal.
+    var setup: String {
+        var text = ""
+        for rank in stride(from: 7, through: 0, by: -1) {
+            var empty = 0
+            for file in 0..<8 {
+                let piece = squares[rank * 8 + file]
+                if piece == 0 {
+                    empty += 1
+                    continue
+                }
+                if empty > 0 { text += String(empty) }
+                empty = 0
+                let letter = ChessRules.letters[Int(abs(piece)) - 1]
+                text.append(piece > 0 ? Character(letter.uppercased()) : letter)
+            }
+            if empty > 0 { text += String(empty) }
+            if rank > 0 { text += "/" }
+        }
+        var rights = ""
+        if castling & ChessRules.whiteKingside != 0 { rights += "K" }
+        if castling & ChessRules.whiteQueenside != 0 { rights += "Q" }
+        if castling & ChessRules.blackKingside != 0 { rights += "k" }
+        if castling & ChessRules.blackQueenside != 0 { rights += "q" }
+        let side = sideToMove == .first ? "w" : "b"
+        let target = enPassant >= 0 ? ChessRules.name(enPassant) : "-"
+        return
+            "\(text) \(side) \(rights.isEmpty ? "-" : rights) \(target) \(halfmoveClock) \(fullmoveNumber)"
+    }
+
+    /// Reads FEN (four or six fields). Refuses positions the rules cannot reach: a side without
+    /// exactly one king, a pawn on the first or last rank, the side not to move in check, or an
+    /// en passant square with no pawn that just made the double step.
+    init?(setup: String) {
+        let fields = setup.split(separator: " ", omittingEmptySubsequences: false)
+        guard fields.count == 6 || fields.count == 4 else { return nil }
+        let rows = fields[0].split(separator: "/", omittingEmptySubsequences: false)
+        guard rows.count == 8 else { return nil }
+        var board = [Int8](repeating: 0, count: 64)
+        for (index, row) in rows.enumerated() {
+            let rank = 7 - index
+            var file = 0
+            for character in row {
+                if let gap = character.wholeNumberValue, character.isASCII, (1...8).contains(gap) {
+                    file += gap
+                } else {
+                    guard file < 8, let code = ChessRules.code(character) else { return nil }
+                    board[rank * 8 + file] = code
+                    file += 1
+                }
+                guard file <= 8 else { return nil }
+            }
+            guard file == 8 else { return nil }
+        }
+        let side: Side
+        switch fields[1] {
+        case "w": side = .first
+        case "b": side = .second
+        default: return nil
+        }
+        var rights: UInt8 = 0
+        if fields[2] != "-" {
+            guard !fields[2].isEmpty else { return nil }
+            for character in fields[2] {
+                guard let bit = ChessRules.rightBits[character], rights & bit == 0 else {
+                    return nil
+                }
+                rights |= bit
+            }
+        }
+        // A right without its king and rook at home could never be used; drop it.
+        let rook = ChessRules.rook
+        let king = ChessRules.king
+        if board[4] != king || board[7] != rook { rights &= ~ChessRules.whiteKingside }
+        if board[4] != king || board[0] != rook { rights &= ~ChessRules.whiteQueenside }
+        if board[60] != -king || board[63] != -rook { rights &= ~ChessRules.blackKingside }
+        if board[60] != -king || board[56] != -rook { rights &= ~ChessRules.blackQueenside }
+
+        guard board.filter({ $0 == king }).count == 1, board.filter({ $0 == -king }).count == 1
+        else { return nil }
+        for file in 0..<8
+        where abs(board[file]) == ChessRules.pawn || abs(board[56 + file]) == ChessRules.pawn {
+            return nil
+        }
+        let us: Int8 = side == .first ? 1 : -1
+        guard let theirKing = board.firstIndex(of: -us * king),
+            !ChessRules.isAttacked(board, theirKing, by: us)
+        else { return nil }
+
+        var target = -1
+        if fields[3] != "-" {
+            guard let square = ChessRules.square(named: fields[3]),
+                square / 8 == (us > 0 ? 5 : 2)
+            else { return nil }
+            // The pawn that stepped two squares stands in front of the target, its start is empty.
+            let pushed = square - 8 * Int(us)
+            let origin = square + 8 * Int(us)
+            guard board[pushed] == -us * ChessRules.pawn, board[square] == 0, board[origin] == 0
+            else { return nil }
+            if ChessRules.enPassantIsLegal(board, target: square, by: us) {
+                target = square
+            }
+        }
+        var clock = 0
+        var fullmove = 1
+        if fields.count == 6 {
+            guard let c = Int(fields[4]), c >= 0, let f = Int(fields[5]), f >= 1 else {
+                return nil
+            }
+            clock = c
+            fullmove = f
+        }
+        self.init(
+            squares: board, side: side, castling: rights, enPassant: target, clock: clock,
+            fullmove: fullmove, earlier: [])
+    }
+}
+
+enum ChessRules {
+    static let pawn: Int8 = 1
+    static let knight: Int8 = 2
+    static let bishop: Int8 = 3
+    static let rook: Int8 = 4
+    static let queen: Int8 = 5
+    static let king: Int8 = 6
+
+    static let whiteKingside: UInt8 = 1
+    static let whiteQueenside: UInt8 = 2
+    static let blackKingside: UInt8 = 4
+    static let blackQueenside: UInt8 = 8
+    static let rightBits: [Character: UInt8] = [
+        "K": whiteKingside, "Q": whiteQueenside, "k": blackKingside, "q": blackQueenside,
+    ]
+
+    /// Indexed by piece code minus one.
+    static let letters: [Character] = ["p", "n", "b", "r", "q", "k"]
+    static let kinds: [PieceKind] = [.pawn, .knight, .bishop, .rook, .queen, .king]
+    /// The order promotions are listed in.
+    static let promotions: [Int8] = [queen, rook, bishop, knight]
+
+    /// (file, rank) steps.
+    static let knightSteps = [
+        (1, 2), (2, 1), (2, -1), (1, -2), (-1, -2), (-2, -1), (-2, 1), (-1, 2),
+    ]
+    static let kingSteps = [(0, 1), (1, 1), (1, 0), (1, -1), (0, -1), (-1, -1), (-1, 0), (-1, 1)]
+    static let straight = [(0, 1), (0, -1), (1, 0), (-1, 0)]
+    static let diagonal = [(1, 1), (-1, 1), (1, -1), (-1, -1)]
+
+    static func name(_ square: Int) -> String {
+        let file = Character(UnicodeScalar(UInt8(ascii: "a") + UInt8(square % 8)))
+        let rank = Character(UnicodeScalar(UInt8(ascii: "1") + UInt8(square / 8)))
+        return String([file, rank])
+    }
+
+    static func square(named text: Substring) -> Int? {
+        let bytes = Array(text.utf8)
+        guard bytes.count == 2,
+            (UInt8(ascii: "a")...UInt8(ascii: "h")).contains(bytes[0]),
+            (UInt8(ascii: "1")...UInt8(ascii: "8")).contains(bytes[1])
+        else { return nil }
+        return Int(bytes[1] - UInt8(ascii: "1")) * 8 + Int(bytes[0] - UInt8(ascii: "a"))
+    }
+
+    static func code(_ character: Character) -> Int8? {
+        guard character.isASCII,
+            let index = letters.firstIndex(of: Character(character.lowercased()))
+        else { return nil }
+        let code = Int8(index + 1)
+        return character.isUppercase ? code : -code
+    }
+
+    /// 0 for a dark square, 1 for a light one.
+    static func colour(_ square: Int) -> Int {
+        (square % 8 + square / 8) % 2
+    }
+
+    /// The castling right lost when a piece leaves or is taken on this corner.
+    static func rightTiedTo(_ square: Int) -> UInt8 {
+        switch square {
+        case 0: return whiteQueenside
+        case 7: return whiteKingside
+        case 56: return blackQueenside
+        case 63: return blackKingside
+        default: return 0
+        }
+    }
+
+    /// Whether a piece of the side with `sign` (1 white, -1 black) attacks `square`.
+    static func isAttacked(_ board: [Int8], _ square: Int, by sign: Int8) -> Bool {
+        let file = square % 8
+        let rank = square / 8
+        // A pawn attacks the rank ahead of it, so a white attacker stands one rank lower.
+        let pawnRank = rank - Int(sign)
+        if pawnRank >= 0 && pawnRank < 8 {
+            for step in [-1, 1] {
+                let f = file + step
+                if f >= 0 && f < 8 && board[pawnRank * 8 + f] == sign * pawn { return true }
+            }
+        }
+        if reaches(board, file, rank, knightSteps, sign * knight)
+            || reaches(board, file, rank, kingSteps, sign * king)
+        {
+            return true
+        }
+        return slides(board, file, rank, straight, sign * rook, sign * queen)
+            || slides(board, file, rank, diagonal, sign * bishop, sign * queen)
+    }
+
+    private static func reaches(
+        _ board: [Int8], _ file: Int, _ rank: Int, _ steps: [(Int, Int)], _ piece: Int8
+    ) -> Bool {
+        for (df, dr) in steps {
+            let f = file + df
+            let r = rank + dr
+            if f >= 0 && f < 8 && r >= 0 && r < 8 && board[r * 8 + f] == piece { return true }
+        }
+        return false
+    }
+
+    /// Whether the first piece met along any direction is `slider` or `queen`.
+    private static func slides(
+        _ board: [Int8], _ file: Int, _ rank: Int, _ directions: [(Int, Int)], _ slider: Int8,
+        _ queen: Int8
+    ) -> Bool {
+        for (df, dr) in directions {
+            var f = file + df
+            var r = rank + dr
+            while f >= 0 && f < 8 && r >= 0 && r < 8 {
+                let piece = board[r * 8 + f]
+                if piece != 0 {
+                    if piece == slider || piece == queen { return true }
+                    break
+                }
+                f += df
+                r += dr
+            }
+        }
+        return false
+    }
+
+    /// Whether the side with `sign` can legally capture en passant onto `target`.
+    static func enPassantIsLegal(_ board: [Int8], target: Int, by sign: Int8) -> Bool {
+        let victim = target - 8 * Int(sign)
+        guard let king = board.firstIndex(of: sign * self.king) else { return false }
+        for step in [-1, 1] {
+            let file = victim % 8 + step
+            guard file >= 0 && file < 8 else { continue }
+            let from = victim - victim % 8 + file
+            guard board[from] == sign * pawn else { continue }
+            var after = board
+            after[target] = sign * pawn
+            after[from] = 0
+            after[victim] = 0
+            if !isAttacked(after, king, by: -sign) { return true }
+        }
+        return false
+    }
+}
@@ -0,0 +1,284 @@
+/// The games played inside chats, by their wire names (DESIGN.md section 2).
+public enum GameType: String, CaseIterable, Hashable, Sendable {
+    case chess
+    case checkers
+    case reversi
+    case tictactoe
+
+    /// The longest log accepted for this game. A longer one is refused before any of it is played.
+    public var maxPlies: Int {
+        switch self {
+        case .chess: return 600
+        case .checkers: return 400
+        case .reversi: return 130
+        case .tictactoe: return 9
+        }
+    }
+
+    /// The side that played entry `index` (zero-based) of a log played from the start.
+    ///
+    /// Every entry, a reversi `pass` included, is one ply by the side to move, so the sides
+    /// alternate and entry 0 is always `first`'s. A receiver checks each new entry in a peer's log
+    /// against the peer's side with this.
+    public func side(ofPly index: Int) -> Side {
+        index % 2 == 0 ? .first : .second
+    }
+}
+
+/// Who plays. `first` is chess white, checkers dark, reversi black and tic-tac-toe X.
+public enum Side: String, CaseIterable, Hashable, Sendable {
+    case first
+    case second
+
+    public var opponent: Side { self == .first ? .second : .first }
+}
+
+/// Why a game was won. The raw values are the names used in `games-v1.json`.
+public enum WinReason: String, Hashable, Sendable {
+    case checkmate
+    /// Checkers: the side to move has no legal move, which includes having no pieces left.
+    case noMoves = "no-moves"
+    /// Reversi: neither side can move and the winner has more discs.
+    case moreDiscs = "more-discs"
+    case threeInARow = "three-in-a-row"
+}
+
+/// Why a game was drawn. The raw values are the names used in `games-v1.json`.
+public enum DrawReason: String, Hashable, Sendable {
+    case stalemate
+    case insufficientMaterial = "insufficient-material"
+    /// Chess: 100 plies without a capture or a pawn move.
+    case fiftyMoves = "fifty-moves"
+    /// Checkers: 80 plies without a capture or a man move.
+    case fortyMoves = "forty-moves"
+    /// The same position for the third time.
+    case repetition
+    /// Reversi: neither side can move and the discs are level.
+    case equalDiscs = "equal-discs"
+    case fullBoard = "full-board"
+}
+
+/// How a position stands. Resigning and agreed draws travel on the wire; only the natural ends
+/// that both sides compute from the log are here.
+public enum Outcome: Hashable, Sendable {
+    case ongoing
+    case win(Side, WinReason)
+    case draw(DrawReason)
+
+    public var isOver: Bool { self != .ongoing }
+}
+
+/// Why a move was refused.
+public enum MoveError: Error, Hashable, Sendable {
+    /// Not written in the game's notation, for example `E2E4` or `11 - 15`.
+    case malformed
+    /// Written correctly but not legal here. Every move is illegal once the game is over.
+    case illegal
+}
+
+/// Why a log could not be replayed.
+public enum ReplayError: Error, Hashable, Sendable {
+    /// The log is longer than `GameType.maxPlies` allows.
+    case tooLong(plies: Int, max: Int)
+    /// The entry at this zero-based index of the log was refused.
+    case atPly(Int, MoveError)
+}
+
+/// What a piece is. Checkers uses `man` and `king`, reversi `disc`, tic-tac-toe `mark`.
+public enum PieceKind: String, Hashable, Sendable {
+    case pawn
+    case knight
+    case bishop
+    case rook
+    case queen
+    case king
+    case man
+    case disc
+    case mark
+}
+
+/// One piece on the board.
+public struct Piece: Hashable, Sendable {
+    public let side: Side
+    public let kind: PieceKind
+
+    public init(side: Side, kind: PieceKind) {
+        self.side = side
+        self.kind = kind
+    }
+}
+
+/// A board for drawing. Row 0 is the top row as the first player sees the board: chess has rank
+/// 8 at the top, checkers has squares 29-32 there (dark's men start at the bottom), reversi has
+/// rank 1 there, tic-tac-toe has cells 1-3. Turn it round to show the second player's view.
+public struct Board: Hashable, Sendable {
+    public let rows: Int
+    public let columns: Int
+    /// Row-major from the top-left.
+    public let cells: [Piece?]
+    /// The wire name of each cell (`e4`, `15`, `d3`, `5`), nil where nothing can stand.
+    public let squares: [String?]
+
+    public func piece(row: Int, column: Int) -> Piece? {
+        cells[row * columns + column]
+    }
+
+    public func square(row: Int, column: Int) -> String? {
+        squares[row * columns + column]
+    }
+}
+
+/// A position in one of the four games. Values are immutable; applying a move makes a new one.
+public enum GamePosition: Hashable, Sendable {
+    case chess(ChessPosition)
+    case checkers(CheckersPosition)
+    case reversi(ReversiPosition)
+    case tictactoe(TicTacToePosition)
+
+    public var type: GameType {
+        switch self {
+        case .chess: return .chess
+        case .checkers: return .checkers
+        case .reversi: return .reversi
+        case .tictactoe: return .tictactoe
+        }
+    }
+
+    public var sideToMove: Side { rules.sideToMove }
+
+    public var board: Board { rules.board }
+
+    /// This position in its game's setup notation; see `Games.position(_:setup:)`.
+    public var setup: String { rules.setup }
+
+    var rules: any GameRules {
+        switch self {
+        case .chess(let p): return p
+        case .checkers(let p): return p
+        case .reversi(let p): return p
+        case .tictactoe(let p): return p
+        }
+    }
+}
+
+/// The rules engine for the chat games.
+///
+/// Moves are strings in the wire notation of DESIGN.md section 2. `apply` accepts exactly the
+/// strings `legalMoves` returns, so a log that one app wrote replays identically on the other.
+public enum Games {
+    public static func start(_ type: GameType) -> GamePosition {
+        switch type {
+        case .chess: return .chess(.start)
+        case .checkers: return .checkers(.start)
+        case .reversi: return .reversi(.start)
+        case .tictactoe: return .tictactoe(.start)
+        }
+    }
+
+    /// A position from a setup string, for tests and tools; the wire never carries one.
+    ///
+    /// Chess takes FEN. Checkers takes PDN FEN such as `B:W21,22:BK1,9` (B is the first, dark
+    /// side; K marks a king). Reversi takes eight rows of `x` (first), `o` and `-` from rank 1
+    /// to rank 8 split by `/`, a space and the side to move, `x` or `o`; tic-tac-toe the same
+    /// with three rows of three. Returns nil for anything malformed or impossible.
+    public static func position(_ type: GameType, setup: String) -> GamePosition? {
+        switch type {
+        case .chess: return ChessPosition(setup: setup).map { .chess($0) }
+        case .checkers: return CheckersPosition(setup: setup).map { .checkers($0) }
+        case .reversi: return ReversiPosition(setup: setup).map { .reversi($0) }
+        case .tictactoe: return TicTacToePosition(setup: setup).map { .tictactoe($0) }
+        }
+    }
+
+    /// Every legal move, empty once the game is over.
+    public static func legalMoves(_ position: GamePosition) -> [String] {
+        position.rules.legalNotations()
+    }
+
+    public static func apply(_ position: GamePosition, _ move: String) throws(MoveError)
+        -> GamePosition
+    {
+        switch position {
+        case .chess(let p): return .chess(try p.applying(notation: move))
+        case .checkers(let p): return .checkers(try p.applying(notation: move))
+        case .reversi(let p): return .reversi(try p.applying(notation: move))
+        case .tictactoe(let p): return .tictactoe(try p.applying(notation: move))
+        }
+    }
+
+    public static func outcome(_ position: GamePosition) -> Outcome {
+        position.rules.outcome
+    }
+
+    /// The position after a whole log played from the start.
+    public static func replay(_ type: GameType, _ log: [String]) throws(ReplayError)
+        -> GamePosition
+    {
+        guard log.count <= type.maxPlies else {
+            throw .tooLong(plies: log.count, max: type.maxPlies)
+        }
+        return try replay(from: start(type), log)
+    }
+
+    /// The position after `moves` played from `position`. An error names the index in `moves`.
+    public static func replay(from position: GamePosition, _ moves: [String]) throws(ReplayError)
+        -> GamePosition
+    {
+        var current = position
+        for (index, move) in moves.enumerated() {
+            do {
+                current = try apply(current, move)
+            } catch {
+                throw .atPly(index, error)
+            }
+        }
+        return current
+    }
+
+    /// The number of move sequences of length `depth`, for checking move generation.
+    public static func perft(_ position: GamePosition, depth: Int) -> Int {
+        position.rules.perft(depth)
+    }
+}
+
+/// What each game's position type provides to `Games`.
+protocol GameRules: Hashable, Sendable {
+    associatedtype Move
+
+    var sideToMove: Side { get }
+    var board: Board { get }
+    var setup: String { get }
+    var outcome: Outcome { get }
+
+    /// The legal moves, empty once the game is over.
+    func legalMoveList() -> [Move]
+    func notation(_ move: Move) -> String
+    func applying(_ move: Move) -> Self
+    /// Whether `text` is written in the game's notation, legal or not.
+    static func isWellFormed(_ text: String) -> Bool
+}
+
+extension GameRules {
+    func legalNotations() -> [String] {
+        legalMoveList().map(notation)
+    }
+
+    func applying(notation text: String) throws(MoveError) -> Self {
+        guard Self.isWellFormed(text) else { throw .malformed }
+        for move in legalMoveList() where notation(move) == text {
+            return applying(move)
+        }
+        throw .illegal
+    }
+
+    func perft(_ depth: Int) -> Int {
+        if depth <= 0 { return 1 }
+        let moves = legalMoveList()
+        if depth == 1 { return moves.count }
+        var total = 0
+        for move in moves {
+            total += applying(move).perft(depth - 1)
+        }
+        return total
+    }
+}
@@ -0,0 +1,141 @@
+/// A reversi position. Files a-h run left to right and ranks 1-8 top to bottom as the first
+/// player draws the board.
+public struct ReversiPosition: Hashable, Sendable {
+    /// Index is row * 8 + column: row 0 is rank 1, column 0 is file a. First's (black) discs
+    /// are 1, second's (white) -1.
+    let squares: [Int8]
+    public let sideToMove: Side
+
+    /// A square index, or `pass`.
+    typealias Move = Int
+    static let pass: Move = -1
+
+    static let start = ReversiPosition(
+        setup: "--------/--------/--------/---ox---/---xo---/--------/--------/-------- x")!
+
+    var sign: Int8 { sideToMove == .first ? 1 : -1 }
+}
+
+extension ReversiPosition: GameRules {
+    var outcome: Outcome {
+        if !legalMoveList().isEmpty { return .ongoing }
+        let first = squares.filter { $0 == 1 }.count
+        let second = squares.filter { $0 == -1 }.count
+        if first == second { return .draw(.equalDiscs) }
+        return .win(first > second ? .first : .second, .moreDiscs)
+    }
+
+    /// Placements, or `pass` only when there are none and the opponent has one. Empty when
+    /// neither side can place, which ends the game.
+    func legalMoveList() -> [Move] {
+        let mine = ReversiRules.placements(squares, sign)
+        if !mine.isEmpty { return mine }
+        return ReversiRules.placements(squares, -sign).isEmpty ? [] : [Self.pass]
+    }
+
+    func notation(_ move: Move) -> String {
+        move == Self.pass ? "pass" : ReversiRules.name(move)
+    }
+
+    func applying(_ move: Move) -> ReversiPosition {
+        guard move != Self.pass else {
+            return ReversiPosition(squares: squares, sideToMove: sideToMove.opponent)
+        }
+        var board = squares
+        board[move] = sign
+        for flipped in ReversiRules.flips(squares, move, sign) {
+            board[flipped] = sign
+        }
+        return ReversiPosition(squares: board, sideToMove: sideToMove.opponent)
+    }
+
+    static func isWellFormed(_ text: String) -> Bool {
+        text == "pass" || ReversiRules.square(named: text) != nil
+    }
+
+    var board: Board {
+        Board(
+            rows: 8, columns: 8,
+            cells: squares.map {
+                $0 == 0 ? nil : Piece(side: $0 > 0 ? .first : .second, kind: .disc)
+            },
+            squares: (0..<64).map { ReversiRules.name($0) })
+    }
+
+    var setup: String {
+        let rows = (0..<8).map { row in
+            String(squares[row * 8..<row * 8 + 8].map { $0 == 1 ? "x" : $0 == -1 ? "o" : "-" })
+        }
+        return rows.joined(separator: "/") + (sideToMove == .first ? " x" : " o")
+    }
+
+    /// Reads eight rows of `x`, `o` and `-` from rank 1 to rank 8 split by `/`, a space, and
+    /// the side to move.
+    init?(setup: String) {
+        let fields = setup.split(separator: " ", omittingEmptySubsequences: false)
+        guard fields.count == 2 else { return nil }
+        let rows = fields[0].split(separator: "/", omittingEmptySubsequences: false)
+        guard rows.count == 8, rows.allSatisfy({ $0.count == 8 }) else { return nil }
+        var board: [Int8] = []
+        for character in rows.joined() {
+            switch character {
+            case "x": board.append(1)
+            case "o": board.append(-1)
+            case "-": board.append(0)
+            default: return nil
+            }
+        }
+        switch fields[1] {
+        case "x": self.init(squares: board, sideToMove: .first)
+        case "o": self.init(squares: board, sideToMove: .second)
+        default: return nil
+        }
+    }
+}
+
+enum ReversiRules {
+    /// (row, column) steps.
+    static let steps = [(-1, -1), (-1, 0), (-1, 1), (0, -1), (0, 1), (1, -1), (1, 0), (1, 1)]
+
+    static func name(_ index: Int) -> String {
+        let file = Character(UnicodeScalar(UInt8(ascii: "a") + UInt8(index % 8)))
+        return String(file) + String(index / 8 + 1)
+    }
+
+    static func square(named text: String) -> Int? {
+        let bytes = Array(text.utf8)
+        guard bytes.count == 2,
+            (UInt8(ascii: "a")...UInt8(ascii: "h")).contains(bytes[0]),
+            (UInt8(ascii: "1")...UInt8(ascii: "8")).contains(bytes[1])
+        else { return nil }
+        return Int(bytes[1] - UInt8(ascii: "1")) * 8 + Int(bytes[0] - UInt8(ascii: "a"))
+    }
+
+    /// The discs a placement on `index` by the side with `sign` would turn over.
+    static func flips(_ board: [Int8], _ index: Int, _ sign: Int8) -> [Int] {
+        guard board[index] == 0 else { return [] }
+        var turned: [Int] = []
+        for (dr, dc) in steps {
+            var row = index / 8 + dr
+            var column = index % 8 + dc
+            var line: [Int] = []
+            while row >= 0 && row < 8 && column >= 0 && column < 8
+                && board[row * 8 + column] == -sign
+            {
+                line.append(row * 8 + column)
+                row += dr
+                column += dc
+            }
+            if !line.isEmpty && row >= 0 && row < 8 && column >= 0 && column < 8
+                && board[row * 8 + column] == sign
+            {
+                turned += line
+            }
+        }
+        return turned
+    }
+
+    static func placements(_ board: [Int8], _ sign: Int8) -> [Int] {
+        (0..<64).filter { !flips(board, $0, sign).isEmpty }
+    }
+}
@@ -0,0 +1,97 @@
+/// A tic-tac-toe position. Cells are named 1-9 row by row from the top-left; X moves first.
+public struct TicTacToePosition: Hashable, Sendable {
+    /// Cell 0 is `1`. X (first) is 1, O (second) is -1.
+    let cells: [Int8]
+    public let sideToMove: Side
+
+    /// A cell index.
+    typealias Move = Int
+
+    static let start = TicTacToePosition(cells: [Int8](repeating: 0, count: 9), sideToMove: .first)
+
+    static let lines = [
+        [0, 1, 2], [3, 4, 5], [6, 7, 8], [0, 3, 6], [1, 4, 7], [2, 5, 8], [0, 4, 8], [2, 4, 6],
+    ]
+
+    var winner: Side? {
+        for line in Self.lines where cells[line[0]] != 0 {
+            if cells[line[0]] == cells[line[1]] && cells[line[1]] == cells[line[2]] {
+                return cells[line[0]] > 0 ? .first : .second
+            }
+        }
+        return nil
+    }
+}
+
+extension TicTacToePosition: GameRules {
+    var outcome: Outcome {
+        if let winner { return .win(winner, .threeInARow) }
+        return cells.contains(0) ? .ongoing : .draw(.fullBoard)
+    }
+
+    func legalMoveList() -> [Move] {
+        winner != nil ? [] : (0..<9).filter { cells[$0] == 0 }
+    }
+
+    func notation(_ move: Move) -> String {
+        String(move + 1)
+    }
+
+    func applying(_ move: Move) -> TicTacToePosition {
+        var next = cells
+        next[move] = sideToMove == .first ? 1 : -1
+        return TicTacToePosition(cells: next, sideToMove: sideToMove.opponent)
+    }
+
+    static func isWellFormed(_ text: String) -> Bool {
+        text.utf8.count == 1 && (UInt8(ascii: "1")...UInt8(ascii: "9")).contains(text.utf8.first!)
+    }
+
+    var board: Board {
+        Board(
+            rows: 3, columns: 3,
+            cells: cells.map {
+                $0 == 0 ? nil : Piece(side: $0 > 0 ? .first : .second, kind: .mark)
+            },
+            squares: (1...9).map { String($0) })
+    }
+
+    var setup: String {
+        let rows = (0..<3).map { row in
+            String(cells[row * 3..<row * 3 + 3].map { $0 == 1 ? "x" : $0 == -1 ? "o" : "-" })
+        }
+        return rows.joined(separator: "/") + (sideToMove == .first ? " x" : " o")
+    }
+
+    /// Reads three rows of `x`, `o` and `-` split by `/`, a space, and the side to move, which
+    /// must be the one the counts say; a board where both sides have a line is refused.
+    init?(setup: String) {
+        let fields = setup.split(separator: " ", omittingEmptySubsequences: false)
+        guard fields.count == 2 else { return nil }
+        let rows = fields[0].split(separator: "/", omittingEmptySubsequences: false)
+        guard rows.count == 3, rows.allSatisfy({ $0.count == 3 }) else { return nil }
+        var cells: [Int8] = []
+        for character in rows.joined() {
+            switch character {
+            case "x": cells.append(1)
+            case "o": cells.append(-1)
+            case "-": cells.append(0)
+            default: return nil
+            }
+        }
+        let xs = cells.filter { $0 == 1 }.count
+        let os = cells.filter { $0 == -1 }.count
+        let side: Side
+        switch (fields[1], xs - os) {
+        case ("x", 0): side = .first
+        case ("o", 1): side = .second
+        default: return nil
+        }
+        let lines = Self.lines.filter { line in
+            cells[line[0]] != 0 && cells[line[0]] == cells[line[1]]
+                && cells[line[1]] == cells[line[2]]
+        }
+        guard Set(lines.map { cells[$0[0]] }).count < 2 else { return nil }
+        self.init(cells: cells, sideToMove: side)
+    }
+}
@@ -0,0 +1,114 @@
+import FlamenetGames
+import XCTest
+
+/// The parts of the API the vectors do not reach: names, caps, board orientation, setup refusals.
+final class GamesTests: XCTestCase {
+    func testWireNames() {
+        XCTAssertEqual(
+            GameType.allCases.map(\.rawValue), ["chess", "checkers", "reversi", "tictactoe"])
+        XCTAssertEqual(Side.allCases.map(\.rawValue), ["first", "second"])
+        XCTAssertEqual(GameType.allCases.map(\.maxPlies), [600, 400, 130, 9])
+    }
+
+    func testPliesAlternateFromFirst() {
+        for type in GameType.allCases {
+            XCTAssertEqual(
+                (0..<4).map { type.side(ofPly: $0) }, [.first, .second, .first, .second])
+        }
+    }
+
+    func testTheCapIsCheckedBeforeAnyMove() {
+        XCTAssertThrowsError(try Games.replay(.tictactoe, Array(repeating: "x", count: 10))) {
+            XCTAssertEqual($0 as? ReplayError, .tooLong(plies: 10, max: 9))
+        }
+    }
+
+    func testApplyReportsWhichKindOfRefusal() throws {
+        let start = Games.start(.chess)
+        XCTAssertThrowsError(try Games.apply(start, "e2e5")) {
+            XCTAssertEqual($0 as? MoveError, .illegal)
+        }
+        XCTAssertThrowsError(try Games.apply(start, "E2E4")) {
+            XCTAssertEqual($0 as? MoveError, .malformed)
+        }
+        let moved = try Games.apply(start, "e2e4")
+        XCTAssertEqual(start, Games.start(.chess), "applying a move left the old position alone")
+        XCTAssertEqual(moved, try Games.replay(.chess, ["e2e4"]))
+        XCTAssertEqual(moved.sideToMove, .second)
+    }
+
+    func testChessBoardHasRankEightOnTop() throws {
+        let board = Games.start(.chess).board
+        XCTAssertEqual(board.rows, 8)
+        XCTAssertEqual(board.square(row: 0, column: 0), "a8")
+        XCTAssertEqual(board.piece(row: 0, column: 0), Piece(side: .second, kind: .rook))
+        XCTAssertEqual(board.square(row: 7, column: 4), "e1")
+        XCTAssertEqual(board.piece(row: 7, column: 4), Piece(side: .first, kind: .king))
+        XCTAssertEqual(board.cells.compactMap { $0 }.count, 32)
+    }
+
+    func testChessReportsCheck() throws {
+        let mated = try Games.replay(.chess, ["f2f3", "e7e5", "g2g4", "d8h4"])
+        guard case .chess(let position) = mated else { return XCTFail("not chess") }
+        XCTAssertTrue(position.inCheck)
+    }
+
+    func testCheckersBoardHasTheFirstPlayersMenAtTheBottom() {
+        let board = Games.start(.checkers).board
+        XCTAssertEqual(
+            (0..<8).map { board.square(row: 7, column: $0) },
+            ["4", nil, "3", nil, "2", nil, "1", nil])
+        XCTAssertEqual(
+            (0..<8).map { board.square(row: 0, column: $0) },
+            [nil, "32", nil, "31", nil, "30", nil, "29"])
+        XCTAssertEqual(board.piece(row: 7, column: 0), Piece(side: .first, kind: .man))
+        XCTAssertEqual(board.piece(row: 0, column: 1), Piece(side: .second, kind: .man))
+        XCTAssertNil(board.piece(row: 4, column: 3))
+    }
+
+    func testReversiBoardHasRankOneOnTop() {
+        let board = Games.start(.reversi).board
+        XCTAssertEqual(board.square(row: 0, column: 0), "a1")
+        XCTAssertEqual(board.square(row: 3, column: 3), "d4")
+        XCTAssertEqual(board.piece(row: 3, column: 3), Piece(side: .second, kind: .disc))
+        XCTAssertEqual(board.piece(row: 3, column: 4), Piece(side: .first, kind: .disc))
+        XCTAssertEqual(board.piece(row: 4, column: 3), Piece(side: .first, kind: .disc))
+        XCTAssertEqual(board.piece(row: 4, column: 4), Piece(side: .second, kind: .disc))
+    }
+
+    func testTicTacToeBoardIsNumberedRowByRow() throws {
+        let board = try Games.replay(.tictactoe, ["5", "1"]).board
+        XCTAssertEqual(board.squares, ["1", "2", "3", "4", "5", "6", "7", "8", "9"])
+        XCTAssertEqual(board.piece(row: 1, column: 1), Piece(side: .first, kind: .mark))
+        XCTAssertEqual(board.piece(row: 0, column: 0), Piece(side: .second, kind: .mark))
+    }
+
+    func testImpossibleSetupsAreRefused() {
+        let refused: [(GameType, String)] = [
+            (.chess, "4k3/8/8/8/8/8/8/4K2K w - - 0 1"),  // two white kings
+            (.chess, "4k2P/8/8/8/8/8/8/4K3 w - - 0 1"),  // a pawn on the last rank
+            (.chess, "4k3/8/8/8/8/8/8/4K2R w - - 0 1 extra"),
+            (.chess, "4k3/4R3/8/8/8/8/8/4K3 w - - 0 1"),  // black in check with white to move
+            (.chess, "4k3/8/8/8/8/8/8/4K3 w - e6 0 1"),  // en passant with no pawn that stepped
+            (.chess, "4k3/8/8/8/8/8/8/4K3 w KK - 0 1"),
+            (.checkers, "B:W21:B29"),  // a dark man where it would have been crowned
+            (.checkers, "B:W21,21:B1"),
+            (.checkers, "B:W33:B1"),
+            (.checkers, "B:W21:W1"),
+            (.reversi, "--------/--------/--------/---ox---/---xo---/--------/--------/------- x"),
+            (.reversi, "--------/--------/--------/---ox---/---xo---/--------/--------/-------- b"),
+            (.tictactoe, "x--/---/--- x"),  // X has moved, so O is to move
+            (.tictactoe, "xxx/ooo/--- x"),
+        ]
+        for (type, setup) in refused {
+            XCTAssertNil(Games.position(type, setup: setup), setup)
+        }
+    }
+
+    func testSetupReadsBackTheStart() {
+        for type in GameType.allCases {
+            let start = Games.start(type)
+            XCTAssertEqual(Games.position(type, setup: start.setup), start, type.rawValue)
+        }
+    }
+}
@@ -0,0 +1,211 @@
+import FlamenetGames
+import Foundation
+import XCTest
+
+/// Runs `games-v1.json`. The Android `:games` module runs the same file, byte for byte, so the
+/// two engines agree on every vector or one of the suites is red.
+final class VectorTests: XCTestCase {
+    struct Vectors: Decodable {
+        let v: Int
+        let perft: [Perft]
+        let cases: [Case]
+    }
+
+    struct Perft: Decodable {
+        let name: String
+        let t: String
+        let setup: String?
+        let counts: [Int]
+        let deep: [[Int]]?
+    }
+
+    struct Case: Decodable {
+        let name: String
+        let t: String
+        let setup: String?
+        let log: [String]
+        let expect: Expect
+    }
+
+    struct Expect: Decodable {
+        let error: String?
+        let ply: Int?
+        let outcome: String?
+        let toMove: String?
+        let legal: [String]?
+        let includes: [String]?
+        let excludes: [String]?
+        let setup: String?
+        let trace: [Int]?
+    }
+
+    func loadVectors() throws -> Vectors {
+        let url = try XCTUnwrap(Bundle.module.url(forResource: "games-v1", withExtension: "json"))
+        return try JSONDecoder().decode(Vectors.self, from: Data(contentsOf: url))
+    }
+
+    func testPerftMatchesTheLiterature() throws {
+        for entry in try loadVectors().perft {
+            let position = try startingPosition(entry.t, entry.setup)
+            for (index, expected) in entry.counts.enumerated() {
+                assertPerft(entry.name, position, depth: index + 1, expected)
+            }
+        }
+    }
+
+    /// The deeper published counts take seconds to minutes, so they run only on request.
+    func testDeepPerft() throws {
+        guard ProcessInfo.processInfo.environment["FLAMENET_GAMES_DEEP"] == "1" else {
+            throw XCTSkip("set FLAMENET_GAMES_DEEP=1 to run the deep perft counts")
+        }
+        for entry in try loadVectors().perft {
+            let position = try startingPosition(entry.t, entry.setup)
+            for pair in entry.deep ?? [] {
+                assertPerft(entry.name, position, depth: pair[0], pair[1])
+            }
+        }
+    }
+
+    func testEveryCase() throws {
+        let cases = try loadVectors().cases
+        for vector in cases {
+            check(vector)
+        }
+        print("games-v1.json: \(cases.count) cases checked")
+    }
+
+    /// Guards against a vectors file that lost entries and still parses.
+    func testTheVectorsCoverEveryGame() throws {
+        let vectors = try loadVectors()
+        XCTAssertEqual(vectors.v, 1)
+        XCTAssertGreaterThanOrEqual(vectors.cases.count, 40)
+        for type in GameType.allCases {
+            XCTAssertGreaterThanOrEqual(
+                vectors.cases.filter { $0.t == type.rawValue }.count, 10, type.rawValue)
+            XCTAssertTrue(vectors.perft.contains { $0.t == type.rawValue }, type.rawValue)
+        }
+    }
+
+    private func assertPerft(_ name: String, _ position: GamePosition, depth: Int, _ expected: Int)
+    {
+        let clock = ContinuousClock()
+        var count = 0
+        let elapsed = clock.measure { count = Games.perft(position, depth: depth) }
+        print("perft \(name) depth \(depth): \(count) in \(elapsed)")
+        XCTAssertEqual(count, expected, "perft \(name) depth \(depth)")
+    }
+
+    private func startingPosition(_ name: String, _ setup: String?) throws -> GamePosition {
+        let type = try XCTUnwrap(GameType(rawValue: name), "no game called \(name)")
+        guard let setup else { return Games.start(type) }
+        return try XCTUnwrap(Games.position(type, setup: setup), "setup refused: \(setup)")
+    }
+
+    private func check(_ vector: Case) {
+        let name = vector.name
+        guard let start = try? startingPosition(vector.t, vector.setup),
+            let type = GameType(rawValue: vector.t)
+        else { return XCTFail("\(name): cannot start") }
+        let expect = vector.expect
+
+        let result: Result<GamePosition, ReplayError>
+        do throws(ReplayError) {
+            result = .success(
+                vector.setup == nil
+                    ? try Games.replay(type, vector.log) : try Games.replay(from: start, vector.log)
+            )
+        } catch {
+            result = .failure(error)
+        }
+
+        switch result {
+        case .failure(let error):
+            XCTAssertEqual(describe(error), expectedError(expect), name)
+        case .success(let position):
+            XCTAssertNil(expect.error, "\(name): played through, expected \(expectedError(expect))")
+            if let outcome = expect.outcome {
+                XCTAssertEqual(describe(Games.outcome(position)), outcome, name)
+            }
+            if let toMove = expect.toMove {
+                XCTAssertEqual(position.sideToMove.rawValue, toMove, name)
+            }
+            let legal = Games.legalMoves(position)
+            if let exact = expect.legal {
+                XCTAssertEqual(Set(legal), Set(exact), name)
+                XCTAssertEqual(legal.count, exact.count, "\(name): duplicate moves")
+            }
+            for move in expect.includes ?? [] {
+                XCTAssertTrue(legal.contains(move), "\(name): \(move) should be legal")
+            }
+            for move in expect.excludes ?? [] {
+                XCTAssertFalse(legal.contains(move), "\(name): \(move) should not be legal")
+            }
+            if let setup = expect.setup {
+                XCTAssertEqual(position.setup, setup, name)
+            }
+        }
+        walk(vector, from: start)
+    }
+
+    /// Plays the log one move at a time and checks what must hold at every step: the game is over
+    /// exactly when there are no legal moves, `apply` accepts exactly the listed moves, the side
+    /// to move is the one `side(ofPly:)` names, the setup string reads back unchanged, and the
+    /// number of legal moves matches `trace` when the vector has one.
+    private func walk(_ vector: Case, from start: GamePosition) {
+        let name = vector.name
+        let trace = vector.expect.trace
+        if let trace {
+            XCTAssertEqual(trace.count, vector.log.count + 1, "\(name): trace length")
+        }
+        var position = start
+        for (index, move) in vector.log.enumerated() {
+            let legal = Games.legalMoves(position)
+            if let trace, index < trace.count {
+                XCTAssertEqual(
+                    legal.count, trace[index], "\(name): legal moves before ply \(index)")
+            }
+            XCTAssertEqual(
+                Games.outcome(position).isOver, legal.isEmpty, "\(name): before ply \(index)")
+            if vector.setup == nil {
+                XCTAssertEqual(position.sideToMove, position.type.side(ofPly: index), name)
+            }
+            XCTAssertEqual(
+                Games.position(position.type, setup: position.setup)?.setup, position.setup,
+                "\(name): setup round trip before ply \(index)")
+            do {
+                position = try Games.apply(position, move)
+                XCTAssertTrue(legal.contains(move), "\(name): applied \(move), not listed")
+            } catch {
+                XCTAssertFalse(legal.contains(move), "\(name): refused \(move), but listed")
+                return
+            }
+        }
+        XCTAssertEqual(
+            Games.outcome(position).isOver, Games.legalMoves(position).isEmpty, "\(name): at end")
+        if let trace, let last = trace.last {
+            XCTAssertEqual(
+                Games.legalMoves(position).count, last, "\(name): legal moves at the end")
+        }
+    }
+
+    private func describe(_ outcome: Outcome) -> String {
+        switch outcome {
+        case .ongoing: return "ongoing"
+        case .win(let side, let reason): return "win \(side.rawValue) \(reason.rawValue)"
+        case .draw(let reason): return "draw \(reason.rawValue)"
+        }
+    }
+
+    private func describe(_ error: ReplayError) -> String {
+        switch error {
+        case .tooLong: return "too-long"
+        case .atPly(let ply, .malformed): return "malformed at \(ply)"
+        case .atPly(let ply, .illegal): return "illegal at \(ply)"
+        }
+    }
+
+    private func expectedError(_ expect: Expect) -> String {
+        guard let error = expect.error else { return "no error" }
+        return error == "too-long" ? error : "\(error) at \(expect.ply ?? -1)"
+    }
+}
@@ -0,0 +1,19 @@
+// swift-tools-version:5.9
+import PackageDescription
+
+/// Google's WebRTC binary, pinned by us rather than by a tag we do not control.
+let package = Package(
+    name: "WebRTCBinary",
+    platforms: [.iOS(.v14)],
+    products: [
+        .library(name: "WebRTC", targets: ["WebRTC"])
+    ],
+    targets: [
+        .binaryTarget(
+            name: "WebRTC",
+            url:
+                "https://github.com/stasel/WebRTC/releases/download/151.0.1/WebRTC-M151.xcframework.zip",
+            checksum: "6f3f5693383ce65763190c46ca9f2c4325c34b83681acb9db30f01488e15f1e0"
+        )
+    ]
+)
@@ -4,35 +4,50 @@ An end-to-end encrypted messenger: the apps, the server they talk to, and a
 specification complete enough that someone else could build a compatible
 client from it.

+The site is at <https://flamenetmessenger.com>, which is served by the relay in
+this family and explains what the apps do, what the server keeps, and where the
+limits are.
+
 This repository holds all of it, and is the source of truth for every part. A
 protocol and the thing that speaks it drifting apart in separate repositories is
-how "compatible" quietly stops being true — so the interop harness here compiles
+how "compatible" quietly stops being true, so the interop harness here compiles
 the iOS engine and runs it against the JavaScript one on every change, which only
 works while they sit in the same checkout.

 ```
-engine/     the JavaScript engine, the specification, and the published vectors
-server/     the Swift relay — protocol, mobile routes, and this project's website
-Sources/    the iOS app (SwiftUI), including its own Swift engine
-android/    the Kotlin engine. No app yet; see android/README.md
-docs/       historical design notes
+Sources/    the app (SwiftUI), including its Swift E2E engine
+Tests/      unit tests, run on any Mac, no device
+UITests/    the driven-simulator suites
+Resources/  assets, entitlements, the shared sticker manifest
+docs/       design notes, the roadmap, the padding design
 ```

-Two of those are also published on their own, for people who want one piece
-rather than the whole project:
+The rest of the product lives in its own repositories, each with its own
+pipeline:

-| Repo | Mirrors | For |
-|---|---|---|
-| [flamenet-e2e](https://gitlab.com/paulhitt/flamenet-e2e) | `engine/` | The protocol, as a package |
-| [flamenet-relay](https://gitlab.com/paulhitt/flamenet-relay) | `server/` | Running your own relay |
+| Repo | What it is |
+|---|---|
+| [flamenet-e2e](https://git.extant2000.com/extant2000/flamenet-e2e) | The protocol: JS engine, specification, published vectors, the interop driver |
+| [flamenet-relay](https://git.extant2000.com/extant2000/flamenet-relay) | The server |
+| [flamenet-messenger-android](https://git.extant2000.com/extant2000/flamenet-messenger-android) | The Android app |

-Those are **extracts, not forks**. Changes are made here and mirrored out; a
-patch sent to one of them has to land here or it will be overwritten. They have
-already drifted once, badly, which is why it is written down.
+those three lived here as subtrees, and the public
+repos were rsync extracts of them, refreshed by hand. The extracts drifted for
+days at a time. They are standalone now, split out with their history, work on
+each product happens in its own repository, and a patch to a subtree here has
+nowhere to go because the subtrees are gone.
+
+**What still spans repos**, and how it is wired rather than wished for:
+
+- `flamenet-e2e`'s interop driver compiles this app's `Sources/E2E/*.swift`,
+  it finds this repo as a sibling checkout, or via `FNMSG_APP_DIR`.
+- The Android engine fetches the published vectors from `flamenet-e2e` at HEAD
+  in CI rather than carrying a copy that would drift.
+- The relay's conformance job clones `flamenet-e2e` for the §8 harness.

 ## The three engines

-The protocol is implemented three times, and that is the point rather than an
+The protocol is implemented three times rather than an
 accident. Two implementations that agree may agree because one was written
 while reading the other; a third, written against the specification and the
 published vectors, is what finds the places where the spec says less than the
@@ -42,36 +57,55 @@ They are checked against each other rather than trusted:

 | Engine | Where | State |
 |---|---|---|
-| JavaScript | `engine/src/` | Complete — the reference implementation |
-| Swift | `Sources/E2E/` | Complete, and compiled directly into the interop harness rather than reimplemented for it |
-| Kotlin | `android/engine/` | Safety numbers and key transparency only — see `android/README.md` |
+| JavaScript | `flamenet-e2e/src/`, 8 files | Complete, the reference implementation, and the one the published vectors are generated from |
+| Swift | `Sources/E2E/`, 20 files | Complete, and compiled directly into the interop harness rather than reimplemented for it |
+| Kotlin | `flamenet-messenger-android/engine/`, 18 files | Complete: X3DH, the ratchet, sealed sender, the key-transparency log, safety numbers |

 ## Running the tests

+Each repository tests itself; there is no longer a command that runs all of
+them, because they are no longer one checkout.
+
 ```bash
-cd server && swift build          # the relay binary the suite drives
-cd ../engine && npm test          # 478 assertions across five suites
-cd ../android && ./gradlew :engine:test
+# this repo: the app's unit suite, the merge gate
+xcodegen generate && xcodebuild -project FlamenetMessenger.xcodeproj \
+  -scheme FlamenetMessenger -sdk iphonesimulator \
+  -destination "platform=iOS Simulator,name=iPhone 17" \
+  test -only-testing:FlamenetMessengerTests
 ```

-`npm test` runs conformance, ratchet, client, interop and relay. The interop
-suite compiles the iOS app's own `Sources/E2E/*.swift` and runs it against the
-JavaScript engine, so it needs a Mac; the relay suite drives the compiled Swift
-binary over real HTTP, so `swift build` has to have run first — a stale binary
-in `server/.build/` will happily pass tests for code you just changed.
+The cross-repository suites live in `flamenet-e2e` and need it checked out as a
+sibling of this one (or `FNMSG_APP_DIR` pointing here):
+
+```bash
+cd ../flamenet-e2e
+node test/conformance.mjs   # published vectors, both backends
+node test/interop.mjs       # compiles THIS app's Sources/E2E and runs it against the JS engine, needs a Mac
+node test/relay.mjs         # drives a compiled relay over real HTTP; needs FN_RELAY_DIR
+```
+
+`relay.mjs` drives a **binary**, so `swift build` in the relay checkout has
+to have run first, a stale binary passes tests for code you just changed.
+
+UI tests (`UITests/`) are not in any gate: they need a local relay on port
+18810 and, for the conversation suites, two booted simulators. Without the
+relay they **skip rather than fail**, so read the executed count and not the
+tick.

 ## Running the relay

+The server is its own repository now:
+
 ```bash
-cd server
+git clone https://git.extant2000.com/extant2000/flamenet-relay.git
+cd flamenet-relay
 cp .env.example .env    # then fill in the secrets it asks for
 docker compose up -d
 ```

 Open <http://localhost:8080>. The relay serves this project's website itself,
 so a working install explains what it is rather than answering with a 404.
-
-For production, see `server/DEPLOY.md`.
+For production, see that repository's `docs/HOSTING.md`.

 ## Building the iOS app

@@ -80,24 +114,33 @@ xcodegen generate
 open FlamenetMessenger.xcodeproj
 ```

-Requires Xcode and [XcodeGen](https://github.com/yonsm/XcodeGen)
-(`brew install xcodegen`). The app is pinned to `relay.flamenet.io`; the
-sign-in screen accepts another address for a relay you run yourself.
+Requires Xcode and [XcodeGen](https://github.com/yonaskolb/XcodeGen)
+(`brew install xcodegen`).

-The app has never been released. `SCOPING-v1.md` tracks what stands between it
-and a first TestFlight build.
+`FlamenetMessenger.xcodeproj/project.pbxproj` is **generated and gitignored**.
+Declare sources in `project.yml` and regenerate; never hand-edit it.

-## What is published, and what is not
+The app is pinned to `relay.flamenet.io`; the sign-in screen accepts another
+address for a relay you run yourself.

-`engine/` and `server/` are mirrored to a public repository under the MIT
-licence. The iOS app is not: the mirror is built from an allowlist rather than
-an ignore list, so a new directory here is private by default instead of
-published by accident. The mirror job is manual — a push to a public repository
-is the one step in this pipeline that cannot be undone.
+The app has not been released. `SCOPING-v1.md` tracks what stands between it and
+a first TestFlight build.
+
+## What is published
+
+All four repositories are public under the MIT licence, this one included.
+That was not always true: the app was private while the engine and server were
+mirrored out of it by an allowlist, and those mirrors were the
+only public copies. They are standalone repositories now, so what you are
+reading is the source rather than an extract of it.
+
+Being public is a constraint on what may be committed: **no keystores, no
+passphrases, no secrets, ever**, including in test fixtures and in the history.

 ## Where to read next

- The protocol: `engine/docs/SPEC.md`, also served at `/spec`
- What an auditor would need: `engine/docs/AUDIT-SCOPE.md`, served at `/audit`
+- The protocol: `flamenet-e2e/docs/SPEC.md`, also served at `/spec`
+- What an auditor would need: `flamenet-e2e/docs/AUDIT-SCOPE.md`, served at `/audit`
 - What the relay stores: served at `/metadata`
 - What is not done: served at `/roadmap`
+- How to contribute: [CONTRIBUTING.md](CONTRIBUTING.md) · security: [SECURITY.md](SECURITY.md)
@@ -0,0 +1,8 @@
+{
+  "images": [
+    { "filename": "logo@1x.png", "idiom": "universal", "scale": "1x" },
+    { "filename": "logo@2x.png", "idiom": "universal", "scale": "2x" },
+    { "filename": "logo@3x.png", "idiom": "universal", "scale": "3x" }
+  ],
+  "info": { "author": "xcode", "version": 1 }
+}
@@ -0,0 +1,23 @@
+{
+  "images": [
+    {
+      "filename": "mark@1x.png",
+      "idiom": "universal",
+      "scale": "1x"
+    },
+    {
+      "filename": "mark@2x.png",
+      "idiom": "universal",
+      "scale": "2x"
+    },
+    {
+      "filename": "mark@3x.png",
+      "idiom": "universal",
+      "scale": "3x"
+    }
+  ],
+  "info": {
+    "author": "xcode",
+    "version": 1
+  }
+}
@@ -7,5 +7,13 @@
 	     breaks debug builds, which then never receive a token. -->
 	<key>aps-environment</key>
 	<string>development</string>
+	<!-- Section 8.14: https://<relay>/add#... opens the app. The relay serves
+	     the matching apple-app-site-association (team M5923Y84P5, /add*).
+	     The App ID needs the Associated Domains capability to sign. -->
+	<key>com.apple.developer.associated-domains</key>
+	<array>
+		<string>applinks:relay.flamenet.io</string>
+		<string>applinks:relay1.flamenet.io</string>
+	</array>
 </dict>
 </plist>
@@ -18,12 +18,43 @@
 	<string>APPL</string>
 	<key>CFBundleShortVersionString</key>
 	<string>$(MARKETING_VERSION)</string>
+	<key>CFBundleURLTypes</key>
+	<array>
+		<dict>
+			<key>CFBundleURLName</key>
+			<string>io.flamenet.messenger.contact-link</string>
+			<key>CFBundleURLSchemes</key>
+			<array>
+				<string>flamenet</string>
+			</array>
+		</dict>
+		<dict>
+			<key>CFBundleTypeRole</key>
+			<string>Viewer</string>
+			<key>CFBundleURLName</key>
+			<string>net.flamenet.messenger.hello</string>
+			<key>CFBundleURLSchemes</key>
+			<array>
+				<string>flamenetmessenger</string>
+			</array>
+		</dict>
+	</array>
 	<key>CFBundleVersion</key>
 	<string>$(CURRENT_PROJECT_VERSION)</string>
+	<key>LSApplicationQueriesSchemes</key>
+	<array>
+		<string>cydia</string>
+		<string>sileo</string>
+		<string>zbra</string>
+	</array>
+	<key>NSCameraUsageDescription</key>
+	<string>Flamenet uses the camera to scan a contact's address code. Nothing is recorded and no image leaves your device.</string>
 	<key>NSFaceIDUsageDescription</key>
 	<string>Flamenet can require Face ID before opening the app, so somebody holding your unlocked phone cannot read your conversations.</string>
 	<key>NSMicrophoneUsageDescription</key>
 	<string>Flamenet uses the microphone for voice notes and voice calls, which are end-to-end encrypted before they leave your device.</string>
+	<key>NSPhotoLibraryAddUsageDescription</key>
+	<string>Flamenet can save a story you posted yourself to your photos, so you keep it after it disappears for everyone else. It only ever adds; it cannot see the photos you already have.</string>
 	<key>UIApplicationSceneManifest</key>
 	<dict>
 		<key>UIApplicationSupportsMultipleScenes</key>
@@ -32,6 +63,8 @@
 	<key>UIBackgroundModes</key>
 	<array>
 		<string>remote-notification</string>
+		<string>voip</string>
+		<string>audio</string>
 	</array>
 	<key>UILaunchScreen</key>
 	<dict/>
@@ -39,5 +72,12 @@
 	<array>
 		<string>UIInterfaceOrientationPortrait</string>
 	</array>
+	<key>UISupportedInterfaceOrientations~ipad</key>
+	<array>
+		<string>UIInterfaceOrientationPortrait</string>
+		<string>UIInterfaceOrientationPortraitUpsideDown</string>
+		<string>UIInterfaceOrientationLandscapeLeft</string>
+		<string>UIInterfaceOrientationLandscapeRight</string>
+	</array>
 </dict>
 </plist>
--- a/Show More
+++ b/Show More