docs: 2.0 screenshots of the library, the whole library and a title page

The episode, track, speed, chapter and sleep choosers and the More menu
live inside the player's controls, and the controls hide four seconds
after they come up while the video plays. Hiding them took the open
chooser with them, so a sheet being picked from closed at what looked
like random. The controls now hold still while a chooser is open.

.github/workflows/android.yml

@@ -39,8 +39,8 @@ env:
   CARGO_TERM_COLOR: always
   ANDROID_API: '36'
   ANDROID_BUILD_TOOLS: '37.0.0'
-  ANDROID_NDK: '29.0.14206865'
-  ANDROID_NDK_HOME: /usr/local/lib/android/sdk/ndk/29.0.14206865
+  ANDROID_NDK: '30.0.16248370'
+  ANDROID_NDK_HOME: /usr/local/lib/android/sdk/ndk/30.0.16248370
 
 jobs:
   build:
@@ -107,19 +107,34 @@ jobs:
           "build-tools;${ANDROID_BUILD_TOOLS}"
           "ndk;${ANDROID_NDK}"
 
-      - uses: dtolnay/rust-toolchain@stable
+      - id: toolchain
+        uses: dtolnay/rust-toolchain@stable
         with:
           toolchain: '1.96'
           targets: aarch64-linux-android,x86_64-linux-android
 
-      # One cache for both jobs: the signed build compiles the same crates for
-      # the same targets. Saved on failure too, so a run that breaks late does
-      # not throw away everything it compiled before the break.
+      # The registry and the installed helpers only. rust-cache reads
+      # `target/android/<triple>` as a profile directory and deletes the
+      # `release` tree under it before saving, so with its target caching on
+      # every run rebuilt both ABIs from scratch.
       - uses: Swatinem/rust-cache@v2.9.1
         with:
-          shared-key: android
+          shared-key: android-registry
+          cache-targets: false
           cache-on-failure: true
 
+      # The target directory as is: the host build the UniFFI bindings come
+      # from and both cargo-ndk ABIs. One entry for both jobs, since the signed
+      # build compiles the same crates for the same targets. A new lockfile
+      # starts from the last one's tree, so a version bump rebuilds only the
+      # workspace crates.
+      - id: target
+        uses: actions/cache/restore@v6
+        with:
+          path: target
+          key: rust-target-android-${{ steps.toolchain.outputs.cachekey }}-${{ hashFiles('Cargo.lock') }}
+          restore-keys: rust-target-android-${{ steps.toolchain.outputs.cachekey }}-
+
       # libmpv and its dependency tree are the slowest part of the build, and
       # depend only on the pinned revision and the build script, which stamps
       # its output with both and skips the build when the stamp matches. Built
@@ -167,6 +182,12 @@ jobs:
       - name: Android checks and artifacts
         run: bash scripts/build-android.sh all
 
+      - if: steps.target.outputs.cache-hit != 'true'
+        uses: actions/cache/save@v6
+        with:
+          path: target
+          key: ${{ steps.target.outputs.cache-primary-key }}
+
   signed-release:
     name: Signed release
     if: startsWith(github.ref, 'refs/tags/v') || inputs.signed_release
@@ -209,19 +230,34 @@ jobs:
           "build-tools;${ANDROID_BUILD_TOOLS}"
           "ndk;${ANDROID_NDK}"
 
-      - uses: dtolnay/rust-toolchain@stable
+      - id: toolchain
+        uses: dtolnay/rust-toolchain@stable
         with:
           toolchain: '1.96'
           targets: aarch64-linux-android,x86_64-linux-android
 
-      # One cache for both jobs: the signed build compiles the same crates for
-      # the same targets. Saved on failure too, so a run that breaks late does
-      # not throw away everything it compiled before the break.
+      # The registry and the installed helpers only. rust-cache reads
+      # `target/android/<triple>` as a profile directory and deletes the
+      # `release` tree under it before saving, so with its target caching on
+      # every run rebuilt both ABIs from scratch.
       - uses: Swatinem/rust-cache@v2.9.1
         with:
-          shared-key: android
+          shared-key: android-registry
+          cache-targets: false
           cache-on-failure: true
 
+      # The target directory as is: the host build the UniFFI bindings come
+      # from and both cargo-ndk ABIs. One entry for both jobs, since the signed
+      # build compiles the same crates for the same targets. A new lockfile
+      # starts from the last one's tree, so a version bump rebuilds only the
+      # workspace crates.
+      - id: target
+        uses: actions/cache/restore@v6
+        with:
+          path: target
+          key: rust-target-android-${{ steps.toolchain.outputs.cachekey }}-${{ hashFiles('Cargo.lock') }}
+          restore-keys: rust-target-android-${{ steps.toolchain.outputs.cachekey }}-
+
       # libmpv and its dependency tree are the slowest part of the build, and
       # depend only on the pinned revision and the build script, which stamps
       # its output with both and skips the build when the stamp matches. Built
@@ -266,6 +302,12 @@ jobs:
       - name: Build signed APK and AAB
         run: bash scripts/build-android.sh signed
 
+      - if: steps.target.outputs.cache-hit != 'true'
+        uses: actions/cache/save@v6
+        with:
+          path: target
+          key: ${{ steps.target.outputs.cache-primary-key }}
+
       # The APK bundles a GPL libmpv, so its corresponding source ships next to
       # it. The AAB is for Play only and stays out of the GitHub release.
       - name: Stage release files

.github/workflows/ci.yml

@@ -23,11 +23,11 @@ jobs:
 
       - uses: Swatinem/rust-cache@v2.9.1
 
-      # libmpv for pstr-player.
-      - name: Install libmpv
+      # libmpv for pstr-player, WebKitGTK for the CAPTCHA window.
+      - name: Install libmpv and WebKitGTK
         run: |
           sudo apt-get update
-          sudo apt-get install -y libmpv-dev
+          sudo apt-get install -y libmpv-dev libwebkit2gtk-4.1-dev
 
       - run: cargo fmt --all -- --check
 

.github/workflows/ios.yml

@@ -0,0 +1,71 @@
+name: iOS
+
+on:
+  push:
+    branches: [main]
+  workflow_call:
+  pull_request:
+    paths:
+      - 'ios/**'
+      - 'android/app/src/main/res/font/**'
+      - 'android/app/src/main/assets/licenses/**'
+      - 'crates/pstr-android/**'
+      - 'crates/pstr-core/**'
+      - 'crates/pstr-meta/**'
+      - 'crates/pstr-stream/**'
+      - 'Cargo.toml'
+      - 'Cargo.lock'
+      - 'scripts/build-ios.sh'
+      - '.github/workflows/ios.yml'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+env:
+  CARGO_TERM_COLOR: always
+
+jobs:
+  build:
+    name: Unit tests and unsigned .ipa
+    runs-on: macos-15
+    steps:
+      - uses: actions/checkout@v7
+
+      - id: toolchain
+        uses: dtolnay/rust-toolchain@stable
+        with:
+          toolchain: '1.96'
+          targets: aarch64-apple-ios,aarch64-apple-ios-sim
+
+      - name: Restore the Rust target tree
+        uses: actions/cache@v6
+        with:
+          path: |
+            ~/.cargo/registry
+            ~/.cargo/git
+            target
+          key: rust-target-ios-${{ steps.toolchain.outputs.cachekey }}-${{ hashFiles('Cargo.lock') }}
+          restore-keys: rust-target-ios-${{ steps.toolchain.outputs.cachekey }}-
+
+      - name: Install XcodeGen
+        run: brew install xcodegen
+
+      - name: Bindings
+        run: scripts/build-ios.sh bindings
+
+      - name: Unit tests on the simulator
+        run: scripts/build-ios.sh test
+
+      # SideStore and AltStore re-sign whatever they install with the viewer's
+      # own Apple ID, so the release artifact is unsigned.
+      - name: Unsigned .ipa
+        run: |
+          scripts/build-ios.sh rust
+          scripts/build-ios.sh ipa
+
+      - uses: actions/upload-artifact@v7
+        with:
+          name: ios
+          path: dist/*.ipa
+          if-no-files-found: error

.github/workflows/release.yml

@@ -76,7 +76,7 @@ jobs:
       - name: Install build dependencies
         run: |
           sudo apt-get update
-          sudo apt-get install -y libmpv-dev rpm
+          sudo apt-get install -y libmpv-dev libwebkit2gtk-4.1-dev rpm
 
       - name: Gate
         run: |
@@ -150,10 +150,17 @@ jobs:
       signed_release: true
     secrets: inherit
 
+  # The unsigned .ipa: SideStore and AltStore re-sign it with the viewer's own
+  # Apple ID when they install it.
+  ios:
+    name: iOS
+    needs: verify
+    uses: ./.github/workflows/ios.yml
+
   publish:
     name: Publish
     if: startsWith(github.ref, 'refs/tags/')
-    needs: [linux, windows, android]
+    needs: [linux, windows, android, ios]
     runs-on: ubuntu-24.04
     permissions:
       contents: write
@@ -172,6 +179,10 @@ jobs:
         with:
           name: android
           path: artifacts
+      - uses: actions/download-artifact@v8
+        with:
+          name: ios
+          path: artifacts
 
       - name: Checksums
         run: |

.github/workflows/wiki.yml

@@ -0,0 +1,68 @@
+name: Wiki
+
+# docs/ is the source of the GitHub wiki. Every change to the documentation
+# checks its links; a push to main publishes the result, so the wiki follows
+# main. Pull requests only check: nothing unmerged reaches the wiki. Run it from
+# the Actions tab to publish another ref, such as a release tag.
+on:
+  push:
+    branches: [main]
+    paths:
+      - 'docs/**'
+      - 'images/**'
+      - 'README.md'
+      - 'scripts/publish-wiki.sh'
+      - '.github/workflows/wiki.yml'
+  pull_request:
+    paths:
+      - 'docs/**'
+      - 'images/**'
+      - 'README.md'
+      - 'scripts/publish-wiki.sh'
+      - '.github/workflows/wiki.yml'
+  workflow_dispatch:
+    inputs:
+      ref:
+        description: 'Tag or branch to publish'
+        required: false
+        default: 'main'
+        type: string
+
+permissions:
+  contents: read
+
+jobs:
+  check:
+    name: Check documentation links
+    runs-on: ubuntu-24.04
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          ref: ${{ inputs.ref || github.sha }}
+
+      - name: Check links
+        run: scripts/publish-wiki.sh --check "$RUNNER_TEMP"
+
+  publish:
+    name: Publish to the wiki
+    needs: check
+    # Pull requests never publish.
+    if: github.event_name != 'pull_request'
+    runs-on: ubuntu-24.04
+    concurrency:
+      group: wiki-publish
+      cancel-in-progress: false
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          ref: ${{ inputs.ref || github.sha }}
+
+      - name: Publish
+        env:
+          WIKI_REMOTE: https://x-access-token:${{ github.token }}@github.com/${{ github.repository }}.wiki.git
+        run: |
+          git config --global user.name 'github-actions[bot]'
+          git config --global user.email '41898282+github-actions[bot]@users.noreply.github.com'
+          scripts/publish-wiki.sh --push "$RUNNER_TEMP"

Cargo.toml

@@ -11,7 +11,7 @@ members = [
 ]
 
 [workspace.package]
-version = "0.5.1"
+version = "2.0.1"
 edition = "2024"
 license = "MIT"
 repository = "https://github.com/narrrl/proton-stream"
@@ -28,8 +28,8 @@ authors = ["Nils Pukropp <contact@narl.io>"]
 opt-level = 2
 
 [workspace.dependencies]
-proton-sdk = { version = "0.7.2" }
-proton-drive-rs = { version = "0.7.2" }
+proton-sdk = { version = "0.9.0" }
+proton-drive-rs = { version = "0.9.0" }
 
 # Internal crates.
 pstr-core = { path = "crates/pstr-core" }
@@ -54,6 +54,8 @@ directories = "5"
 # Local dates for the history page. Already in the tree through the SDK.
 chrono = { version = "0.4", default-features = false, features = ["clock"] }
 sha2 = "0.10"
+# The id a watch-history file is named by. Already in the tree through the SDK.
+getrandom = "0.3"
 # `bundled` so a Windows build needs no system SQLite.
 rusqlite = { version = "0.32", features = ["bundled"] }
 # The share URL fragment and the custom password are both secrets; they go in
@@ -71,8 +73,10 @@ keyring = { version = "3" }
 clap = { version = "4", features = ["derive"] }
 # The UI. `glow` rather than `wgpu` because step two of the player hands mpv an
 # `MPV_RENDER_API_TYPE_OPENGL` context, and that has to be the same context
-# eframe is drawing into.
+# eframe is drawing into. `accesskit` hands the widget tree to the platform's
+# screen reader (AT-SPI, UI Automation, NSAccessibility).
 eframe = { version = "0.35", default-features = false, features = [
+    "accesskit",
     "default_fonts",
     "glow",
     "wayland",
@@ -103,6 +107,14 @@ dbus = "0.9"
 windows-sys = "0.61"
 # Toasts on Windows. Linux notifications go over the `dbus` above.
 tauri-winrt-notification = "0.8"
+# The exe's own icon resource, which is what Explorer and a taskbar pin draw.
+embed-resource = "3"
+# Proton's CAPTCHA page, which reports success by posting a message to its
+# host, so it needs a webview this app controls. Run in a child process of its
+# own (`pstr-app::verify`): tao and eframe's winit cannot share an event loop.
+# WebKitGTK on Linux, WebView2 on Windows, WKWebView on macOS.
+wry = { version = "0.57", default-features = false, features = ["os-webview"] }
+tao = { version = "0.37", default-features = false, features = ["rwh_06"] }
 rpassword = "7"
 libloading = "0.8"
 lru = "0.18"

PLAN.md

@@ -10,16 +10,38 @@ gained about twenty features on 2026-10-02 that Android does not have.
 
 ## Status (2026-10-03)
 
-Done: section 0, every parity item, the Library, Title, Shares and Settings
-redesigns, Inter, and screenshot tests. Not yet verified on a device; the
-host gate (ktlint, lint, unit and screenshot tests) and CI's build job pass.
+Done: section 0, every parity item, and every recommendation in section 2 —
+the Library, Title, Shares, Settings and Downloads redesigns, per-page app
+bars drawn edge to edge, search behind an icon, skeleton loading and
+generated placeholder art, Settings sub-pages and a language picker, a
+long-press Change match, Inter, light and tablet screenshots, the library
+and a title side by side from 840 dp, a poster-to-backdrop shared element
+transition, and predictive back on the title page.
 
-Open, from section 2: per-screen app bars and edge-to-edge under the status
-bar, skeleton loading and generated placeholder art, a search icon that
-expands, a language picker, Settings sub-pages, the Downloads page, light
-theme and tablet screenshots, `ListDetailPaneScaffold` on tablets, shared
-element transitions and predictive back, and a long-press Change match (the
-title page has it).
+Two departures from the text below. The tablet layout is a two-pane `Row`
+rather than `ListDetailPaneScaffold`, which would have added the
+`adaptive-layout` artifact for one split. Pull to refresh shows the
+indicator while a crawl runs, but not the crawl's progress.
+
+Not yet verified on a device; the host gate (ktlint, unit and screenshot
+tests) passes, and Android lint runs in CI.
+
+A source review on 2026-10-12 found these still short of the text below:
+
+- **Title page.** The backdrop scrolls away with the back button instead of
+  collapsing to a pinned bar, and the icon row has no mark-watched action.
+- **Episode rows** show the file size where runtime was asked for.
+- **Player episode list** is a bottom sheet in landscape too, not a side
+  panel.
+- **Storage** has a usage bar for the streaming cache only; offline episodes
+  have none.
+- **Metadata language** is still a free-text field.
+- **Touch targets.** The player's icons are 40 dp, under the 48 dp floor.
+- **Screenshots** do not cover the player, and only the library is taken at
+  font scale 1.5.
+
+Share rows now say how many files the last crawl found, when it ran and why it
+failed (section 2, Shares), as of the catalog's `share_crawls` table.
 
 ## 0. CI (done)
 

README.md

@@ -1,79 +1,145 @@
+<div align="center">
+
+<img src="images/logo.svg" alt="" width="112" height="112">
+
 # proton-stream
 
-A Netflix-style cross-platform client for **Proton Drive public links**.
+**Your Proton Drive, streaming.** A Netflix-style library for the videos in your Proton Drive and
+the share links people send you, on Linux, Windows, Android, Android TV and iOS.
 
-Paste a share URL and its password; get a browsable, streamable library. No
-Proton account, no server to host, no download step — episodes start playing in
-seconds and the seek bar works.
+**[proton-stream.narl.io](https://proton-stream.narl.io)**
 
-Built on [`proton-sdk-rs`](https://github.com/narrrl/proton-sdk-rs), a pure-Rust
-Proton Drive SDK.
+[![CI](https://github.com/narrrl/proton-stream/actions/workflows/ci.yml/badge.svg)](https://github.com/narrrl/proton-stream/actions/workflows/ci.yml)
+[![Release](https://img.shields.io/github/v/release/narrrl/proton-stream?sort=semver)](https://github.com/narrrl/proton-stream/releases/latest)
+[![License: MIT / GPL-3.0](https://img.shields.io/badge/license-MIT%20%2F%20GPL--3.0-blue.svg)](#license)
+[![Rust 1.96+](https://img.shields.io/badge/rust-1.96%2B-orange.svg)](https://www.rust-lang.org)
+[![Buy me a coffee](https://img.shields.io/badge/Buy%20me%20a%20coffee-FFDD00?logo=buymeacoffee&logoColor=black)](https://buymeacoffee.com/narl)
+
+<img src="images/desktop-home.png" alt="The library in the desktop app" width="820">
+
+</div>
+
+> [!IMPORTANT]
+> This is an **unofficial**, community-built client. It is not affiliated with, endorsed by, or
+> supported by Proton AG. "Proton" and "Proton Drive" are trademarks of Proton AG, used here only
+> to describe what the software talks to. It provides no content: it plays what you keep in
+> Proton Drive or what is shared with you.
+
+## Features
+
+**Library**
+
+- **Public share links or your own Drive.** Paste a share link, with its password if it has one,
+  or sign in and pick folders of your Drive. Any number of them merge into one library.
+- **Seasons and episodes from your folders.** The folder names the show, the file name gives the
+  season and episode, and a file without numbers is a film.
+- **Posters, synopses and shelves**, from AniList or TMDB, **off by default**: shelves such as
+  *Directed by* and *From MADHOUSE*, a franchise folded into one tile, and a hand-picked match
+  that is never overwritten.
+- **Filters and sorting:** series, films, watching, not started, downloaded; by name, last watched,
+  last added, air date, rating or popularity.
+
+**Player**
+
+- **Streams, never downloads first.** Episodes start in seconds, and a seek fetches only what it
+  lands on.
+- **libmpv inside the app's own window:** HEVC 10-bit, HDR and ASS subtitles with hardware
+  decoding, and no transcoding.
+- **Skip the opening and the ending** by chapter, an **Up next** countdown, and next and previous
+  episode.
+- **Subtitle files beside the video** (`.srt`, `.ass`, `.ssa`, `.vtt`), and **the dialogue track
+  over *Signs & Songs***. Audio and subtitle choices are remembered for each show.
+
+**Everywhere**
+
+- **Resume on any device.** Sign in, and your place in every episode, your shares and your
+  settings sync through your own Drive.
+- **Downloads** of an episode, a season or a show, to play offline.
+- **Android 12+ and Android TV** with Material 3, background audio and new-episode
+  notifications; **iOS 17+** as a SwiftUI port for SideStore and AltStore.
+- **Themes:** a near-black default, four Catppuccin flavours and Persona 5, each with nine accents.
+- **Full keyboard control** on the desktop, and the `pstr` command line.
+
+<table>
+  <tr>
+    <td width="50%"><img src="images/desktop-library.png" alt="The whole library, filtered and sorted"></td>
+    <td width="50%">
+      <img src="images/android-home.png" alt="Android: home" width="24%">
+      <img src="images/android-library.png" alt="Android: all titles" width="24%">
+      <img src="images/android-title.png" alt="Android: a title page" width="24%">
+      <img src="images/android-episodes.png" alt="Android: episodes and downloads" width="24%">
+    </td>
+  </tr>
+</table>
+
+## Install
+
+Every [release](https://github.com/narrrl/proton-stream/releases/latest) has:
+
+| Platform | Download |
+|---|---|
+| Debian, Ubuntu | `proton-stream_<version>-1_amd64.deb` |
+| Fedora | `proton-stream-<version>-1.x86_64.rpm` |
+| Other Linux | `proton-stream-<version>-x86_64-unknown-linux-gnu.tar.gz` |
+| Windows | `proton-stream-<version>-x64.msi`, or the portable `…-x86_64-windows.zip` |
+| Android, Android TV | `proton-stream-<version>-android.apk` |
+| iOS, iPadOS | `proton-stream-<version>-ios.ipa`, for SideStore or AltStore |
+
+```bash
+sudo apt install ./proton-stream_*_amd64.deb     # Debian, Ubuntu
+sudo dnf install ./proton-stream-*.x86_64.rpm    # Fedora
+cd packaging && makepkg -si                      # Arch, from a checkout
+```
+
+Then open **Proton Stream**, paste a share link on the **Shares** page (or press **Ctrl+V**), and
+the library fills in. [Getting started](docs/GETTING_STARTED.md) walks through it, and
+[Installation](docs/INSTALL.md) covers every platform, updating and uninstalling.
+
+## Documentation
+
+The [wiki](https://github.com/narrrl/proton-stream/wiki) is generated from [`docs/`](docs/) on
+every push to `main`:
+
+- [Getting started](docs/GETTING_STARTED.md), [Installation](docs/INSTALL.md) and the
+  [FAQ](docs/FAQ.md)
+- [User guide](docs/USER_GUIDE.md), [Account and sync](docs/ACCOUNT_AND_SYNC.md) and
+  [Android and iOS](docs/MOBILE.md)
+- [Command-line reference](docs/CLI.md), [Privacy](docs/PRIVACY.md) and
+  [Troubleshooting](docs/TROUBLESHOOTING.md)
+- For contributors: [Development](docs/DEVELOPMENT.md), [Architecture](docs/ARCHITECTURE.md),
+  [Testing](docs/TESTING.md), [Android](docs/ANDROID.md) and [iOS](docs/IOS.md)
 
 ## Why it works
 
-A Proton Drive file's content blocks are each a self-contained PGP packet
-decrypted under one shared session key. There is no sequential streaming session
-to resume, so seeking costs exactly the blocks the seek lands on — a 2 GB episode
-is playable without downloading 2 GB of it.
+A Proton Drive file's content blocks are each a self-contained PGP packet decrypted under one
+shared session key. There is no sequential streaming session to resume, so seeking costs exactly
+the blocks the seek lands on: a 2 GB episode plays without downloading 2 GB of it.
 
-## Status
+On a 761 MiB, 26-minute 1080p HEVC episode over a real password-protected link: **2.3 s to first
+frame, about 1.5 s to resume after dragging to an arbitrary point, and 61 MiB fetched for the
+first 38 seconds of playback.** Watch it again and the disk cache serves it with **no network at
+all**: 0.3 s to first frame.
 
-Early, but it is an app now: the picture lands **inside the window**, not in an
-mpv window of its own. The SDK streaming surface, the catalog, the streaming
-layer and the player are done and verified against a real share, and the app has
-a library wall, a page per title with seasons and episodes,
-resume-where-you-left-off, an overlay with a chapter-marked seek bar, a skip
-button for openings and endings, next/previous episode with an "up next"
-countdown, optional metadata, themes and share management. What is left is mostly sidecar subtitle files
-(`.srt`/`.ass` beside the video are invisible to the crawl today) and running the
-macOS packaging on a real Mac. See `docs/DEVELOPMENT.md`.
+The player is fed through an in-process mpv stream callback, not a local HTTP server, so there is
+no port another process could ask for the plaintext. [Architecture](docs/ARCHITECTURE.md) has the
+whole data flow.
 
-A native Android 12+ client is under `android/`, sharing the Rust catalog and
-streaming implementation through UniFFI. It features a modern Material 3 interface,
-an immersive fullscreen player with auto-hiding controls, and offline downloads.
-Its toolchain, emulator, signing, and release instructions are in [`docs/ANDROID.md`](docs/ANDROID.md).
+Built on [`proton-sdk-rs`](https://github.com/narrrl/proton-sdk-rs), a pure-Rust Proton Drive
+SDK.
 
-```bash
-cargo run --release -p pstr-app          # the app
-proton-stream 'https://drive.proton.me/urls/TOKEN#fragment'   # open the Add form with a link
-```
+## Privacy
 
-One window at a time: a second launch brings the open window forward and
-hands it any share link it was given, then exits.
+- **No server, no telemetry.** Each app talks to Proton and to nothing else, unless you turn on
+  posters and descriptions, which sends your title names to AniList or TMDB.
+- **The part of a share link after `#` is its decryption key.** It, any link password and your
+  Proton session live in the system credential store (Secret Service, Credential Manager, the
+  Android Keystore, the iOS Keychain), never in a config file.
+- **Sync is end-to-end encrypted.** Watch history, shares and settings travel through your own
+  Drive, one file per device.
+- **The block cache and downloads hold decrypted video** in your cache and data folders. Size or
+  empty the cache in **Settings → Storage**.
 
-The `pstr` CLI does the same work headlessly, and is what tells you which layer
-is broken:
-
-```bash
-cargo run -p pstr-cli -- add --name anime 'https://drive.proton.me/urls/TOKEN#fragment'
-cargo run -p pstr-cli -- crawl
-cargo run -p pstr-cli -- list
-cargo run -p pstr-cli -- metadata                      # opt-in; off unless configured
-cargo run --release -p pstr-cli -- play --file Frieren --disk-cache
-cargo run --release -p pstr-cli -- bench --file Frieren --verify
-```
-
-On a 761 MiB, 26-minute 1080p HEVC episode over a real password-protected link:
-**2.3 s to first frame, ~1.5 s to resume after dragging to an arbitrary point,
-61 MiB fetched for the first 38 seconds of playback.** Watch it again and the
-disk cache serves it with **no network at all** — 0.3 s to first frame.
-
-`bench` measures the same file without a player, reporting cold seek latency,
-sustained throughput and peak memory, and `--verify` cross-checks a mid-file read
-against the SDK's own range download.
-
-## Design
-
-| | |
-|---|---|
-| Topology | Fat client. No server; each viewer's app talks to Proton directly. |
-| Auth | Public links only — but several, merged into one library. |
-| Player | Embedded libmpv, drawing into the app's own GL surface: HEVC 10-bit, HDR and ASS subtitles with hardware decode. Volume, audio-track, subtitle and chapter pickers; skip-the-opening; next/previous episode and autoplay. The language picked is preferred for the next file too. |
-| Transcoding | None. mpv demuxes and decodes natively. |
-| UI | egui/eframe on glow; mpv renders into the same GL context. |
-| Themes | The shipped near-black palette, Catppuccin Latte, Frappé, Macchiato and Mocha, and a Persona 5 one — black, white and one loud red, which is what the Red accent is there for — each with a choice of nine accents, drawn as a gradient unless you turn that off. Picked on the Settings page, applied without a restart. |
-| Metadata | Filename parsing, with optional AniList/TMDB enrichment — **off by default**, because enabling it sends your library's titles to a third party. It brings posters, synopses and per-episode titles; a title the scorer refuses to guess about can be pinned by hand, and a pinned match is never overwritten. |
-| Platforms | Linux and Windows; macOS packaging is written but has not been run on a Mac. A native Android 12+ client is available featuring a Material 3 UI and immersive fullscreen playback. |
+[Privacy](docs/PRIVACY.md) lists every connection and every file.
 
 ## Building
 
@@ -81,47 +147,26 @@ Rust 2024, MSRV 1.96.
 
 ```bash
 cargo build --release
+cargo run --release -p pstr-app                    # the app
+cargo run -p pstr-cli -- add --name anime 'URL'    # the same work, headless
 ```
 
-`pstr-player` needs libmpv development headers (`mpv` ≥ 2.0). On Windows those
-come from the separate **mpv-dev** archive rather than mpv's player build, and
-`libmpv-2.dll` ships next to the executable. The Proton SDK crates come from
-crates.io; nothing here builds against a sibling checkout.
+`pstr-player` needs libmpv development headers (`mpv` ≥ 2.0), and on Linux `pstr-app` needs
+WebKitGTK 4.1's, for the CAPTCHA window. The Proton SDK crates come from crates.io.
 
-Installable artifacts — tarball, `.deb`, `.rpm`, Arch package, `.app`/`.dmg`,
-and a portable `.zip` plus an `.msi` on Windows — are produced by
-`scripts/build.sh` and `scripts\build.ps1`; `packaging/README.md` has the
-per-platform detail.
-
-Android builds use JDK 17, Android SDK 36/NDK 28, Gradle 8.13, `cargo-ndk`, and
-UniFFI. Run `bash scripts/build-android.sh debug` after installing that toolchain;
-see [`docs/ANDROID.md`](docs/ANDROID.md) for exact setup and release signing.
-
-## Privacy
-
-- The share URL fragment **is** the decryption password. It and any custom
-  password live in the OS credential store — Secret Service on Linux, Credential
-  Manager on Windows — never in a config file.
-- Nothing leaves your machine except requests to Proton, unless you turn metadata
-  enrichment on. The player is fed through an in-process mpv stream callback, not
-  a local HTTP server: there is no port for another process on the machine to ask
-  for the plaintext, and mpv is handed an opaque token rather than a URL that
-  would put a share secret in its log and window title.
-- The block cache holds decrypted content. It lives in your cache directory,
-  can be deleted at any time the app is not running, and can be sized or
-  emptied from Settings → Storage.
-- A share link given as a command-line argument is visible to other users of
-  the machine in the process list while that launch runs, and may land in
-  shell history. Pasting it into the window (Ctrl+V) does neither.
-- The desktop's media widget is handed the title, the episode and a `file://`
-  path to artwork already on disk — never a provider URL, so the shell never
-  contacts a metadata provider on its own.
+- **Release artifacts:** `scripts/build.sh` (tarball, `.deb`, `.rpm`, Arch, macOS) and
+  `scripts/build-windows.sh` or `scripts\build.ps1` (`.zip`, `.msi`). See
+  [`packaging/README.md`](packaging/README.md).
+- **Android:** JDK 17, Android SDK 36, NDK 28, `cargo-ndk`, then
+  `scripts/build-android.sh debug`. See [`docs/ANDROID.md`](docs/ANDROID.md).
+- **iOS:** macOS with Xcode and XcodeGen, then `scripts/build-ios.sh all`. See
+  [`docs/IOS.md`](docs/IOS.md).
 
 ## License
 
-The shared Rust crates and desktop application are MIT licensed. The Android
-application and its combined native distribution are GPL-3.0-or-later; see
-[`android/LICENSE.md`](android/LICENSE.md) and the bundled-component notices.
-The desktop application embeds the Inter typeface, under the SIL Open Font
+The shared Rust crates and desktop application are MIT licensed. The Android and iOS applications
+and their combined native distributions are GPL-3.0-or-later; see
+[`android/LICENSE.md`](android/LICENSE.md), [`ios/LICENSE.md`](ios/LICENSE.md) and the bundled
+component notices. The desktop application embeds the Inter typeface, under the SIL Open Font
 License 1.1 ([`crates/pstr-app/assets/fonts/Inter-OFL.txt`](crates/pstr-app/assets/fonts/Inter-OFL.txt)),
 and the Phosphor icon font, under MIT.

android/THIRD_PARTY_NOTICES.md

@@ -7,7 +7,7 @@ distributions.
 | Component | License |
 |---|---|
 | mpv/libmpv | GPL-2.0-or-later by default; verify the pinned build configuration |
-| LLVM libc++ shared runtime (Android NDK r29) | Apache-2.0 WITH LLVM-exception |
+| LLVM libc++ shared runtime (Android NDK r30) | Apache-2.0 WITH LLVM-exception |
 | AndroidX and Jetpack Compose | Apache-2.0 |
 | Kotlin | Apache-2.0 |
 | JNA | Apache-2.0 or LGPL-2.1-or-later |

android/app/build.gradle.kts

@@ -47,7 +47,7 @@ android {
     namespace = "io.narl.protonstream"
     compileSdk = 36
     buildToolsVersion = "37.0.0"
-    ndkVersion = "29.0.14206865"
+    ndkVersion = "30.0.16248370"
 
     defaultConfig {
         applicationId = "io.narl.protonstream"
@@ -180,20 +180,16 @@ val uniffiSourceDir = layout.buildDirectory.dir("generated/source/uniffi")
 val hostRustLibrary = repositoryRoot.resolve(
     "target/debug/${System.mapLibraryName("pstr_android")}",
 )
-val stagedMpvDir = layout.buildDirectory.dir("generated/mpv")
 
 val buildLibmpvAndroid by tasks.registering(Exec::class) {
     group = "native"
     description = "Builds the pinned GPL libmpv and stages both Android ABIs."
     workingDir(repositoryRoot)
     commandLine("bash", repositoryRoot.resolve("scripts/build-libmpv-android.sh").absolutePath)
-    inputs.file(repositoryRoot.resolve("scripts/build-libmpv-android.sh"))
-    outputs.files(
-        stagedMpvDir.map { it.file("jniLibs/arm64-v8a/libmpv.so") },
-        stagedMpvDir.map { it.file("jniLibs/x86_64/libmpv.so") },
-        stagedMpvDir.map { it.file("include/mpv/client.h") },
-        stagedMpvDir.map { it.file("REVISION") },
-    )
+    // No declared outputs: the script's STAMP is the up-to-date check. Gradle
+    // deletes the declared outputs of a task it has no history for, which on a
+    // fresh CI checkout threw away the tree just restored from the cache and
+    // rebuilt libmpv from source on every run.
 }
 
 val buildRustHost by tasks.registering(Exec::class) {

android/app/src/androidTest/java/io/narl/protonstream/native/UniFfiBoundaryTest.kt

@@ -102,7 +102,7 @@ class UniFfiBoundaryTest {
      */
     @Test
     fun chapterPlanningCrossesTheBoundaryIntact() {
-        val plan = chapterPlan(emptyList(), 1560.0)
+        val plan = chapterPlan(emptyList(), 1560.0, emptyList())
         assertNotNull(plan)
         assertNull(skipOffer(plan, 12.0))
     }

android/app/src/main/AndroidManifest.xml

@@ -7,11 +7,21 @@
     <uses-permission android:name="android.permission.FOREGROUND_SERVICE_DATA_SYNC" />
     <uses-permission android:name="android.permission.FOREGROUND_SERVICE_MEDIA_PLAYBACK" />
 
+    <!--
+      Android TV: listed in its launcher, and installable without a touch
+      screen. Neither is required, so phones are offered the same build.
+    -->
+    <uses-feature android:name="android.software.leanback" android:required="false" />
+    <uses-feature android:name="android.hardware.touchscreen" android:required="false" />
+
     <application
         android:name=".ProtonStreamApplication"
         android:allowBackup="false"
         android:dataExtractionRules="@xml/data_extraction_rules"
+        android:enableOnBackInvokedCallback="true"
+        tools:targetApi="33"
         android:icon="@mipmap/ic_launcher"
+        android:banner="@drawable/tv_banner"
         android:label="@string/app_name"
         android:supportsRtl="true"
         android:theme="@style/Theme.ProtonStream">
@@ -33,11 +43,11 @@
             android:configChanges="screenSize|smallestScreenSize|screenLayout|orientation|uiMode|density|fontScale|locale|layoutDirection|keyboardHidden"
             android:exported="true"
             android:launchMode="singleTask"
-            android:supportsPictureInPicture="true"
             android:resizeableActivity="true">
             <intent-filter>
                 <action android:name="android.intent.action.MAIN" />
                 <category android:name="android.intent.category.LAUNCHER" />
+                <category android:name="android.intent.category.LEANBACK_LAUNCHER" />
             </intent-filter>
             <!--
               Proton Drive public links. autoVerify="false", said explicitly:

android/app/src/main/assets/licenses/THIRD_PARTY_NOTICES.md

@@ -6,7 +6,7 @@ complete GNU GPL version 3 text is packaged beside this file as `GPL-3.0.txt`.
 | Component | License |
 |---|---|
 | mpv/libmpv | GPL-2.0-or-later by default; verify the pinned build configuration |
-| LLVM libc++ shared runtime (Android NDK r29) | Apache-2.0 WITH LLVM-exception |
+| LLVM libc++ shared runtime (Android NDK r30) | Apache-2.0 WITH LLVM-exception |
 | AndroidX and Jetpack Compose | Apache-2.0 |
 | Kotlin | Apache-2.0 |
 | JNA | Apache-2.0 or LGPL-2.1-or-later |

android/app/src/main/cpp/pstr_mpv.cpp

@@ -27,6 +27,7 @@ extern "C" {
 #include <string_view>
 #include <thread>
 #include <utility>
+#include <vector>
 
 namespace {
 
@@ -202,7 +203,7 @@ struct PlaybackState {
     /// and must not be attributed to the file being loaded.
     bool loading = false;
     /// The picture's display size, once mpv has decoded enough to know it.
-    /// Zero until then, and the aspect Picture-in-Picture is given.
+    /// Zero until then.
     double video_width = 0.0;
     double video_height = 0.0;
     /// Which loaded file this state describes. Bumped by every load, so a
@@ -210,6 +211,17 @@ struct PlaybackState {
     /// episode one — which is the difference between resuming an episode where
     /// the viewer left it and resuming it where the *previous* one ended.
     int64_t generation = 0;
+    /// mpv has loaded this generation's file and made its own track pick,
+    /// which is the first moment the pick can be second-guessed.
+    bool loaded = false;
+};
+
+/// A subtitle file published for mpv, and what to call it.
+struct Subtitle {
+    uint64_t handle = 0;
+    std::string title;
+    std::string language;
+    bool select = false;
 };
 
 class Player {
@@ -311,8 +323,11 @@ class Player {
         // needs no window, and a load that cannot get one plays audio anyway —
         // waiting for a surface here is what made background playback fail after
         // a five-second stall.
-        if (!audio.empty()) set_string("alang", audio);
-        if (!subtitle.empty()) set_string("slang", subtitle);
+        //
+        // Set even when empty: mpv keeps both across `loadfile`, so a file
+        // with no language preference used to inherit the last one's.
+        set_string("alang", audio);
+        set_string("slang", subtitle);
         set_string("sid", subtitles ? "auto" : "no");
         pending_start_.store(std::max(0.0, start));
         // Retire the outgoing file's position, duration and end flag *before*
@@ -338,7 +353,10 @@ class Player {
             state_.generation = generation;
             state_.loading = true;
             error_.clear();
+            for (const auto &subtitle : pending_subtitles_) released_.push_back(subtitle.handle);
+            pending_subtitles_.clear();
         }
+        flush_released();
         const std::string url = "pstr://" + std::to_string(handle);
         const char *command[] = {"loadfile", url.c_str(), nullptr};
         if (mpv_command(mpv_, command) < 0) {
@@ -372,6 +390,27 @@ class Player {
         mpv_command(mpv_, command);
     }
 
+    /// A subtitle file beside the file of load `generation`, added once mpv
+    /// has that file loaded: an external track belongs to the file open at
+    /// the time. Handed over for a file already replaced, it is released
+    /// instead. `select` turns it on, but only when the file has no subtitle
+    /// of its own playing.
+    void add_subtitle(int64_t generation, Subtitle subtitle) {
+        bool now = false;
+        {
+            std::lock_guard lock(state_mutex_);
+            if (generation != state_.generation) {
+                released_.push_back(subtitle.handle);
+            } else if (loaded_generation_ == generation) {
+                now = true;
+            } else {
+                pending_subtitles_.push_back(std::move(subtitle));
+            }
+        }
+        flush_released();
+        if (now) attach_subtitle(subtitle);
+    }
+
     PlaybackState state() const {
         std::lock_guard lock(state_mutex_);
         return state_;
@@ -395,6 +434,8 @@ class Player {
             char *lang_raw = nullptr;
             char *title_raw = nullptr;
             int selected = 0;
+            int is_default = 0;
+            int forced = 0;
             mpv_get_property(mpv_, (base + "id").c_str(), MPV_FORMAT_INT64, &id);
             mpv_get_property(mpv_, (base + "type").c_str(), MPV_FORMAT_STRING, &type_raw);
             MpvString type(type_raw);
@@ -403,10 +444,14 @@ class Player {
             mpv_get_property(mpv_, (base + "title").c_str(), MPV_FORMAT_STRING, &title_raw);
             MpvString title(title_raw);
             mpv_get_property(mpv_, (base + "selected").c_str(), MPV_FORMAT_FLAG, &selected);
+            mpv_get_property(mpv_, (base + "default").c_str(), MPV_FORMAT_FLAG, &is_default);
+            mpv_get_property(mpv_, (base + "forced").c_str(), MPV_FORMAT_FLAG, &forced);
             if (i) json += ',';
             json += "{\"id\":" + std::to_string(id) + ",\"type\":\"" + escape(type.get()) +
                     "\",\"language\":\"" + escape(lang.get()) + "\",\"title\":\"" +
-                    escape(title.get()) + "\",\"selected\":" + (selected ? "true" : "false") + "}";
+                    escape(title.get()) + "\",\"selected\":" + (selected ? "true" : "false") +
+                    ",\"default\":" + (is_default ? "true" : "false") +
+                    ",\"forced\":" + (forced ? "true" : "false") + "}";
         }
         return json + ']';
     }
@@ -434,6 +479,35 @@ class Player {
     }
 
   private:
+    void attach_subtitle(const Subtitle &subtitle) {
+        bool showing = false;
+        if (char *sid = mpv_get_property_string(mpv_, "sid")) {
+            showing = std::strcmp(sid, "no") != 0;
+            mpv_free(sid);
+        }
+        const std::string url = "pstr://" + std::to_string(subtitle.handle);
+        std::vector<const char *> command{
+            "sub-add", url.c_str(), subtitle.select && !showing ? "select" : "auto",
+            subtitle.title.c_str()};
+        if (!subtitle.language.empty()) command.push_back(subtitle.language.c_str());
+        command.push_back(nullptr);
+        // On failure mpv may never have opened it, so nothing will close it.
+        // Releasing one it did open and close is a no-op.
+        if (mpv_command(mpv_, command.data()) < 0) pstr_android_stream_release(subtitle.handle);
+    }
+
+    /// Release the subtitle streams queued under `state_mutex_`, outside it:
+    /// a release runs Rust destructors, which must not run under a lock a
+    /// reader of the state may be waiting on.
+    void flush_released() {
+        std::vector<uint64_t> handles;
+        {
+            std::lock_guard lock(state_mutex_);
+            handles.swap(released_);
+        }
+        for (const uint64_t handle : handles) pstr_android_stream_release(handle);
+    }
+
     struct MpvFree {
         void operator()(char *value) const noexcept { if (value) mpv_free(value); }
     };
@@ -534,6 +608,17 @@ class Player {
             if (event->event_id == MPV_EVENT_FILE_LOADED) {
                 const double start = pending_start_.exchange(0.0);
                 if (start > 0.0) set_double("time-pos", start);
+                std::vector<Subtitle> ready;
+                {
+                    std::lock_guard lock(state_mutex_);
+                    // Mid-load, this is the outgoing file finishing its load.
+                    if (!state_.loading) {
+                        loaded_generation_ = state_.generation;
+                        state_.loaded = true;
+                        ready.swap(pending_subtitles_);
+                    }
+                }
+                for (const auto &subtitle : ready) attach_subtitle(subtitle);
             }
             if (event->event_id == MPV_EVENT_END_FILE) {
                 const auto *end = static_cast<mpv_event_end_file *>(event->data);
@@ -757,6 +842,12 @@ class Player {
     bool surface_changed_ = false;
     std::atomic<bool> frame_ready_{false};
     std::atomic<double> pending_start_{0.0};
+    /// The load generation whose file mpv has loaded, under `state_mutex_`.
+    int64_t loaded_generation_ = -1;
+    /// Subtitles handed over before their file loaded, under `state_mutex_`.
+    std::vector<Subtitle> pending_subtitles_;
+    /// Streams to release once `state_mutex_` is let go.
+    std::vector<uint64_t> released_;
 };
 
 Player *from(jlong handle) { return reinterpret_cast<Player *>(handle); }
@@ -850,6 +941,17 @@ extern "C" JNIEXPORT jboolean JNICALL Java_io_narl_protonstream_playback_NativeM
                 : JNI_FALSE);
     });
 }
+extern "C" JNIEXPORT void JNICALL Java_io_narl_protonstream_playback_NativeMpvHost_nativeAddSubtitle(JNIEnv *env, jobject, jlong handle, jlong generation, jlong stream, jstring title, jstring language, jboolean select) noexcept {
+    c_boundary([=] {
+        Subtitle subtitle{static_cast<uint64_t>(stream), {}, {}, select == JNI_TRUE};
+        auto *p = from(handle);
+        if (!p || !utf8(env, title, subtitle.title) || !utf8(env, language, subtitle.language)) {
+            pstr_android_stream_release(subtitle.handle);
+            return;
+        }
+        p->add_subtitle(generation, std::move(subtitle));
+    });
+}
 extern "C" JNIEXPORT void JNICALL Java_io_narl_protonstream_playback_NativeMpvHost_nativePause(JNIEnv *, jobject, jlong h, jboolean value) noexcept {
     c_boundary([=] { if (auto *p = from(h)) p->pause(value == JNI_TRUE); });
 }
@@ -881,8 +983,9 @@ extern "C" JNIEXPORT jdoubleArray JNICALL Java_io_narl_protonstream_playback_Nat
                                   state.video_width, state.video_height,
                                   static_cast<jdouble>(state.end_reason),
                                   state.buffering ? 1.0 : 0.0, state.cache_percent,
-                                  state.seeking ? 1.0 : 0.0, state.cached_until};
-        constexpr jsize kFields = 14;
+                                  state.seeking ? 1.0 : 0.0, state.cached_until,
+                                  state.loaded ? 1.0 : 0.0};
+        constexpr jsize kFields = 15;
         jdoubleArray result = env->NewDoubleArray(kFields);
         if (!result) return static_cast<jdoubleArray>(nullptr);
         env->SetDoubleArrayRegion(result, 0, kFields, values);

android/app/src/main/java/io/narl/protonstream/MainActivity.kt

@@ -1,53 +1,38 @@
 package io.narl.protonstream
 
 import android.Manifest
-import android.app.PendingIntent
-import android.app.PictureInPictureParams
-import android.app.RemoteAction
-import android.content.BroadcastReceiver
 import android.content.ComponentName
 import android.content.Context
 import android.content.Intent
-import android.content.IntentFilter
 import android.content.ServiceConnection
 import android.content.pm.PackageManager
-import android.content.res.Configuration
-import android.graphics.Rect
-import android.graphics.drawable.Icon
 import android.os.Build
 import android.os.Bundle
 import android.os.IBinder
-import android.util.Rational
 import androidx.activity.ComponentActivity
 import androidx.activity.compose.setContent
 import androidx.activity.enableEdgeToEdge
 import androidx.activity.result.contract.ActivityResultContracts
 import androidx.compose.runtime.mutableStateOf
-import androidx.compose.runtime.snapshotFlow
-import androidx.core.content.ContextCompat
 import androidx.core.graphics.drawable.toDrawable
 import androidx.core.view.WindowCompat
 import androidx.lifecycle.lifecycleScope
 import io.narl.protonstream.native.NativeRuntime
-import io.narl.protonstream.playback.MpvPlaybackState
 import io.narl.protonstream.playback.NativeMpvHost
 import io.narl.protonstream.playback.PlaybackService
 import io.narl.protonstream.settings.SettingsStore
+import io.narl.protonstream.sync.NewEpisodesWorker
+import io.narl.protonstream.sync.WatchSyncWorker
 import io.narl.protonstream.ui.ProtonStreamApp
 import io.narl.protonstream.ui.theme.AppearanceState
 import io.narl.protonstream.ui.theme.ProtonStreamTheme
-import kotlinx.coroutines.ExperimentalCoroutinesApi
 import kotlinx.coroutines.flow.distinctUntilChanged
 import kotlinx.coroutines.flow.filterNotNull
-import kotlinx.coroutines.flow.flatMapLatest
-import kotlinx.coroutines.flow.flowOf
-import kotlinx.coroutines.flow.map
 import kotlinx.coroutines.launch
 import uniffi.pstr_android.PaletteRecord
 
 class MainActivity : ComponentActivity() {
     private val playerHost = mutableStateOf<NativeMpvHost?>(null)
-    private val inPictureInPicture = mutableStateOf(false)
 
     /** A share link handed over by a browser or the share sheet, until the Add form takes it. */
     private val incomingShareLink = mutableStateOf<String?>(null)
@@ -68,30 +53,10 @@ class MainActivity : ComponentActivity() {
         }
     }
 
-    /**
-     * The transport behind the buttons Android draws over the PiP window.
-     *
-     * A broadcast rather than a service intent: PiP is one of the states in
-     * which a background service start is refused, and the receiver is
-     * registered for as long as the activity that owns the window exists.
-     */
-    private val pictureInPictureControls = object : BroadcastReceiver() {
-        override fun onReceive(context: Context?, intent: Intent?) {
-            val host = playerHost.value ?: return
-            when (intent?.getStringExtra(EXTRA_CONTROL)) {
-                CONTROL_PLAY -> host.setPaused(false)
-                CONTROL_PAUSE -> host.setPaused(true)
-                CONTROL_NEXT -> host.onSkipNext?.invoke()
-                CONTROL_PREVIOUS -> host.onSkipPrevious?.invoke()
-            }
-        }
-    }
-
     private val notificationPermission = registerForActivityResult(
         ActivityResultContracts.RequestPermission(),
     ) { /* Downloads remain usable; Android suppresses their notifications if denied. */ }
 
-    @OptIn(ExperimentalCoroutinesApi::class)
     override fun onCreate(savedInstanceState: Bundle?) {
         super.onCreate(savedInstanceState)
         // Before anything draws. The palette decides the window's own
@@ -115,34 +80,17 @@ class MainActivity : ComponentActivity() {
             playbackConnection,
             Context.BIND_AUTO_CREATE,
         )
-        ContextCompat.registerReceiver(
-            this,
-            pictureInPictureControls,
-            IntentFilter(ACTION_PIP_CONTROL),
-            ContextCompat.RECEIVER_NOT_EXPORTED,
-        )
+        NewEpisodesWorker.schedule(this)
         if (
             Build.VERSION.SDK_INT >= Build.VERSION_CODES.TIRAMISU &&
             checkSelfPermission(Manifest.permission.POST_NOTIFICATIONS) != PackageManager.PERMISSION_GRANTED
         ) {
             notificationPermission.launch(Manifest.permission.POST_NOTIFICATIONS)
         }
-        // Auto-enter has to be armed *before* the gesture that would use it:
-        // building the params inside onUserLeaveHint is too late for the swipe
-        // home that gesture navigation sends, which never calls it. Re-register
-        // whenever the picture's shape or the transport's does.
-        lifecycleScope.launch {
-            snapshotFlow { playerHost.value }
-                .flatMapLatest { host -> host?.state ?: flowOf(null) }
-                .map { state -> PictureInPictureShape.of(state) }
-                .distinctUntilChanged()
-                .collect { shape -> runCatching { setPictureInPictureParams(shape.params()) } }
-        }
         setContent {
             ProtonStreamTheme {
                 ProtonStreamApp(
                     playerHost.value,
-                    inPictureInPicture.value,
                     shareLink = incomingShareLink.value,
                     onShareLinkTaken = { incomingShareLink.value = null },
                 )
@@ -177,27 +125,7 @@ class MainActivity : ComponentActivity() {
         intent.shareLink()?.let { incomingShareLink.value = it }
     }
 
-    override fun onUserLeaveHint() {
-        super.onUserLeaveHint()
-        // The backstop for launchers that still send this instead of arming
-        // auto-enter. Entering twice is not an error; not entering at all is.
-        if (playerHost.value?.hasActivePlayback == true && !isInPictureInPictureMode) {
-            runCatching {
-                enterPictureInPictureMode(PictureInPictureShape.of(playerHost.value?.state?.value).params())
-            }
-        }
-    }
-
-    override fun onPictureInPictureModeChanged(isInPictureInPictureMode: Boolean, newConfig: Configuration) {
-        super.onPictureInPictureModeChanged(isInPictureInPictureMode, newConfig)
-        // The window is now a thumbnail with its own controls. Anything the
-        // player would draw over it — the transport, the title bar, the skip
-        // offer — is unreadable at that size and covers the picture.
-        inPictureInPicture.value = isInPictureInPictureMode
-    }
-
     override fun onDestroy() {
-        runCatching { unregisterReceiver(pictureInPictureControls) }
         if (bound) {
             unbindService(playbackConnection)
             bound = false
@@ -207,89 +135,14 @@ class MainActivity : ComponentActivity() {
 
     override fun onStop() {
         super.onStop()
+        // Where the viewer stopped is what their other devices want next, and
+        // a process in the background may not live to the next timed sync.
+        if (!isChangingConfigurations) WatchSyncWorker.enqueue(this)
         if (
             !isChangingConfigurations &&
-            !isInPictureInPictureMode &&
             !SettingsStore(this).backgroundAudio
         ) {
             playerHost.value?.stop()
         }
     }
-
-    /** Everything the PiP window's shape depends on, and nothing that polls. */
-    private data class PictureInPictureShape(
-        val active: Boolean,
-        val paused: Boolean,
-        val width: Int,
-        val height: Int,
-    ) {
-        companion object {
-            fun of(state: MpvPlaybackState?): PictureInPictureShape = PictureInPictureShape(
-                active = state != null && state.duration > 0.0 && !state.ended,
-                paused = state?.paused != false,
-                width = state?.videoWidth?.toInt() ?: 0,
-                height = state?.videoHeight?.toInt() ?: 0,
-            )
-        }
-    }
-
-    private fun PictureInPictureShape.params(): PictureInPictureParams =
-        PictureInPictureParams.Builder()
-            .setAspectRatio(aspectRatio(width, height))
-            .setAutoEnterEnabled(active)
-            .setSeamlessResizeEnabled(false)
-            // The player owns the whole window, so the picture's rectangle is
-            // the window's. Without it the transition into PiP cross-fades from
-            // a screenshot instead of shrinking the video that is already there.
-            .setSourceRectHint(windowBounds())
-            .setActions(
-                listOf(
-                    remoteAction(android.R.drawable.ic_media_previous, "Previous episode", CONTROL_PREVIOUS, 11),
-                    if (paused) remoteAction(android.R.drawable.ic_media_play, "Play", CONTROL_PLAY, 12)
-                    else remoteAction(android.R.drawable.ic_media_pause, "Pause", CONTROL_PAUSE, 13),
-                    remoteAction(android.R.drawable.ic_media_next, "Next episode", CONTROL_NEXT, 14),
-                ),
-            )
-            .build()
-
-    private fun windowBounds(): Rect = window.decorView.let { Rect(0, 0, it.width, it.height) }
-
-    private fun remoteAction(icon: Int, label: String, control: String, requestCode: Int): RemoteAction =
-        RemoteAction(
-            Icon.createWithResource(this, icon),
-            label,
-            label,
-            PendingIntent.getBroadcast(
-                this,
-                requestCode,
-                Intent(ACTION_PIP_CONTROL).setPackage(packageName).putExtra(EXTRA_CONTROL, control),
-                PendingIntent.FLAG_IMMUTABLE or PendingIntent.FLAG_UPDATE_CURRENT,
-            ),
-        )
-
-    private companion object {
-        const val ACTION_PIP_CONTROL = "io.narl.protonstream.PIP_CONTROL"
-        const val EXTRA_CONTROL = "control"
-        const val CONTROL_PLAY = "play"
-        const val CONTROL_PAUSE = "pause"
-        const val CONTROL_NEXT = "next"
-        const val CONTROL_PREVIOUS = "previous"
-
-        /**
-         * Android refuses a window narrower than 1:2.39 or taller than 2.39:1,
-         * and refuses the request outright rather than clamping it — so a
-         * 2.40:1 scope release would take PiP away entirely.
-         */
-        fun aspectRatio(width: Int, height: Int): Rational {
-            if (width <= 0 || height <= 0) return Rational(16, 9)
-            val ratio = width.toDouble() / height
-            return when {
-                ratio > MAX_RATIO -> Rational(239, 100)
-                ratio < 1 / MAX_RATIO -> Rational(100, 239)
-                else -> Rational(width, height)
-            }
-        }
-
-        const val MAX_RATIO = 2.39
-    }
 }

android/app/src/main/java/io/narl/protonstream/ProtonStreamApplication.kt

@@ -2,10 +2,15 @@ package io.narl.protonstream
 
 import android.app.Application
 import io.narl.protonstream.native.NativeRuntime
+import io.narl.protonstream.settings.SettingsStore
 
 class ProtonStreamApplication : Application() {
     override fun onCreate() {
         super.onCreate()
         NativeRuntime.initialize(this)
+        // SharedPreferences reads its file on first use, and the first use was
+        // on the main thread — in the playback service's start callback among
+        // others. Read here, off it, and every later read is from memory.
+        Thread({ SettingsStore.preload(this) }, "settings-preload").start()
     }
 }

android/app/src/main/java/io/narl/protonstream/download/DownloadStateStore.kt

@@ -13,6 +13,8 @@ data class RetainedDownload(
     val total: Long = 0,
     val status: String = STATUS_QUEUED,
     val error: String? = null,
+    /** Recent transfer rate while running; 0 when unknown or not running. */
+    val bytesPerSecond: Long = 0,
 ) {
     val key: String get() = "$shareId\u001f$linkId"
 
@@ -99,6 +101,7 @@ class DownloadStateStore(context: Context) {
         .put("total", record.total)
         .put("status", record.status)
         .put("error", record.error)
+        .put("rate", record.bytesPerSecond)
         .toString()
 
     private fun decode(encoded: String): RetainedDownload {
@@ -112,6 +115,7 @@ class DownloadStateStore(context: Context) {
             total = json.optLong("total"),
             status = json.optString("status", RetainedDownload.STATUS_QUEUED),
             error = json.optString("error").takeIf(String::isNotBlank),
+            bytesPerSecond = json.optLong("rate"),
         )
     }
 

android/app/src/main/java/io/narl/protonstream/download/OfflineDownloadWorker.kt

@@ -1,11 +1,15 @@
 package io.narl.protonstream.download
 
+import android.Manifest
 import android.app.NotificationChannel
 import android.app.NotificationManager
+import android.content.pm.PackageManager
 import android.content.pm.ServiceInfo
 import android.content.Context
+import android.os.Build
 import android.os.SystemClock
 import androidx.core.app.NotificationCompat
+import androidx.core.content.ContextCompat
 import androidx.work.CoroutineWorker
 import androidx.work.Data
 import androidx.work.ForegroundInfo
@@ -25,20 +29,39 @@ class OfflineDownloadWorker(
 ) : CoroutineWorker(appContext, parameters) {
     override suspend fun doWork(): Result {
         createNotificationChannel()
-        setForeground(createForegroundInfo(0))
         val shareId = inputData.getString(KEY_SHARE_ID) ?: return Result.failure(error("missing share"))
         val volumeId = inputData.getString(KEY_VOLUME_ID) ?: return Result.failure(error("missing volume"))
         val linkId = inputData.getString(KEY_LINK_ID) ?: return Result.failure(error("missing link"))
         val label = inputData.getString(KEY_LABEL) ?: linkId
         val store = DownloadStateStore(applicationContext)
+        setForeground(createForegroundInfo(label, null))
+        postSummary(store)
+        try {
+            return transfer(store, shareId, volumeId, linkId, label)
+        } finally {
+            postSummary(store)
+        }
+    }
+
+    private suspend fun transfer(
+        store: DownloadStateStore,
+        shareId: String,
+        volumeId: String,
+        linkId: String,
+        label: String,
+    ): Result {
+        // Queued, not running: the engine lets two downloads transfer at once
+        // and holds the rest back, and only the first progress report means
+        // this one has a slot.
         var retained = store.get(shareId, linkId)
             ?: RetainedDownload(shareId, volumeId, linkId, label)
-        retained = retained.copy(status = RetainedDownload.STATUS_RUNNING, error = null)
+        retained = retained.copy(status = RetainedDownload.STATUS_QUEUED, error = null, bytesPerSecond = 0)
         store.put(retained)
 
         val observer = object : DownloadObserver {
             private var reportedAt = 0L
             private var reportedPercent = -1
+            private val rate = TransferRate()
 
             /**
              * Called once per 4 MiB block — a dozen times a second on a fast
@@ -51,13 +74,14 @@ class OfflineDownloadWorker(
                 val percent = if (total == 0UL) 0 else ((downloaded * 100UL) / total).toInt()
                 val now = SystemClock.elapsedRealtime()
                 val complete = total > 0UL && downloaded >= total
+                val bytesPerSecond = rate.sample(downloaded.toLong(), now)
                 if (!complete && percent == reportedPercent && now - reportedAt < PROGRESS_INTERVAL_MS) {
                     return
                 }
                 reportedAt = now
                 reportedPercent = percent
                 setProgressAsync(workDataOf(KEY_DOWNLOADED to downloaded.toLong(), KEY_TOTAL to total.toLong()))
-                setForegroundAsync(createForegroundInfo(percent))
+                setForegroundAsync(createForegroundInfo(label, percent))
                 // Under the store's lock: `pause()` is a concurrent writer, and
                 // this read-modify-write used to put RUNNING back over the
                 // viewer's PAUSED and then report the download as cancelled.
@@ -66,6 +90,7 @@ class OfflineDownloadWorker(
                     current.copy(
                         downloaded = downloaded.toLong(),
                         total = total.toLong(),
+                        bytesPerSecond = bytesPerSecond,
                         status = when (current.status) {
                             RetainedDownload.STATUS_PAUSED,
                             RetainedDownload.STATUS_CANCELLED,
@@ -114,12 +139,20 @@ class OfflineDownloadWorker(
         )
     }
 
-    private fun createForegroundInfo(progress: Int): ForegroundInfo {
+    /**
+     * This episode's line, under [GROUP]: a season is fourteen workers, and
+     * fourteen loose notifications saying the same thing named nothing.
+     * [progress] is a percentage, or null while waiting for a download slot.
+     */
+    private fun createForegroundInfo(label: String, progress: Int?): ForegroundInfo {
         val notification = NotificationCompat.Builder(applicationContext, CHANNEL_ID)
             .setSmallIcon(io.narl.protonstream.R.drawable.ic_launcher_foreground)
-            .setContentTitle("Making episode available offline")
-            .setProgress(100, progress, progress == 0)
+            .setContentTitle(label)
+            .setContentText(if (progress == null) "Waiting to download" else "$progress %")
+            .setProgress(100, progress ?: 0, progress == null || progress == 0)
             .setOngoing(true)
+            .setOnlyAlertOnce(true)
+            .setGroup(GROUP)
             .build()
         return ForegroundInfo(
             stableNotificationId(id),
@@ -128,6 +161,36 @@ class OfflineDownloadWorker(
         )
     }
 
+    /**
+     * The one line the group folds into — "Downloading 12 episodes" — or none
+     * once nothing is left to download. Posted as each worker starts and
+     * ends rather than on progress, which each episode's own line carries.
+     */
+    private fun postSummary(store: DownloadStateStore) {
+        val manager = applicationContext.getSystemService(NotificationManager::class.java)
+        val left = store.records().count {
+            it.status == RetainedDownload.STATUS_QUEUED || it.status == RetainedDownload.STATUS_RUNNING
+        }
+        if (left == 0) {
+            manager.cancel(SUMMARY_ID)
+            return
+        }
+        val allowed = Build.VERSION.SDK_INT < Build.VERSION_CODES.TIRAMISU ||
+            ContextCompat.checkSelfPermission(applicationContext, Manifest.permission.POST_NOTIFICATIONS) ==
+            PackageManager.PERMISSION_GRANTED
+        if (!allowed) return
+        manager.notify(
+            SUMMARY_ID,
+            NotificationCompat.Builder(applicationContext, CHANNEL_ID)
+                .setSmallIcon(io.narl.protonstream.R.drawable.ic_launcher_foreground)
+                .setContentTitle(if (left == 1) "Downloading 1 episode" else "Downloading $left episodes")
+                .setOnlyAlertOnce(true)
+                .setGroup(GROUP)
+                .setGroupSummary(true)
+                .build(),
+        )
+    }
+
     private fun error(message: String) = Data.Builder().putString(KEY_ERROR, message).build()
 
     companion object {
@@ -140,11 +203,45 @@ class OfflineDownloadWorker(
         const val KEY_TOTAL = "total"
         private const val MAX_RETRIES = 3
         private const val CHANNEL_ID = "offline-downloads"
+        private const val GROUP = "offline-downloads"
+
+        /** Below [stableNotificationId]'s range, so no episode's line replaces it. */
+        internal const val SUMMARY_ID = 1
 
         /** Shortest gap between two identical-looking progress reports. */
         private const val PROGRESS_INTERVAL_MS = 1_000L
     }
 }
 
+/**
+ * Bytes per second over roughly the last few seconds.
+ *
+ * Progress arrives once per 4 MiB block, so on a slow link the bar moves in
+ * steps seconds apart; a rate beside it is what tells a slow download from a
+ * stuck one. Smoothed, because one block that took a little longer than the
+ * last would otherwise halve the figure for a moment.
+ */
+internal class TransferRate {
+    private var lastBytes = -1L
+    private var lastAt = 0L
+    private var smoothed = 0.0
+
+    /** Record [bytes] transferred at [now] (milliseconds) and return the rate. */
+    fun sample(bytes: Long, now: Long): Long {
+        if (lastBytes < 0 || bytes < lastBytes) {
+            lastBytes = bytes
+            lastAt = now
+            return smoothed.toLong()
+        }
+        val elapsed = now - lastAt
+        if (elapsed <= 0) return smoothed.toLong()
+        val instant = (bytes - lastBytes) * 1000.0 / elapsed
+        smoothed = if (smoothed > 0.0) 0.7 * smoothed + 0.3 * instant else instant
+        lastBytes = bytes
+        lastAt = now
+        return smoothed.toLong()
+    }
+}
+
 internal fun stableNotificationId(workId: UUID): Int =
-    (workId.hashCode() and Int.MAX_VALUE).coerceAtLeast(1)
+    (workId.hashCode() and Int.MAX_VALUE).coerceAtLeast(OfflineDownloadWorker.SUMMARY_ID + 1)

android/app/src/main/java/io/narl/protonstream/playback/NativeMpvHost.kt

@@ -1,5 +1,6 @@
 package io.narl.protonstream.playback
 
+import android.os.SystemClock
 import android.view.Surface
 import io.narl.protonstream.ui.ThumbnailSource
 import kotlinx.coroutines.CoroutineScope
@@ -19,7 +20,11 @@ import java.util.concurrent.locks.ReentrantLock
 import kotlin.concurrent.withLock
 import uniffi.pstr_android.ChapterPlan
 import uniffi.pstr_android.ChapterRecord
+import uniffi.pstr_android.SkipRangeRecord
+import uniffi.pstr_android.SubtitleFilesRecord
+import uniffi.pstr_android.SubtitleTrackRecord
 import uniffi.pstr_android.chapterPlan
+import uniffi.pstr_android.fullSubtitlesInstead
 
 /**
  * Why the open file ended, mirroring `pstr_player::EndReason` so both clients
@@ -85,9 +90,9 @@ data class MpvPlaybackState(
 /**
  * What is on screen, for the surfaces that are not the player.
  *
- * The media session, its notification and Picture-in-Picture all have to name
- * the episode, and none of them can reach the composition that knows it. The
- * player publishes this once per episode and they read it.
+ * The media session and its notification have to name the episode, and
+ * neither can reach the composition that knows it. The player publishes this
+ * once per episode and they read it.
  */
 data class NowPlaying(
     val media: String,
@@ -101,12 +106,25 @@ data class NowPlaying(
     val hasNext: Boolean,
 )
 
+/** A sleep timer that is running. */
+sealed interface SleepTimer {
+    /** Stop when [media] ends, rather than going on to the next episode. */
+    data class EndOf(val media: String) : SleepTimer
+
+    /** Pause at [at], on the [SystemClock.elapsedRealtime] clock. */
+    data class At(val at: Long) : SleepTimer
+}
+
 data class MpvTrack(
     val id: Long,
     val type: String,
     val language: String,
     val title: String,
     val selected: Boolean,
+    /** The container marks it as the default choice. */
+    val isDefault: Boolean = false,
+    /** The container marks it as forced: on-screen text only, by convention. */
+    val forced: Boolean = false,
 ) {
     val label: String get() = listOf(language, title).filter(String::isNotBlank)
         .joinToString(" — ").ifBlank { "${type.replaceFirstChar(Char::uppercase)} $id" }
@@ -123,19 +141,25 @@ class NativeMpvHost private constructor(private val nativeHandle: Long) : Libmpv
     private val mutableNowPlaying = MutableStateFlow<NowPlaying?>(null)
     private val mutableAdvancing = MutableStateFlow(false)
     private val mutableProblem = MutableStateFlow<String?>(null)
+    private val mutableSleep = MutableStateFlow<SleepTimer?>(null)
+    private var sleepJob: Job? = null
     private var poller: Job? = null
     /** The episode key and load generation the native player currently holds. */
     @Volatile private var currentMedia: String? = null
     @Volatile private var currentGeneration: Double = -1.0
     @Volatile private var plannedFor: Pair<Double, Long>? = null
+    /** What AniSkip said about the open episode, keyed by that episode. */
+    @Volatile private var skipRanges: Pair<String, List<SkipRangeRecord>>? = null
+    /** The load generation whose subtitle pick has been looked at. */
+    @Volatile private var subtitlesCheckedFor: Double = -1.0
     var onPlaybackStarted: (() -> Unit)? = null
     var onStateChanged: ((MpvPlaybackState) -> Unit)? = null
     var onExplicitStop: (() -> Unit)? = null
     /**
      * Where a transport outside the player sends previous/next.
      *
-     * The player owns which episode is open, so the notification, the lock
-     * screen and Picture-in-Picture cannot walk the playlist themselves. Both
+     * The player owns which episode is open, so the notification and the lock
+     * screen cannot walk the playlist themselves. Both
      * run on the main thread, which is where the player's state lives.
      */
     var onSkipPrevious: (() -> Unit)? = null
@@ -166,6 +190,25 @@ class NativeMpvHost private constructor(private val nativeHandle: Long) : Libmpv
      */
     val problem: StateFlow<String?> = mutableProblem.asStateFlow()
 
+    /**
+     * The sleep timer. Kept here rather than on the screen, because the
+     * episode it is about keeps playing with the screen off.
+     */
+    val sleep: StateFlow<SleepTimer?> = mutableSleep.asStateFlow()
+
+    /** Start a sleep timer, replacing any running one, or turn it off. */
+    fun setSleepTimer(timer: SleepTimer?) {
+        sleepJob?.cancel()
+        mutableSleep.value = timer
+        if (timer is SleepTimer.At) {
+            sleepJob = scope.launch {
+                delay((timer.at - SystemClock.elapsedRealtime()).coerceAtLeast(0))
+                mutableSleep.value = null
+                setPaused(true)
+            }
+        }
+    }
+
     /** Dismiss the current [problem]. */
     fun clearProblem() { mutableProblem.value = null }
     val hasActivePlayback: Boolean get() = mutableState.value.duration > 0.0 && !mutableState.value.ended
@@ -217,6 +260,7 @@ class NativeMpvHost private constructor(private val nativeHandle: Long) : Libmpv
                             mutableTracks.value = emptyList()
                             mutableChapters.value = ChapterPlan(emptyList(), null)
                             plannedFor = null
+                            skipRanges = null
                         }
                     }
                 } ?: false
@@ -245,7 +289,7 @@ class NativeMpvHost private constructor(private val nativeHandle: Long) : Libmpv
      */
     fun beginTransition() { mutableAdvancing.value = true }
 
-    /** Names the open episode for the media session, its notification and PiP. */
+    /** Names the open episode for the media session and its notification. */
     fun publish(playing: NowPlaying?) { mutableNowPlaying.value = playing }
 
     fun setPaused(paused: Boolean) {
@@ -259,6 +303,17 @@ class NativeMpvHost private constructor(private val nativeHandle: Long) : Libmpv
     }
 
     fun seek(position: Double) { withOpenHandle { nativeSeek(it, position) } }
+
+    /**
+     * Take AniSkip's answer for [media], and plan the chapters again with it.
+     * Dropped when another episode has opened since it was asked for.
+     */
+    fun setSkipRanges(media: String, ranges: List<SkipRangeRecord>) {
+        if (media != currentMedia) return
+        skipRanges = media to ranges
+        plannedFor = null
+        refreshChapters(mutableState.value)
+    }
     fun setVolume(volume: Double) { withOpenHandle { nativeVolume(it, volume) } }
     fun setMuted(muted: Boolean) { withOpenHandle { nativeMute(it, muted) } }
 
@@ -267,7 +322,17 @@ class NativeMpvHost private constructor(private val nativeHandle: Long) : Libmpv
     fun selectTrack(track: MpvTrack?) {
         val audio = track?.type == "audio"
         withOpenHandle { nativeSelectTrack(it, audio, track?.id ?: -1) }
-        refreshTracks()
+        // mpv makes the switch on its own thread and lists it a moment later,
+        // so a track list read back now still ticks the old track. The tick
+        // moves here, and a read shortly after confirms it.
+        val type = if (audio) "audio" else "sub"
+        mutableTracks.value = mutableTracks.value.map {
+            if (it.type == type) it.copy(selected = it.id == track?.id) else it
+        }
+        scope.launch(Dispatchers.Default) {
+            delay(TRACK_SETTLE_MS)
+            refreshTracks()
+        }
     }
 
     /**
@@ -292,6 +357,30 @@ class NativeMpvHost private constructor(private val nativeHandle: Long) : Libmpv
 
     override fun releaseNativeStream(nativeHandle: ULong) = pstrAndroidStreamRelease(nativeHandle.toLong())
 
+    /**
+     * Hand mpv the subtitle files beside [media], the episode [play] loaded.
+     *
+     * Native code holds them until mpv has the file loaded, since an external
+     * track belongs to the file open at the time, and releases them instead
+     * if another episode has been loaded since. [SubtitleFilesRecord.preferred]
+     * is turned on only when the file has no subtitle of its own playing;
+     * pass [subtitles] false to turn none on.
+     */
+    fun addSubtitles(media: String, files: SubtitleFilesRecord, subtitles: Boolean) {
+        val generation = currentGeneration.toLong()
+        val added = withOpenHandle { handle ->
+            files.files.forEachIndexed { index, file ->
+                if (currentMedia == media) {
+                    val select = subtitles && files.preferred == index.toUInt()
+                    nativeAddSubtitle(handle, generation, file.handle.toLong(), file.title, file.language, select)
+                } else {
+                    pstrAndroidStreamRelease(file.handle.toLong())
+                }
+            }
+        }
+        if (added == null) files.files.forEach { pstrAndroidStreamRelease(it.handle.toLong()) }
+    }
+
     private fun startPolling() {
         if (poller?.isActive == true) return
         // Off the main thread deliberately: `nativeState` and `nativeTracks`
@@ -322,6 +411,12 @@ class NativeMpvHost private constructor(private val nativeHandle: Long) : Libmpv
                     // both of which are the main thread's.
                     withContext(Dispatchers.Main) { onStateChanged?.invoke(next) }
                     refreshChapters(next)
+                    if (values[LOADED] != 0.0 && values.generation() == currentGeneration &&
+                        subtitlesCheckedFor != currentGeneration
+                    ) {
+                        subtitlesCheckedFor = currentGeneration
+                        preferFullSubtitles()
+                    }
                 }
                 withOpenHandle(::nativeTakeError)?.let { mutableProblem.value = it }
                 if (tick++ % 4 == 0) refreshTracks()
@@ -355,17 +450,37 @@ class NativeMpvHost private constructor(private val nativeHandle: Long) : Libmpv
             }
         }.onSuccess { chapters ->
             plannedFor = wanted
-            mutableChapters.value = chapterPlan(chapters, state.duration.takeIf { it > 0.0 })
+            val skips = skipRanges?.takeIf { it.first == currentMedia }?.second.orEmpty()
+            mutableChapters.value = chapterPlan(chapters, state.duration.takeIf { it > 0.0 }, skips)
         }
     }
 
+    /**
+     * Play the dialogue rather than the signs and songs mpv picked by language
+     * (`pstr_core::subtitles`). Not remembered: it is the choice mpv should
+     * have made, not the viewer's.
+     */
+    private fun preferFullSubtitles() {
+        refreshTracks()
+        val subtitles = mutableTracks.value.filter { it.type == "sub" }
+        val id = fullSubtitlesInstead(
+            subtitles.map {
+                SubtitleTrackRecord(it.id, it.language, it.title, it.isDefault, it.forced, it.selected)
+            },
+        ) ?: return
+        subtitles.firstOrNull { it.id == id }?.let(::selectTrack)
+    }
+
     private fun refreshTracks() {
         runCatching {
             val encoded = withOpenHandle(::nativeTracks) ?: return
             val values = JSONArray(encoded)
             List(values.length()) { index ->
                 values.getJSONObject(index).run {
-                    MpvTrack(getLong("id"), getString("type"), getString("language"), getString("title"), getBoolean("selected"))
+                    MpvTrack(
+                        getLong("id"), getString("type"), getString("language"), getString("title"),
+                        getBoolean("selected"), optBoolean("default"), optBoolean("forced"),
+                    )
                 }
             }
         }.onSuccess { mutableTracks.value = it }
@@ -414,6 +529,14 @@ class NativeMpvHost private constructor(private val nativeHandle: Long) : Libmpv
         subtitles: Boolean,
         hardwareDecoding: Boolean,
     ): Boolean
+    private external fun nativeAddSubtitle(
+        handle: Long,
+        generation: Long,
+        stream: Long,
+        title: String,
+        language: String?,
+        select: Boolean,
+    )
     private external fun nativePause(handle: Long, paused: Boolean)
     private external fun nativeSeek(handle: Long, position: Double)
     private external fun nativeVolume(handle: Long, volume: Double)
@@ -434,7 +557,7 @@ class NativeMpvHost private constructor(private val nativeHandle: Long) : Libmpv
 
     companion object {
         /** Fields `nativeState` fills, in the order `pstr_mpv.cpp` writes them. */
-        private const val FIELDS = 14
+        private const val FIELDS = 15
         private const val GENERATION = 6
         private const val WIDTH = 7
         private const val HEIGHT = 8
@@ -443,6 +566,10 @@ class NativeMpvHost private constructor(private val nativeHandle: Long) : Libmpv
         private const val CACHE_PERCENT = 11
         private const val SEEKING = 12
         private const val CACHED_UNTIL = 13
+        private const val LOADED = 14
+
+        /** How long after a track switch mpv's track list is read again. */
+        private const val TRACK_SETTLE_MS = 300L
 
         init {
             System.loadLibrary("pstr_android")

android/app/src/main/java/io/narl/protonstream/playback/PlaybackService.kt

@@ -19,9 +19,11 @@ import android.media.session.MediaSession
 import android.media.session.PlaybackState
 import android.os.Binder
 import android.os.IBinder
+import android.os.SystemClock
 import androidx.core.content.ContextCompat
 import io.narl.protonstream.MainActivity
 import io.narl.protonstream.R
+import io.narl.protonstream.native.NativeRuntime
 import io.narl.protonstream.settings.SettingsStore
 import io.narl.protonstream.ui.loadArtwork
 import io.narl.protonstream.ui.loadThumbnail
@@ -33,9 +35,11 @@ import kotlinx.coroutines.cancel
 import kotlinx.coroutines.delay
 import kotlinx.coroutines.flow.first
 import kotlinx.coroutines.launch
+import kotlinx.coroutines.runBlocking
+import kotlinx.coroutines.withContext
 import kotlinx.coroutines.withTimeoutOrNull
 
-/** Owns libmpv so audio survives Activity recreation, rotation and PiP. */
+/** Owns libmpv so audio survives Activity recreation and rotation. */
 class PlaybackService : Service() {
     inner class PlaybackBinder : Binder() {
         val host: NativeMpvHost? get() = this@PlaybackService.host
@@ -81,6 +85,9 @@ class PlaybackService : Service() {
     private var notified: NotificationShape? = null
     /** The pending teardown, held so an episode transition can call it off. */
     private var retire: Job? = null
+    /** The open episode's latest reading, which [track] saves. */
+    private var lastReading: MpvPlaybackState? = null
+    private var lastSave = 0L
     /** The episode's artwork, and the source key it was fetched for. */
     private var artwork: Pair<String, Bitmap>? = null
     private val binder = PlaybackBinder()
@@ -115,7 +122,7 @@ class PlaybackService : Service() {
                 }
                 mediaSession.isActive = true
             }
-            onStateChanged = { updateSession(it) }
+            onStateChanged = { updateSession(it); track(it) }
             onExplicitStop = { retirePlayback() }
         }
         mediaSession = MediaSession(this, "proton-stream").apply {
@@ -164,6 +171,22 @@ class PlaybackService : Service() {
         return START_NOT_STICKY
     }
 
+    /**
+     * Swiped away from Recents. With background audio on, this service would
+     * otherwise play on with no screen to return to and no autoplay, so it
+     * saves where the episode got to and stops.
+     */
+    override fun onTaskRemoved(rootIntent: Intent?) {
+        lastReading?.let { reading ->
+            // Bounded and on this thread: the process may go as soon as the
+            // service stops, and a save launched into its scope would go with it.
+            runBlocking { withTimeoutOrNull(SAVE_ON_EXIT_MS) { withContext(Dispatchers.IO) { save(reading) } } }
+        }
+        host?.stop()
+        retirePlayback()
+        super.onTaskRemoved(rootIntent)
+    }
+
     override fun onDestroy() {
         scope.cancel()
         runCatching { unregisterReceiver(becomingNoisy) }
@@ -225,6 +248,52 @@ class PlaybackService : Service() {
         return audioManager.requestAudioFocus(request) == AudioManager.AUDIOFOCUS_REQUEST_GRANTED
     }
 
+    /**
+     * Keep the resume position from here rather than from the player screen.
+     *
+     * This service outlives the activity whenever background audio is on, and a
+     * position the screen alone kept stopped being saved the moment the screen
+     * went. Readings are attributed by [MpvPlaybackState.media], so an episode
+     * change saves the outgoing episode's last reading before the new one's.
+     */
+    private fun track(state: MpvPlaybackState) {
+        val media = state.media ?: return
+        if (state.duration <= 0.0) return
+        val previous = lastReading
+        lastReading = state
+        val now = SystemClock.elapsedRealtime()
+        val due = when {
+            previous != null && previous.media != media -> {
+                scope.launch(Dispatchers.IO) { save(previous) }
+                true
+            }
+            state.ended -> previous?.ended != true
+            state.paused -> previous?.paused != true
+            else -> now - lastSave >= SAVE_EVERY_MS
+        }
+        if (due) {
+            lastSave = now
+            scope.launch(Dispatchers.IO) { save(state) }
+        }
+    }
+
+    private suspend fun save(state: MpvPlaybackState) {
+        val media = state.media ?: return
+        // Played to the end, or near enough that what is left is credits. A
+        // failure or a stop also "ends", and recording either as watched would
+        // retire an episode nobody saw.
+        val watched = state.endReason == EndReason.Eof || state.position >= state.duration * WATCHED_FRACTION
+        runCatching {
+            NativeRuntime.engine().saveWatchState(
+                media.substringBeforeLast(':'),
+                media.substringAfterLast(':'),
+                state.position.coerceIn(0.0, state.duration),
+                state.duration,
+                watched,
+            )
+        }
+    }
+
     private fun updateSession(state: MpvPlaybackState) {
         refreshSession(state, host?.nowPlaying?.value)
         if (state.ended) scheduleRetire() else cancelRetire()
@@ -419,6 +488,9 @@ class PlaybackService : Service() {
         private const val TRANSITION_GRACE_MS = 30_000L
         /** How far the volume drops for a navigation prompt or a notification. */
         private const val DUCK_FACTOR = 0.3
+        private const val SAVE_EVERY_MS = 5_000L
+        /** How long a swipe from Recents may hold the main thread to save. */
+        private const val SAVE_ON_EXIT_MS = 2_000L
 
         /** Catppuccin Mocha mauve, the accent the app is themed with. */
         private const val ACCENT = 0xFFCBA6F7.toInt()

android/app/src/main/java/io/narl/protonstream/playback/PlayerGestures.kt

@@ -0,0 +1,220 @@
+package io.narl.protonstream.playback
+
+import android.app.Activity
+import android.content.Context
+import android.media.AudioManager
+import android.view.WindowManager
+import androidx.compose.foundation.background
+import androidx.compose.foundation.gestures.detectDragGestures
+import androidx.compose.foundation.layout.Arrangement
+import androidx.compose.foundation.layout.Box
+import androidx.compose.foundation.layout.Column
+import androidx.compose.foundation.layout.fillMaxWidth
+import androidx.compose.foundation.layout.height
+import androidx.compose.foundation.layout.padding
+import androidx.compose.foundation.layout.size
+import androidx.compose.foundation.layout.width
+import androidx.compose.foundation.shape.RoundedCornerShape
+import androidx.compose.material.icons.Icons
+import androidx.compose.material.icons.automirrored.filled.VolumeUp
+import androidx.compose.material.icons.filled.BrightnessMedium
+import androidx.compose.material.icons.filled.FastForward
+import androidx.compose.material.icons.filled.FastRewind
+import androidx.compose.material3.Icon
+import androidx.compose.material3.LinearProgressIndicator
+import androidx.compose.material3.MaterialTheme
+import androidx.compose.material3.Text
+import androidx.compose.runtime.Composable
+import androidx.compose.ui.Alignment
+import androidx.compose.ui.Modifier
+import androidx.compose.ui.draw.clip
+import androidx.compose.ui.geometry.Offset
+import androidx.compose.ui.graphics.Color
+import androidx.compose.ui.input.pointer.pointerInput
+import androidx.compose.ui.unit.dp
+import kotlin.math.abs
+import kotlin.math.roundToInt
+
+/** What a swipe on the picture is doing, for the bubble that says so. */
+sealed interface Swipe {
+    /** The window's brightness, from 0 to 1. */
+    data class Brightness(val level: Float) : Swipe
+
+    /** The device's media volume, from 0 to 1. */
+    data class Volume(val level: Float) : Swipe
+
+    /** Where the playhead will land when the finger lifts, and where it was. */
+    data class Seek(val from: Double, val to: Double) : Swipe
+}
+
+/** How much of the file one swipe across the whole width is worth, in seconds. */
+private const val SEEK_SPAN_SECONDS = 90.0
+
+/**
+ * A finger that comes down this close to the top or bottom of the screen is
+ * the system's: pulling down the shade, swiping home.
+ */
+private val SYSTEM_EDGE = 48.dp
+
+/** Which way a swipe went, settled by its first movement past the touch slop. */
+private enum class Axis { Brightness, Volume, Seek, Ignored }
+
+/**
+ * The swipes every phone video player has taught: up and down on the left for
+ * brightness, on the right for volume, and sideways to seek — shown while the
+ * finger is down and only seeking when it lifts, because a seek per movement
+ * would throw away every block in flight.
+ */
+fun Modifier.playerSwipes(
+    enabled: Boolean,
+    activity: Activity?,
+    position: () -> Double,
+    duration: () -> Double,
+    onSwipe: (Swipe?) -> Unit,
+    onSeek: (Double) -> Unit,
+): Modifier = pointerInput(enabled, activity) {
+    if (!enabled) return@pointerInput
+    val audio = activity?.getSystemService(Context.AUDIO_SERVICE) as? AudioManager
+    val edge = SYSTEM_EDGE.toPx()
+    var axis = Axis.Ignored
+    var start = Offset.Zero
+    var travelled = Offset.Zero
+    var level = 0f
+    var seekFrom = 0.0
+    var seekTo = 0.0
+    detectDragGestures(
+        onDragStart = { offset ->
+            start = offset
+            travelled = Offset.Zero
+            axis = if (offset.y < edge || offset.y > size.height - edge) Axis.Ignored else Axis.Seek
+        },
+        onDragEnd = {
+            if (axis == Axis.Seek && seekTo != seekFrom) onSeek(seekTo)
+            onSwipe(null)
+        },
+        onDragCancel = { onSwipe(null) },
+    ) { change, amount ->
+        if (axis == Axis.Ignored) return@detectDragGestures
+        change.consume()
+        val first = travelled == Offset.Zero
+        travelled += amount
+        if (first) {
+            // The first movement past the slop decides what the swipe is for.
+            axis = when {
+                abs(amount.x) > abs(amount.y) -> Axis.Seek
+                start.x < size.width / 2 -> Axis.Brightness
+                else -> Axis.Volume
+            }
+            level = when (axis) {
+                Axis.Brightness -> activity?.brightness() ?: 0.5f
+                Axis.Volume -> audio?.mediaLevel() ?: 0f
+                else -> 0f
+            }
+            seekFrom = position()
+            seekTo = seekFrom
+        }
+        when (axis) {
+            // A swipe the whole height of the screen goes from none to all.
+            Axis.Brightness -> {
+                level = (level - amount.y / size.height).coerceIn(0f, 1f)
+                activity?.setBrightness(level)
+                onSwipe(Swipe.Brightness(level))
+            }
+            Axis.Volume -> {
+                level = (level - amount.y / size.height).coerceIn(0f, 1f)
+                audio?.setMediaLevel(level)
+                onSwipe(Swipe.Volume(level))
+            }
+            Axis.Seek -> {
+                val length = duration()
+                if (length <= 0.0) return@detectDragGestures
+                seekTo = (seekFrom + travelled.x / size.width * SEEK_SPAN_SECONDS).coerceIn(0.0, length)
+                onSwipe(Swipe.Seek(seekFrom, seekTo))
+            }
+            Axis.Ignored -> {}
+        }
+    }
+}
+
+/** The window's own brightness, or the screen's when the window has none. */
+private fun Activity.brightness(): Float {
+    val own = window.attributes.screenBrightness
+    if (own >= 0f) return own
+    return runCatching {
+        android.provider.Settings.System.getInt(contentResolver, android.provider.Settings.System.SCREEN_BRIGHTNESS) / 255f
+    }.getOrDefault(0.5f)
+}
+
+private fun Activity.setBrightness(level: Float) {
+    window.attributes = window.attributes.apply {
+        // Never quite off: a black screen under a playing film looks broken.
+        screenBrightness = level.coerceAtLeast(0.01f)
+    }
+}
+
+/** Hand brightness back to the system, as the player is left. */
+fun Activity.releaseBrightness() {
+    window.attributes = window.attributes.apply {
+        screenBrightness = WindowManager.LayoutParams.BRIGHTNESS_OVERRIDE_NONE
+    }
+}
+
+private fun AudioManager.mediaLevel(): Float {
+    val max = getStreamMaxVolume(AudioManager.STREAM_MUSIC).coerceAtLeast(1)
+    return getStreamVolume(AudioManager.STREAM_MUSIC).toFloat() / max
+}
+
+private fun AudioManager.setMediaLevel(level: Float) {
+    val max = getStreamMaxVolume(AudioManager.STREAM_MUSIC)
+    // No flags: the bubble is the feedback, and the system's own volume panel
+    // over the picture would be a second one.
+    setStreamVolume(AudioManager.STREAM_MUSIC, (level * max).roundToInt(), 0)
+}
+
+/** The bubble in the middle of the picture while a swipe is under way. */
+@Composable
+fun SwipeBubble(swipe: Swipe, format: (Double) -> String, modifier: Modifier = Modifier) {
+    Column(
+        modifier
+            .clip(RoundedCornerShape(20.dp))
+            .background(Color.Black.copy(alpha = 0.6f))
+            .padding(horizontal = 24.dp, vertical = 16.dp),
+        horizontalAlignment = Alignment.CenterHorizontally,
+        verticalArrangement = Arrangement.spacedBy(8.dp),
+    ) {
+        when (swipe) {
+            is Swipe.Brightness -> Level(Icons.Default.BrightnessMedium, "Brightness", swipe.level)
+            is Swipe.Volume -> Level(Icons.AutoMirrored.Filled.VolumeUp, "Volume", swipe.level)
+            is Swipe.Seek -> {
+                val delta = swipe.to - swipe.from
+                Icon(
+                    if (delta < 0) Icons.Default.FastRewind else Icons.Default.FastForward,
+                    contentDescription = null,
+                    tint = Color.White,
+                    modifier = Modifier.size(32.dp),
+                )
+                Text(
+                    (if (delta < 0) "−" else "+") + format(abs(delta)),
+                    color = Color.White,
+                    style = MaterialTheme.typography.titleMedium,
+                )
+                Text(format(swipe.to), color = Color.White.copy(alpha = 0.7f), style = MaterialTheme.typography.labelMedium)
+            }
+        }
+    }
+}
+
+@Composable
+private fun Level(icon: androidx.compose.ui.graphics.vector.ImageVector, label: String, level: Float) {
+    Icon(icon, contentDescription = null, tint = Color.White, modifier = Modifier.size(32.dp))
+    Text("$label ${(level * 100).roundToInt()}%", color = Color.White, style = MaterialTheme.typography.labelLarge)
+    Box(Modifier.width(120.dp)) {
+        LinearProgressIndicator(
+            progress = { level },
+            modifier = Modifier.fillMaxWidth().height(4.dp),
+            color = MaterialTheme.colorScheme.primary,
+            trackColor = Color.White.copy(alpha = 0.25f),
+            drawStopIndicator = {},
+        )
+    }
+}

android/app/src/main/java/io/narl/protonstream/settings/SettingsStore.kt

@@ -1,6 +1,7 @@
 package io.narl.protonstream.settings
 
 import android.content.Context
+import androidx.core.content.edit
 
 /**
  * The settings that are Android's alone.
@@ -35,6 +36,31 @@ class SettingsStore(context: Context) {
         get() = preferences.getInt(KEY_CACHE_BUDGET_GIB, DEFAULT_CACHE_BUDGET_GIB)
         set(value) { preferences.edit().putInt(KEY_CACHE_BUDGET_GIB, value).apply() }
 
+    /** How the library was last sorted, as a `LibrarySort` name; null for the default. */
+    var librarySort: String?
+        get() = preferences.getString(KEY_LIBRARY_SORT, null)
+        set(value) { preferences.edit { putString(KEY_LIBRARY_SORT, value) } }
+
+    /** The library's offer of posters and synopses was turned down. */
+    var metadataOfferDismissed: Boolean
+        get() = preferences.getBoolean(KEY_METADATA_OFFER_DISMISSED, false)
+        set(value) { preferences.edit { putBoolean(KEY_METADATA_OFFER_DISMISSED, value) } }
+
+    /** Which titles the library last showed, as a `LibraryFilter` name; null for all. */
+    var libraryFilter: String?
+        get() = preferences.getString(KEY_LIBRARY_FILTER, null)
+        set(value) { preferences.edit { putString(KEY_LIBRARY_FILTER, value) } }
+
+    /** Whether the library folds each franchise into one tile. */
+    var libraryGrouped: Boolean
+        get() = preferences.getBoolean(KEY_LIBRARY_GROUPED, true)
+        set(value) { preferences.edit { putBoolean(KEY_LIBRARY_GROUPED, value) } }
+
+    /** Whether a background crawl may say that a show gained episodes. */
+    var newEpisodeNotifications: Boolean
+        get() = preferences.getBoolean(KEY_NEW_EPISODE_NOTIFICATIONS, true)
+        set(value) { preferences.edit { putBoolean(KEY_NEW_EPISODE_NOTIFICATIONS, value) } }
+
     companion object {
         /** The desktop's range, in the steps a phone's storage is bought in. */
         val CACHE_BUDGET_CHOICES = listOf(1, 2, 4, 8, 16)
@@ -44,10 +70,20 @@ class SettingsStore(context: Context) {
 
         fun gibToBytes(gib: Int): ULong = gib.toULong() * 1024uL * 1024uL * 1024uL
 
+        /** Load the file into memory, so no later read waits on the disk. */
+        fun preload(context: Context) {
+            context.getSharedPreferences(NAME, Context.MODE_PRIVATE).all
+        }
+
         private const val NAME = "proton_stream_settings"
         private const val KEY_WIFI_ONLY = "wifi_only"
         private const val KEY_BACKGROUND_AUDIO = "background_audio"
         private const val KEY_HARDWARE_DECODING = "hardware_decoding"
         private const val KEY_CACHE_BUDGET_GIB = "cache_budget_gib"
+        private const val KEY_LIBRARY_SORT = "library_sort"
+        private const val KEY_LIBRARY_GROUPED = "library_grouped"
+        private const val KEY_LIBRARY_FILTER = "library_filter"
+        private const val KEY_NEW_EPISODE_NOTIFICATIONS = "new_episode_notifications"
+        private const val KEY_METADATA_OFFER_DISMISSED = "metadata_offer_dismissed"
     }
 }

android/app/src/main/java/io/narl/protonstream/sync/NewEpisodesWorker.kt

@@ -0,0 +1,136 @@
+package io.narl.protonstream.sync
+
+import android.Manifest
+import android.app.NotificationChannel
+import android.app.NotificationManager
+import android.app.PendingIntent
+import android.content.Context
+import android.content.Intent
+import android.content.pm.PackageManager
+import android.os.Build
+import androidx.core.app.NotificationCompat
+import androidx.core.app.NotificationManagerCompat
+import androidx.work.Constraints
+import androidx.work.CoroutineWorker
+import androidx.work.ExistingPeriodicWorkPolicy
+import androidx.work.NetworkType
+import androidx.work.PeriodicWorkRequestBuilder
+import androidx.work.WorkManager
+import androidx.work.WorkerParameters
+import io.narl.protonstream.MainActivity
+import io.narl.protonstream.R
+import io.narl.protonstream.native.NativeRuntime
+import io.narl.protonstream.settings.SettingsStore
+import uniffi.pstr_android.NewEpisodesRecord
+import java.util.concurrent.TimeUnit
+
+/**
+ * Look at the shares while the app is away, and say when a show gained episodes.
+ *
+ * The app crawls a share it has not looked at for six hours whenever it opens,
+ * which finds a new episode only once someone opens it to look. This runs the
+ * same crawl on WorkManager's schedule instead. It only reports files the
+ * crawl itself found, so a share the app crawled since says nothing twice.
+ */
+class NewEpisodesWorker(
+    appContext: Context,
+    parameters: WorkerParameters,
+) : CoroutineWorker(appContext, parameters) {
+    override suspend fun doWork(): Result {
+        if (!SettingsStore(applicationContext).newEpisodeNotifications) return Result.success()
+        val news = runCatching { NativeRuntime.engine().crawlForNews() }.getOrElse { return Result.retry() }
+        if (news.isNotEmpty()) post(news)
+        return Result.success()
+    }
+
+    private fun post(news: List<NewEpisodesRecord>) {
+        if (
+            Build.VERSION.SDK_INT >= Build.VERSION_CODES.TIRAMISU &&
+            applicationContext.checkSelfPermission(Manifest.permission.POST_NOTIFICATIONS) !=
+            PackageManager.PERMISSION_GRANTED
+        ) {
+            return
+        }
+        val manager = applicationContext.getSystemService(NotificationManager::class.java)
+        manager.createNotificationChannel(
+            NotificationChannel(CHANNEL_ID, "New episodes", NotificationManager.IMPORTANCE_DEFAULT).apply {
+                description = "A show in your library gained episodes"
+            },
+        )
+        val open = PendingIntent.getActivity(
+            applicationContext,
+            0,
+            Intent(applicationContext, MainActivity::class.java),
+            PendingIntent.FLAG_IMMUTABLE or PendingIntent.FLAG_UPDATE_CURRENT,
+        )
+        val compat = NotificationManagerCompat.from(applicationContext)
+        // One per show, keyed by it, so a second crawl's news for the same show
+        // replaces the first rather than stacking under it.
+        news.forEach { item ->
+            val notification = NotificationCompat.Builder(applicationContext, CHANNEL_ID)
+                .setSmallIcon(R.drawable.ic_notification_stream)
+                .setContentTitle(item.title)
+                .setContentText(describe(item))
+                .setContentIntent(open)
+                .setGroup(GROUP)
+                .setAutoCancel(true)
+                .build()
+            compat.notify(item.titleKey, NOTIFICATION_ID, notification)
+        }
+        if (news.size > 1) {
+            val summary = NotificationCompat.Builder(applicationContext, CHANNEL_ID)
+                .setSmallIcon(R.drawable.ic_notification_stream)
+                .setContentTitle("New episodes")
+                .setContentText(news.joinToString { it.title })
+                .setContentIntent(open)
+                .setGroup(GROUP)
+                .setGroupSummary(true)
+                .setAutoCancel(true)
+                .build()
+            compat.notify(SUMMARY_TAG, NOTIFICATION_ID, summary)
+        }
+    }
+
+    companion object {
+        private const val WORK_NAME = "new-episodes"
+        private const val CHANNEL_ID = "new-episodes"
+        private const val GROUP = "io.narl.protonstream.NEW_EPISODES"
+        private const val SUMMARY_TAG = "new-episodes-summary"
+        private const val NOTIFICATION_ID = 7
+        private const val INTERVAL_HOURS = 6L
+
+        /** What one show's notification says: "S01E04 and 2 more". */
+        fun describe(news: NewEpisodesRecord): String {
+            val more = news.count.toInt() - 1
+            val first = news.first
+            return when {
+                first == null -> if (news.count == 1u) "1 new episode" else "${news.count} new episodes"
+                more == 0 -> "$first is new"
+                more == 1 -> "$first and 1 more are new"
+                else -> "$first and $more more are new"
+            }
+        }
+
+        /**
+         * Keep the periodic look scheduled, or cancel it when the viewer
+         * turned it off. Called on every launch; keeping an existing schedule
+         * means a launch does not push the next look back.
+         */
+        fun schedule(context: Context) {
+            val work = WorkManager.getInstance(context.applicationContext)
+            if (!SettingsStore(context).newEpisodeNotifications) {
+                work.cancelUniqueWork(WORK_NAME)
+                return
+            }
+            val request = PeriodicWorkRequestBuilder<NewEpisodesWorker>(INTERVAL_HOURS, TimeUnit.HOURS)
+                .setConstraints(
+                    Constraints.Builder()
+                        .setRequiredNetworkType(NetworkType.CONNECTED)
+                        .setRequiresBatteryNotLow(true)
+                        .build(),
+                )
+                .build()
+            work.enqueueUniquePeriodicWork(WORK_NAME, ExistingPeriodicWorkPolicy.KEEP, request)
+        }
+    }
+}

android/app/src/main/java/io/narl/protonstream/sync/WatchSyncWorker.kt

@@ -0,0 +1,56 @@
+package io.narl.protonstream.sync
+
+import android.content.Context
+import androidx.work.BackoffPolicy
+import androidx.work.Constraints
+import androidx.work.CoroutineWorker
+import androidx.work.ExistingWorkPolicy
+import androidx.work.NetworkType
+import androidx.work.OneTimeWorkRequestBuilder
+import androidx.work.WorkManager
+import androidx.work.WorkerParameters
+import io.narl.protonstream.native.NativeRuntime
+import uniffi.pstr_android.AccountState
+import java.util.concurrent.TimeUnit
+
+/**
+ * One watch-history sync after the app leaves the screen.
+ *
+ * The model's timer only runs while the app is alive, and Android is free to
+ * kill a process in the background without notice — so the position the
+ * viewer stopped at would wait for the next launch to reach their other
+ * devices. Handed to WorkManager instead, it goes as soon as there is a
+ * network, even if the process is gone by then.
+ */
+class WatchSyncWorker(
+    appContext: Context,
+    parameters: WorkerParameters,
+) : CoroutineWorker(appContext, parameters) {
+    override suspend fun doWork(): Result {
+        val engine = NativeRuntime.engine()
+        return runCatching { engine.syncWatchHistory() }.fold(
+            onSuccess = { Result.success() },
+            onFailure = {
+                // Signed out by the engine — the session ended — is not
+                // something a retry fixes; a dropped connection is.
+                val signedOut = runCatching { engine.accountState() }.getOrNull() == AccountState.SignedOut
+                if (signedOut || runAttemptCount >= MAX_ATTEMPTS) Result.failure() else Result.retry()
+            },
+        )
+    }
+
+    companion object {
+        private const val WORK_NAME = "watch-history-sync"
+        private const val MAX_ATTEMPTS = 3
+
+        /** Replacing: one pending sync covers every position saved before it runs. */
+        fun enqueue(context: Context) {
+            val request = OneTimeWorkRequestBuilder<WatchSyncWorker>()
+                .setConstraints(Constraints.Builder().setRequiredNetworkType(NetworkType.CONNECTED).build())
+                .setBackoffCriteria(BackoffPolicy.EXPONENTIAL, 30, TimeUnit.SECONDS)
+                .build()
+            WorkManager.getInstance(context.applicationContext)
+                .enqueueUniqueWork(WORK_NAME, ExistingWorkPolicy.REPLACE, request)
+        }
+    }
+}

android/app/src/main/java/io/narl/protonstream/ui/AccountUi.kt

@@ -0,0 +1,507 @@
+package io.narl.protonstream.ui
+
+import android.annotation.SuppressLint
+import android.os.Handler
+import android.os.Looper
+import android.webkit.JavascriptInterface
+import android.webkit.WebResourceRequest
+import android.webkit.WebView
+import android.webkit.WebViewClient
+import androidx.activity.compose.BackHandler
+import androidx.compose.foundation.clickable
+import androidx.compose.foundation.layout.Arrangement
+import androidx.compose.foundation.layout.Box
+import androidx.compose.foundation.layout.Column
+import androidx.compose.foundation.layout.PaddingValues
+import androidx.compose.foundation.layout.Row
+import androidx.compose.foundation.layout.fillMaxSize
+import androidx.compose.foundation.layout.fillMaxWidth
+import androidx.compose.foundation.layout.height
+import androidx.compose.foundation.layout.padding
+import androidx.compose.foundation.lazy.LazyColumn
+import androidx.compose.foundation.lazy.items
+import androidx.compose.foundation.text.KeyboardOptions
+import androidx.compose.material.icons.Icons
+import androidx.compose.material.icons.automirrored.filled.ArrowBack
+import androidx.compose.material.icons.filled.AccountCircle
+import androidx.compose.material.icons.filled.Close
+import androidx.compose.material.icons.filled.Computer
+import androidx.compose.material.icons.filled.Folder
+import androidx.compose.material.icons.filled.FolderShared
+import androidx.compose.material.icons.filled.InsertDriveFile
+import androidx.compose.material.icons.filled.Logout
+import androidx.compose.material.icons.filled.Movie
+import androidx.compose.material.icons.filled.MoreVert
+import androidx.compose.material.icons.filled.Storage
+import androidx.compose.material.icons.filled.Sync
+import androidx.compose.material3.AlertDialog
+import androidx.compose.material3.Card
+import androidx.compose.material3.CircularProgressIndicator
+import androidx.compose.material3.DropdownMenu
+import androidx.compose.material3.DropdownMenuItem
+import androidx.compose.material3.ExperimentalMaterial3Api
+import androidx.compose.material3.Icon
+import androidx.compose.material3.IconButton
+import androidx.compose.material3.ListItem
+import androidx.compose.material3.ListItemDefaults
+import androidx.compose.material3.MaterialTheme
+import androidx.compose.material3.OutlinedTextField
+import androidx.compose.material3.Scaffold
+import androidx.compose.material3.Text
+import androidx.compose.material3.TopAppBar
+import androidx.compose.runtime.Composable
+import androidx.compose.runtime.LaunchedEffect
+import androidx.compose.runtime.getValue
+import androidx.compose.runtime.mutableStateListOf
+import androidx.compose.runtime.mutableStateOf
+import androidx.compose.runtime.remember
+import androidx.compose.runtime.setValue
+import androidx.compose.ui.Alignment
+import androidx.compose.ui.Modifier
+import androidx.compose.ui.graphics.Color
+import androidx.compose.ui.text.font.FontWeight
+import androidx.compose.ui.text.input.KeyboardType
+import androidx.compose.ui.text.input.PasswordVisualTransformation
+import androidx.compose.ui.text.style.TextOverflow
+import androidx.compose.ui.unit.dp
+import androidx.compose.ui.viewinterop.AndroidView
+import androidx.compose.ui.window.Dialog
+import androidx.compose.ui.window.DialogProperties
+import androidx.compose.ui.window.SecureFlagPolicy
+import io.narl.protonstream.native.NativeRuntime
+import io.narl.protonstream.ui.theme.AccentButton
+import io.narl.protonstream.ui.theme.TonalButton
+import uniffi.pstr_android.AccountState
+import uniffi.pstr_android.DriveEntryRecord
+import uniffi.pstr_android.DrivePlaceRecord
+import uniffi.pstr_android.PlaceType
+import uniffi.pstr_android.verificationToken
+
+/** What the account card and its dialogs can ask the model for. */
+internal data class AccountActions(
+    val signIn: (String, String, String?) -> Unit,
+    val submitSecondFactor: (String) -> Unit,
+    val submitMailboxPassword: (String) -> Unit,
+    val cancelSignIn: () -> Unit,
+    val dismissVerification: () -> Unit,
+    val signOut: () -> Unit,
+    val syncNow: () -> Unit,
+    val addFolder: (String, String, String) -> Unit,
+    val onError: (Throwable) -> Unit,
+)
+
+/**
+ * The Proton account, at the top of the shares page: why one would sign in,
+ * or who is signed in and how watch-history sync is doing.
+ */
+@Composable
+internal fun AccountCard(
+    account: AccountUiState,
+    actions: AccountActions,
+    onSignIn: () -> Unit,
+    onBrowse: () -> Unit,
+) {
+    val state = account.state ?: return
+    Card(Modifier.fillMaxWidth().padding(horizontal = 16.dp, vertical = 8.dp)) {
+        if (state is AccountState.SignedIn) {
+            var menu by remember { mutableStateOf(false) }
+            ListItem(
+                headlineContent = { Text(state.username, fontWeight = FontWeight.SemiBold) },
+                supportingContent = { Text(syncLine(account, System.currentTimeMillis())) },
+                leadingContent = {
+                    Icon(Icons.Default.AccountCircle, contentDescription = null, tint = MaterialTheme.colorScheme.primary)
+                },
+                trailingContent = {
+                    Box {
+                        IconButton(onClick = { menu = true }) {
+                            Icon(Icons.Default.MoreVert, contentDescription = "Account actions")
+                        }
+                        DropdownMenu(expanded = menu, onDismissRequest = { menu = false }) {
+                            DropdownMenuItem(
+                                text = { Text("Sync now") },
+                                leadingIcon = { Icon(Icons.Default.Sync, contentDescription = null) },
+                                onClick = { menu = false; actions.syncNow() },
+                            )
+                            DropdownMenuItem(
+                                text = { Text("Sign out") },
+                                leadingIcon = { Icon(Icons.Default.Logout, contentDescription = null) },
+                                onClick = { menu = false; actions.signOut() },
+                            )
+                        }
+                    }
+                },
+                colors = ListItemDefaults.colors(containerColor = Color.Transparent),
+            )
+            TonalButton(
+                onClick = onBrowse,
+                modifier = Modifier.padding(start = 16.dp, end = 16.dp, bottom = 16.dp),
+            ) {
+                Icon(Icons.Default.Folder, contentDescription = null)
+                Text("Add from your Drive", Modifier.padding(start = 8.dp))
+            }
+        } else {
+            Column(Modifier.padding(16.dp), verticalArrangement = Arrangement.spacedBy(8.dp)) {
+                Text("Proton account", style = MaterialTheme.typography.titleMedium)
+                Text(
+                    "Optional. Signed in, your shares, settings and watch history are kept in your own " +
+                        "Drive, so every device shows the same library and resumes where another left off, " +
+                        "and folders of your Drive can join the library.",
+                    style = MaterialTheme.typography.bodyMedium,
+                    color = MaterialTheme.colorScheme.onSurfaceVariant,
+                )
+                TonalButton(onClick = onSignIn) { Text("Sign in") }
+            }
+        }
+    }
+}
+
+/** "Synced 3 min ago · 2 from other devices", or why it did not. */
+internal fun syncLine(account: AccountUiState, now: Long): String {
+    account.syncError?.let { return "Did not sync: $it" }
+    val at = account.syncedAt ?: return "Library, settings and watch history sync through your Drive"
+    val minutes = ((now - at).coerceAtLeast(0) / 60_000).toInt()
+    val ago = when {
+        minutes < 1 -> "just now"
+        minutes < 60 -> "$minutes min ago"
+        else -> "${minutes / 60} h ago"
+    }
+    val applied = if (account.applied > 0) " · ${account.applied} from other devices" else ""
+    return "Synced $ago$applied"
+}
+
+/**
+ * Signing in, one step at a time: address and password, then a second-factor
+ * code or the mailbox password if the account has them, with Proton's CAPTCHA
+ * over the top when it asks for one.
+ */
+@Composable
+internal fun SignInDialog(account: AccountUiState, actions: AccountActions, onDismiss: () -> Unit) {
+    var username by remember { mutableStateOf("") }
+    var password by remember { mutableStateOf("") }
+    var code by remember { mutableStateOf("") }
+    var mailbox by remember { mutableStateOf("") }
+    val state = account.state
+    LaunchedEffect(state) {
+        if (state is AccountState.SignedIn) onDismiss()
+    }
+    val dismiss = {
+        if (state == AccountState.SecondFactor || state == AccountState.MailboxPassword) actions.cancelSignIn()
+        onDismiss()
+    }
+    AlertDialog(
+        onDismissRequest = dismiss,
+        properties = DialogProperties(securePolicy = SecureFlagPolicy.SecureOn),
+        title = { Text("Sign in to Proton") },
+        text = {
+            Column(verticalArrangement = Arrangement.spacedBy(8.dp)) {
+                when (state) {
+                    AccountState.SecondFactor -> {
+                        OutlinedTextField(
+                            code,
+                            { code = it },
+                            label = { Text("Code from your authenticator app") },
+                            singleLine = true,
+                            keyboardOptions = KeyboardOptions(keyboardType = KeyboardType.NumberPassword),
+                        )
+                        Text(SECURITY_KEY_NOTE, style = MaterialTheme.typography.bodySmall)
+                    }
+                    AccountState.MailboxPassword -> {
+                        Text(
+                            "This account has a separate mailbox password. It unlocks your files.",
+                            style = MaterialTheme.typography.bodySmall,
+                        )
+                        PasswordField(mailbox, { mailbox = it }, "Mailbox password")
+                    }
+                    else -> {
+                        OutlinedTextField(
+                            username,
+                            { username = it },
+                            label = { Text("Address") },
+                            singleLine = true,
+                            keyboardOptions = KeyboardOptions(keyboardType = KeyboardType.Email),
+                        )
+                        PasswordField(password, { password = it }, "Password")
+                    }
+                }
+                account.error?.let { Text(it, color = MaterialTheme.colorScheme.error) }
+                if (account.busy) CircularProgressIndicator(Modifier.padding(top = 4.dp))
+            }
+        },
+        confirmButton = {
+            when (state) {
+                AccountState.SecondFactor -> AccentButton(
+                    onClick = { actions.submitSecondFactor(code.trim()) },
+                    enabled = code.isNotBlank() && !account.busy,
+                ) { Text("Continue") }
+                AccountState.MailboxPassword -> AccentButton(
+                    onClick = { actions.submitMailboxPassword(mailbox) },
+                    enabled = mailbox.isNotEmpty() && !account.busy,
+                ) { Text("Unlock") }
+                else -> AccentButton(
+                    onClick = { actions.signIn(username.trim(), password, null) },
+                    enabled = username.isNotBlank() && password.isNotEmpty() && !account.busy,
+                ) { Text("Sign in") }
+            }
+        },
+        dismissButton = { TonalButton(onClick = dismiss) { Text("Cancel") } },
+    )
+    account.verificationUrl?.let { url ->
+        VerificationDialog(
+            url = url,
+            onToken = { token -> actions.signIn(username.trim(), password, token) },
+            onDismiss = actions.dismissVerification,
+        )
+    }
+}
+
+@Composable
+private fun PasswordField(value: String, onChange: (String) -> Unit, label: String) = OutlinedTextField(
+    value,
+    onChange,
+    label = { Text(label) },
+    singleLine = true,
+    visualTransformation = PasswordVisualTransformation(),
+    keyboardOptions = KeyboardOptions(keyboardType = KeyboardType.Password),
+)
+
+/**
+ * Proton's hosted CAPTCHA, which it puts in front of a sign-in it does not
+ * recognise — a new network, a VPN exit.
+ *
+ * In a WebView rather than the browser because the page reports success by
+ * posting a message to its host, not by redirecting: a browser has nowhere to
+ * post it back to. The page targets `window.parent`, which for a top-level
+ * page is the page itself, so a listener on its own window hears it.
+ */
+@SuppressLint("SetJavaScriptEnabled") // The verification page is a script; it does not run without.
+@Composable
+private fun VerificationDialog(url: String, onToken: (String) -> Unit, onDismiss: () -> Unit) {
+    Dialog(onDismissRequest = onDismiss, properties = DialogProperties(usePlatformDefaultWidth = false)) {
+        Card(Modifier.fillMaxWidth().padding(16.dp).height(560.dp)) {
+            Row(verticalAlignment = Alignment.CenterVertically) {
+                Text(
+                    "Confirm you are human",
+                    style = MaterialTheme.typography.titleMedium,
+                    modifier = Modifier.weight(1f).padding(start = 16.dp),
+                )
+                IconButton(onClick = onDismiss) { Icon(Icons.Default.Close, contentDescription = "Cancel") }
+            }
+            AndroidView(
+                modifier = Modifier.fillMaxSize(),
+                factory = { context ->
+                    val main = Handler(Looper.getMainLooper())
+                    var answered = false
+                    WebView(context).apply {
+                        settings.javaScriptEnabled = true
+                        settings.domStorageEnabled = true
+                        addJavascriptInterface(
+                            object {
+                                @JavascriptInterface
+                                fun post(message: String) {
+                                    // Every message the page posts lands here,
+                                    // most of them its own chatter.
+                                    val token = verificationToken(message) ?: return
+                                    main.post {
+                                        if (!answered) {
+                                            answered = true
+                                            onToken(token)
+                                        }
+                                    }
+                                }
+                            },
+                            "pstrVerification",
+                        )
+                        webViewClient = object : WebViewClient() {
+                            override fun onPageStarted(view: WebView, url: String?, favicon: android.graphics.Bitmap?) {
+                                view.evaluateJavascript(VERIFICATION_BRIDGE, null)
+                            }
+
+                            override fun onPageFinished(view: WebView, url: String?) {
+                                view.evaluateJavascript(VERIFICATION_BRIDGE, null)
+                            }
+
+                            // The bridge above is reachable by whatever the
+                            // frame shows, so the frame stays on Proton.
+                            override fun shouldOverrideUrlLoading(view: WebView, request: WebResourceRequest) =
+                                !isProtonPage(request.url.scheme, request.url.host)
+                        }
+                        loadUrl(url)
+                    }
+                },
+            )
+        }
+    }
+}
+
+/**
+ * Security keys need WebAuthn, which the sign-in here does not speak. An account
+ * with nothing else is refused before this form (`AccountStore::sign_in`).
+ */
+private const val SECURITY_KEY_NOTE =
+    "Security keys are not supported here — use the code from your authenticator app."
+
+/** Installed once per page, at start and again at finish in case the first ran too early. */
+private const val VERIFICATION_BRIDGE = """
+if (!window.__pstrVerification) {
+    window.__pstrVerification = true;
+    window.addEventListener('message', function (event) {
+        try {
+            pstrVerification.post(typeof event.data === 'string' ? event.data : JSON.stringify(event.data));
+        } catch (e) {}
+    });
+}
+"""
+
+/** Whether a page is Proton's own, over HTTPS. */
+internal fun isProtonPage(scheme: String?, host: String?): Boolean =
+    scheme == "https" && host != null && (host == "proton.me" || host.endsWith(".proton.me"))
+
+/**
+ * Walk the account's Drive and add a folder of it to the library.
+ *
+ * Full screen, because a Drive is deep and a dialog's height is a few rows of
+ * it. Listings are asked for here rather than through the model: they are
+ * this dialog's alone, and gone when it closes.
+ */
+@OptIn(ExperimentalMaterial3Api::class)
+@Composable
+internal fun DriveBrowserDialog(
+    actions: AccountActions,
+    onDismiss: () -> Unit,
+) {
+    val trail = remember { mutableStateListOf<Pair<String, DrivePlaceRecord>>() }
+    var places by remember { mutableStateOf<List<DrivePlaceRecord>?>(null) }
+    var entries by remember { mutableStateOf<List<DriveEntryRecord>?>(null) }
+    var error by remember { mutableStateOf<String?>(null) }
+    val current = trail.lastOrNull()?.second
+
+    LaunchedEffect(current) {
+        error = null
+        if (current == null) {
+            if (places == null) {
+                runCatching { NativeRuntime.engine().drivePlaces() }
+                    .onSuccess { places = it }
+                    .onFailure { error = it.message }
+            }
+        } else {
+            entries = null
+            runCatching { NativeRuntime.engine().driveFolder(current.volumeId, current.linkId) }
+                .onSuccess { entries = it }
+                .onFailure { error = it.message }
+        }
+    }
+
+    Dialog(onDismissRequest = onDismiss, properties = DialogProperties(usePlatformDefaultWidth = false)) {
+        BackHandler(enabled = trail.isNotEmpty()) { trail.removeAt(trail.lastIndex) }
+        Scaffold(
+            topBar = {
+                TopAppBar(
+                    title = {
+                        Text(
+                            trail.lastOrNull()?.first ?: "Your Drive",
+                            maxLines = 1,
+                            overflow = TextOverflow.Ellipsis,
+                        )
+                    },
+                    navigationIcon = {
+                        IconButton(onClick = { if (trail.isEmpty()) onDismiss() else trail.removeAt(trail.lastIndex) }) {
+                            Icon(
+                                if (trail.isEmpty()) Icons.Default.Close else Icons.AutoMirrored.Filled.ArrowBack,
+                                contentDescription = if (trail.isEmpty()) "Close" else "Up a folder",
+                            )
+                        }
+                    },
+                )
+            },
+            bottomBar = {
+                // A folder already in the library is refused by the engine,
+                // with a message saying so.
+                val folder = current ?: return@Scaffold
+                Row(Modifier.fillMaxWidth().padding(16.dp), horizontalArrangement = Arrangement.End) {
+                    AccentButton(
+                        onClick = {
+                            actions.addFolder(trail.last().first, folder.volumeId, folder.linkId)
+                            onDismiss()
+                        },
+                    ) { Text("Add this folder") }
+                }
+            },
+        ) { padding ->
+            Box(Modifier.fillMaxSize().padding(padding)) {
+                val loading = error == null && (if (current == null) places == null else entries == null)
+                when {
+                    error != null -> EmptyState("Could not list this", error.orEmpty())
+                    loading -> CircularProgressIndicator(Modifier.align(Alignment.Center))
+                    current == null -> LazyColumn(contentPadding = PaddingValues(vertical = 8.dp)) {
+                        items(places.orEmpty(), key = { "${it.volumeId}/${it.linkId}" }) { place ->
+                            DriveRow(
+                                icon = when (place.kind) {
+                                    PlaceType.MY_FILES -> Icons.Default.Storage
+                                    PlaceType.DEVICE -> Icons.Default.Computer
+                                    PlaceType.SHARED_WITH_ME -> Icons.Default.FolderShared
+                                },
+                                name = place.name,
+                                detail = null,
+                                onClick = { trail.add(place.name to place) },
+                            )
+                        }
+                    }
+                    entries.orEmpty().isEmpty() -> EmptyState("Empty folder", "Nothing to add from here.")
+                    else -> LazyColumn(contentPadding = PaddingValues(vertical = 8.dp)) {
+                        items(entries.orEmpty(), key = { "${it.volumeId}/${it.linkId}" }) { entry ->
+                            DriveRow(
+                                icon = when {
+                                    entry.isFolder -> Icons.Default.Folder
+                                    entry.isVideo -> Icons.Default.Movie
+                                    else -> Icons.Default.InsertDriveFile
+                                },
+                                name = entry.name,
+                                detail = entry.size?.let(::formatBytes),
+                                onClick = if (entry.isFolder) {
+                                    {
+                                        trail.add(
+                                            entry.name to DrivePlaceRecord(
+                                                PlaceType.MY_FILES,
+                                                entry.name,
+                                                entry.volumeId,
+                                                entry.linkId,
+                                            ),
+                                        )
+                                    }
+                                } else {
+                                    null
+                                },
+                            )
+                        }
+                    }
+                }
+            }
+        }
+    }
+}
+
+@Composable
+private fun DriveRow(
+    icon: androidx.compose.ui.graphics.vector.ImageVector,
+    name: String,
+    detail: String?,
+    onClick: (() -> Unit)?,
+) {
+    ListItem(
+        headlineContent = { Text(name, maxLines = 2, overflow = TextOverflow.Ellipsis) },
+        supportingContent = detail?.let { { Text(it) } },
+        leadingContent = {
+            Icon(
+                icon,
+                contentDescription = null,
+                tint = if (onClick != null) {
+                    MaterialTheme.colorScheme.primary
+                } else {
+                    MaterialTheme.colorScheme.onSurfaceVariant
+                },
+            )
+        },
+        colors = ListItemDefaults.colors(containerColor = Color.Transparent),
+        modifier = if (onClick != null) Modifier.clickable(onClick = onClick) else Modifier,
+    )
+}

android/app/src/main/java/io/narl/protonstream/ui/AppViewModel.kt

@@ -25,6 +25,13 @@ import kotlinx.coroutines.flow.callbackFlow
 import kotlinx.coroutines.channels.awaitClose
 import kotlinx.coroutines.withContext
 import io.narl.protonstream.native.NativeRuntime
+import io.narl.protonstream.settings.SettingsStore
+import io.narl.protonstream.ui.theme.AppearanceState
+import uniffi.pstr_android.ArrangementRecord
+import uniffi.pstr_android.BrowseFacet
+import uniffi.pstr_android.SearchExtrasRecord
+import uniffi.pstr_android.LibraryFilter
+import uniffi.pstr_android.LibrarySort
 import uniffi.pstr_android.ShareRecord
 import uniffi.pstr_android.TitleRecord
 import uniffi.pstr_android.OfflineRecord
@@ -34,12 +41,37 @@ import uniffi.pstr_android.MetadataSettingsRecord
 import uniffi.pstr_android.StorageUsageRecord
 import uniffi.pstr_android.EpisodeRecord
 import uniffi.pstr_android.WatchStateRecord
+import uniffi.pstr_android.AccountState
+import uniffi.pstr_android.SignInOutcome
+import uniffi.pstr_android.SyncRecord
+import kotlinx.coroutines.delay
+import kotlinx.coroutines.isActive
 
 data class AppUiState(
     val loading: Boolean = true,
     val refreshing: Boolean = false,
+    /** A crawl is running, which the banner offers to stop. */
+    val crawling: Boolean = false,
     val query: String = "",
+    /**
+     * The whole library, whatever is searched for: the grid narrows to the
+     * search through [arrangement], and a title opened from a search, or from
+     * an episode it found, stays one the app can show.
+     */
     val titles: List<TitleRecord> = emptyList(),
+    /** What the search found besides titles; null with no search. */
+    val searchExtras: SearchExtrasRecord? = null,
+    /** The last few searches on this device, newest first. */
+    val recentSearches: List<String> = emptyList(),
+    /**
+     * The grid: [titles] ordered, each franchise folded into one tile when
+     * [grouped], and the shelves above it. Null until the bridge has answered,
+     * when the grid falls back to [titles] as they are.
+     */
+    val arrangement: ArrangementRecord? = null,
+    val filter: LibraryFilter = LibraryFilter.ALL,
+    val sort: LibrarySort = LibrarySort.NAME,
+    val grouped: Boolean = true,
     val shares: List<ShareRecord> = emptyList(),
     val offline: List<OfflineRecord> = emptyList(),
     val metadataSettings: MetadataSettingsRecord = MetadataSettingsRecord(
@@ -50,8 +82,33 @@ data class AppUiState(
     ),
     val storage: StorageUsageRecord = StorageUsageRecord(0uL, 0uL, 0uL, 0uL),
     val message: String? = null,
+    /**
+     * What is running in the background right now, said in a banner for as
+     * long as it runs: an add, a crawl, a match, a sync. Without it a
+     * minute-long crawl looked like a tap that did nothing.
+     */
+    val activity: String? = null,
     /** What Undo on [message] puts back, when the message offers one. */
     val undo: List<WatchSnapshot>? = null,
+    val account: AccountUiState = AccountUiState(),
+)
+
+/** The Proton account: where a sign-in stands, and how sync is doing. */
+data class AccountUiState(
+    /** Null until the bridge has said. */
+    val state: AccountState? = null,
+    /** A sign-in step is out and not answered yet. */
+    val busy: Boolean = false,
+    /** Why the last sign-in step was refused. */
+    val error: String? = null,
+    /** The CAPTCHA page Proton wants solved before it accepts the sign-in. */
+    val verificationUrl: String? = null,
+    /** When watch history last synced, in epoch milliseconds. */
+    val syncedAt: Long? = null,
+    /** Positions the last sync took from other devices. */
+    val applied: Int = 0,
+    /** Why the last sync failed, until one succeeds. */
+    val syncError: String? = null,
 )
 
 /**
@@ -66,6 +123,21 @@ class AppViewModel(context: Context, private val workManager: WorkManager) : Vie
     private val mutableState = MutableStateFlow(AppUiState())
     private val searchQuery = MutableStateFlow("")
     val state: StateFlow<AppUiState> = mutableState.asStateFlow()
+    /** Launch and coming back both ask; one crawl answers. */
+    private var catchingUp = false
+
+    /**
+     * Every banner line whose work is still running, oldest first. Touched on
+     * the main thread only, as everything in [viewModelScope] is.
+     */
+    private val activities = mutableListOf<Pair<Long, String>>()
+    private var nextActivity = 0L
+
+    /** Crawls running now; main thread only, like [activities]. */
+    private var crawlsRunning = 0
+
+    /** Set by [stopCrawl], so a queue of shares stops rather than going on to the next. */
+    private var crawlStopped = false
 
     init {
         if (!NativeRuntime.tlsReady) {
@@ -73,10 +145,44 @@ class AppViewModel(context: Context, private val workManager: WorkManager) : Vie
                 it.copy(message = "Certificate verification is unavailable; Proton requests will fail")
             }
         }
-        reload()
+        // The arrangement first, so the first grid is drawn the way the viewer
+        // left it rather than A–Z and then re-sorted under them.
+        viewModelScope.launch {
+            val (filter, sort, grouped) = withContext(Dispatchers.IO) {
+                SettingsStore(appContext).run {
+                    Triple(
+                        libraryFilter?.let { name -> LibraryFilter.entries.firstOrNull { it.name == name } },
+                        librarySort?.let { name -> LibrarySort.entries.firstOrNull { it.name == name } },
+                        libraryGrouped,
+                    )
+                }
+            }
+            mutableState.update { it.copy(filter = filter ?: it.filter, sort = sort ?: it.sort, grouped = grouped) }
+            reload()
+        }
+        catchUp()
+        viewModelScope.launch {
+            val account = runCatching { withContext(Dispatchers.IO) { NativeRuntime.engine().accountState() } }
+                .getOrDefault(AccountState.SignedOut)
+            updateAccount { it.copy(state = account) }
+            // While the app is alive, on top of after sign-in and whenever the
+            // player closes. Cheap when nothing changed: one folder listing,
+            // and no upload.
+            while (isActive) {
+                syncWatchHistory()
+                // A sync WatchSyncWorker ran while the app was away may have
+                // brought shares this one has not crawled.
+                catchUp()
+                delay(SYNC_INTERVAL_MS)
+            }
+        }
         viewModelScope.launch {
             searchQuery.debounce(300).distinctUntilChanged().collect { reloadLibrary(it) }
         }
+        viewModelScope.launch {
+            runCatching { withContext(Dispatchers.IO) { NativeRuntime.engine().recentSearches() } }
+                .onSuccess { recent -> mutableState.update { it.copy(recentSearches = recent) } }
+        }
         viewModelScope.launch {
             workManager.workInfosByTagFlow(DownloadCoordinator.TAG)
                 .map { work -> work.filter { it.state.isFinished }.map { it.id }.toSet() }
@@ -86,21 +192,128 @@ class AppViewModel(context: Context, private val workManager: WorkManager) : Vie
         }
     }
 
+    /** Sort and fold the library, and keep both for the next launch. */
+    fun arrange(sort: LibrarySort, grouped: Boolean) {
+        mutableState.update { it.copy(sort = sort, grouped = grouped) }
+        viewModelScope.launch {
+            withContext(Dispatchers.IO) {
+                SettingsStore(appContext).apply {
+                    librarySort = sort.name
+                    libraryGrouped = grouped
+                }
+            }
+            reloadLibrary(mutableState.value.query)
+        }
+    }
+
+    /** Narrow the grid to some titles, and keep the choice for the next launch. */
+    fun filter(filter: LibraryFilter) {
+        mutableState.update { it.copy(filter = filter) }
+        viewModelScope.launch {
+            withContext(Dispatchers.IO) { SettingsStore(appContext).libraryFilter = filter.name }
+            reloadLibrary(mutableState.value.query)
+        }
+    }
+
     fun search(query: String) {
         mutableState.update { it.copy(query = query) }
         searchQuery.value = query
     }
 
+    /**
+     * Keep the search being shown as one to offer again: called when a viewer
+     * opens something it found. Nothing for an empty one.
+     */
+    fun rememberSearch() {
+        val query = mutableState.value.query.takeIf(String::isNotBlank) ?: return
+        viewModelScope.launch {
+            runCatching {
+                withContext(Dispatchers.IO) {
+                    NativeRuntime.engine().run {
+                        rememberSearch(query)
+                        recentSearches()
+                    }
+                }
+            }.onSuccess { recent -> mutableState.update { it.copy(recentSearches = recent) } }
+        }
+    }
+
+    fun forgetSearches() {
+        viewModelScope.launch {
+            runCatching { withContext(Dispatchers.IO) { NativeRuntime.engine().forgetSearches() } }
+                .onSuccess { mutableState.update { it.copy(recentSearches = emptyList()) } }
+                .onFailure(::reportError)
+        }
+    }
+
     fun refresh() {
         viewModelScope.launch {
-            mutableState.update { it.copy(refreshing = true, message = null) }
-            runCatching { withContext(Dispatchers.IO) { NativeRuntime.engine().crawl(null) } }
-                .onFailure { error -> mutableState.update { it.copy(message = error.message) } }
-            mutableState.update { it.copy(refreshing = false) }
-            reload()
+            busy("Refreshing the library…") {
+                mutableState.update { it.copy(message = null) }
+                runCatching { crawlShares(null) }
+                    .onFailure { error -> mutableState.update { it.copy(message = error.message) } }
+            }
+            reloadNow()
+            matchAfterCrawl()
         }
     }
 
+    /**
+     * Look up whatever a crawl brought that has no answer yet: a new show, or
+     * a new episode its stored guide cannot name. When everything already has
+     * one the bridge asks nothing, so this is cheap after every crawl.
+     */
+    private suspend fun matchAfterCrawl() {
+        val settings = mutableState.value.metadataSettings
+        if (settings.enabled && settings.ready) match(force = false, quiet = true)
+    }
+
+    /**
+     * Say [what] in the activity banner while [work] runs.
+     *
+     * The banner shows the newest line still running. Work overlaps — a sync
+     * starts during a crawl and ends after it — so each line is removed by
+     * itself rather than by putting back whatever was showing before, which
+     * once brought back a finished crawl's line and spun it forever.
+     */
+    private suspend fun busy(what: String, work: suspend () -> Unit) {
+        val token = nextActivity++
+        activities += token to what
+        showActivity()
+        try {
+            work()
+        } finally {
+            activities.removeAll { it.first == token }
+            showActivity()
+        }
+    }
+
+    /** Crawl one share, or all with null, with the banner offering Stop meanwhile. */
+    private suspend fun crawlShares(id: String?) {
+        crawlsRunning++
+        mutableState.update { it.copy(crawling = true) }
+        try {
+            withContext(Dispatchers.IO) { NativeRuntime.engine().crawl(id) }
+        } finally {
+            crawlsRunning--
+            mutableState.update { it.copy(crawling = crawlsRunning > 0) }
+        }
+    }
+
+    /**
+     * Stop the crawls running now. Shares already read stay in the library;
+     * the one being read keeps what it had.
+     */
+    fun stopCrawl() {
+        crawlStopped = true
+        viewModelScope.launch(Dispatchers.IO) { NativeRuntime.engine().stopCrawl() }
+    }
+
+    private fun showActivity() {
+        val newest = activities.lastOrNull()?.second
+        mutableState.update { it.copy(activity = newest, refreshing = newest != null) }
+    }
+
     /**
      * Recrawl one share rather than the whole library.
      *
@@ -111,11 +324,14 @@ class AppViewModel(context: Context, private val workManager: WorkManager) : Vie
      */
     fun refreshShare(id: String) {
         viewModelScope.launch {
-            mutableState.update { it.copy(refreshing = true, message = null) }
-            runCatching { withContext(Dispatchers.IO) { NativeRuntime.engine().crawl(id) } }
-                .onFailure { error -> mutableState.update { it.copy(message = error.message) } }
-            mutableState.update { it.copy(refreshing = false) }
-            reload()
+            val name = mutableState.value.shares.firstOrNull { it.id == id }?.name ?: "the share"
+            busy("Reading $name…") {
+                mutableState.update { it.copy(message = null) }
+                runCatching { crawlShares(id) }
+                    .onFailure { error -> mutableState.update { it.copy(message = error.message) } }
+            }
+            reloadNow()
+            matchAfterCrawl()
         }
     }
 
@@ -128,26 +344,100 @@ class AppViewModel(context: Context, private val workManager: WorkManager) : Vie
      * changed.
      */
     fun matchTitles(force: Boolean) {
-        viewModelScope.launch {
-            mutableState.update { it.copy(refreshing = true, message = null) }
+        viewModelScope.launch { match(force) }
+    }
+
+    /**
+     * With [quiet], a run nobody asked for says nothing when it found nothing
+     * to do.
+     */
+    private suspend fun match(force: Boolean, quiet: Boolean = false) {
+        busy("Looking up titles…") {
             runCatching { withContext(Dispatchers.IO) { NativeRuntime.engine().matchTitles(force) } }
-                .onSuccess { summary -> mutableState.update { it.copy(message = describe(summary)) } }
+                .onSuccess { summary ->
+                    if (!quiet || !summary.isEmpty()) {
+                        mutableState.update { it.copy(message = describe(summary)) }
+                    }
+                }
                 .onFailure { error -> mutableState.update { it.copy(message = error.message) } }
-            mutableState.update { it.copy(refreshing = false) }
-            reload()
+        }
+        reloadNow()
+    }
+
+    private fun MatchSummary.isEmpty() = matched == 0u && unmatched == 0u && failed == 0u && episodes == 0u
+
+    /**
+     * Add a link, and return why it was refused, if it was.
+     *
+     * The link is opened before anything is stored, so the form can stay up
+     * with the reason under it and a retry is a retry — not "already in the
+     * library" for a share that never opened. Only the new share is crawled:
+     * another share that fails to open must not make this one look broken.
+     */
+    suspend fun addShare(name: String, url: String, password: String?): String? {
+        val share = runCatching {
+            withContext(Dispatchers.IO) {
+                NativeRuntime.engine().addShare(name, url, password?.takeIf(String::isNotBlank))
+            }
+        }.getOrElse { return it.message ?: "That link could not be added" }
+        reload()
+        viewModelScope.launch { crawlAdded(listOf(share.id), announce = true) }
+        return null
+    }
+
+    /**
+     * Crawl shares that are new here — added on this device or by sync — then
+     * match them when enrichment is on.
+     */
+    private suspend fun crawlAdded(ids: List<String>, announce: Boolean) {
+        if (ids.isEmpty()) return
+        val before = mutableState.value.titles.map { it.key }.toSet()
+        val failed = mutableListOf<String>()
+        crawlStopped = false
+        for (id in ids) {
+            if (crawlStopped) break
+            val name = mutableState.value.shares.firstOrNull { it.id == id }?.name ?: "the new share"
+            busy("Reading $name…") {
+                runCatching { crawlShares(id) }
+                    .onFailure { failed += "$name: ${it.message}" }
+            }
+        }
+        reloadNow()
+        // A catch-up is the app's doing, not the viewer's: a failure goes on
+        // the share's row rather than in their face, and only news is said.
+        if (failed.isNotEmpty() && announce) {
+            mutableState.update { it.copy(message = failed.joinToString("\n")) }
+            return
+        }
+        matchAfterCrawl()
+        if (announce) {
+            val added = (mutableState.value.titles.map { it.key }.toSet() - before).size
+            mutableState.update { it.copy(message = if (added == 1) "1 title added" else "$added titles added") }
+        } else {
+            val files = mutableState.value.shares.filter { it.id in ids }.sumOf { it.crawlAdded ?: 0uL }
+            if (files > 0uL) {
+                mutableState.update { it.copy(message = if (files == 1uL) "1 new file" else "$files new files") }
+            }
         }
     }
 
-    fun addShare(name: String, url: String, password: String?) {
+    /**
+     * Crawl shares due a look: ones the catalog has nothing of — brought by a
+     * sync that ran in [io.narl.protonstream.sync.WatchSyncWorker], or an add
+     * whose crawl never finished — and ones not crawled for six hours, so new
+     * episodes turn up without a pull to refresh.
+     */
+    fun catchUp() {
+        if (catchingUp) return
+        catchingUp = true
         viewModelScope.launch {
-            runCatching {
-                withContext(Dispatchers.IO) {
-                    val engine = NativeRuntime.engine()
-                    engine.addShare(name, url, password?.takeIf(String::isNotBlank))
-                    engine.crawl(null)
-                }
-            }.onFailure { error -> mutableState.update { it.copy(message = error.message) } }
-            reload()
+            try {
+                val ids = runCatching { withContext(Dispatchers.IO) { NativeRuntime.engine().uncrawledShares() } }
+                    .getOrDefault(emptyList())
+                crawlAdded(ids, announce = false)
+            } finally {
+                catchingUp = false
+            }
         }
     }
 
@@ -169,6 +459,16 @@ class AppViewModel(context: Context, private val workManager: WorkManager) : Vie
                     engine.crawl(id)
                 }
             }.onFailure(::reportError)
+            reloadNow()
+            matchAfterCrawl()
+        }
+    }
+
+    /** Call a share something else. The library, history and downloads stay. */
+    fun renameShare(id: String, name: String) {
+        viewModelScope.launch {
+            runCatching { withContext(Dispatchers.IO) { NativeRuntime.engine().renameShare(id, name) } }
+                .onFailure(::reportError)
             reload()
         }
     }
@@ -196,16 +496,209 @@ class AppViewModel(context: Context, private val workManager: WorkManager) : Vie
 
     fun dismissMessage() = mutableState.update { it.copy(message = null, undo = null) }
 
+    private fun updateAccount(change: (AccountUiState) -> AccountUiState) =
+        mutableState.update { it.copy(account = change(it.account)) }
+
+    /**
+     * Start signing in, or start again with [verificationToken] once the
+     * CAPTCHA from a first try is solved.
+     */
+    fun signIn(username: String, password: String, verificationToken: String? = null) =
+        signInStep { engine -> engine.signIn(username, password, verificationToken) }
+
+    fun submitSecondFactor(code: String) = signInStep { engine -> engine.submitSecondFactor(code) }
+
+    fun submitMailboxPassword(password: String) =
+        signInStep(keepStepOnFailure = true) { engine -> engine.submitMailboxPassword(password) }
+
+    fun cancelSignIn() {
+        updateAccount { AccountUiState(state = AccountState.SignedOut) }
+        viewModelScope.launch { runCatching { NativeRuntime.engine().cancelSignIn() } }
+    }
+
+    /** The CAPTCHA page closed without a token. */
+    fun dismissVerification() = updateAccount { it.copy(verificationUrl = null, busy = false) }
+
+    private fun signInStep(
+        keepStepOnFailure: Boolean = false,
+        step: suspend (uniffi.pstr_android.AndroidEngine) -> SignInOutcome,
+    ) {
+        updateAccount { it.copy(busy = true, error = null, verificationUrl = null) }
+        viewModelScope.launch {
+            runCatching { withContext(Dispatchers.IO) { step(NativeRuntime.engine()) } }
+                .onSuccess { outcome ->
+                    when (outcome) {
+                        is SignInOutcome.Done -> {
+                            updateAccount {
+                                AccountUiState(state = AccountState.SignedIn(outcome.username))
+                            }
+                            mutableState.update { it.copy(message = "Signed in as ${outcome.username}") }
+                            syncWatchHistory()
+                            reload()
+                        }
+                        SignInOutcome.SecondFactor ->
+                            updateAccount { it.copy(state = AccountState.SecondFactor, busy = false) }
+                        SignInOutcome.MailboxPassword ->
+                            updateAccount { it.copy(state = AccountState.MailboxPassword, busy = false) }
+                        is SignInOutcome.HumanVerification ->
+                            updateAccount { it.copy(verificationUrl = outcome.url) }
+                    }
+                }
+                .onFailure { error ->
+                    updateAccount {
+                        it.copy(
+                            busy = false,
+                            error = error.message ?: "Sign-in failed",
+                            // A refused code spends the half-made session.
+                            state = if (keepStepOnFailure) it.state else AccountState.SignedOut,
+                        )
+                    }
+                }
+        }
+    }
+
+    fun signOut() {
+        viewModelScope.launch {
+            runCatching { withContext(Dispatchers.IO) { NativeRuntime.engine().signOut() } }
+                .onFailure(::reportError)
+            updateAccount { AccountUiState(state = AccountState.SignedOut) }
+            reload()
+        }
+    }
+
+    /** Sync now, from a tap: says so when it is done. */
+    fun syncNow() {
+        viewModelScope.launch {
+            if (syncWatchHistory()) {
+                val applied = mutableState.value.account.applied
+                mutableState.update {
+                    it.copy(
+                        message = if (applied > 0) {
+                            "Watch history synced, $applied from other devices"
+                        } else {
+                            "Watch history is up to date"
+                        },
+                    )
+                }
+            }
+        }
+    }
+
+    /**
+     * Pull other devices' positions in and push this one's out. Quiet: it runs
+     * on a timer, and a failure is shown on the account card rather than as a
+     * snackbar every five minutes of an offline evening. Returns whether it
+     * synced.
+     */
+    private suspend fun syncWatchHistory(): Boolean {
+        if (mutableState.value.account.state !is AccountState.SignedIn) return false
+        return runCatching { withContext(Dispatchers.IO) { NativeRuntime.engine().syncWatchHistory() } }
+            .fold(
+                onSuccess = { report ->
+                    if (report == null) return false
+                    updateAccount {
+                        it.copy(
+                            syncedAt = System.currentTimeMillis(),
+                            applied = report.applied.toInt(),
+                            syncError = null,
+                        )
+                    }
+                    takeSynced(report)
+                    true
+                },
+                onFailure = { error ->
+                    val state = runCatching { NativeRuntime.engine().accountState() }.getOrNull()
+                    updateAccount { it.copy(state = state ?: it.state, syncError = error.message) }
+                    // Signed out by the engine: the session ended, and that is
+                    // worth interrupting for, unlike a dropped connection.
+                    if (state == AccountState.SignedOut) reportError(error)
+                    false
+                },
+            )
+    }
+
+    /**
+     * What another device changed: its shares crawled or dropped here, its
+     * settings repainted.
+     */
+    private suspend fun takeSynced(report: SyncRecord) {
+        if (report.sharesRemoved.isNotEmpty()) {
+            withContext(Dispatchers.IO) {
+                val downloads = DownloadStateStore(appContext)
+                report.sharesRemoved.forEach { id ->
+                    workManager.cancelAllWorkByTag(DownloadCoordinator.shareTag(id)).result.get()
+                    downloads.removeShare(id)
+                }
+            }
+        }
+        if (report.settingsChanged) AppearanceState.reload()
+        if (report.applied > 0u || report.titles > 0u || report.settingsChanged || report.listChanged ||
+            report.sharesRemoved.isNotEmpty()
+        ) {
+            reloadNow()
+        }
+        if (report.sharesAdded.isNotEmpty()) {
+            crawlAdded(report.sharesAdded, announce = false)
+            val count = report.sharesAdded.size
+            mutableState.update {
+                it.copy(message = if (count == 1) "A share arrived from another device" else "$count shares arrived from other devices")
+            }
+        }
+    }
+
+    /** After the player closes: where it stopped is what another device wants next. */
+    fun playerClosed() {
+        reload()
+        viewModelScope.launch { syncWatchHistory() }
+    }
+
+    fun addAccountFolder(name: String, volumeId: String, linkId: String) {
+        viewModelScope.launch {
+            runCatching {
+                withContext(Dispatchers.IO) { NativeRuntime.engine().addAccountFolder(name, volumeId, linkId) }
+            }.onSuccess { share ->
+                reload()
+                crawlAdded(listOf(share.id), announce = true)
+            }.onFailure(::reportError)
+        }
+    }
+
     /**
      * Every episode of a title watched or unwatched, with an Undo: a whole
      * title's positions are what this throws away, and a mis-tap on a tile's
      * menu should not cost them.
      */
-    fun setTitleWatched(title: TitleRecord, watched: Boolean) {
-        val episodes = title.seasons.flatMap { it.episodes }
+    /** Put a title on My List, or take it off. */
+    fun setOnList(title: TitleRecord, on: Boolean) {
+        viewModelScope.launch {
+            runCatching {
+                withContext(Dispatchers.IO) { NativeRuntime.engine().setOnList(title.key, on) }
+            }.onFailure(::reportError)
+            reload()
+        }
+    }
+
+    /** The keys of the titles most like [key], best first; none if the engine cannot say. */
+    suspend fun moreLike(key: String): List<String> =
+        runCatching { withContext(Dispatchers.IO) { NativeRuntime.engine().moreLike(key) } }.getOrDefault(emptyList())
+
+    /** The keys of every title [facet] stands for, in library order. */
+    suspend fun browse(facet: BrowseFacet): List<String> =
+        runCatching { withContext(Dispatchers.IO) { NativeRuntime.engine().browse(facet) } }
+            .onFailure(::reportError)
+            .getOrDefault(emptyList())
+
+        fun setTitleWatched(title: TitleRecord, watched: Boolean) =
+        markEpisodes(title.seasons.flatMap { it.episodes }, watched, title.displayName)
+
+    /**
+     * Some episodes seen or unseen — a season, or a whole title — with an
+     * Undo; [what] names them in the message.
+     */
+    fun markEpisodes(episodes: List<EpisodeRecord>, watched: Boolean, what: String) {
         changeWatch(
-            episodes,
-            "${title.canonicalName ?: title.name} marked ${if (watched) "watched" else "unwatched"}",
+            episodes.filter { it.watched != watched },
+            "$what marked ${if (watched) "watched" else "unwatched"}",
         ) { engine, episode, before ->
             val duration = before?.durationSecs
             engine.saveWatchState(
@@ -225,7 +718,7 @@ class AppViewModel(context: Context, private val workManager: WorkManager) : Vie
     fun forgetPosition(title: TitleRecord, episode: EpisodeRecord) {
         changeWatch(
             listOf(episode),
-            "${title.canonicalName ?: title.name} removed from Continue watching",
+            "${title.displayName} removed from Continue watching",
         ) { engine, target, before ->
             engine.saveWatchState(target.shareId, target.linkId, 0.0, before?.durationSecs, false)
         }
@@ -238,7 +731,7 @@ class AppViewModel(context: Context, private val workManager: WorkManager) : Vie
     fun removeFromHistory(title: TitleRecord, episode: EpisodeRecord) {
         changeWatch(
             listOf(episode),
-            "${episode.label} of ${title.canonicalName ?: title.name} removed from history",
+            "${episode.label} of ${title.displayName} removed from history",
         ) { engine, target, before ->
             engine.saveWatchState(target.shareId, target.linkId, 0.0, before?.durationSecs, false)
         }
@@ -253,14 +746,7 @@ class AppViewModel(context: Context, private val workManager: WorkManager) : Vie
                 withContext(Dispatchers.IO) {
                     val engine = NativeRuntime.engine()
                     snapshots.forEach { snapshot ->
-                        val state = snapshot.state
-                        engine.saveWatchState(
-                            snapshot.shareId,
-                            snapshot.linkId,
-                            state?.positionSecs ?: 0.0,
-                            state?.durationSecs,
-                            state?.watched ?: false,
-                        )
+                        engine.restoreWatchState(snapshot.shareId, snapshot.linkId, snapshot.state)
                     }
                 }
             }.onFailure(::reportError)
@@ -294,22 +780,29 @@ class AppViewModel(context: Context, private val workManager: WorkManager) : Vie
         mutableState.update { it.copy(message = error.message ?: "Unexpected error") }
     }
 
-    fun saveMetadataSettings(enabled: Boolean, provider: MetadataProvider, language: String, apiKey: String) {
-        viewModelScope.launch {
-            runCatching {
-                withContext(Dispatchers.IO) {
-                    val engine = NativeRuntime.engine()
-                    if (provider == MetadataProvider.TMDB && apiKey.isNotBlank()) {
-                        engine.setMetadataApiKey(provider, apiKey)
-                    }
-                    engine.setMetadataSettings(MetadataSettingsRecord(enabled, provider, language, true))
-                    if (enabled) engine.matchTitles(false) else null
+    /**
+     * Store the enrichment settings, and return why not, if they were not.
+     *
+     * The page shows the new settings as soon as they are stored; the match
+     * run that follows can take minutes and says so in the activity banner.
+     */
+    suspend fun saveMetadataSettings(enabled: Boolean, provider: MetadataProvider, language: String, apiKey: String): String? {
+        val stored = runCatching {
+            withContext(Dispatchers.IO) {
+                val engine = NativeRuntime.engine()
+                // TMDB's is the only key: the provider's with TMDB chosen, and
+                // film art's with AniList.
+                if (apiKey.isNotBlank()) {
+                    engine.setMetadataApiKey(MetadataProvider.TMDB, apiKey)
                 }
-            }.onSuccess { summary ->
-                summary?.let { mutableState.update { state -> state.copy(message = describe(it)) } }
-            }.onFailure(::reportError)
-            reload()
-        }
+                engine.setMetadataSettings(MetadataSettingsRecord(enabled, provider, language, true))
+                engine.metadataSettings()
+            }
+        }.getOrElse { return it.message ?: "The settings could not be saved" }
+        mutableState.update { it.copy(metadataSettings = stored) }
+        reloadNow()
+        if (enabled) viewModelScope.launch { match(force = false) }
+        return null
     }
 
     fun reloadAfterMetadataChange() = reload()
@@ -392,24 +885,8 @@ class AppViewModel(context: Context, private val workManager: WorkManager) : Vie
      * at its duration where one is known, so the progress bar agrees with the
      * tick.
      */
-    fun setWatched(episode: EpisodeRecord, watched: Boolean) {
-        viewModelScope.launch {
-            runCatching {
-                withContext(Dispatchers.IO) {
-                    val engine = NativeRuntime.engine()
-                    val duration = engine.watchState(episode.shareId, episode.linkId)?.durationSecs
-                    engine.saveWatchState(
-                        episode.shareId,
-                        episode.linkId,
-                        if (watched) duration ?: 0.0 else 0.0,
-                        duration,
-                        watched,
-                    )
-                }
-            }.onFailure(::reportError)
-            reload()
-        }
-    }
+    /** One episode's tick, with the same Undo a season's has. */
+    fun setWatched(episode: EpisodeRecord, watched: Boolean) = markEpisodes(listOf(episode), watched, episode.label)
 
     fun removeAllOffline() {
         viewModelScope.launch {
@@ -436,43 +913,64 @@ class AppViewModel(context: Context, private val workManager: WorkManager) : Vie
     }
 
     private fun reload() {
-        viewModelScope.launch {
-            runCatching {
-                withContext(Dispatchers.IO) {
-                    val engine = NativeRuntime.engine()
-                    // Here rather than inside `library()`, which is read-only
-                    // and cached: a full reload is the one place that has
-                    // already paid for a walk of the offline files.
-                    engine.pruneOfflineFiles()
-                    Reloaded(
-                        engine.shares(),
-                        engine.library(mutableState.value.query.takeIf(String::isNotBlank)),
-                        engine.offlineFiles(),
-                        engine.metadataSettings(),
-                        engine.storageUsage(),
-                    )
-                }
-            }.onSuccess { result ->
-                    mutableState.update { it.copy(
-                        loading = false,
-                        shares = result.shares,
-                        titles = result.titles,
-                        offline = result.offline,
-                        metadataSettings = result.metadataSettings,
-                        storage = result.storage,
-                    ) }
-                }
-                .onFailure { error ->
-                    mutableState.update { it.copy(loading = false, message = error.message) }
-                }
-        }
+        viewModelScope.launch { reloadNow() }
+    }
+
+    /** [reload], for a caller that goes on to read what it loaded. */
+    private suspend fun reloadNow() {
+        runCatching {
+            withContext(Dispatchers.IO) {
+                val engine = NativeRuntime.engine()
+                // Here rather than inside `library()`, which is read-only
+                // and cached: a full reload is the one place that has
+                // already paid for a walk of the offline files.
+                engine.pruneOfflineFiles()
+                val current = mutableState.value
+                val query = current.query.takeIf(String::isNotBlank)
+                Reloaded(
+                    engine.shares(),
+                    engine.library(null),
+                    engine.arrangement(query, current.filter, current.sort, current.grouped),
+                    engine.offlineFiles(),
+                    engine.metadataSettings(),
+                    engine.storageUsage(),
+                )
+            }
+        }.onSuccess { result ->
+                mutableState.update { it.copy(
+                    loading = false,
+                    shares = result.shares,
+                    titles = result.titles,
+                    arrangement = result.arrangement,
+                    offline = result.offline,
+                    metadataSettings = result.metadataSettings,
+                    storage = result.storage,
+                ) }
+            }
+            .onFailure { error ->
+                mutableState.update { it.copy(loading = false, message = error.message) }
+            }
     }
 
     private suspend fun reloadLibrary(query: String) {
+        val current = mutableState.value
         runCatching {
-            withContext(Dispatchers.IO) { NativeRuntime.engine().library(query.takeIf(String::isNotBlank)) }
-        }.onSuccess { titles -> mutableState.update { it.copy(titles = titles) } }
-            .onFailure { error -> mutableState.update { it.copy(message = error.message) } }
+            withContext(Dispatchers.IO) {
+                val engine = NativeRuntime.engine()
+                val search = query.takeIf(String::isNotBlank)
+                Triple(
+                    engine.library(null),
+                    engine.arrangement(search, current.filter, current.sort, current.grouped),
+                    search?.let(engine::searchExtras),
+                )
+            }
+        }.onSuccess { (titles, arrangement, extras) ->
+            mutableState.update { it.copy(titles = titles, arrangement = arrangement, searchExtras = extras) }
+        }.onFailure { error -> mutableState.update { it.copy(message = error.message) } }
+    }
+
+    private companion object {
+        const val SYNC_INTERVAL_MS = 5 * 60 * 1000L
     }
 
     class Factory(private val context: Context, private val workManager: WorkManager) : ViewModelProvider.Factory {
@@ -484,6 +982,7 @@ class AppViewModel(context: Context, private val workManager: WorkManager) : Vie
 private data class Reloaded(
     val shares: List<ShareRecord>,
     val titles: List<TitleRecord>,
+    val arrangement: ArrangementRecord,
     val offline: List<OfflineRecord>,
     val metadataSettings: MetadataSettingsRecord,
     val storage: StorageUsageRecord,

android/app/src/main/java/io/narl/protonstream/ui/Common.kt

@@ -1,34 +1,170 @@
 package io.narl.protonstream.ui
 
+import android.net.ConnectivityManager
+import androidx.compose.animation.AnimatedVisibilityScope
+import androidx.compose.animation.ExperimentalSharedTransitionApi
+import androidx.compose.animation.SharedTransitionScope
+import androidx.compose.foundation.border
+import androidx.compose.foundation.background
+import androidx.compose.foundation.clickable
+import androidx.compose.ui.draw.clip
+import androidx.compose.foundation.shape.RoundedCornerShape
 import androidx.compose.foundation.layout.Box
+import androidx.compose.foundation.shape.CircleShape
+import androidx.compose.foundation.layout.width
+import androidx.compose.foundation.layout.size
+import androidx.compose.foundation.layout.Spacer
+import androidx.compose.foundation.layout.Row
 import androidx.compose.foundation.layout.Column
+import androidx.compose.foundation.layout.PaddingValues
+import androidx.compose.foundation.layout.RowScope
 import androidx.compose.foundation.layout.fillMaxSize
+import androidx.compose.foundation.layout.padding
+import androidx.compose.material.icons.Icons
+import androidx.compose.material.icons.filled.Add
+import androidx.compose.material.icons.filled.Check
+import androidx.compose.material3.FilledTonalIconButton
+import androidx.compose.material3.Icon
+import androidx.compose.ui.semantics.contentDescription
+import androidx.compose.ui.semantics.semantics
+import androidx.compose.material3.AlertDialog
+import androidx.compose.material3.ExperimentalMaterial3Api
 import androidx.compose.material3.MaterialTheme
 import androidx.compose.material3.Text
+import androidx.compose.material3.TopAppBar
+import androidx.compose.material3.TopAppBarColors
+import androidx.compose.material3.TopAppBarDefaults
 import androidx.compose.runtime.Composable
+import androidx.compose.runtime.getValue
+import androidx.compose.runtime.mutableStateOf
+import androidx.compose.runtime.remember
+import androidx.compose.runtime.setValue
+import androidx.compose.runtime.staticCompositionLocalOf
 import androidx.compose.ui.Alignment
 import androidx.compose.ui.Modifier
+import androidx.compose.ui.platform.LocalContext
+import androidx.compose.ui.input.nestedscroll.nestedScroll
+import androidx.compose.ui.text.style.TextAlign
+import androidx.compose.ui.unit.dp
+import io.narl.protonstream.download.DownloadCoordinator
+import io.narl.protonstream.download.RetainedDownload
+import io.narl.protonstream.settings.SettingsStore
+import io.narl.protonstream.ui.theme.AccentButton
+import io.narl.protonstream.ui.theme.TonalButton
 import uniffi.pstr_android.EpisodeRecord
 
+/**
+ * A tab's page: its own name in an app bar, over whatever the page holds.
+ *
+ * One bar for the whole app said "proton-stream" on every page, which is a band
+ * of height spent naming the app the viewer is already in. The bar draws under
+ * the status bar itself, which is why the shell hands pages no top padding;
+ * [content] gets the rest of [padding] (the navigation bar and the mini
+ * transport) to apply as it scrolls.
+ */
+@OptIn(ExperimentalMaterial3Api::class)
 @Composable
-internal fun EmptyState(title: String, body: String) {
+internal fun TabPage(
+    title: String,
+    padding: PaddingValues,
+    navigationIcon: @Composable () -> Unit = {},
+    actions: @Composable RowScope.() -> Unit = {},
+    content: @Composable (PaddingValues) -> Unit,
+) {
+    // Pinned: the bar stays, and takes the container tint once the page has
+    // scrolled under it, so the edge between the two is still visible.
+    val scroll = TopAppBarDefaults.pinnedScrollBehavior()
+    Column(Modifier.fillMaxSize().nestedScroll(scroll.nestedScrollConnection)) {
+        TopAppBar(
+            title = { Text(title) },
+            navigationIcon = navigationIcon,
+            actions = actions,
+            colors = pageBarColors(),
+            scrollBehavior = scroll,
+        )
+        Box(Modifier.weight(1f)) { content(padding) }
+    }
+}
+
+/**
+ * The page's own background until something scrolls under the bar, then the
+ * container tint. A bar in `surface` from the start read as a band across the
+ * top of a page drawn in `background`.
+ */
+@OptIn(ExperimentalMaterial3Api::class)
+@Composable
+internal fun pageBarColors(): TopAppBarColors = TopAppBarDefaults.topAppBarColors(
+    containerColor = MaterialTheme.colorScheme.background,
+    scrolledContainerColor = MaterialTheme.colorScheme.surfaceContainer,
+)
+
+/**
+ * The shared-element scopes the library-to-title switch runs in, or null where
+ * there is none — the two-pane layout, a screenshot, a preview. Locals rather
+ * than parameters, because the poster that animates is three calls deep in the
+ * grid and nothing between needs to know.
+ */
+@OptIn(ExperimentalSharedTransitionApi::class)
+internal val LocalSharedTransition = staticCompositionLocalOf<SharedTransitionScope?> { null }
+internal val LocalPaneVisibility = staticCompositionLocalOf<AnimatedVisibilityScope?> { null }
+
+/**
+ * A title's art as one element across the switch: the poster tapped in the
+ * grid grows into the backdrop of the page it opens, and shrinks back on the
+ * way out, so the page is visibly *that* title's rather than a new screen.
+ */
+@OptIn(ExperimentalSharedTransitionApi::class)
+@Composable
+internal fun Modifier.sharedArt(key: String): Modifier {
+    val transition = LocalSharedTransition.current ?: return this
+    val visibility = LocalPaneVisibility.current ?: return this
+    return with(transition) {
+        this@sharedArt.sharedBounds(rememberSharedContentState("art/$key"), visibility)
+    }
+}
+
+@Composable
+internal fun EmptyState(title: String, body: String, action: Pair<String, () -> Unit>? = null) {
     Box(Modifier.fillMaxSize(), contentAlignment = Alignment.Center) {
-        Column(horizontalAlignment = Alignment.CenterHorizontally) {
-            Text(title, style = MaterialTheme.typography.titleMedium)
-            Text(body, style = MaterialTheme.typography.bodyMedium)
+        Column(Modifier.padding(horizontal = 32.dp), horizontalAlignment = Alignment.CenterHorizontally) {
+            Text(title, style = MaterialTheme.typography.titleMedium, textAlign = TextAlign.Center)
+            Text(
+                body,
+                style = MaterialTheme.typography.bodyMedium,
+                color = MaterialTheme.colorScheme.onSurfaceVariant,
+                textAlign = TextAlign.Center,
+                modifier = Modifier.padding(top = 4.dp),
+            )
+            action?.let { (label, onClick) ->
+                AccentButton(onClick = onClick, modifier = Modifier.padding(top = 16.dp)) { Text(label) }
+            }
         }
     }
 }
 
 /**
- * Where Play on a title lands: the most recently played part-watched episode,
- * else the first unwatched one, else the first — the desktop's `next_up`.
+ * Where Play on a title lands: what Continue watching offers
+ * ([TitleRecord.continueIndex]), else the most recently played part-watched
+ * episode, else the first unwatched one, else the first — the desktop's
+ * `next_up`.
  */
-internal fun nextUpIndex(playlist: List<EpisodeRecord>): Int =
-    playlist.withIndex().filter { it.value.resumeAt != null }.maxByOrNull { it.value.lastPlayed }?.index
+internal fun nextUpIndex(playlist: List<EpisodeRecord>, continueIndex: UInt? = null): Int =
+    continueIndex?.toInt()?.takeIf { it in playlist.indices }
+        ?: playlist.withIndex().filter { it.value.resumeAt != null }.maxByOrNull { it.value.lastPlayed }?.index
         ?: playlist.indexOfFirst { !it.watched }.takeIf { it >= 0 }
         ?: 0
 
+/** `24 min`, `2 h 4 min`, `2 h`: a provider's running time in minutes. */
+internal fun formatRuntime(minutes: UInt): String {
+    val hours = minutes / 60u
+    val rest = minutes % 60u
+    return when {
+        hours == 0u -> "$rest min"
+        rest == 0u -> "$hours h"
+        else -> "$hours h $rest min"
+    }
+}
+
 internal fun formatBytes(bytes: ULong): String {
     val value = bytes.toDouble()
     return when {
@@ -38,3 +174,185 @@ internal fun formatBytes(bytes: ULong): String {
         else -> "$bytes bytes"
     }
 }
+
+/**
+ * Download episodes, asking first when it is more than one: a season or a
+ * show is tens of gigabytes, and one tap should not fill a phone. The
+ * question says how many and how big. Call it in composition; it draws the
+ * dialog where it is called and returns what starts the download.
+ */
+@Composable
+internal fun rememberDownload(): (List<EpisodeRecord>, String) -> Unit {
+    val context = LocalContext.current
+    var asking by remember { mutableStateOf<Pair<List<EpisodeRecord>, String>?>(null) }
+    asking?.let { (episodes, what) ->
+        val bytes = episodes.sumOf { it.size ?: 0uL }
+        AlertDialog(
+            onDismissRequest = { asking = null },
+            title = { Text("Download ${episodes.size} episodes of $what?") },
+            text = {
+                Text(
+                    "They are kept on this device for watching without a connection" +
+                        (if (bytes > 0uL) " — about ${formatBytes(bytes)}" else "") +
+                        ". Delete them from Downloads.",
+                )
+            },
+            confirmButton = {
+                AccentButton(onClick = {
+                    asking = null
+                    DownloadCoordinator.enqueue(context, episodes)
+                }) { Text("Download") }
+            },
+            dismissButton = { TonalButton(onClick = { asking = null }) { Text("Cancel") } },
+        )
+    }
+    return remember(context) {
+        { episodes, what ->
+            val wanted = episodes.filterNot(EpisodeRecord::offline)
+            if (wanted.size > 1) asking = wanted to what else DownloadCoordinator.enqueue(context, wanted)
+        }
+    }
+}
+
+/**
+ * One line under a download that has not finished: "Running · 120.0 MiB of
+ * 1.2 GiB · 2.4 MiB/s", or "Queued" while it waits for a slot — or, given a
+ * [waitingFor], what it is really waiting on.
+ */
+internal fun downloadStatusLine(download: RetainedDownload, waitingFor: String? = null): String = listOfNotNull(
+    waitingFor?.takeIf { download.status == RetainedDownload.STATUS_QUEUED }
+        ?: download.status.replaceFirstChar { it.uppercase() },
+    download.total.takeIf { it > 0L && download.downloaded > 0L }?.let {
+        "${formatBytes(download.downloaded.toULong())} of ${formatBytes(it.toULong())}"
+    },
+    download.bytesPerSecond
+        .takeIf { it > 0L && download.status == RetainedDownload.STATUS_RUNNING }
+        ?.let { "${formatBytes(it.toULong())}/s" },
+).joinToString(" · ")
+
+/**
+ * Why a queued download is not running, when it is not merely a free slot:
+ * WorkManager holds a Wi-Fi-only download back on mobile data without a word,
+ * and "Queued" for an hour on the bus reads as stuck. Re-read whenever [key]
+ * changes — the download's own updates are the clock.
+ */
+@Composable
+internal fun rememberQueueReason(key: Any?): String? {
+    val context = LocalContext.current
+    return remember(key) {
+        val network = context.getSystemService(ConnectivityManager::class.java)
+        when {
+            network?.activeNetwork == null -> "Waiting for a connection"
+            SettingsStore(context).wifiOnly && network.isActiveNetworkMetered -> "Waiting for Wi-Fi"
+            else -> null
+        }
+    }
+}
+
+/**
+ * The episode's own name: the provider's, else the one the filename gave it.
+ * `null` rather than the filename, which is a release group's tag and the
+ * episode's numbering again.
+ */
+internal fun EpisodeRecord.shownName(): String? = providerName ?: detail.takeIf { it != name && it.isNotBlank() }
+
+/**
+ * What an episode row is headed with: "1. Mother and Children".
+ *
+ * The provider's name for the episode, else the name the filename gave it,
+ * else "Episode 1". The bare filename only when none of those exist — a column
+ * of `[Group] Show - S01E01.mkv` is forty rows that differ in two characters.
+ */
+internal fun EpisodeRecord.heading(position: Int): String {
+    val named = shownName()
+    val number = number?.toInt()
+    return when {
+        named != null && number != null -> "$number. $named"
+        named != null -> named
+        number != null -> "Episode $number"
+        else -> name.substringBeforeLast('.').ifBlank { "Episode ${position + 1}" }
+    }
+}
+
+/**
+ * Something the title is filed under — a genre — as a small rounded label.
+ * The desktop's `widgets::chip`.
+ */
+@Composable
+internal fun GenreChip(text: String, onClick: (() -> Unit)? = null) {
+    Text(
+        text,
+        style = MaterialTheme.typography.labelMedium,
+        color = MaterialTheme.colorScheme.onSurface,
+        modifier = Modifier
+            .clip(RoundedCornerShape(12.dp))
+            .background(MaterialTheme.colorScheme.surfaceVariant)
+            .then(if (onClick != null) Modifier.clickable(onClickLabel = "Browse $text", onClick = onClick) else Modifier)
+            .padding(horizontal = 10.dp, vertical = 4.dp),
+    )
+}
+
+/**
+ * Where a title stands — "Airing · episode 8 Sat 1 Nov", "Finished" — as a
+ * [GenreChip] with a dot in front: the accent while more is coming, muted once
+ * it is all out. The desktop's `widgets::status_chip`.
+ */
+@Composable
+internal fun StatusChip(text: String, live: Boolean, modifier: Modifier = Modifier) {
+    val scheme = MaterialTheme.colorScheme
+    Row(
+        modifier
+            .background(scheme.surfaceVariant, RoundedCornerShape(12.dp))
+            .padding(horizontal = 10.dp, vertical = 4.dp),
+        verticalAlignment = Alignment.CenterVertically,
+    ) {
+        Box(
+            Modifier
+                .size(6.dp)
+                .background(if (live) scheme.primary else scheme.onSurfaceVariant, CircleShape),
+        )
+        Spacer(Modifier.width(6.dp))
+        Text(text, style = MaterialTheme.typography.labelMedium, color = scheme.onSurface)
+    }
+}
+
+/**
+ * A fact about the files rather than the title — 4K, HDR, Dual audio — as a
+ * small outlined mark, the way a box prints them. Quieter than a [GenreChip].
+ * The desktop's `widgets::spec_badge`.
+ */
+@Composable
+internal fun SpecBadge(text: String) {
+    val ink = MaterialTheme.colorScheme.onSurfaceVariant
+    Text(
+        text,
+        style = MaterialTheme.typography.labelSmall,
+        fontWeight = androidx.compose.ui.text.font.FontWeight.SemiBold,
+        color = ink,
+        modifier = Modifier
+            .border(1.dp, ink.copy(alpha = 0.7f), MaterialTheme.shapes.extraSmall)
+            .padding(horizontal = 5.dp, vertical = 1.dp),
+    )
+}
+
+/**
+ * My List's button: a plus to put the title on it, a tick once it is, which
+ * takes it off again. [compact] is the icon alone, for the banner's row, where
+ * a third labelled button does not fit a phone.
+ */
+@Composable
+internal fun ListButton(onList: Boolean, onSet: (Boolean) -> Unit, compact: Boolean = false) {
+    val icon = if (onList) Icons.Default.Check else Icons.Default.Add
+    val label = if (onList) "Remove from My List" else "Add to My List"
+    if (compact) {
+        FilledTonalIconButton(onClick = { onSet(!onList) }, shape = MaterialTheme.shapes.small) {
+            Icon(icon, contentDescription = label)
+        }
+    } else {
+        TonalButton(onClick = { onSet(!onList) }, modifier = Modifier.semantics { contentDescription = label }) {
+            Icon(icon, contentDescription = null)
+            Spacer(Modifier.width(6.dp))
+            Text("My List")
+        }
+    }
+}

android/app/src/main/java/io/narl/protonstream/ui/DownloadsScreen.kt

@@ -1,51 +1,67 @@
 package io.narl.protonstream.ui
 
-import androidx.compose.foundation.layout.Arrangement
+import androidx.compose.foundation.layout.Box
 import androidx.compose.foundation.layout.Column
 import androidx.compose.foundation.layout.PaddingValues
+import androidx.compose.foundation.clickable
 import androidx.compose.foundation.layout.Row
-import androidx.compose.foundation.layout.Spacer
+import androidx.compose.foundation.layout.aspectRatio
 import androidx.compose.foundation.layout.fillMaxSize
 import androidx.compose.foundation.layout.fillMaxWidth
-import androidx.compose.foundation.layout.height
 import androidx.compose.foundation.layout.padding
-import androidx.compose.foundation.layout.size
 import androidx.compose.foundation.layout.width
 import androidx.compose.foundation.lazy.LazyColumn
 import androidx.compose.foundation.lazy.items
-import androidx.compose.foundation.lazy.grid.items
-import androidx.compose.material3.Card
+import androidx.compose.material.icons.Icons
+import androidx.compose.material.icons.filled.Close
+import androidx.compose.material.icons.filled.Pause
+import androidx.compose.material.icons.filled.PlayArrow
+import androidx.compose.material.icons.outlined.Delete
+import androidx.compose.material.icons.outlined.Info
+import androidx.compose.material3.AlertDialog
+import androidx.compose.material3.Icon
+import androidx.compose.material3.IconButton
+import androidx.compose.material3.ListItem
+import androidx.compose.material3.ListItemDefaults
 import androidx.compose.material3.MaterialTheme
 import androidx.compose.material3.Text
-import androidx.compose.material3.Icon
-import androidx.compose.material.icons.Icons
-import androidx.compose.material.icons.filled.Delete
 import androidx.compose.runtime.Composable
 import androidx.compose.runtime.getValue
-import androidx.compose.runtime.remember
 import androidx.compose.runtime.livedata.observeAsState
+import androidx.compose.runtime.mutableStateOf
+import androidx.compose.runtime.remember
+import androidx.compose.runtime.setValue
 import androidx.compose.ui.Alignment
 import androidx.compose.ui.Modifier
+import androidx.compose.ui.draw.clip
+import androidx.compose.ui.graphics.Color
 import androidx.compose.ui.platform.LocalContext
-import androidx.compose.ui.text.font.FontWeight
+import androidx.compose.ui.text.style.TextOverflow
 import androidx.compose.ui.unit.dp
 import androidx.work.WorkManager
 import io.narl.protonstream.download.DownloadCoordinator
 import io.narl.protonstream.download.DownloadStateStore
 import io.narl.protonstream.download.RetainedDownload
+import io.narl.protonstream.ui.theme.DangerButton
 import io.narl.protonstream.ui.theme.AccentProgress
-import io.narl.protonstream.ui.theme.QuietButton
 import io.narl.protonstream.ui.theme.TonalButton
+import uniffi.pstr_android.OfflineRecord
 import uniffi.pstr_android.SeasonRecord
+import uniffi.pstr_android.TitleRecord
+
+/** One show's saved episodes, and the show itself where the library has it. */
+private data class OfflineGroup(val name: String, val title: TitleRecord?, val files: List<OfflineRecord>)
 
 @Composable
 internal fun DownloadsScreen(
     state: AppUiState,
-    onRemove: (uniffi.pstr_android.OfflineRecord) -> Unit,
+    onRemove: (OfflineRecord) -> Unit,
     onPause: (RetainedDownload) -> Unit,
     onResume: (RetainedDownload) -> Unit,
     onDeletePartial: (RetainedDownload) -> Unit,
     padding: PaddingValues,
+    onPlay: (TitleRecord, Int) -> Unit = { _, _ -> },
+    onOpen: (TitleRecord) -> Unit = {},
 ) {
     val context = LocalContext.current
     val work = WorkManager.getInstance(context).getWorkInfosByTagLiveData(DownloadCoordinator.TAG)
@@ -57,83 +73,189 @@ internal fun DownloadsScreen(
     // but not its show, and the library is the only thing that does.
     val groups = remember(state.offline, state.titles) {
         val shows = state.titles.flatMap { title ->
-            title.seasons.flatMap(SeasonRecord::episodes).map {
-                "${it.shareId}/${it.linkId}" to (title.canonicalName ?: title.name)
-            }
+            title.seasons.flatMap(SeasonRecord::episodes).map { "${it.shareId}/${it.linkId}" to title }
         }.toMap()
         state.offline
-            .groupBy { shows["${it.shareId}/${it.linkId}"] ?: "Not in the library" }
-            .toSortedMap()
+            .groupBy { shows["${it.shareId}/${it.linkId}"] }
+            .map { (title, files) ->
+                OfflineGroup(title?.displayName ?: "Not in the library", title, files)
+            }
+            .sortedBy { it.name }
     }
-    LazyColumn(
-        modifier = Modifier.fillMaxSize().padding(padding).padding(16.dp),
-        contentPadding = PaddingValues(bottom = 16.dp),
-    ) {
-        item {
-            Text("Offline downloads", style = MaterialTheme.typography.titleLarge)
-            Spacer(Modifier.height(16.dp))
-        }
+    // Deleting a saved episode asks first: it is the viewer's own choice to
+    // keep it, and getting it back is a download, not a tap.
+    var deleting by remember { mutableStateOf<OfflineRecord?>(null) }
+    TabPage("Downloads", padding) { body ->
         if (retained.isEmpty() && state.offline.isEmpty()) {
-            item { EmptyState("No downloads", "Episodes, seasons, and shows saved offline appear here.") }
+            Box(Modifier.fillMaxSize().padding(body)) {
+                EmptyState("No downloads", "Episodes, seasons and shows saved offline appear here.")
+            }
+            return@TabPage
         }
-        // Under the show they belong to, as on desktop: a saved season is
-        // fourteen rows, and fourteen rows of "Episode 3" name nothing.
-        groups.forEach { (show, files) ->
-            item(key = "group/$show") {
-                Text(show, style = MaterialTheme.typography.titleMedium, modifier = Modifier.padding(top = 4.dp))
+        LazyColumn(
+            modifier = Modifier.fillMaxSize().padding(body),
+            contentPadding = PaddingValues(bottom = 24.dp),
+        ) {
+            if (state.offline.isNotEmpty()) {
+                item(key = "summary") {
+                    Text(
+                        "${state.offline.size} ${if (state.offline.size == 1) "episode" else "episodes"} · " +
+                            "${formatBytes(state.offline.sumOf { it.size })} on this device",
+                        style = MaterialTheme.typography.bodyMedium,
+                        color = MaterialTheme.colorScheme.onSurfaceVariant,
+                        modifier = Modifier.padding(horizontal = 16.dp, vertical = 4.dp),
+                    )
+                }
+            }
+            // What is still arriving comes first: it is the part of the page
+            // that changes, and the part with something to do.
+            if (retained.isNotEmpty()) {
+                item(key = "in-progress") { SectionHeading("In progress") }
+                items(retained, key = { "partial/${it.shareId}/${it.linkId}" }) { download ->
+                    PartialRow(download, onPause, onResume, onDeletePartial)
+                }
+            }
+            // Under the show they belong to, as on desktop: a saved season is
+            // fourteen rows, and fourteen rows of "Episode 3" name nothing.
+            groups.forEach { group ->
+                item(key = "group/${group.name}") {
+                    SectionHeading(
+                        group.name,
+                        "${group.files.size} ${if (group.files.size == 1) "episode" else "episodes"} · " +
+                            formatBytes(group.files.sumOf { it.size }),
+                    )
+                }
+                items(group.files, key = { "${it.shareId}/${it.linkId}" }) { file ->
+                    SavedRow(file, group.title, onDelete = { deleting = file }, onPlay = onPlay, onOpen = onOpen)
+                }
+            }
+        }
+    }
+    deleting?.let { file ->
+        AlertDialog(
+            onDismissRequest = { deleting = null },
+            title = { Text("Delete this download?") },
+            text = {
                 Text(
-                    "${files.size} ${if (files.size == 1) "episode" else "episodes"} · " +
-                        formatBytes(files.sumOf { it.size }),
-                    style = MaterialTheme.typography.bodySmall,
-                    modifier = Modifier.padding(bottom = 8.dp),
+                    "${file.episode?.label ?: "The episode"} (${formatBytes(file.size)}) leaves this device. " +
+                        "It still streams, and can be downloaded again.",
                 )
-            }
-            items(files, key = { "${it.shareId}/${it.linkId}" }) { file ->
-                val episode = file.episode
-                Card(Modifier.fillMaxWidth().padding(bottom = 8.dp)) {
-                    Row(Modifier.padding(16.dp), verticalAlignment = Alignment.CenterVertically) {
-                        Column(Modifier.weight(1f)) {
-                            Text(episode?.label ?: file.linkId, fontWeight = FontWeight.SemiBold)
-                            Text(formatBytes(file.size))
-                        }
-                        TonalButton(onClick = { onRemove(file) }) {
-                            Icon(Icons.Default.Delete, contentDescription = null, modifier = Modifier.size(18.dp))
-                            Spacer(Modifier.width(8.dp))
-                            Text("Delete")
-                        }
-                    }
-                }
-            }
-        }
-        items(retained, key = { "${it.shareId}/${it.linkId}" }) { download ->
-            val progress = if (download.total > 0L) download.downloaded.toFloat() / download.total else 0f
-            Card(Modifier.fillMaxWidth().padding(bottom = 8.dp)) {
-                Column(Modifier.padding(16.dp)) {
-                    Text(download.label, fontWeight = FontWeight.SemiBold)
-                    Text(download.status.replaceFirstChar { it.uppercase() })
-                    if (download.total > 0L) {
-                        AccentProgress(
-                            progress = { progress },
-                            modifier = Modifier.fillMaxWidth().padding(top = 8.dp),
-                        )
-                        Text("${formatBytes(download.downloaded.toULong())} of ${formatBytes(download.total.toULong())}", style = MaterialTheme.typography.bodySmall)
-                    }
-                    download.error?.let { Text(it, color = MaterialTheme.colorScheme.error) }
-                    Row(
-                        horizontalArrangement = Arrangement.spacedBy(8.dp),
-                        modifier = Modifier.padding(top = 8.dp),
-                    ) {
-                        if (download.status == RetainedDownload.STATUS_RUNNING ||
-                            download.status == RetainedDownload.STATUS_QUEUED
-                        ) {
-                            TonalButton(onClick = { onPause(download) }) { Text("Pause") }
-                        } else {
-                            TonalButton(onClick = { onResume(download) }) { Text("Resume") }
-                        }
-                        QuietButton(onClick = { onDeletePartial(download) }) { Text("Delete partial") }
-                    }
-                }
-            }
+            },
+            confirmButton = {
+                DangerButton(onClick = {
+                    deleting = null
+                    onRemove(file)
+                }) { Text("Delete") }
+            },
+            dismissButton = { TonalButton(onClick = { deleting = null }) { Text("Cancel") } },
+        )
+    }
+}
+
+@Composable
+private fun SectionHeading(title: String, caption: String? = null) {
+    Column(Modifier.padding(start = 16.dp, end = 16.dp, top = 20.dp, bottom = 4.dp)) {
+        Text(title, style = MaterialTheme.typography.titleMedium, maxLines = 1, overflow = TextOverflow.Ellipsis)
+        caption?.let {
+            Text(it, style = MaterialTheme.typography.bodySmall, color = MaterialTheme.colorScheme.onSurfaceVariant)
         }
     }
 }
+
+/** A saved episode: its still, what it is, its size, and a way to remove it. */
+@Composable
+private fun SavedRow(
+    file: OfflineRecord,
+    title: TitleRecord?,
+    onDelete: () -> Unit,
+    onPlay: (TitleRecord, Int) -> Unit,
+    onOpen: (TitleRecord) -> Unit,
+) {
+    val episode = file.episode
+    // What a download is for: tapping it plays it, from where it was left,
+    // without going back through the library to find it.
+    val index = title?.seasons?.flatMap(SeasonRecord::episodes)?.indexOfFirst { it.linkId == file.linkId } ?: -1
+    ListItem(
+        modifier = if (title != null && index >= 0) {
+            Modifier.clickable(onClickLabel = "Play") { onPlay(title, index) }
+        } else {
+            Modifier
+        },
+        leadingContent = {
+            RemoteArtwork(
+                episode?.stillUrl ?: title?.backdropUrl,
+                title?.name ?: file.linkId,
+                Modifier.width(96.dp).aspectRatio(16f / 9f).clip(MaterialTheme.shapes.small),
+                fallback = episode?.thumbnailSource,
+                labelled = episode == null,
+            )
+        },
+        headlineContent = {
+            Text(episode?.heading(0) ?: file.linkId, maxLines = 2, overflow = TextOverflow.Ellipsis)
+        },
+        supportingContent = {
+            Text(listOfNotNull(episode?.label, formatBytes(file.size)).joinToString(" · "))
+        },
+        trailingContent = {
+            Row {
+                title?.let {
+                    IconButton(onClick = { onOpen(it) }) {
+                        Icon(Icons.Outlined.Info, contentDescription = "Open ${it.displayName}")
+                    }
+                }
+                IconButton(onClick = onDelete) {
+                    Icon(Icons.Outlined.Delete, contentDescription = "Delete download")
+                }
+            }
+        },
+        colors = ListItemDefaults.colors(containerColor = Color.Transparent),
+    )
+}
+
+/**
+ * A download not yet finished: how far it has got, why it stopped if it did,
+ * and pause or resume beside cancel.
+ */
+@Composable
+private fun PartialRow(
+    download: RetainedDownload,
+    onPause: (RetainedDownload) -> Unit,
+    onResume: (RetainedDownload) -> Unit,
+    onDeletePartial: (RetainedDownload) -> Unit,
+) {
+    val active = download.status == RetainedDownload.STATUS_RUNNING ||
+        download.status == RetainedDownload.STATUS_QUEUED
+    ListItem(
+        headlineContent = { Text(download.label, maxLines = 2, overflow = TextOverflow.Ellipsis) },
+        supportingContent = {
+            Column {
+                Text(downloadStatusLine(download, rememberQueueReason(download)))
+                if (download.total > 0L) {
+                    AccentProgress(
+                        progress = { (download.downloaded.toFloat() / download.total).coerceIn(0f, 1f) },
+                        modifier = Modifier.fillMaxWidth().padding(top = 8.dp),
+                    )
+                }
+                download.error?.let { Text(it, color = MaterialTheme.colorScheme.error) }
+            }
+        },
+        trailingContent = {
+            Row(verticalAlignment = Alignment.CenterVertically) {
+                if (active) {
+                    IconButton(onClick = { onPause(download) }) {
+                        Icon(Icons.Default.Pause, contentDescription = "Pause download")
+                    }
+                } else {
+                    IconButton(onClick = { onResume(download) }) {
+                        Icon(Icons.Default.PlayArrow, contentDescription = "Resume download")
+                    }
+                }
+                // What has arrived so far is discarded; nothing finished is.
+                IconButton(onClick = { onDeletePartial(download) }) {
+                    Icon(Icons.Default.Close, contentDescription = "Cancel and delete what has arrived")
+                }
+            }
+        },
+        colors = ListItemDefaults.colors(containerColor = Color.Transparent),
+    )
+}

android/app/src/main/java/io/narl/protonstream/ui/HistoryScreen.kt

@@ -80,28 +80,32 @@ internal fun HistoryScreen(
         history(state.titles).groupBy { Instant.ofEpochSecond(it.episode.lastPlayed).atZone(zone).toLocalDate() }
     }
     if (days.isEmpty()) {
-        Box(Modifier.fillMaxSize().padding(padding)) {
-            EmptyState("Nothing watched yet", "Episodes you play show up here, newest first.")
+        TabPage("History", padding) { body ->
+            Box(Modifier.fillMaxSize().padding(body)) {
+                EmptyState("Nothing watched yet", "Episodes you play show up here, newest first.")
+            }
         }
         return
     }
-    LazyColumn(Modifier.fillMaxSize().padding(padding), contentPadding = PaddingValues(bottom = 24.dp)) {
-        days.forEach { (day, played) ->
-            item(key = "day/$day") {
-                Text(
-                    dayHeading(day, today),
-                    style = MaterialTheme.typography.titleSmall,
-                    color = MaterialTheme.colorScheme.primary,
-                    modifier = Modifier.padding(start = 16.dp, end = 16.dp, top = 20.dp, bottom = 4.dp),
-                )
-            }
-            items(played, key = { "${it.episode.shareId}/${it.episode.linkId}" }) { entry ->
-                HistoryRow(
-                    entry,
-                    onPlay = { onPlay(entry.title, entry.index) },
-                    onTitle = { onTitle(entry.title) },
-                    onRemove = { onRemove(entry.title, entry.episode) },
-                )
+    TabPage("History", padding) { body ->
+        LazyColumn(Modifier.fillMaxSize().padding(body), contentPadding = PaddingValues(bottom = 24.dp)) {
+            days.forEach { (day, played) ->
+                item(key = "day/$day") {
+                    Text(
+                        dayHeading(day, today),
+                        style = MaterialTheme.typography.titleSmall,
+                        color = MaterialTheme.colorScheme.primary,
+                        modifier = Modifier.padding(start = 16.dp, end = 16.dp, top = 20.dp, bottom = 4.dp),
+                    )
+                }
+                items(played, key = { "${it.episode.shareId}/${it.episode.linkId}" }) { entry ->
+                    HistoryRow(
+                        entry,
+                        onPlay = { onPlay(entry.title, entry.index) },
+                        onTitle = { onTitle(entry.title) },
+                        onRemove = { onRemove(entry.title, entry.episode) },
+                    )
+                }
             }
         }
     }
@@ -130,6 +134,7 @@ private fun HistoryRow(entry: Played, onPlay: () -> Unit, onTitle: () -> Unit, o
                 episode.label,
                 Modifier.fillMaxSize(),
                 fallback = episode.thumbnailSource,
+                labelled = false,
             )
             episode.progress?.takeIf { !episode.watched }?.let { progress ->
                 AccentProgress(
@@ -140,7 +145,7 @@ private fun HistoryRow(entry: Played, onPlay: () -> Unit, onTitle: () -> Unit, o
         }
         Column(Modifier.weight(1f).clickable(onClick = onTitle).padding(horizontal = 12.dp, vertical = 4.dp)) {
             Text(
-                entry.title.canonicalName ?: entry.title.name,
+                entry.title.displayName,
                 style = MaterialTheme.typography.titleSmall,
                 maxLines = 1,
                 overflow = TextOverflow.Ellipsis,

android/app/src/main/java/io/narl/protonstream/ui/LanguagePicker.kt

@@ -0,0 +1,183 @@
+package io.narl.protonstream.ui
+
+import androidx.compose.foundation.clickable
+import androidx.compose.foundation.layout.Column
+import androidx.compose.foundation.layout.fillMaxWidth
+import androidx.compose.foundation.layout.heightIn
+import androidx.compose.foundation.layout.padding
+import androidx.compose.foundation.lazy.LazyColumn
+import androidx.compose.foundation.lazy.items
+import androidx.compose.material3.AlertDialog
+import androidx.compose.material3.HorizontalDivider
+import androidx.compose.material3.ListItem
+import androidx.compose.material3.ListItemDefaults
+import androidx.compose.material3.MaterialTheme
+import androidx.compose.material3.OutlinedTextField
+import androidx.compose.material3.RadioButton
+import androidx.compose.material3.Text
+import androidx.compose.runtime.Composable
+import androidx.compose.runtime.getValue
+import androidx.compose.runtime.mutableStateOf
+import androidx.compose.runtime.remember
+import androidx.compose.runtime.setValue
+import androidx.compose.ui.Modifier
+import androidx.compose.ui.graphics.Color
+import androidx.compose.ui.semantics.Role
+import androidx.compose.ui.unit.dp
+import io.narl.protonstream.ui.theme.AccentButton
+import io.narl.protonstream.ui.theme.TonalButton
+
+/**
+ * The languages offered by name, as the three-letter tag a Matroska file
+ * carries.
+ *
+ * The same short list the desktop names tracks from (`pstr-player`'s
+ * `language_name`): what the shares this app is pointed at actually contain.
+ * mpv treats the two- and three-letter forms of a language as one, so the tag
+ * chosen here also matches a file that says "ja". Anything else is still one
+ * typed tag away.
+ */
+internal val LANGUAGES: List<Pair<String, String>> = listOf(
+    "jpn" to "Japanese",
+    "eng" to "English",
+    "ger" to "German",
+    "fre" to "French",
+    "spa" to "Spanish",
+    "ita" to "Italian",
+    "por" to "Portuguese",
+    "dut" to "Dutch",
+    "rus" to "Russian",
+    "pol" to "Polish",
+    "swe" to "Swedish",
+    "dan" to "Danish",
+    "nor" to "Norwegian",
+    "fin" to "Finnish",
+    "cze" to "Czech",
+    "hun" to "Hungarian",
+    "tur" to "Turkish",
+    "ara" to "Arabic",
+    "heb" to "Hebrew",
+    "hin" to "Hindi",
+    "kor" to "Korean",
+    "chi" to "Chinese",
+    "tha" to "Thai",
+    "vie" to "Vietnamese",
+    "ukr" to "Ukrainian",
+    "rum" to "Romanian",
+    "gre" to "Greek",
+    "ind" to "Indonesian",
+    "may" to "Malay",
+)
+
+/**
+ * "Japanese", for a tag in any of the forms a file or the desktop may have
+ * stored — "jpn", "ja", "JA-jp" — and the tag itself for one not on the list.
+ * Null is no preference.
+ */
+internal fun languageLabel(tag: String?): String {
+    val value = tag?.trim()?.takeIf(String::isNotEmpty) ?: return "No preference"
+    return languageOf(value)?.second ?: value
+}
+
+/** The listed language a tag names, matching either ISO 639 form. */
+private fun languageOf(tag: String): Pair<String, String>? {
+    val base = tag.split('-', '_').first().lowercase()
+    return LANGUAGES.firstOrNull { (code, _) -> code == base || TWO_LETTER[code] == base || terminology(code) == base }
+}
+
+/** ISO 639-2/T, for the handful whose bibliographic code differs. */
+private fun terminology(code: String): String? = when (code) {
+    "ger" -> "deu"
+    "fre" -> "fra"
+    "dut" -> "nld"
+    "cze" -> "ces"
+    "chi" -> "zho"
+    "rum" -> "ron"
+    "gre" -> "ell"
+    "may" -> "msa"
+    else -> null
+}
+
+/** ISO 639-1, the form a file or the desktop may also have stored. */
+private val TWO_LETTER = mapOf(
+    "jpn" to "ja", "eng" to "en", "ger" to "de", "fre" to "fr", "spa" to "es", "ita" to "it",
+    "por" to "pt", "dut" to "nl", "rus" to "ru", "pol" to "pl", "swe" to "sv", "dan" to "da",
+    "nor" to "no", "fin" to "fi", "cze" to "cs", "hun" to "hu", "tur" to "tr", "ara" to "ar",
+    "heb" to "he", "hin" to "hi", "kor" to "ko", "chi" to "zh", "tha" to "th", "vie" to "vi",
+    "ukr" to "uk", "rum" to "ro", "gre" to "el", "ind" to "id", "may" to "ms",
+)
+
+/**
+ * A language preference as a row, opening a list to choose from.
+ *
+ * It was a free-text field asking for "jpn or eng", which is a question only
+ * someone who has read a Matroska header can answer.
+ */
+@Composable
+internal fun LanguageSetting(headline: String, value: String?, onChange: (String?) -> Unit) {
+    var choosing by remember { mutableStateOf(false) }
+    ListItem(
+        headlineContent = { Text(headline) },
+        supportingContent = { Text(languageLabel(value)) },
+        colors = ListItemDefaults.colors(containerColor = Color.Transparent),
+        modifier = Modifier.clickable(role = Role.Button) { choosing = true },
+    )
+    if (choosing) {
+        LanguageDialog(
+            headline,
+            value,
+            onDismiss = { choosing = false },
+            onChoose = {
+                choosing = false
+                onChange(it)
+            },
+        )
+    }
+}
+
+@Composable
+private fun LanguageDialog(headline: String, value: String?, onDismiss: () -> Unit, onChoose: (String?) -> Unit) {
+    val current = value?.let(::languageOf)?.first ?: value
+    // A tag that is not on the list starts in the field, so it is shown and
+    // can be edited rather than silently replaced.
+    var typed by remember { mutableStateOf(current?.takeIf { tag -> LANGUAGES.none { it.first == tag } }.orEmpty()) }
+    AlertDialog(
+        onDismissRequest = onDismiss,
+        title = { Text(headline) },
+        text = {
+            Column {
+                LazyColumn(Modifier.fillMaxWidth().heightIn(max = 360.dp)) {
+                    item(key = "none") { LanguageOption("No preference", current == null) { onChoose(null) } }
+                    items(LANGUAGES, key = { it.first }) { (code, name) ->
+                        LanguageOption(name, current == code) { onChoose(code) }
+                    }
+                }
+                HorizontalDivider(Modifier.padding(vertical = 8.dp))
+                OutlinedTextField(
+                    value = typed,
+                    onValueChange = { typed = it },
+                    label = { Text("Another tag") },
+                    supportingText = { Text("As it appears in the file, such as \"tgl\"") },
+                    singleLine = true,
+                    modifier = Modifier.fillMaxWidth(),
+                )
+            }
+        },
+        confirmButton = {
+            AccentButton(enabled = typed.isNotBlank(), onClick = { onChoose(typed.trim().lowercase()) }) {
+                Text("Use tag")
+            }
+        },
+        dismissButton = { TonalButton(onClick = onDismiss) { Text("Cancel") } },
+    )
+}
+
+@Composable
+private fun LanguageOption(name: String, selected: Boolean, onClick: () -> Unit) {
+    ListItem(
+        headlineContent = { Text(name, style = MaterialTheme.typography.bodyLarge) },
+        leadingContent = { RadioButton(selected = selected, onClick = null) },
+        colors = ListItemDefaults.colors(containerColor = Color.Transparent),
+        modifier = Modifier.clickable(role = Role.RadioButton, onClick = onClick),
+    )
+}

android/app/src/main/java/io/narl/protonstream/ui/ProtonStreamApp.kt

@@ -1,13 +1,28 @@
 package io.narl.protonstream.ui
 
+import androidx.compose.ui.semantics.LiveRegionMode
+import androidx.compose.ui.semantics.liveRegion
+import androidx.compose.ui.semantics.semantics
+import androidx.compose.material3.CircularProgressIndicator
+import androidx.compose.foundation.layout.Arrangement
+import androidx.compose.foundation.background
+import androidx.compose.animation.slideOutVertically
+import androidx.compose.animation.slideInVertically
+import androidx.compose.animation.fadeOut
+import androidx.compose.animation.fadeIn
+import androidx.compose.animation.AnimatedVisibility
 import androidx.activity.compose.BackHandler
 import androidx.compose.animation.AnimatedContent
+import androidx.compose.animation.ExperimentalSharedTransitionApi
+import androidx.compose.animation.SharedTransitionLayout
+import androidx.compose.runtime.CompositionLocalProvider
 import androidx.compose.foundation.clickable
 import androidx.compose.foundation.layout.Box
+import androidx.compose.foundation.layout.BoxWithConstraints
+import androidx.compose.material3.VerticalDivider
 import androidx.compose.foundation.layout.Column
 import androidx.compose.foundation.layout.PaddingValues
 import androidx.compose.foundation.layout.Row
-import androidx.compose.foundation.layout.Spacer
 import androidx.compose.foundation.layout.fillMaxSize
 import androidx.compose.foundation.layout.fillMaxWidth
 import androidx.compose.foundation.layout.padding
@@ -17,16 +32,18 @@ import androidx.compose.foundation.layout.aspectRatio
 import androidx.compose.foundation.layout.calculateEndPadding
 import androidx.compose.foundation.layout.calculateStartPadding
 import androidx.compose.material3.Card
-import androidx.compose.material3.CircularProgressIndicator
 import androidx.compose.material3.ExperimentalMaterial3Api
 import androidx.compose.material3.MaterialTheme
 import androidx.compose.material3.Scaffold
+import androidx.compose.material3.ScaffoldDefaults
+import androidx.compose.foundation.layout.WindowInsetsSides
+import androidx.compose.foundation.layout.only
+import androidx.compose.foundation.layout.plus
 import androidx.compose.material3.SnackbarHost
 import androidx.compose.material3.SnackbarDuration
 import androidx.compose.material3.SnackbarHostState
 import androidx.compose.material3.SnackbarResult
 import androidx.compose.material3.Text
-import androidx.compose.material3.TopAppBar
 import androidx.compose.material3.Icon
 import androidx.compose.material3.IconButton
 import androidx.compose.material.icons.Icons
@@ -35,7 +52,6 @@ import androidx.compose.material.icons.filled.Share
 import androidx.compose.material.icons.filled.Download
 import androidx.compose.material.icons.filled.History
 import androidx.compose.material.icons.filled.Settings
-import androidx.compose.material.icons.filled.Refresh
 import androidx.compose.material.icons.filled.Close
 import androidx.compose.material.icons.filled.Pause
 import androidx.compose.material.icons.filled.PlayArrow
@@ -46,6 +62,7 @@ import androidx.compose.runtime.collectAsState
 import androidx.compose.runtime.getValue
 import androidx.compose.runtime.mutableIntStateOf
 import androidx.compose.runtime.mutableStateOf
+import androidx.compose.runtime.produceState
 import androidx.compose.runtime.remember
 import androidx.compose.runtime.saveable.rememberSaveable
 import androidx.compose.runtime.setValue
@@ -60,7 +77,9 @@ import androidx.compose.ui.text.style.TextOverflow
 import androidx.compose.ui.unit.dp
 import androidx.lifecycle.viewmodel.compose.viewModel
 import androidx.work.WorkManager
+import io.narl.protonstream.ui.theme.QuietButton
 import io.narl.protonstream.ui.theme.accentNavigationColors
+import uniffi.pstr_android.BrowseFacet
 import uniffi.pstr_android.TitleRecord
 import uniffi.pstr_android.EpisodeRecord
 import uniffi.pstr_android.SeasonRecord
@@ -68,6 +87,9 @@ import io.narl.protonstream.playback.LibmpvHost
 import io.narl.protonstream.playback.NativeMpvHost
 import io.narl.protonstream.playback.PlayerScreen
 
+/** From this width the library and an open title share the window. */
+private val TWO_PANE_WIDTH = 840.dp
+
 /** How much room the floating mini transport needs at the foot of a page. */
 private val MINI_TRANSPORT_INSET = 88.dp
 
@@ -86,11 +108,10 @@ private enum class Destination(val label: String, val icon: ImageVector) {
     Settings("Settings", Icons.Default.Settings),
 }
 
-@OptIn(ExperimentalMaterial3Api::class)
+@OptIn(ExperimentalMaterial3Api::class, ExperimentalSharedTransitionApi::class)
 @Composable
 fun ProtonStreamApp(
     playerHost: LibmpvHost? = null,
-    inPictureInPicture: Boolean = false,
     shareLink: String? = null,
     onShareLinkTaken: () -> Unit = {},
     model: AppViewModel = viewModel(
@@ -115,6 +136,29 @@ fun ProtonStreamApp(
     // is what says so. Saved, because a rotation must not throw the viewer back
     // into the video they had just left.
     var playerMinimized by rememberSaveable { mutableStateOf(false) }
+    var addingShare by remember { mutableStateOf(false) }
+    // What a genre, studio or director chip opened, over the library pane.
+    // As its two parts, which survive process recreation where the record
+    // would not.
+    var browseKind by rememberSaveable { mutableStateOf<String?>(null) }
+    var browseName by rememberSaveable { mutableStateOf("") }
+    // The title it was opened from, which is where back goes, as on the
+    // desktop.
+    var browseFrom by rememberSaveable { mutableStateOf<String?>(null) }
+    val browsing = when (browseKind) {
+        "genre" -> BrowseFacet.Genre(browseName)
+        "studio" -> BrowseFacet.Studio(browseName)
+        "person" -> BrowseFacet.Person(browseName)
+        else -> null
+    }
+    val browse = { facet: BrowseFacet ->
+        browseKind = when (facet) {
+            is BrowseFacet.Genre -> "genre"
+            is BrowseFacet.Studio -> "studio"
+            is BrowseFacet.Person -> "person"
+        }
+        browseName = facet.label
+    }
 
     val selectedTitle = state.titles.firstOrNull { it.key == selectedTitleKey }
     val playing = playingTitleKey
@@ -152,7 +196,7 @@ fun ProtonStreamApp(
             Destination.entries.forEach { item ->
                 item(
                     selected = destination == item,
-                    onClick = { destination = item; selectedTitleKey = null },
+                    onClick = { destination = item; selectedTitleKey = null; browseKind = null },
                     icon = { Icon(item.icon, contentDescription = item.label) },
                     label = { Text(item.label) },
                     colors = navigation,
@@ -162,23 +206,10 @@ fun ProtonStreamApp(
     ) {
         Scaffold(
             snackbarHost = { SnackbarHost(snackbars) },
-            topBar = {
-                TopAppBar(
-                    title = { Text(selectedTitle?.name ?: "proton-stream") },
-                    actions = {
-                        if (destination == Destination.Library) {
-                            if (state.refreshing) {
-                                CircularProgressIndicator(modifier = Modifier.size(24.dp))
-                                Spacer(Modifier.width(16.dp))
-                            } else {
-                                IconButton(onClick = model::refresh) {
-                                    Icon(Icons.Default.Refresh, contentDescription = "Refresh")
-                                }
-                            }
-                        }
-                    },
-                )
-            },
+            // Each page draws its own bar under the status bar, and the title
+            // page draws its backdrop there, so the top inset is theirs.
+            contentWindowInsets = ScaffoldDefaults.contentWindowInsets
+                .only(WindowInsetsSides.Horizontal + WindowInsetsSides.Bottom),
         ) { padding ->
             // Back from a secondary tab returns to the library rather than
             // leaving the app; the library's own back is the system's, which is
@@ -200,46 +231,147 @@ fun ProtonStreamApp(
             Box(Modifier.fillMaxSize()) {
             AnimatedContent(destination, label = "primary navigation") { target ->
                 when (target) {
-                    Destination.Library -> if (selectedTitle == null) {
-                        LibraryScreen(
-                            state,
-                            model::search,
-                            { title, index ->
-                                playingTitleKey = title.key
-                                playingIndex = index
-                                playerMinimized = false
-                            },
-                            { selectedTitleKey = it.key },
-                            model::refresh,
-                            model::setTitleWatched,
-                            model::forgetPosition,
-                            body,
-                        )
-                    } else {
-                        TitleScreen(
-                            selectedTitle,
-                            playerHost != null,
-                            { _, index ->
-                                playingTitleKey = selectedTitle.key
-                                playingIndex = index
-                                playerMinimized = false
-                            },
-                            { selectedTitleKey = null },
-                            model::reportError,
-                            model::reloadAfterMetadataChange,
-                            model::setWatched,
-                            body,
-                        )
+                    // Side by side where there is room for both: on a tablet the
+                    // library stays in view while a title is open, so moving
+                    // between titles is one tap rather than back and in again.
+                    Destination.Library -> BoxWithConstraints(Modifier.fillMaxSize()) {
+                        val twoPane = maxWidth >= TWO_PANE_WIDTH
+                        val browsed by produceState(emptyList<String>(), browsing, state.titles) {
+                            value = browsing?.let { model.browse(it) }.orEmpty()
+                        }
+                        val libraryPane = @Composable {
+                            browsing?.let { facet ->
+                                BrowseScreen(
+                                    facet,
+                                    browsed.mapNotNull { key -> state.titles.firstOrNull { it.key == key } },
+                                    onBack = {
+                                        browseKind = null
+                                        browseFrom?.let { selectedTitleKey = it }
+                                    },
+                                    onTitle = { selectedTitleKey = it.key },
+                                    padding = body,
+                                )
+                            } ?: LibraryScreen(
+                                state,
+                                model::search,
+                                { title, index ->
+                                    // A search that led somewhere is one
+                                    // worth offering again.
+                                    model.rememberSearch()
+                                    playingTitleKey = title.key
+                                    playingIndex = index
+                                    playerMinimized = false
+                                },
+                                { model.rememberSearch(); selectedTitleKey = it.key },
+                                model::refresh,
+                                model::setTitleWatched,
+                                model::forgetPosition,
+                                body,
+                                onMatchChanged = model::reloadAfterMetadataChange,
+                                onError = model::reportError,
+                                onArrange = model::arrange,
+                                onAddShare = {
+                                    destination = Destination.Shares
+                                    addingShare = true
+                                },
+                                onOpenSettings = { destination = Destination.Settings },
+                                onFilter = model::filter,
+                                onSetOnList = model::setOnList,
+                                onBrowse = { facet ->
+                                    model.rememberSearch()
+                                    browse(facet)
+                                    browseFrom = null
+                                },
+                                onForgetSearches = model::forgetSearches,
+                                )
+                        }
+                        val titlePane = @Composable { selected: TitleRecord ->
+                                val similar by produceState(emptyList<String>(), selected.key, state.titles) {
+                                    value = model.moreLike(selected.key)
+                                }
+                                TitleScreen(
+                                selected,
+                                playerHost != null,
+                                { _, index ->
+                                    playingTitleKey = selected.key
+                                    playingIndex = index
+                                    playerMinimized = false
+                                },
+                                { selectedTitleKey = null },
+                                model::reportError,
+                                model::reloadAfterMetadataChange,
+                                model::setWatched,
+                                body,
+                                onMarkEpisodes = model::markEpisodes,
+                                franchise = selected.franchise.mapNotNull { key ->
+                                    state.titles.firstOrNull { it.key == key }
+                                },
+                                onOpenTitle = { selectedTitleKey = it.key },
+                                onSetOnList = model::setOnList,
+                                moreLike = similar.mapNotNull { key -> state.titles.firstOrNull { it.key == key } },
+                                onBrowse = { facet ->
+                                    browse(facet)
+                                    browseFrom = selected.key
+                                    // On a phone the list is under the title;
+                                    // the page it opens is the library pane's.
+                                    if (!twoPane) selectedTitleKey = null
+                                },
+                                )
+                        }
+                        if (twoPane) {
+                            Row(Modifier.fillMaxSize()) {
+                                Box(Modifier.weight(0.45f)) { libraryPane() }
+                                VerticalDivider()
+                                Box(Modifier.weight(0.55f)) {
+                                    selectedTitle?.let { titlePane(it) } ?: Box(Modifier.padding(body)) {
+                                        EmptyState("Choose a title", "Its seasons and episodes open here.")
+                                    }
+                                }
+                            }
+                        } else {
+                            SharedTransitionLayout {
+                                AnimatedContent(selectedTitle, contentKey = { it?.key }, label = "title") { open ->
+                                    CompositionLocalProvider(
+                                        LocalSharedTransition provides this@SharedTransitionLayout,
+                                        LocalPaneVisibility provides this,
+                                    ) {
+                                        open?.let { titlePane(it) } ?: libraryPane()
+                                    }
+                                }
+                            }
+                        }
                     }
                     Destination.Shares -> SharesScreen(
                         state.shares,
-                        model::addShare,
+                        { name, url, password ->
+                            // The first share is the library: watch it fill
+                            // rather than stay on a form that has done its job.
+                            val first = state.titles.isEmpty()
+                            model.addShare(name, url, password).also { refusal ->
+                                if (refusal == null && first) destination = Destination.Library
+                            }
+                        },
                         model::repairShare,
                         model::refreshShare,
                         model::removeShare,
-                        shareLink,
-                        onShareLinkTaken,
+                        // The empty library's button opens the form as a
+                        // pasted link would, only with nothing in it.
+                        shareLink ?: "".takeIf { addingShare },
+                        { addingShare = false; onShareLinkTaken() },
                         body,
+                        account = state.account,
+                        accountActions = AccountActions(
+                            signIn = model::signIn,
+                            submitSecondFactor = model::submitSecondFactor,
+                            submitMailboxPassword = model::submitMailboxPassword,
+                            cancelSignIn = model::cancelSignIn,
+                            dismissVerification = model::dismissVerification,
+                            signOut = model::signOut,
+                            syncNow = model::syncNow,
+                            addFolder = model::addAccountFolder,
+                            onError = model::reportError,
+                        ),
+                        onRename = model::renameShare,
                     )
                     Destination.History -> HistoryScreen(
                         state,
@@ -259,6 +391,15 @@ fun ProtonStreamApp(
                         model::resumeDownload,
                         model::deletePartial,
                         body,
+                        onPlay = { title, index ->
+                            playingTitleKey = title.key
+                            playingIndex = index
+                            playerMinimized = false
+                        },
+                        onOpen = { title ->
+                            destination = Destination.Library
+                            selectedTitleKey = title.key
+                        },
                     )
                     Destination.Settings -> SettingsScreen(
                         state,
@@ -267,6 +408,7 @@ fun ProtonStreamApp(
                         model::clearBlockCache,
                         model::removeAllOffline,
                         body,
+                        onNamesChanged = model::reloadAfterMetadataChange,
                     )
                 }
             }
@@ -277,29 +419,35 @@ fun ProtonStreamApp(
                     onClose = {
                         playingTitleKey = null
                         playerMinimized = false
-                        model.reloadAfterMetadataChange()
+                        model.playerClosed()
                     },
                     modifier = Modifier
                         .align(Alignment.BottomCenter)
                         .padding(bottom = padding.calculateBottomPadding() + 8.dp),
                 )
             }
+            ActivityBanner(
+                state.activity,
+                onStop = model::stopCrawl.takeIf { state.crawling },
+                modifier = Modifier
+                    .align(Alignment.BottomCenter)
+                    .padding(bottom = body.calculateBottomPadding() + 8.dp),
+            )
             }
         }
     }
 
     // Drawn over the scaffold rather than instead of it. The player owns the
     // whole window while it is up — it is a screen, not a dialog over one, which
-    // is what lets it draw into the cutout and hand the right window to
-    // Picture-in-Picture — but the page behind it stays composed, so leaving the
-    // player finds the title page where it was rather than rebuilt from the top.
+    // is what lets it draw into the cutout — but the page behind it stays
+    // composed, so leaving the player finds the title page where it was rather
+    // than rebuilt from the top.
     playing?.let { request ->
         PlayerScreen(
             title = request.title,
             episodes = request.episodes,
             index = request.index,
             host = playerHost,
-            inPictureInPicture = inPictureInPicture,
             minimized = playerMinimized,
             onIndexChange = { playingIndex = it },
             onSaveProgress = model::saveProgress,
@@ -307,7 +455,7 @@ fun ProtonStreamApp(
             onClose = {
                 playingTitleKey = null
                 playerMinimized = false
-                model.reloadAfterMetadataChange()
+                model.playerClosed()
             },
         )
     }
@@ -357,3 +505,37 @@ private fun MiniTransport(
         }
     }
 }
+
+/**
+ * What the app is busy with, for as long as it is: a spinner and one line.
+ * Not dismissible and not timed — it goes when the work does.
+ */
+@Composable
+private fun ActivityBanner(activity: String?, onStop: (() -> Unit)?, modifier: Modifier = Modifier) {
+    AnimatedVisibility(
+        visible = activity != null,
+        modifier = modifier,
+        enter = fadeIn() + slideInVertically { it },
+        exit = fadeOut() + slideOutVertically { it },
+    ) {
+        // Held through the exit, so the line does not blank before it fades.
+        var shown by remember { mutableStateOf(activity.orEmpty()) }
+        if (activity != null) shown = activity
+        Row(
+            Modifier
+                .padding(horizontal = 12.dp)
+                .fillMaxWidth()
+                .background(MaterialTheme.colorScheme.surfaceContainerHighest, MaterialTheme.shapes.small)
+                .padding(horizontal = 16.dp, vertical = 12.dp)
+                .semantics { liveRegion = LiveRegionMode.Polite },
+            horizontalArrangement = Arrangement.spacedBy(12.dp),
+            verticalAlignment = Alignment.CenterVertically,
+        ) {
+            CircularProgressIndicator(Modifier.size(18.dp), strokeWidth = 2.dp)
+            Text(shown, style = MaterialTheme.typography.bodyMedium, maxLines = 2, modifier = Modifier.weight(1f))
+            // A crawl of a large share can take minutes, and is the viewer's
+            // to call off; what it has read so far stays.
+            onStop?.let { QuietButton(onClick = it) { Text("Stop") } }
+        }
+    }
+}

android/app/src/main/java/io/narl/protonstream/ui/RemoteArtwork.kt

@@ -6,7 +6,15 @@ import android.graphics.BitmapFactory
 import android.util.LruCache
 import androidx.compose.foundation.Image
 import androidx.compose.foundation.background
+import androidx.compose.animation.Crossfade
+import androidx.compose.animation.animateColorAsState
+import androidx.compose.animation.core.LinearEasing
+import androidx.compose.animation.core.animateFloat
+import androidx.compose.animation.core.infiniteRepeatable
+import androidx.compose.animation.core.rememberInfiniteTransition
+import androidx.compose.animation.core.tween
 import androidx.compose.foundation.layout.Box
+import androidx.compose.foundation.layout.BoxWithConstraints
 import androidx.compose.foundation.layout.fillMaxSize
 import androidx.compose.material3.MaterialTheme
 import androidx.compose.material3.Text
@@ -16,17 +24,33 @@ import androidx.compose.runtime.getValue
 import androidx.compose.runtime.mutableStateOf
 import androidx.compose.runtime.remember
 import androidx.compose.runtime.setValue
+import androidx.compose.runtime.staticCompositionLocalOf
 import androidx.compose.ui.Alignment
 import androidx.compose.ui.Modifier
+import androidx.compose.ui.draw.blur
+import androidx.compose.ui.draw.drawBehind
+import androidx.compose.ui.geometry.Offset
+import androidx.compose.ui.graphics.Brush
+import androidx.compose.ui.graphics.Color
 import androidx.compose.ui.graphics.ImageBitmap
+import androidx.compose.ui.graphics.lerp
+import androidx.compose.ui.graphics.luminance
+import androidx.compose.ui.graphics.toArgb
 import androidx.compose.ui.graphics.asImageBitmap
 import androidx.compose.ui.layout.ContentScale
 import androidx.compose.ui.platform.LocalContext
+import androidx.compose.ui.platform.LocalDensity
+import androidx.compose.ui.unit.Dp
+import androidx.compose.ui.unit.dp
+import androidx.compose.ui.text.font.FontWeight
+import androidx.core.graphics.scale
 import io.narl.protonstream.native.NativeRuntime
 import kotlinx.coroutines.Dispatchers
 import kotlinx.coroutines.withContext
 import uniffi.pstr_android.EpisodeRecord
 import uniffi.pstr_android.TitleRecord
+import uniffi.pstr_android.moodVeil as sharedMoodVeil
+import uniffi.pstr_android.pictureMood as sharedPictureMood
 import java.net.HttpURLConnection
 import java.net.URI
 import java.io.ByteArrayOutputStream
@@ -64,7 +88,13 @@ internal val EpisodeRecord.thumbnailSource: ThumbnailSource
  *
  * [fallback] is used only when there is no provider artwork or it fails to
  * load, which — with metadata off — is the common case rather than the rare
- * one.
+ * one. Until either answers, the box shimmers as a skeleton; when neither has
+ * anything, it shows [ArtworkPlaceholder] rather than an empty card — without
+ * initials when [labelled] is false, for art with the name already over it.
+ *
+ * Art that arrives fades in over the skeleton rather than replacing it in one
+ * frame, which across a grid reads as flicker. Art already decoded is drawn
+ * at once: a tile scrolled back into view has nothing to arrive.
  */
 @Composable
 internal fun RemoteArtwork(
@@ -72,19 +102,291 @@ internal fun RemoteArtwork(
     description: String,
     modifier: Modifier = Modifier,
     fallback: ThumbnailSource? = null,
+    labelled: Boolean = true,
+    maxEdge: Dp? = null,
+    onMood: ((Color) -> Unit)? = null,
 ) {
     val context = LocalContext.current
-    var image by remember(url, fallback) { mutableStateOf<ImageBitmap?>(null) }
-    LaunchedEffect(url, fallback) {
-        image = (loadArtwork(context, url) ?: loadThumbnail(fallback))?.asImageBitmap()
+    val enabled = LocalArtworkLoading.current
+    // Decoded at the size it is drawn: a grid tile is a few hundred pixels,
+    // and decoding its poster at 1024 holds four times the memory for nothing.
+    val edge = with(LocalDensity.current) { maxEdge?.roundToPx() }?.coerceIn(1, MAX_ART_EDGE) ?: MAX_ART_EDGE
+    var image by remember(url, fallback) { mutableStateOf(alreadyDecoded(url, fallback, edge)) }
+    LaunchedEffect(url, fallback, enabled) {
+        if (!enabled) {
+            image = ArtworkLoad.Missing
+            return@LaunchedEffect
+        }
+        val bitmap = loadArtwork(context, url, edge) ?: loadThumbnail(fallback, edge)
+        image = bitmap?.let { ArtworkLoad.Loaded(it.asImageBitmap()) } ?: ArtworkLoad.Missing
+        if (bitmap != null && onMood != null) {
+            moodOf(url ?: fallback?.key ?: return@LaunchedEffect, bitmap)?.let(onMood)
+        }
     }
-    Box(modifier.background(MaterialTheme.colorScheme.surfaceVariant), contentAlignment = Alignment.Center) {
-        image?.let {
-            Image(it, description, Modifier.fillMaxSize(), contentScale = ContentScale.Crop)
-        } ?: Text("▶", style = MaterialTheme.typography.displaySmall)
+    Crossfade(image, modifier, animationSpec = tween(ARRIVE_MS), label = "artwork") { loaded ->
+        when (loaded) {
+            ArtworkLoad.Pending -> Skeleton(Modifier.fillMaxSize())
+            ArtworkLoad.Missing -> ArtworkPlaceholder(description, Modifier.fillMaxSize(), labelled)
+            is ArtworkLoad.Loaded -> Image(
+                loaded.image,
+                description,
+                Modifier.fillMaxSize(),
+                contentScale = ContentScale.Crop,
+            )
+        }
     }
 }
 
+/** What the decoded cache already holds for this art, so it skips the fade. */
+private fun alreadyDecoded(url: String?, fallback: ThumbnailSource?, edge: Int): ArtworkLoad {
+    val hit = url?.let { decoded.get(sized(it, edge)) } ?: fallback?.let { decoded.get(sized(it.key, edge)) }
+    return hit?.let { ArtworkLoad.Loaded(it.asImageBitmap()) } ?: ArtworkLoad.Pending
+}
+
+/**
+ * How long art takes to fade in over its skeleton: the desktop's
+ * `motion::ARRIVE`.
+ */
+private const val ARRIVE_MS = 240
+
+/** One pass of the skeleton's highlight: the desktop's `motion::SHIMMER`. */
+private const val SHIMMER_MS = 1_400
+
+/**
+ * A title's art across the top of a page: its backdrop, or with none, its
+ * poster as a wash of its own colours — decoded tiny and blurred, so it reads as
+ * the poster's light rather than a blown-up slice of it. The desktop's
+ * `Fit::Ambient`. Android 11 and older cannot blur; there the tiny decode,
+ * stretched, is what softens it.
+ */
+@Composable
+internal fun Backdrop(title: TitleRecord, modifier: Modifier = Modifier, onMood: ((Color) -> Unit)? = null) {
+    val wash = title.backdropUrl == null && title.posterUrl != null
+    RemoteArtwork(
+        title.backdropUrl ?: title.posterUrl,
+        title.displayName,
+        if (wash) modifier.blur(WASH_BLUR) else modifier,
+        fallback = title.thumbnailSource,
+        labelled = false,
+        maxEdge = if (wash) WASH_EDGE else null,
+        onMood = onMood,
+    )
+}
+
+/**
+ * The colour a picture leaves behind — the shared `appearance::mood`, over the
+ * picture squeezed to [MOOD_EDGE] pixels a side. Remembered per picture, so a
+ * banner paging back to a title does not work it out again.
+ */
+private suspend fun moodOf(key: String, bitmap: Bitmap): Color? {
+    moods.get(key)?.let { return Color(it) }
+    val argb = withContext(Dispatchers.Default) {
+        runCatching {
+            val small = bitmap.scale(MOOD_EDGE, MOOD_EDGE)
+            val pixels = IntArray(MOOD_EDGE * MOOD_EDGE)
+            small.getPixels(pixels, 0, MOOD_EDGE, 0, 0, MOOD_EDGE, MOOD_EDGE)
+            sharedPictureMood(pixels.map(Int::toUInt))?.toInt()
+        }.getOrNull()
+    } ?: return null
+    moods.put(key, argb)
+    return Color(argb)
+}
+
+private val moods = LruCache<String, Int>(64)
+
+/** A picture squeezed to this many pixels a side is still its colours, and a few hundred values to average. */
+private const val MOOD_EDGE = 24
+
+/**
+ * [background] tinted by a picture's [mood], for the veils over that picture —
+ * the shared `appearance::mood_veil`. [background] itself until the mood is
+ * known.
+ */
+@Composable
+internal fun moodVeil(mood: Color?, background: Color = MaterialTheme.colorScheme.background): Color {
+    val light = background.luminance() > 0.5f
+    val target = remember(mood, background) {
+        mood?.let {
+            runCatching {
+                Color(sharedMoodVeil(background.toArgb().toUInt(), it.toArgb().toUInt(), light).toInt())
+            }.getOrNull()
+        } ?: background
+    }
+    return animateColorAsState(target, tween(ARRIVE_MS), label = "veil").value
+}
+
+private val WASH_EDGE = 48.dp
+private val WASH_BLUR = 24.dp
+
+/**
+ * A title's logo — its name as lettering — in place of [fallback], once it has
+ * loaded. [fallback] stands until then, and for good when there is none, so a
+ * title without a logo looks as it always did and one with a logo only gains.
+ *
+ * Trimmed to what is not transparent before it is drawn: TVDB pads every clear
+ * logo to a square, and the padding would otherwise decide its size and place.
+ */
+@Composable
+internal fun RemoteLogo(
+    url: String?,
+    description: String,
+    modifier: Modifier = Modifier,
+    fallback: @Composable () -> Unit,
+) {
+    val context = LocalContext.current
+    val enabled = LocalArtworkLoading.current
+    var logo by remember(url) { mutableStateOf<ImageBitmap?>(null) }
+    LaunchedEffect(url, enabled) {
+        logo = if (enabled) loadLogo(context, url)?.asImageBitmap() else null
+    }
+    Crossfade(logo, animationSpec = tween(ARRIVE_MS), label = "logo") { loaded ->
+        when (loaded) {
+            null -> fallback()
+            else -> Image(
+                loaded,
+                description,
+                modifier,
+                alignment = Alignment.BottomStart,
+                contentScale = ContentScale.Fit,
+            )
+        }
+    }
+}
+
+private suspend fun loadLogo(context: Context, url: String?): Bitmap? {
+    val requested = url ?: return null
+    val key = "logo:$requested"
+    decoded.get(key)?.let { return it }
+    val bitmap = loadArtwork(context, requested, LOGO_EDGE) ?: return null
+    return withContext(Dispatchers.Default) { trimTransparent(bitmap) }.also { decoded.put(key, it) }
+}
+
+/** [bitmap] cropped to [opaqueBounds], or itself when there is nothing to crop. */
+private fun trimTransparent(bitmap: Bitmap): Bitmap {
+    if (!bitmap.hasAlpha()) return bitmap
+    val pixels = IntArray(bitmap.width * bitmap.height)
+    bitmap.getPixels(pixels, 0, bitmap.width, 0, 0, bitmap.width, bitmap.height)
+    val (left, top, right, bottom) = opaqueBounds(pixels, bitmap.width) ?: return bitmap
+    if (left == 0 && top == 0 && right == bitmap.width - 1 && bottom == bitmap.height - 1) return bitmap
+    return Bitmap.createBitmap(bitmap, left, top, right - left + 1, bottom - top + 1)
+}
+
+/**
+ * The inclusive `[left, top, right, bottom]` of the pixels in an ARGB [pixels]
+ * row-major image of [width] that are not (nearly) transparent; `null` when
+ * none are. Below the threshold is anti-aliasing haze, not lettering.
+ */
+internal fun opaqueBounds(pixels: IntArray, width: Int): IntArray? {
+    var left = Int.MAX_VALUE
+    var top = Int.MAX_VALUE
+    var right = -1
+    var bottom = -1
+    for (index in pixels.indices) {
+        if ((pixels[index] ushr 24) <= VISIBLE_ALPHA) continue
+        val x = index % width
+        val y = index / width
+        if (x < left) left = x
+        if (x > right) right = x
+        if (y < top) top = y
+        if (y > bottom) bottom = y
+    }
+    return if (right < 0) null else intArrayOf(left, top, right, bottom)
+}
+
+private const val VISIBLE_ALPHA = 8
+
+/** A logo is drawn a few hundred pixels wide at most. */
+private const val LOGO_EDGE = 800
+
+private sealed interface ArtworkLoad {
+    data object Pending : ArtworkLoad
+    data object Missing : ArtworkLoad
+    data class Loaded(val image: ImageBitmap) : ArtworkLoad
+}
+
+/**
+ * Whether [RemoteArtwork] fetches anything at all.
+ *
+ * Off in the screenshot tests: there is no bridge on the host, and whether a
+ * failed fetch lands before or after the capture would decide between a
+ * skeleton and a placeholder in the committed image.
+ */
+internal val LocalArtworkLoading = staticCompositionLocalOf { true }
+
+/**
+ * Something being loaded: the surface tint, with a soft highlight sweeping
+ * across it on a diagonal.
+ *
+ * A spinner per tile is a grid of spinners; a shape where the poster will be
+ * says what is coming and where, and settles the layout before it arrives.
+ * The sweep is measured in the tile's own width, so neighbouring tiles of one
+ * size shimmer in step, as one surface.
+ */
+@Composable
+internal fun Skeleton(modifier: Modifier = Modifier) {
+    val sweep by rememberInfiniteTransition(label = "skeleton").animateFloat(
+        initialValue = -1f,
+        targetValue = 2f,
+        animationSpec = infiniteRepeatable(tween(SHIMMER_MS, easing = LinearEasing)),
+        label = "skeleton sweep",
+    )
+    val base = MaterialTheme.colorScheme.surfaceVariant
+    val highlight = lerp(base, MaterialTheme.colorScheme.onSurface, 0.07f)
+    Box(
+        modifier.drawBehind {
+            drawRect(base)
+            val centre = size.width * sweep
+            val half = size.width * 0.6f
+            drawRect(
+                Brush.linearGradient(
+                    listOf(Color.Transparent, highlight, Color.Transparent),
+                    start = Offset(centre - half, 0f),
+                    end = Offset(centre + half, size.height),
+                ),
+            )
+        },
+    )
+}
+
+/**
+ * Art for a title that has none: the accent as a gradient, and its initials.
+ *
+ * A black card with a play triangle on it said nothing about which title it
+ * was, so a grid of unmatched titles was a grid of identical cards. Each name
+ * sets where on the accent ramp its gradient starts, so neighbours differ
+ * while every one stays in the theme's colours.
+ */
+@Composable
+internal fun ArtworkPlaceholder(name: String, modifier: Modifier = Modifier, labelled: Boolean = true) {
+    val scheme = MaterialTheme.colorScheme
+    val brush = remember(name, scheme.primary, scheme.secondary) {
+        val start = lerp(scheme.primary, scheme.secondary, (name.hashCode().mod(5)) / 4f)
+        Brush.linearGradient(listOf(start, lerp(start, Color.Black, 0.55f)))
+    }
+    BoxWithConstraints(modifier.background(brush), contentAlignment = Alignment.Center) {
+        if (!labelled) return@BoxWithConstraints
+        val size = with(LocalDensity.current) { (minOf(maxWidth, maxHeight) * 0.3f).toSp() }
+        Text(
+            initials(name),
+            color = Color.White.copy(alpha = 0.9f),
+            fontSize = size,
+            fontWeight = FontWeight.SemiBold,
+            maxLines = 1,
+        )
+    }
+}
+
+/**
+ * "Oshi no Ko" is "OK", "Akira" is "A": the first letters of up to two
+ * capitalised words, so particles and articles in a romanised name do not
+ * take a slot. A name with no capitals uses its first two words.
+ */
+internal fun initials(name: String): String {
+    val words = name.split(' ', '-', '_', '.', ':').filter { word -> word.firstOrNull()?.isLetterOrDigit() == true }
+    val picked = words.filter { it.first().isUpperCase() || it.first().isDigit() }.ifEmpty { words }
+    return picked.take(2).joinToString("") { it.first().uppercase() }
+}
+
 /**
  * The same HTTPS-only fetch behind the library grid, reusable off the composition.
  *
@@ -93,8 +395,8 @@ internal fun RemoteArtwork(
  * loader's protocol checks and exactly this disk cache, so the artwork the shade
  * shows costs no second download.
  */
-internal suspend fun loadArtwork(context: Context, url: String?): Bitmap? = url?.let { requested ->
-    decoded.get(requested) ?: withContext(Dispatchers.IO) {
+internal suspend fun loadArtwork(context: Context, url: String?, edge: Int = MAX_ART_EDGE): Bitmap? = url?.let { requested ->
+    decoded.get(sized(requested, edge)) ?: withContext(Dispatchers.IO) {
         runCatching {
             val uri = URI(requested)
             require(uri.scheme.equals("https", ignoreCase = true)) { "Artwork must use HTTPS" }
@@ -104,7 +406,7 @@ internal suspend fun loadArtwork(context: Context, url: String?): Bitmap? = url?
             val cached = directory.resolve("$digest.img")
             val fresh = !cached.isFile
             val bytes = if (fresh) download(uri) else cached.readBytes()
-            val bitmap = requireNotNull(decodeSampled(bytes)) { "Artwork is not a decodable image" }
+            val bitmap = requireNotNull(decodeSampled(bytes, edge)) { "Artwork is not a decodable image" }
             if (fresh) {
                 // Written only once it has decoded. Caching the bytes first is
                 // what turns one hostile poster into a crash on every launch
@@ -117,7 +419,7 @@ internal suspend fun loadArtwork(context: Context, url: String?): Bitmap? = url?
                 cached.setLastModified(System.currentTimeMillis())
             }
             bitmap
-        }.getOrNull()?.also { decoded.put(requested, it) }
+        }.getOrNull()?.also { decoded.put(sized(requested, edge), it) }
     }
 }
 
@@ -131,21 +433,21 @@ internal suspend fun loadArtwork(context: Context, url: String?): Bitmap? = url?
  * share or a session that has to be reopened is transient, and the next
  * composition should try again.
  */
-internal suspend fun loadThumbnail(source: ThumbnailSource?): Bitmap? {
+internal suspend fun loadThumbnail(source: ThumbnailSource?, edge: Int = MAX_ART_EDGE): Bitmap? {
     val file = source ?: return null
     val key = file.key
-    decoded.get(key)?.let { return it }
+    decoded.get(sized(key, edge))?.let { return it }
     if (key in missing) return null
     val fetched = withContext(Dispatchers.IO) {
         runCatching { NativeRuntime.engine().thumbnail(file.shareId, file.volumeId, file.linkId) }
     }
     val bytes = fetched.getOrElse { return null }
-    val bitmap = bytes?.let { withContext(Dispatchers.Default) { decodeSampled(it) } }
+    val bitmap = bytes?.let { withContext(Dispatchers.Default) { decodeSampled(it, edge) } }
     if (bitmap == null) {
         missing.add(key)
         return null
     }
-    decoded.put(key, bitmap)
+    decoded.put(sized(key, edge), bitmap)
     return bitmap
 }
 
@@ -164,28 +466,43 @@ private fun download(uri: URI): ByteArray {
 }
 
 /**
- * Decode within a bound the display can actually use.
+ * Decode with its longest edge at most [edge] pixels.
  *
  * [MAX_ART_BYTES] bounds the *compressed* image, which says nothing about what
  * it costs decoded: a 12 MiB PNG can be 12000×12000, and that is a 576 MB
  * `ARGB_8888` allocation on a device that will not give it. The bounds pass
  * costs no allocation and settles a sample size before anything is committed.
+ *
+ * Sampling halves, so it stops while the image is still at least [edge]; the
+ * decoder scales the rest of the way, which a poster sampled straight to under
+ * its tile would show as blur.
  */
-private fun decodeSampled(bytes: ByteArray): Bitmap? {
+private fun decodeSampled(bytes: ByteArray, edge: Int): Bitmap? {
     val bounds = BitmapFactory.Options().apply { inJustDecodeBounds = true }
     BitmapFactory.decodeByteArray(bytes, 0, bytes.size, bounds)
     val longest = maxOf(bounds.outWidth, bounds.outHeight)
     if (longest <= 0) return null
     var sample = 1
-    while (longest / sample > MAX_ART_EDGE) sample *= 2
+    while (longest / (sample * 2) >= edge) sample *= 2
+    val sampled = longest / sample
     return BitmapFactory.decodeByteArray(
         bytes,
         0,
         bytes.size,
-        BitmapFactory.Options().apply { inSampleSize = sample },
+        BitmapFactory.Options().apply {
+            inSampleSize = sample
+            if (sampled > edge) {
+                inScaled = true
+                inDensity = sampled
+                inTargetDensity = edge
+            }
+        },
     )
 }
 
+/** The decoded cache's key for one image at one size. */
+private fun sized(key: String, edge: Int) = "$key#$edge"
+
 /**
  * Hold the cache directory under [MAX_ART_CACHE_BYTES], oldest first.
  *
@@ -222,7 +539,7 @@ private val missing: MutableSet<String> = Collections.synchronizedSet(mutableSet
  * is a full-resolution decode per item.
  */
 private val decoded = object : LruCache<String, Bitmap>(
-    (Runtime.getRuntime().maxMemory() / 8).coerceIn(4L * 1024 * 1024, 32L * 1024 * 1024).toInt(),
+    (Runtime.getRuntime().maxMemory() / 8).coerceIn(4L * 1024 * 1024, 64L * 1024 * 1024).toInt(),
 ) {
     override fun sizeOf(key: String, value: Bitmap): Int = value.byteCount
 }

android/app/src/main/java/io/narl/protonstream/ui/SettingsScreen.kt

@@ -1,6 +1,19 @@
 package io.narl.protonstream.ui
 
+import androidx.activity.compose.BackHandler
 import androidx.compose.foundation.clickable
+import androidx.compose.foundation.layout.ColumnScope
+import androidx.compose.material.icons.Icons
+import androidx.compose.material.icons.automirrored.filled.ArrowBack
+import androidx.compose.material.icons.automirrored.filled.ManageSearch
+import androidx.compose.material.icons.filled.Info
+import androidx.compose.material.icons.filled.Palette
+import androidx.compose.material.icons.filled.PlayCircle
+import androidx.compose.material.icons.filled.Storage
+import androidx.compose.material3.Icon
+import androidx.compose.material3.IconButton
+import androidx.compose.runtime.saveable.rememberSaveable
+import androidx.compose.ui.graphics.vector.ImageVector
 import androidx.compose.foundation.border
 import androidx.compose.foundation.background
 import androidx.compose.foundation.layout.Arrangement
@@ -46,18 +59,21 @@ import androidx.compose.ui.window.DialogProperties
 import androidx.compose.ui.window.SecureFlagPolicy
 import androidx.compose.ui.unit.dp
 import io.narl.protonstream.settings.SettingsStore
+import io.narl.protonstream.sync.NewEpisodesWorker
 import kotlinx.coroutines.Dispatchers
 import kotlinx.coroutines.launch
 import kotlinx.coroutines.withContext
 import io.narl.protonstream.download.DownloadCoordinator
 import io.narl.protonstream.native.NativeRuntime
 import io.narl.protonstream.ui.theme.AccentButton
+import io.narl.protonstream.ui.theme.DangerButton
 import io.narl.protonstream.ui.theme.AppearanceState
 import io.narl.protonstream.ui.theme.EdgedButton
 import io.narl.protonstream.ui.theme.TonalButton
 import uniffi.pstr_android.MetadataProvider
 import uniffi.pstr_android.FlavorChoice
 import uniffi.pstr_android.AppearanceRecord
+import uniffi.pstr_android.TitleNamesChoice
 import uniffi.pstr_android.AccentChoice
 import uniffi.pstr_android.PlaybackPrefsRecord
 import androidx.compose.material3.ListItem
@@ -72,16 +88,24 @@ import io.narl.protonstream.ui.theme.AccentProgress
 @Composable
 internal fun SettingsScreen(
     state: AppUiState,
-    onSaveMetadata: (Boolean, MetadataProvider, String, String) -> Unit,
+    /** Resolves to why the settings were not stored, or null once they are. */
+    onSaveMetadata: suspend (Boolean, MetadataProvider, String, String) -> String?,
     onMatchAgain: () -> Unit,
     onClearCache: () -> Unit,
     onRemoveAllOffline: () -> Unit,
     padding: PaddingValues,
+    initialPage: SettingsPage? = null,
+    // A parameter so the screenshot tests can pin it: read from the package,
+    // every version bump changed the committed image of this page.
+    version: String = appVersion(),
+    /** The library's names changed, and it has to be read again to show them. */
+    onNamesChanged: () -> Unit = {},
 ) {
     val context = LocalContext.current
     val settings = remember { SettingsStore(context) }
     var wifiOnly by remember { mutableStateOf(settings.wifiOnly) }
     var backgroundAudio by remember { mutableStateOf(settings.backgroundAudio) }
+    var newEpisodes by remember { mutableStateOf(settings.newEpisodeNotifications) }
     var hardwareDecoding by remember { mutableStateOf(settings.hardwareDecoding) }
     var cacheBudgetGib by remember { mutableStateOf(settings.cacheBudgetGib) }
     // Playback preferences are the shared store's, not this app's: they are the
@@ -103,156 +127,194 @@ internal fun SettingsScreen(
     var confirmDelete by remember { mutableStateOf(false) }
     var showMetadata by remember { mutableStateOf(false) }
     var legalDocument by remember { mutableStateOf<LegalDocument?>(null) }
-    // Rows with one line of explanation each, in groups, rather than a toggle
-    // followed by a paragraph: the page read as a document to get through
-    // before reaching the switch that was wanted.
-    Column(Modifier.fillMaxSize().padding(padding).verticalScroll(rememberScrollState())) {
-        SettingsGroup("Playback")
-        prefs?.let { current ->
-            SettingSwitch(
-                "Autoplay next episode",
-                "Starts the next episode when the credits begin",
-                current.autoplayNext,
-            ) { on -> update { it.copy(autoplayNext = on) } }
-            // Off is the safer default: a mis-named chapter then costs a tap on
-            // Skip rather than a scene.
-            SettingSwitch(
-                "Skip openings and endings",
-                "Uses the release's chapters; off shows a Skip button instead",
-                current.autoSkip,
-            ) { on -> update { it.copy(autoSkip = on) } }
-            SettingSwitch("Subtitles", "Shown by default where a file has them", current.subtitles) { on ->
-                update { it.copy(subtitles = on) }
-            }
-            // Language tags, not a picker: which languages exist is a property
-            // of each file, and a list built from one episode is wrong for the
-            // next. A show that has been given its own choice keeps it.
-            Row(
-                Modifier.fillMaxWidth().padding(horizontal = 16.dp, vertical = 4.dp),
-                horizontalArrangement = Arrangement.spacedBy(8.dp),
-            ) {
-                LanguageField("Audio language", current.audioLanguage, Modifier.weight(1f)) { tag ->
-                    update { it.copy(audioLanguage = tag) }
-                }
-                LanguageField("Subtitle language", current.subtitleLanguage, Modifier.weight(1f)) { tag ->
-                    update { it.copy(subtitleLanguage = tag) }
-                }
-            }
-            Text(
-                "Tags as they appear in the file, such as jpn or eng",
-                style = MaterialTheme.typography.bodySmall,
-                color = MaterialTheme.colorScheme.onSurfaceVariant,
-                modifier = Modifier.padding(horizontal = 16.dp, vertical = 4.dp),
-            )
+    // One row per area on the first page, each opening its own page: grouped
+    // on one page, the storage controls sat a long scroll below playback, and
+    // every setting added made the rest harder to find.
+    var page by rememberSaveable { mutableStateOf(initialPage) }
+    BackHandler(enabled = page != null) { page = null }
+    val back: @Composable () -> Unit = {
+        IconButton(onClick = { page = null }) {
+            Icon(Icons.AutoMirrored.Filled.ArrowBack, contentDescription = "Back to settings")
         }
-        SettingSwitch(
-            "Hardware decoding",
-            "Turn off if video shows green or torn frames",
-            hardwareDecoding,
-        ) {
-            hardwareDecoding = it
-            settings.hardwareDecoding = it
-        }
-        SettingSwitch(
-            "Background audio",
-            "Keeps playing with the app closed, from the notification",
-            backgroundAudio,
-        ) {
-            backgroundAudio = it
-            settings.backgroundAudio = it
-        }
-
-        SettingsGroup("Downloads and storage")
-        SettingSwitch("Download on Wi-Fi only", "Mobile data is never used for downloads", wifiOnly) {
-            wifiOnly = it
-            settings.wifiOnly = it
-            // Constraints are baked in at enqueue time, so a queue that already
-            // exists keeps the policy it was queued under until it is re-issued.
-            DownloadCoordinator.applyNetworkPolicy(context)
-        }
-        Column(Modifier.padding(horizontal = 16.dp, vertical = 8.dp)) {
-            Text("Streaming cache")
-            Text(
-                "${formatBytes(state.storage.cacheBytes)} of $cacheBudgetGib GiB used",
-                style = MaterialTheme.typography.bodySmall,
-                color = MaterialTheme.colorScheme.onSurfaceVariant,
-            )
-            AccentProgress(
-                progress = {
-                    (state.storage.cacheBytes.toDouble() / SettingsStore.gibToBytes(cacheBudgetGib).toDouble())
-                        .toFloat().coerceIn(0f, 1f)
-                },
-                modifier = Modifier.fillMaxWidth().padding(vertical = 8.dp),
-            )
-            // What has been watched is kept up to this much, so going back over
-            // a scene costs no download. A lower choice frees the difference at
-            // once. Wrapping, so five chips survive a narrow phone at a large
-            // font scale.
-            FlowRow(horizontalArrangement = Arrangement.spacedBy(8.dp)) {
-                SettingsStore.CACHE_BUDGET_CHOICES.forEach { gib ->
-                    FilterChip(
-                        selected = gib == cacheBudgetGib,
-                        onClick = {
-                            cacheBudgetGib = gib
-                            settings.cacheBudgetGib = gib
-                            scope.launch(Dispatchers.IO) {
-                                runCatching {
-                                    NativeRuntime.engine().setStreamCacheBudget(SettingsStore.gibToBytes(gib))
-                                }
-                            }
+    }
+    when (page) {
+        null -> TabPage("Settings", padding) { body ->
+            Column(Modifier.fillMaxSize().padding(body).verticalScroll(rememberScrollState())) {
+                SettingsPage.entries.forEach { entry ->
+                    ListItem(
+                        headlineContent = { Text(entry.title) },
+                        supportingContent = {
+                            Text(
+                                when (entry) {
+                                    SettingsPage.Playback -> "Autoplay, languages and decoding"
+                                    SettingsPage.Storage -> "${formatBytes(state.storage.cacheBytes)} cached · " +
+                                        "${state.storage.offlineCount} offline"
+                                    SettingsPage.Appearance -> "Palette, accent and gradient"
+                                    SettingsPage.Metadata -> if (state.metadataSettings.enabled) {
+                                        "On · ${state.metadataSettings.provider.displayName()}"
+                                    } else {
+                                        "Off"
+                                    }
+                                    SettingsPage.About -> "Version $version · licences"
+                                },
+                            )
                         },
-                        label = { Text("$gib GiB") },
+                        leadingContent = { Icon(entry.icon, contentDescription = null) },
+                        colors = ListItemDefaults.colors(containerColor = Color.Transparent),
+                        modifier = Modifier.clickable { page = entry },
                     )
                 }
             }
         }
-        // The cache is rebuildable, so it goes without asking. Offline episodes
-        // are a choice the viewer made, so that one asks.
-        SettingAction("Clear streaming cache", "Frees ${formatBytes(state.storage.cacheBytes)}", onClick = onClearCache)
-        SettingAction(
-            "Delete all offline episodes",
-            "${state.storage.offlineCount} " + (if (state.storage.offlineCount == 1uL) "episode" else "episodes") +
-                " · ${formatBytes(state.storage.offlineBytes)}" +
-                (
-                    state.storage.partialBytes.takeIf { it > 0uL }
-                        ?.let { " · ${formatBytes(it)} unfinished" }
-                        .orEmpty()
-                    ),
-            enabled = state.storage.offlineCount > 0uL || state.storage.partialBytes > 0uL,
-            onClick = { confirmDelete = true },
-        )
-
-        SettingsGroup("Appearance")
-        Column(Modifier.padding(horizontal = 16.dp)) { AppearancePicker() }
-
-        SettingsGroup("Metadata")
-        SettingAction(
-            "Metadata enrichment",
-            if (state.metadataSettings.enabled) {
-                "On · ${state.metadataSettings.provider.displayName()} · sends title names to it"
-            } else {
-                "Off, the privacy default"
-            },
-            onClick = { showMetadata = true },
-        )
-        // Every title looked up again, matched ones included: the way out of a
-        // library the provider answered wrong, which otherwise stays wrong for
-        // as long as the match is remembered.
-        SettingAction(
-            "Match everything again",
-            "Looks every title up again, hand-picked matches excepted",
-            enabled = state.metadataSettings.enabled && !state.refreshing,
-            onClick = onMatchAgain,
-        )
-
-        SettingsGroup("About")
-        SettingAction("Licence", "GPL-3.0-or-later. Comes with absolutely no warranty.") {
-            legalDocument = LegalDocument("GNU GPL v3", "licenses/GPL-3.0.txt")
+        SettingsPage.Playback -> SettingsSubPage(SettingsPage.Playback, padding, back) {
+            prefs?.let { current ->
+                SettingSwitch(
+                    "Autoplay next episode",
+                    "Starts the next episode when the credits begin",
+                    current.autoplayNext,
+                ) { on -> update { it.copy(autoplayNext = on) } }
+                // Off is the safer default: a mis-named chapter then costs a tap on
+                // Skip rather than a scene.
+                SettingSwitch(
+                    "Skip openings and endings",
+                    "Uses the release's chapters; off shows a Skip button instead",
+                    current.autoSkip,
+                ) { on -> update { it.copy(autoSkip = on) } }
+                SettingSwitch("Subtitles", "Shown by default where a file has them", current.subtitles) { on ->
+                    update { it.copy(subtitles = on) }
+                }
+                // Preferences, not filters: a file with nothing in the language
+                // plays its own default track. A show that has been given its
+                // own choice keeps it.
+                LanguageSetting("Audio language", current.audioLanguage) { tag ->
+                    update { it.copy(audioLanguage = tag) }
+                }
+                LanguageSetting("Subtitle language", current.subtitleLanguage) { tag ->
+                    update { it.copy(subtitleLanguage = tag) }
+                }
+            }
+            SettingSwitch(
+                "Hardware decoding",
+                "Turn off if video shows green or torn frames",
+                hardwareDecoding,
+            ) {
+                hardwareDecoding = it
+                settings.hardwareDecoding = it
+            }
+            SettingSwitch(
+                "Background audio",
+                "Keeps playing with the app closed, from the notification",
+                backgroundAudio,
+            ) {
+                backgroundAudio = it
+                settings.backgroundAudio = it
+            }
+            SettingSwitch(
+                "New episode notifications",
+                "Looks at your shares every few hours and says when a show gains episodes",
+                newEpisodes,
+            ) {
+                newEpisodes = it
+                settings.newEpisodeNotifications = it
+                NewEpisodesWorker.schedule(context)
+            }
         }
-        SettingAction("Third-party notices", "libmpv, Inter and the other components bundled") {
-            legalDocument = LegalDocument("Third-party notices", "licenses/THIRD_PARTY_NOTICES.md")
+        SettingsPage.Storage -> SettingsSubPage(SettingsPage.Storage, padding, back) {
+            SettingSwitch("Download on Wi-Fi only", "Mobile data is never used for downloads", wifiOnly) {
+                wifiOnly = it
+                settings.wifiOnly = it
+                // Constraints are baked in at enqueue time, so a queue that already
+                // exists keeps the policy it was queued under until it is re-issued.
+                DownloadCoordinator.applyNetworkPolicy(context)
+            }
+            Column(Modifier.padding(horizontal = 16.dp, vertical = 8.dp)) {
+                Text("Streaming cache")
+                Text(
+                    "${formatBytes(state.storage.cacheBytes)} of $cacheBudgetGib GiB used",
+                    style = MaterialTheme.typography.bodySmall,
+                    color = MaterialTheme.colorScheme.onSurfaceVariant,
+                )
+                AccentProgress(
+                    progress = {
+                        (state.storage.cacheBytes.toDouble() / SettingsStore.gibToBytes(cacheBudgetGib).toDouble())
+                            .toFloat().coerceIn(0f, 1f)
+                    },
+                    modifier = Modifier.fillMaxWidth().padding(vertical = 8.dp),
+                )
+                // What has been watched is kept up to this much, so going back over
+                // a scene costs no download. A lower choice frees the difference at
+                // once. Wrapping, so five chips survive a narrow phone at a large
+                // font scale.
+                FlowRow(horizontalArrangement = Arrangement.spacedBy(8.dp)) {
+                    SettingsStore.CACHE_BUDGET_CHOICES.forEach { gib ->
+                        FilterChip(
+                            selected = gib == cacheBudgetGib,
+                            onClick = {
+                                cacheBudgetGib = gib
+                                settings.cacheBudgetGib = gib
+                                scope.launch(Dispatchers.IO) {
+                                    runCatching {
+                                        NativeRuntime.engine().setStreamCacheBudget(SettingsStore.gibToBytes(gib))
+                                    }
+                                }
+                            },
+                            label = { Text("$gib GiB") },
+                        )
+                    }
+                }
+            }
+            // The cache is rebuildable, so it goes without asking. Offline episodes
+            // are a choice the viewer made, so that one asks.
+            SettingAction("Clear streaming cache", "Frees ${formatBytes(state.storage.cacheBytes)}", onClick = onClearCache)
+            SettingAction(
+                "Delete all offline episodes",
+                "${state.storage.offlineCount} " + (if (state.storage.offlineCount == 1uL) "episode" else "episodes") +
+                    " · ${formatBytes(state.storage.offlineBytes)}" +
+                    (
+                        state.storage.partialBytes.takeIf { it > 0uL }
+                            ?.let { " · ${formatBytes(it)} unfinished" }
+                            .orEmpty()
+                        ),
+                enabled = state.storage.offlineCount > 0uL || state.storage.partialBytes > 0uL,
+                onClick = { confirmDelete = true },
+            )
+        }
+        SettingsPage.Appearance -> SettingsSubPage(SettingsPage.Appearance, padding, back) {
+            Column(Modifier.padding(horizontal = 16.dp)) { AppearancePicker(onNamesChanged) }
+        }
+        SettingsPage.Metadata -> SettingsSubPage(SettingsPage.Metadata, padding, back) {
+            SettingAction(
+                "Metadata enrichment",
+                if (state.metadataSettings.enabled) {
+                    "On · ${state.metadataSettings.provider.displayName()} · sends title names to it"
+                } else {
+                    "Off, the privacy default"
+                },
+                onClick = { showMetadata = true },
+            )
+            // Every title looked up again, matched ones included: the way out of a
+            // library the provider answered wrong, which otherwise stays wrong for
+            // as long as the match is remembered.
+            SettingAction(
+                "Match everything again",
+                "Looks every title up again, hand-picked matches excepted",
+                enabled = state.metadataSettings.enabled && !state.refreshing,
+                onClick = onMatchAgain,
+            )
+        }
+        SettingsPage.About -> SettingsSubPage(SettingsPage.About, padding, back) {
+            ListItem(
+                headlineContent = { Text("Proton Stream") },
+                supportingContent = { Text("Version $version") },
+                colors = ListItemDefaults.colors(containerColor = Color.Transparent),
+            )
+            SettingAction("Licence", "GPL-3.0-or-later. Comes with absolutely no warranty.") {
+                legalDocument = LegalDocument("GNU GPL v3", "licenses/GPL-3.0.txt")
+            }
+            SettingAction("Third-party notices", "libmpv, Inter and the other components bundled") {
+                legalDocument = LegalDocument("Third-party notices", "licenses/THIRD_PARTY_NOTICES.md")
+            }
         }
-        Spacer(Modifier.height(24.dp))
     }
     if (confirmDelete) {
         AlertDialog(
@@ -266,7 +328,7 @@ internal fun SettingsScreen(
                 )
             },
             confirmButton = {
-                AccentButton(onClick = { confirmDelete = false; onRemoveAllOffline() }) { Text("Delete") }
+                DangerButton(onClick = { confirmDelete = false; onRemoveAllOffline() }) { Text("Delete") }
             },
             dismissButton = { TonalButton(onClick = { confirmDelete = false }) { Text("Cancel") } },
         )
@@ -278,23 +340,44 @@ internal fun SettingsScreen(
         MetadataSettingsDialog(
             current = state.metadataSettings,
             onDismiss = { showMetadata = false },
-            onSave = { enabled, provider, language, key ->
-                onSaveMetadata(enabled, provider, language, key)
-                showMetadata = false
-            },
+            onSave = onSaveMetadata,
         )
     }
 }
 
-/** A group's heading, in the accent, the way Android's own settings mark them. */
+/** The areas the first page lists, each a page of its own. */
+internal enum class SettingsPage(val title: String, val icon: ImageVector) {
+    Playback("Playback", Icons.Default.PlayCircle),
+    Storage("Downloads and storage", Icons.Default.Storage),
+    Appearance("Appearance", Icons.Default.Palette),
+    Metadata("Metadata", Icons.AutoMirrored.Filled.ManageSearch),
+    About("About", Icons.Default.Info),
+}
+
+/** One area's page: its name, a way back, and its rows. */
 @Composable
-private fun SettingsGroup(label: String) {
-    Text(
-        label,
-        style = MaterialTheme.typography.titleSmall,
-        color = MaterialTheme.colorScheme.primary,
-        modifier = Modifier.padding(start = 16.dp, end = 16.dp, top = 24.dp, bottom = 4.dp),
-    )
+private fun SettingsSubPage(
+    page: SettingsPage,
+    padding: PaddingValues,
+    back: @Composable () -> Unit,
+    rows: @Composable ColumnScope.() -> Unit,
+) {
+    TabPage(page.title, padding, navigationIcon = back) { body ->
+        Column(Modifier.fillMaxSize().padding(body).verticalScroll(rememberScrollState())) {
+            rows()
+            Spacer(Modifier.height(24.dp))
+        }
+    }
+}
+
+/** The installed version, as the launcher and the store show it. */
+@Composable
+private fun appVersion(): String {
+    val context = LocalContext.current
+    return remember {
+        runCatching { context.packageManager.getPackageInfo(context.packageName, 0).versionName }
+            .getOrNull() ?: "unknown"
+    }
 }
 
 /** A switch with its one line of explanation; the whole row toggles it. */
@@ -338,57 +421,95 @@ private fun SettingAction(
 private fun MetadataSettingsDialog(
     current: uniffi.pstr_android.MetadataSettingsRecord,
     onDismiss: () -> Unit,
-    onSave: (Boolean, MetadataProvider, String, String) -> Unit,
+    onSave: suspend (Boolean, MetadataProvider, String, String) -> String?,
 ) {
     var enabled by remember { mutableStateOf(current.enabled) }
     var provider by remember { mutableStateOf(current.provider) }
     var language by remember { mutableStateOf(current.language) }
     var apiKey by remember { mutableStateOf("") }
+    var saving by remember { mutableStateOf(false) }
+    var refusal by remember { mutableStateOf<String?>(null) }
+    val scope = rememberCoroutineScope()
+    val needsKey = enabled && provider == MetadataProvider.TMDB && !current.ready && apiKey.isBlank()
+    val forgets = current.enabled && (!enabled || provider != current.provider)
     AlertDialog(
-        onDismissRequest = onDismiss,
+        onDismissRequest = { if (!saving) onDismiss() },
         properties = DialogProperties(securePolicy = SecureFlagPolicy.SecureOn),
         title = { Text("Metadata enrichment") },
         text = {
             Column(verticalArrangement = Arrangement.spacedBy(8.dp)) {
-                Text("Off by default: enabling sends the titles in your library to a third party, associated with your IP address and subject to their privacy policy.")
+                Text("Off by default: enabling sends the titles in your library to a third party, associated with your IP address and subject to their privacy policy. With AniList, a title it has nothing for is then sent to TVmaze, and the matched ids go to ani.zip for episode names and wide artwork.")
                 SettingToggle("Enable enrichment", enabled) { enabled = it }
                 Row(horizontalArrangement = Arrangement.spacedBy(8.dp)) {
-                    MetadataProvider.entries.forEach { option ->
+                    listOf(MetadataProvider.ANI_LIST, MetadataProvider.TMDB).forEach { option ->
                         if (option == provider) AccentButton(onClick = { provider = option }) { Text(option.displayName()) }
                         else EdgedButton(onClick = { provider = option }) { Text(option.displayName()) }
                     }
                 }
                 Text(
-                    if (provider == MetadataProvider.ANI_LIST) "Anime; no account or API key required."
-                    else "Film and television; requires a free TMDB API key.",
+                    if (provider == MetadataProvider.ANI_LIST) {
+                        "Anime, and television from TVmaze; no account or API key required. " +
+                            "With a TMDB API key, films get TMDB's backdrops and logos, asked for by id alone."
+                    } else {
+                        "Film and television; requires a free TMDB API key."
+                    },
                     style = MaterialTheme.typography.bodySmall,
                 )
                 if (provider == MetadataProvider.TMDB) {
                     OutlinedTextField(language, { language = it }, label = { Text("Language") }, singleLine = true)
-                    OutlinedTextField(
-                        apiKey,
-                        { apiKey = it },
-                        label = { Text(if (current.ready) "TMDB API key (leave blank to keep)" else "TMDB API key") },
-                        visualTransformation = PasswordVisualTransformation(),
-                        keyboardOptions = KeyboardOptions(keyboardType = KeyboardType.Password),
-                        singleLine = true,
+                }
+                OutlinedTextField(
+                    apiKey,
+                    { apiKey = it },
+                    label = {
+                        Text(
+                            when {
+                                provider == MetadataProvider.ANI_LIST -> "TMDB API key (optional)"
+                                current.ready -> "TMDB API key (leave blank to keep)"
+                                else -> "TMDB API key"
+                            },
+                        )
+                    },
+                    visualTransformation = PasswordVisualTransformation(),
+                    keyboardOptions = KeyboardOptions(keyboardType = KeyboardType.Password),
+                    singleLine = true,
+                )
+                if (needsKey) Text("Enter a TMDB API key to save.", color = MaterialTheme.colorScheme.error)
+                // Said before Save rather than after: what is forgotten
+                // includes matches chosen by hand, which no look-up redoes.
+                if (forgets) {
+                    Text(
+                        "Saving forgets every poster, description and match stored now, " +
+                            "including ones you chose by hand.",
+                        color = MaterialTheme.colorScheme.error,
+                        style = MaterialTheme.typography.bodySmall,
                     )
                 }
+                refusal?.let { Text(it, color = MaterialTheme.colorScheme.error) }
             }
         },
         confirmButton = {
             AccentButton(
-                enabled = !enabled || provider != MetadataProvider.TMDB || current.ready || apiKey.isNotBlank(),
-                onClick = { onSave(enabled, provider, language.ifBlank { "en" }, apiKey) },
-            ) { Text("Save") }
+                enabled = !needsKey && !saving,
+                onClick = {
+                    saving = true
+                    refusal = null
+                    scope.launch {
+                        refusal = onSave(enabled, provider, language.ifBlank { "en" }, apiKey)
+                        saving = false
+                        if (refusal == null) onDismiss()
+                    }
+                },
+            ) { Text(if (saving) "Saving…" else "Save") }
         },
-        dismissButton = { TonalButton(onClick = onDismiss) { Text("Cancel") } },
+        dismissButton = { TonalButton(onClick = onDismiss, enabled = !saving) { Text("Cancel") } },
     )
 }
 
 internal fun MetadataProvider.displayName(): String = when (this) {
     MetadataProvider.ANI_LIST -> "AniList"
     MetadataProvider.TMDB -> "TMDB"
+    MetadataProvider.TV_MAZE -> "TVmaze"
 }
 
 private data class LegalDocument(val title: String, val assetPath: String)
@@ -432,7 +553,7 @@ internal fun SettingToggle(label: String, checked: Boolean, onChecked: (Boolean)
  * the file both clients read.
  */
 @Composable
-private fun AppearancePicker() {
+private fun AppearancePicker(onNamesChanged: () -> Unit) {
     val scope = rememberCoroutineScope()
     var choice by remember { mutableStateOf<AppearanceRecord?>(null) }
     var swatches by remember { mutableStateOf<Map<AccentChoice, Color>>(emptyMap()) }
@@ -501,6 +622,26 @@ private fun AppearancePicker() {
             )
         }
     }
+    Text("Title names", style = MaterialTheme.typography.bodyMedium)
+    LazyRow(horizontalArrangement = Arrangement.spacedBy(8.dp), modifier = Modifier.padding(vertical = 8.dp)) {
+        items(TitleNamesChoice.entries.toList(), key = { it.name }) { names ->
+            if (names == current.names) {
+                AccentButton(onClick = {}) { Text(names.label()) }
+            } else {
+                EdgedButton(onClick = {
+                    scope.launch {
+                        repaint(current.copy(names = names), store = true)
+                        onNamesChanged()
+                    }
+                }) { Text(names.label()) }
+            }
+        }
+    }
+    Text(
+        "What a matched title is called. Its other names still find it in search.",
+        style = MaterialTheme.typography.bodySmall,
+        modifier = Modifier.padding(bottom = 8.dp),
+    )
     SettingToggle("Paint the accent as a gradient", current.gradients) { on ->
         scope.launch { repaint(current.copy(gradients = on), store = true) }
     }
@@ -512,6 +653,13 @@ private fun AppearancePicker() {
     )
 }
 
+/** What each name setting is called. The desktop client says the same. */
+private fun TitleNamesChoice.label() = when (this) {
+    TitleNamesChoice.LIBRARY -> "As in the share"
+    TitleNamesChoice.ENGLISH -> "English"
+    TitleNamesChoice.ROMAJI -> "Romaji"
+}
+
 /** What each palette family is called. The desktop client says the same. */
 private fun FlavorChoice.label() = when (this) {
     FlavorChoice.PROTON -> "Proton"
@@ -521,20 +669,3 @@ private fun FlavorChoice.label() = when (this) {
     FlavorChoice.MOCHA -> "Catppuccin Mocha"
     FlavorChoice.PERSONA5 -> "Persona 5"
 }
-
-/**
- * One language tag, committed as it is typed.
- *
- * Blank is a real answer and means "no preference" — the bridge stores it as
- * absent, which is what leaves the choice to the container's own default track.
- */
-@Composable
-private fun LanguageField(label: String, value: String?, modifier: Modifier = Modifier, onChange: (String?) -> Unit) {
-    OutlinedTextField(
-        value = value.orEmpty(),
-        onValueChange = { onChange(it.trim().takeIf(String::isNotEmpty)) },
-        label = { Text(label) },
-        singleLine = true,
-        modifier = modifier,
-    )
-}

android/app/src/main/java/io/narl/protonstream/ui/SharesScreen.kt

@@ -1,5 +1,10 @@
 package io.narl.protonstream.ui
 
+import kotlinx.coroutines.launch
+import androidx.compose.runtime.rememberCoroutineScope
+import androidx.compose.material3.CircularProgressIndicator
+import androidx.compose.foundation.layout.size
+import androidx.compose.foundation.layout.Row
 import androidx.compose.foundation.layout.Arrangement
 import androidx.compose.foundation.layout.Column
 import androidx.compose.foundation.layout.PaddingValues
@@ -25,13 +30,18 @@ import androidx.compose.ui.Alignment
 import androidx.compose.ui.Modifier
 import androidx.compose.ui.text.font.FontWeight
 import androidx.compose.ui.text.input.PasswordVisualTransformation
+import androidx.compose.ui.text.input.VisualTransformation
+import androidx.compose.ui.text.style.TextOverflow
 import androidx.compose.foundation.text.KeyboardOptions
 import androidx.compose.ui.text.input.KeyboardType
 import androidx.compose.ui.window.DialogProperties
 import androidx.compose.ui.window.SecureFlagPolicy
 import androidx.compose.ui.unit.dp
 import io.narl.protonstream.ui.theme.AccentButton
+import io.narl.protonstream.ui.theme.DangerButton
 import io.narl.protonstream.ui.theme.TonalButton
+import androidx.compose.material.icons.filled.Edit
+import uniffi.pstr_android.AccountState
 import uniffi.pstr_android.ShareRecord
 import androidx.compose.foundation.layout.Box
 import androidx.compose.material3.ExtendedFloatingActionButton
@@ -44,54 +54,79 @@ import androidx.compose.material.icons.filled.MoreVert
 import androidx.compose.material.icons.filled.Key
 import androidx.compose.material.icons.filled.Delete
 import androidx.compose.material.icons.filled.FolderShared
+import androidx.compose.material.icons.filled.Visibility
+import androidx.compose.material.icons.filled.VisibilityOff
 import androidx.compose.ui.graphics.Color
 
 @Composable
 internal fun SharesScreen(
     shares: List<ShareRecord>,
-    onAdd: (String, String, String?) -> Unit,
+    /** Resolves to why the link was refused, or null once it is added. */
+    onAdd: suspend (String, String, String?) -> String?,
     onRepair: (String, String, String?) -> Unit,
     onRefresh: (String) -> Unit,
     onRemove: (String) -> Unit,
     incomingLink: String?,
     onIncomingLinkTaken: () -> Unit,
     padding: PaddingValues,
+    account: AccountUiState = AccountUiState(),
+    accountActions: AccountActions? = null,
+    onRename: (String, String) -> Unit = { _, _ -> },
 ) {
     var showAdd by remember { mutableStateOf(false) }
+    var renaming by remember { mutableStateOf<ShareRecord?>(null) }
+    var signingIn by remember { mutableStateOf(false) }
+    var browsing by remember { mutableStateOf(false) }
     var repairing by remember { mutableStateOf<ShareRecord?>(null) }
     var removing by remember { mutableStateOf<ShareRecord?>(null) }
-    Box(Modifier.fillMaxSize().padding(padding)) {
-        if (shares.isEmpty()) {
-            EmptyState("No shares yet", "Add a Proton Drive public link to build your library.")
-        } else {
-            LazyColumn(contentPadding = PaddingValues(top = 8.dp, bottom = 96.dp)) {
-                item(key = "heading") {
-                    Text(
-                        "Proton Drive public links",
-                        style = MaterialTheme.typography.titleMedium,
-                        modifier = Modifier.padding(horizontal = 16.dp, vertical = 8.dp),
-                    )
-                }
-                items(shares, key = { it.id }) { share ->
-                    ShareRow(
-                        share = share,
-                        onRefresh = { onRefresh(share.id) },
-                        onRepair = { repairing = share },
-                        onRemove = { removing = share },
-                    )
+    TabPage("Shares", padding) { body ->
+        Box(Modifier.fillMaxSize().padding(body)) {
+            if (shares.isEmpty() && account.state == null) {
+                EmptyState("No shares yet", "Add a Proton Drive public link to build your library.")
+            } else {
+                LazyColumn(contentPadding = PaddingValues(top = 8.dp, bottom = 96.dp)) {
+                    if (accountActions != null) {
+                        item(key = "account") {
+                            AccountCard(
+                                account,
+                                accountActions,
+                                onSignIn = { signingIn = true },
+                                onBrowse = { browsing = true },
+                            )
+                        }
+                    }
+                    if (shares.isEmpty()) {
+                        item(key = "empty") {
+                            Text(
+                                "No shares yet. Add a public link, or a folder of your Drive once signed in.",
+                                style = MaterialTheme.typography.bodyMedium,
+                                color = MaterialTheme.colorScheme.onSurfaceVariant,
+                                modifier = Modifier.padding(16.dp),
+                            )
+                        }
+                    }
+                    items(shares, key = { it.id }) { share ->
+                        ShareRow(
+                            share = share,
+                            onRefresh = { onRefresh(share.id) },
+                            onRepair = { repairing = share },
+                            onRemove = { removing = share },
+                            onRename = { renaming = share },
+                        )
+                    }
                 }
             }
+            // Where a thumb is, and the one thing this page is for. The share
+            // sheet and a tapped link land in the same form.
+            ExtendedFloatingActionButton(
+                onClick = { showAdd = true },
+                icon = { Icon(Icons.Default.Add, contentDescription = null) },
+                text = { Text("Add share") },
+                containerColor = MaterialTheme.colorScheme.primary,
+                contentColor = MaterialTheme.colorScheme.onPrimary,
+                modifier = Modifier.align(Alignment.BottomEnd).padding(16.dp),
+            )
         }
-        // Where a thumb is, and the one thing this page is for. The share
-        // sheet and a tapped link land in the same form.
-        ExtendedFloatingActionButton(
-            onClick = { showAdd = true },
-            icon = { Icon(Icons.Default.Add, contentDescription = null) },
-            text = { Text("Add share") },
-            containerColor = MaterialTheme.colorScheme.primary,
-            contentColor = MaterialTheme.colorScheme.onPrimary,
-            modifier = Modifier.align(Alignment.BottomEnd).padding(16.dp),
-        )
     }
     if (showAdd || incomingLink != null) {
         AddShareDialog(
@@ -100,6 +135,14 @@ internal fun SharesScreen(
             onAdd = onAdd,
         )
     }
+    if (accountActions != null && (signingIn || account.state == AccountState.SecondFactor ||
+            account.state == AccountState.MailboxPassword)
+    ) {
+        SignInDialog(account, accountActions, onDismiss = { signingIn = false })
+    }
+    if (accountActions != null && browsing) {
+        DriveBrowserDialog(accountActions, onDismiss = { browsing = false })
+    }
     repairing?.let { share ->
         RepairShareDialog(
             share = share,
@@ -107,20 +150,35 @@ internal fun SharesScreen(
             onRepair = { url, password -> onRepair(share.id, url, password) },
         )
     }
+    renaming?.let { share ->
+        var name by remember(share.id) { mutableStateOf(share.name) }
+        AlertDialog(
+            onDismissRequest = { renaming = null },
+            title = { Text("Rename ${share.name}") },
+            text = { OutlinedTextField(name, { name = it }, label = { Text("Name") }, singleLine = true) },
+            confirmButton = {
+                AccentButton(enabled = name.isNotBlank(), onClick = {
+                    renaming = null
+                    onRename(share.id, name.trim())
+                }) { Text("Save") }
+            },
+            dismissButton = { TonalButton(onClick = { renaming = null }) { Text("Cancel") } },
+        )
+    }
     removing?.let { share ->
-        // Asked, because it cannot be undone: the link's secret, its offline
-        // files and its watch positions all go (`Catalog::remove_share`).
+        // Asked, because it cannot be undone: the link's secret and its
+        // offline files go. Watch positions stay (`Catalog::remove_share`).
         AlertDialog(
             onDismissRequest = { removing = null },
             title = { Text("Remove ${share.name}?") },
             text = {
                 Text(
-                    "Its titles leave the library, and its offline episodes and watch " +
-                        "progress are deleted. Adding the link again starts it fresh.",
+                    "Its titles leave the library and its offline episodes are deleted. " +
+                        "Watch progress is kept, so adding the link again picks up where you left off.",
                 )
             },
             confirmButton = {
-                AccentButton(onClick = { removing = null; onRemove(share.id) }) { Text("Remove") }
+                DangerButton(onClick = { removing = null; onRemove(share.id) }) { Text("Remove") }
             },
             dismissButton = { TonalButton(onClick = { removing = null }) { Text("Cancel") } },
         )
@@ -133,18 +191,58 @@ internal fun SharesScreen(
  * Three differently styled controls beside the name squeezed it into a column
  * a word wide; one icon leaves the row its width.
  */
+/** "120 files · crawled 2 h ago", or that it has not been yet. */
+internal fun crawlLine(share: ShareRecord, now: Long = System.currentTimeMillis() / 1_000): String {
+    val at = share.crawledAt ?: return "Not crawled yet"
+    val files = share.crawlFiles?.toLong()?.let { if (it == 1L) "1 file" else "$it files" }
+    return listOfNotNull(files, "crawled ${ago(at, now)}").joinToString(" · ")
+}
+
+/** "just now", "5 min ago", "3 h ago", "2 days ago" — the desktop's `ui::ago`. */
+internal fun ago(at: Long, now: Long): String {
+    val seconds = (now - at).coerceAtLeast(0)
+    return when {
+        seconds < 60 -> "just now"
+        seconds < 3_600 -> "${seconds / 60} min ago"
+        seconds < 86_400 -> "${seconds / 3_600} h ago"
+        seconds < 172_800 -> "1 day ago"
+        else -> "${seconds / 86_400} days ago"
+    }
+}
+
 @Composable
 private fun ShareRow(
     share: ShareRecord,
     onRefresh: () -> Unit,
     onRepair: () -> Unit,
     onRemove: () -> Unit,
+    onRename: () -> Unit = {},
 ) {
     var menu by remember { mutableStateOf(false) }
     ListItem(
         headlineContent = { Text(share.name, fontWeight = FontWeight.SemiBold) },
         supportingContent = {
-            Text(if (share.hasCustomPassword) "Link and custom password, stored securely" else "Public link")
+            Column {
+                Text(
+                    when {
+                        share.fromAccount -> "Folder of your Drive"
+                        share.hasCustomPassword -> "Link and custom password"
+                        else -> "Public link"
+                    },
+                )
+                Text(crawlLine(share), style = MaterialTheme.typography.bodySmall)
+                // Until a crawl succeeds: a link revoked upstream otherwise
+                // just stops growing.
+                share.crawlError?.let {
+                    Text(
+                        "Last crawl failed: $it",
+                        color = MaterialTheme.colorScheme.error,
+                        style = MaterialTheme.typography.bodySmall,
+                        maxLines = 2,
+                        overflow = TextOverflow.Ellipsis,
+                    )
+                }
+            }
         },
         leadingContent = {
             Icon(
@@ -166,14 +264,21 @@ private fun ShareRow(
                         leadingIcon = { Icon(Icons.Default.Refresh, contentDescription = null) },
                         onClick = { menu = false; onRefresh() },
                     )
+                    DropdownMenuItem(
+                        text = { Text("Rename") },
+                        leadingIcon = { Icon(Icons.Default.Edit, contentDescription = null) },
+                        onClick = { menu = false; onRename() },
+                    )
                     // Not a remove: a share whose secret has become unreadable
                     // cannot be removed either, since removal deletes a secret
                     // the store can no longer touch.
-                    DropdownMenuItem(
-                        text = { Text("Re-enter link") },
-                        leadingIcon = { Icon(Icons.Default.Key, contentDescription = null) },
-                        onClick = { menu = false; onRepair() },
-                    )
+                    if (!share.fromAccount) {
+                        DropdownMenuItem(
+                            text = { Text("Re-enter link") },
+                            leadingIcon = { Icon(Icons.Default.Key, contentDescription = null) },
+                            onClick = { menu = false; onRepair() },
+                        )
+                    }
                     DropdownMenuItem(
                         text = { Text("Remove") },
                         leadingIcon = { Icon(Icons.Default.Delete, contentDescription = null) },
@@ -241,32 +346,55 @@ private fun RepairShareDialog(
     )
 }
 
+/**
+ * Add a link. The form stays up while the link is opened, and with the reason
+ * under it when the link is refused, so fixing a typo is a retry rather than
+ * starting over.
+ */
 @Composable
 private fun AddShareDialog(
     initialUrl: String,
     onDismiss: () -> Unit,
-    onAdd: (String, String, String?) -> Unit,
+    onAdd: suspend (String, String, String?) -> String?,
 ) {
     var name by remember { mutableStateOf("") }
     var url by remember(initialUrl) { mutableStateOf(initialUrl) }
+    var showLink by remember { mutableStateOf(false) }
     var password by remember { mutableStateOf("") }
+    var adding by remember { mutableStateOf(false) }
+    var refusal by remember { mutableStateOf<String?>(null) }
+    val scope = rememberCoroutineScope()
     AlertDialog(
-        onDismissRequest = onDismiss,
+        onDismissRequest = { if (!adding) onDismiss() },
         properties = DialogProperties(securePolicy = SecureFlagPolicy.SecureOn),
         title = { Text("Add Proton Drive share") },
         text = {
             Column(verticalArrangement = Arrangement.spacedBy(8.dp)) {
-                OutlinedTextField(name, { name = it }, label = { Text("Library name") }, singleLine = true)
                 OutlinedTextField(
                     url,
                     { url = it },
-                    label = { Text("Public share URL") },
+                    label = { Text("Share link") },
                     singleLine = true,
                     // The URL fragment is a secret. Password input disables
                     // IME learning/suggestions while normal long-press paste
-                    // remains available.
-                    visualTransformation = PasswordVisualTransformation(),
+                    // remains available; the eye shows what was pasted.
+                    visualTransformation = if (showLink) VisualTransformation.None else PasswordVisualTransformation(),
                     keyboardOptions = KeyboardOptions(keyboardType = KeyboardType.Password),
+                    trailingIcon = {
+                        IconButton(onClick = { showLink = !showLink }) {
+                            Icon(
+                                if (showLink) Icons.Default.VisibilityOff else Icons.Default.Visibility,
+                                contentDescription = if (showLink) "Hide link" else "Show link",
+                            )
+                        }
+                    },
+                )
+                OutlinedTextField(
+                    name,
+                    { name = it },
+                    label = { Text("Name (optional)") },
+                    supportingText = { Text("Defaults to the shared folder's name") },
+                    singleLine = true,
                 )
                 OutlinedTextField(
                     password,
@@ -276,14 +404,30 @@ private fun AddShareDialog(
                     visualTransformation = PasswordVisualTransformation(),
                     keyboardOptions = KeyboardOptions(keyboardType = KeyboardType.Password),
                 )
+                if (adding) {
+                    Row(horizontalArrangement = Arrangement.spacedBy(12.dp), verticalAlignment = Alignment.CenterVertically) {
+                        CircularProgressIndicator(Modifier.size(18.dp), strokeWidth = 2.dp)
+                        Text("Opening the link…")
+                    }
+                } else {
+                    refusal?.let { Text(it, color = MaterialTheme.colorScheme.error) }
+                }
             }
         },
         confirmButton = {
             AccentButton(
-                onClick = { onAdd(name.trim(), url.trim(), password); onDismiss() },
-                enabled = name.isNotBlank() && url.isNotBlank(),
-            ) { Text("Add") }
+                onClick = {
+                    adding = true
+                    refusal = null
+                    scope.launch {
+                        refusal = onAdd(name.trim(), url.trim(), password)
+                        adding = false
+                        if (refusal == null) onDismiss()
+                    }
+                },
+                enabled = url.isNotBlank() && !adding,
+            ) { Text(if (adding) "Adding…" else "Add") }
         },
-        dismissButton = { TonalButton(onClick = onDismiss) { Text("Cancel") } },
+        dismissButton = { TonalButton(onClick = onDismiss, enabled = !adding) { Text("Cancel") } },
     )
 }

android/app/src/main/java/io/narl/protonstream/ui/theme/Accent.kt

@@ -2,6 +2,7 @@ package io.narl.protonstream.ui.theme
 
 import androidx.compose.foundation.Canvas
 import androidx.compose.foundation.background
+import androidx.compose.foundation.layout.Box
 import androidx.compose.foundation.layout.RowScope
 import androidx.compose.foundation.layout.fillMaxWidth
 import androidx.compose.foundation.layout.height
@@ -9,6 +10,7 @@ import androidx.compose.material3.Button
 import androidx.compose.material3.ButtonDefaults
 import androidx.compose.material3.ExperimentalMaterial3Api
 import androidx.compose.material3.FilledTonalButton
+import androidx.compose.material3.LocalMinimumInteractiveComponentSize
 import androidx.compose.material3.MaterialTheme
 import androidx.compose.material3.NavigationBarItemDefaults
 import androidx.compose.material3.NavigationDrawerItemDefaults
@@ -18,14 +20,18 @@ import androidx.compose.material3.adaptive.navigationsuite.NavigationSuiteDefaul
 import androidx.compose.material3.adaptive.navigationsuite.NavigationSuiteItemColors
 import androidx.compose.material3.SliderState
 import androidx.compose.material3.TextButton
+import androidx.compose.material3.minimumInteractiveComponentSize
 import androidx.compose.runtime.Composable
+import androidx.compose.runtime.CompositionLocalProvider
 import androidx.compose.runtime.remember
+import androidx.compose.ui.Alignment
 import androidx.compose.ui.Modifier
 import androidx.compose.ui.geometry.CornerRadius
 import androidx.compose.ui.geometry.Size
 import androidx.compose.ui.graphics.Brush
 import androidx.compose.ui.graphics.Color
 import androidx.compose.ui.graphics.SolidColor
+import androidx.compose.ui.unit.Dp
 import androidx.compose.ui.unit.dp
 
 /**
@@ -68,17 +74,30 @@ internal fun AccentButton(
     content: @Composable RowScope.() -> Unit,
 ) {
     val shape = MaterialTheme.shapes.small
-    Button(
-        onClick = onClick,
-        // Only while it is live: a disabled button keeps Material's flat
-        // disabled container, because a greyed control that still wears the
-        // one strong colour in the window reads as pressable.
-        modifier = if (enabled) modifier.background(accentBrush(), shape) else modifier,
-        enabled = enabled,
-        shape = shape,
-        colors = ButtonDefaults.buttonColors(containerColor = Color.Transparent),
-        content = content,
-    )
+    // The button pads itself out to the 48dp minimum touch target, and a
+    // background on its modifier fills that whole target — 8dp taller than
+    // the 40dp container every other button draws. So the padding is taken
+    // here, outside the ramp, and the button inside is told not to add its
+    // own. The box hands its size down, so a `fillMaxWidth` still reaches it.
+    Box(
+        modifier.minimumInteractiveComponentSize(),
+        contentAlignment = Alignment.Center,
+        propagateMinConstraints = true,
+    ) {
+        CompositionLocalProvider(LocalMinimumInteractiveComponentSize provides Dp.Unspecified) {
+            Button(
+                onClick = onClick,
+                // Only while it is live: a disabled button keeps Material's flat
+                // disabled container, because a greyed control that still wears the
+                // one strong colour in the window reads as pressable.
+                modifier = if (enabled) Modifier.background(accentBrush(), shape) else Modifier,
+                enabled = enabled,
+                shape = shape,
+                colors = ButtonDefaults.buttonColors(containerColor = Color.Transparent),
+                content = content,
+            )
+        }
+    }
 }
 
 @Composable
@@ -123,6 +142,28 @@ internal fun QuietButton(
     content = content,
 )
 
+/**
+ * The yes of a confirmation that deletes or forgets something.
+ *
+ * Not [AccentButton]: the filled accent is this app's "go on", and a dialog
+ * whose most inviting button is the one that loses something reads as the
+ * safe choice. Error-toned text instead, as Material's own guidance has it.
+ */
+@Composable
+internal fun DangerButton(
+    onClick: () -> Unit,
+    modifier: Modifier = Modifier,
+    enabled: Boolean = true,
+    content: @Composable RowScope.() -> Unit,
+) = TextButton(
+    onClick = onClick,
+    modifier = modifier,
+    enabled = enabled,
+    shape = MaterialTheme.shapes.small,
+    colors = ButtonDefaults.textButtonColors(contentColor = MaterialTheme.colorScheme.error),
+    content = content,
+)
+
 /**
  * How far along something is, drawn in the accent.
  *

android/app/src/main/java/io/narl/protonstream/ui/theme/Theme.kt

@@ -56,6 +56,12 @@ object AppearanceState {
             .onSuccess { current.value = it }
     }
 
+    /** Read the stored choice again, after sync rewrote it. */
+    suspend fun reload() {
+        runCatching { withContext(Dispatchers.IO) { NativeRuntime.engine().palette() } }
+            .onSuccess { current.value = it }
+    }
+
     /** Repaint immediately, before the write that stores the choice lands. */
     fun apply(palette: PaletteRecord) {
         current.value = palette

android/app/src/main/java/io/narl/protonstream/ui/theme/Type.kt

@@ -24,6 +24,13 @@ internal val Inter = FontFamily(
     Font(R.font.inter_semibold, FontWeight.SemiBold),
 )
 
+/**
+ * Inter Display Bold, the optical size drawn for large text, for the one
+ * [HERO] line: the banner's name and the name at the top of a title's page.
+ * The desktop's `theme::display` family, from the same file.
+ */
+internal val InterDisplay = FontFamily(Font(R.font.inter_display_bold, FontWeight.Bold))
+
 /**
  * The type ramp, which is the desktop client's type ramp.
  *
@@ -33,7 +40,10 @@ internal val Inter = FontFamily(
  * were built to share one palette; sharing one scale is the other half of why
  * they should read as one app.
  *
- * The rungs, largest first: 26 / 20 / 18 / 17 / 15 / 14 / 13 / 12 / 11.
+ * The rungs, largest first: 34 / 26 / 20 / 18 / 17 / 15 / 14 / 13 / 12 / 11.
+ * The top one is the hero line, in [InterDisplay] and set tighter, at
+ * [HERO_LEADING]: at that size the text face's leading pushes a two-line name
+ * apart.
  *
  * Where a role maps is decided by what actually draws with it here, not by
  * Material's own sizes — Material's `displayLarge` is 57sp, which is a size for
@@ -44,7 +54,8 @@ internal val Inter = FontFamily(
  * [TypeRampTest] pins every one of these against the Rust ramp.
  */
 internal val ProtonTypography = Typography(
-    displayLarge = role(DISPLAY, FontWeight.SemiBold),
+    // The banner's name and the title page's name, where no logo stands in.
+    displayLarge = role(HERO, FontWeight.Bold, InterDisplay, HERO_LEADING),
     displayMedium = role(DISPLAY, FontWeight.SemiBold),
     displaySmall = role(TITLE, FontWeight.SemiBold),
     // The name of the title you opened — the desktop's display line.
@@ -69,6 +80,7 @@ internal val ProtonTypography = Typography(
     labelSmall = role(MICRO, FontWeight.Medium),
 )
 
+internal const val HERO = 34f
 internal const val DISPLAY = 26f
 internal const val TITLE = 20f
 internal const val HEADING = 18f
@@ -79,6 +91,9 @@ internal const val LABEL = 13f
 internal const val CAPTION = 12f
 internal const val MICRO = 11f
 
+internal const val LEADING = 1.35f
+internal const val HERO_LEADING = 1.1f
+
 /**
  * One rung as a `TextStyle`.
  *
@@ -87,9 +102,14 @@ internal const val MICRO = 11f
  * enough for the two-line title names in the grid and tight enough that a
  * label on a control does not float.
  */
-private fun role(size: Float, weight: FontWeight) = TextStyle(
+private fun role(
+    size: Float,
+    weight: FontWeight,
+    family: FontFamily = Inter,
+    leading: Float = LEADING,
+) = TextStyle(
     fontSize = size.sp,
-    lineHeight = (size * 1.35f).sp,
+    lineHeight = (size * leading).sp,
     fontWeight = weight,
-    fontFamily = Inter,
+    fontFamily = family,
 )

android/app/src/main/res/drawable/ic_launcher_foreground.xml

@@ -2,15 +2,17 @@
   The play mark from packaging/io.narl.proton-stream.svg, cut into the blocks a
   revision is fetched in. The paths are in the SVG's 128-unit space; the group
   maps its 104-unit tile onto the 72dp a launcher shows of a 108dp layer.
+  It centres x=70, between the glyph's centroid (66) and its box (73): the
+  SVG's own centre, 64, leaves it sitting visibly right in a round mask.
 -->
 <vector xmlns:android="http://schemas.android.com/apk/res/android"
     xmlns:aapt="http://schemas.android.com/aapt"
     android:width="108dp" android:height="108dp"
     android:viewportWidth="108" android:viewportHeight="108">
     <group
-        android:pivotX="64" android:pivotY="62"
+        android:pivotX="70" android:pivotY="62"
         android:scaleX="0.6923" android:scaleY="0.6923"
-        android:translateX="-10" android:translateY="-8">
+        android:translateX="-16" android:translateY="-8">
         <group android:translateY="3">
             <clip-path android:pathData="M0,0h63v128h-63zM68.5,0h10v128h-10zM84,0h44v128h-44z" />
             <path android:fillColor="#4D2E1596" android:pathData="M50,41.5v41a6,6 0,0 0,9.1 5.1l34.2,-20.5a6,6 0,0 0,0 -10.3L59.1,36.4A6,6 0,0 0,50 41.5z" />

android/app/src/main/res/drawable/ic_launcher_monochrome.xml

@@ -3,9 +3,9 @@
     android:width="108dp" android:height="108dp"
     android:viewportWidth="108" android:viewportHeight="108">
     <group
-        android:pivotX="64" android:pivotY="62"
+        android:pivotX="70" android:pivotY="62"
         android:scaleX="0.6923" android:scaleY="0.6923"
-        android:translateX="-10" android:translateY="-8">
+        android:translateX="-16" android:translateY="-8">
         <clip-path android:pathData="M0,0h63v128h-63zM68.5,0h10v128h-10zM84,0h44v128h-44z" />
         <path android:fillColor="#FFFFFFFF" android:pathData="M50,41.5v41a6,6 0,0 0,9.1 5.1l34.2,-20.5a6,6 0,0 0,0 -10.3L59.1,36.4A6,6 0,0 0,50 41.5z" />
     </group>

android/app/src/test/java/io/narl/protonstream/download/TransferRateTest.kt

@@ -0,0 +1,37 @@
+package io.narl.protonstream.download
+
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertTrue
+import org.junit.Test
+
+class TransferRateTest {
+    @Test
+    fun `the first sample has no rate to report`() {
+        assertEquals(0L, TransferRate().sample(4L * 1024 * 1024, 1_000))
+    }
+
+    @Test
+    fun `a steady transfer reports its rate`() {
+        val rate = TransferRate()
+        rate.sample(0, 0)
+        assertEquals(1_000_000L, rate.sample(1_000_000, 1_000))
+        assertEquals(1_000_000L, rate.sample(2_000_000, 2_000))
+    }
+
+    @Test
+    fun `one slow block moves the rate without halving it`() {
+        val rate = TransferRate()
+        rate.sample(0, 0)
+        rate.sample(1_000_000, 1_000)
+        val after = rate.sample(2_000_000, 3_000)
+        assertTrue(after in 600_000L..999_999L)
+    }
+
+    @Test
+    fun `a resumed download starting below the last sample starts over`() {
+        val rate = TransferRate()
+        rate.sample(0, 0)
+        rate.sample(1_000_000, 1_000)
+        assertEquals(1_000_000L, rate.sample(0, 2_000))
+    }
+}

android/app/src/test/java/io/narl/protonstream/ui/AccountUiTest.kt

@@ -0,0 +1,38 @@
+package io.narl.protonstream.ui
+
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertFalse
+import org.junit.Assert.assertTrue
+import org.junit.Test
+
+class AccountUiTest {
+    @Test
+    fun `the sync line says how long ago and what came in`() {
+        val minute = 60_000L
+        assertEquals("Library, settings and watch history sync through your Drive", syncLine(AccountUiState(), 0))
+        assertEquals("Synced just now", syncLine(AccountUiState(syncedAt = 0), 30_000))
+        assertEquals("Synced 5 min ago", syncLine(AccountUiState(syncedAt = 0), 5 * minute))
+        assertEquals(
+            "Synced 2 h ago · 3 from other devices",
+            syncLine(AccountUiState(syncedAt = 0, applied = 3), 120 * minute),
+        )
+    }
+
+    @Test
+    fun `a failed sync is said in place of when it last worked`() {
+        assertEquals(
+            "Did not sync: offline",
+            syncLine(AccountUiState(syncedAt = 0, syncError = "offline"), 0),
+        )
+    }
+
+    @Test
+    fun `the verification page may only navigate within Proton over https`() {
+        assertTrue(isProtonPage("https", "verify.proton.me"))
+        assertTrue(isProtonPage("https", "proton.me"))
+        assertFalse(isProtonPage("http", "verify.proton.me"))
+        assertFalse(isProtonPage("https", "proton.me.example.com"))
+        assertFalse(isProtonPage("https", "notproton.me"))
+        assertFalse(isProtonPage("https", null))
+    }
+}

android/app/src/test/java/io/narl/protonstream/ui/ArtworkTest.kt

@@ -0,0 +1,28 @@
+package io.narl.protonstream.ui
+
+import org.junit.Assert.assertEquals
+import org.junit.Test
+
+class ArtworkTest {
+    @Test
+    fun `initials skip the lower-case particles of a romanised name`() {
+        assertEquals("OK", initials("Oshi no Ko"))
+        assertEquals("AH", initials("Ano Hi Mita Hana no Namae o Bokutachi wa Mada Shiranai."))
+    }
+
+    @Test
+    fun `a one-word name has one initial`() {
+        assertEquals("A", initials("Akira"))
+    }
+
+    @Test
+    fun `a name with no capitals falls back to its first two words`() {
+        assertEquals("BW", initials("blue world order"))
+    }
+
+    @Test
+    fun `punctuation and separators are not words`() {
+        assertEquals("S2", initials("Steins;Gate - 2"))
+        assertEquals("", initials(" - "))
+    }
+}

android/app/src/test/java/io/narl/protonstream/ui/EpisodeNameTest.kt

@@ -0,0 +1,24 @@
+package io.narl.protonstream.ui
+
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertNull
+import org.junit.Test
+import uniffi.pstr_android.EpisodeRecord
+
+class EpisodeNameTest {
+    private fun episode(name: String, detail: String, providerName: String? = null) = EpisodeRecord(
+        shareId = "s", volumeId = "v", linkId = "l", name = name, label = "S01E01", detail = detail,
+        season = 1u, number = 1u, size = null, progress = null, resumeAt = null,
+        watched = false, offline = false, providerName = providerName, providerOverview = null, stillUrl = null,
+        airDate = null, lastPlayed = 0,
+    )
+
+    @Test
+    fun `the player captions an episode with its name and never its filename`() {
+        val file = "[Group] Show - S01E01.mkv"
+        assertEquals("Dog & Chainsaw", episode(file, file, providerName = "Dog & Chainsaw").shownName())
+        assertEquals("Winter Is Coming", episode(file, "Winter Is Coming").shownName())
+        assertNull(episode(file, file).shownName())
+        assertNull(episode(file, "").shownName())
+    }
+}

android/app/src/test/java/io/narl/protonstream/ui/HistoryTest.kt

@@ -23,6 +23,10 @@ class HistoryTest {
         metadataProvider = null, metadataId = null, metadataYear = null, metadataKind = null, posterUrl = null,
         backdropUrl = null, rating = null, genres = emptyList(), providerEpisodeCount = null, externalUrl = null,
         manualMatch = false, seasons = listOf(SeasonRecord(1u, "Season 1", episodes.toList())),
+        displayName = key, wideUrl = null, formatLabel = null, seasonLabel = null, studios = emptyList(),
+        directors = emptyList(), tags = emptyList(), airing = false, nextEpisode = null, nextAiringAt = null,
+        franchise = emptyList(),
+        continueIndex = null,
     )
 
     @Test

android/app/src/test/java/io/narl/protonstream/ui/LanguagePickerTest.kt

@@ -0,0 +1,31 @@
+package io.narl.protonstream.ui
+
+import org.junit.Assert.assertEquals
+import org.junit.Test
+
+class LanguagePickerTest {
+    @Test
+    fun `a stored tag reads as its language in either ISO form`() {
+        assertEquals("Japanese", languageLabel("jpn"))
+        assertEquals("Japanese", languageLabel("ja"))
+        assertEquals("German", languageLabel("deu"))
+        assertEquals("German", languageLabel("ger"))
+    }
+
+    @Test
+    fun `a region suffix and capitals do not hide the language`() {
+        assertEquals("Portuguese", languageLabel("PT-br"))
+    }
+
+    @Test
+    fun `a tag not on the list is shown as typed, and blank is no preference`() {
+        assertEquals("tgl", languageLabel("tgl"))
+        assertEquals("No preference", languageLabel(null))
+        assertEquals("No preference", languageLabel("  "))
+    }
+
+    @Test
+    fun `every listed language has a two-letter form`() {
+        LANGUAGES.forEach { (code, name) -> assertEquals(code, name, languageLabel(code)) }
+    }
+}

android/app/src/test/java/io/narl/protonstream/ui/LogoAndRuntimeTest.kt

@@ -0,0 +1,30 @@
+package io.narl.protonstream.ui
+
+import org.junit.Assert.assertArrayEquals
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertNull
+import org.junit.Test
+
+class LogoAndRuntimeTest {
+    @Test
+    fun `a padded logo is bounded by its lettering and not its haze`() {
+        val width = 10
+        val pixels = IntArray(width * 6)
+        // Lettering from (2, 1) to (6, 3), and a pixel of haze in the corner.
+        for (y in 1..3) for (x in 2..6) pixels[y * width + x] = 0xFFFFFFFF.toInt()
+        pixels[5 * width + 9] = 0x03FFFFFF
+        assertArrayEquals(intArrayOf(2, 1, 6, 3), opaqueBounds(pixels, width))
+    }
+
+    @Test
+    fun `a logo with nothing visible has no bounds`() {
+        assertNull(opaqueBounds(IntArray(16), 4))
+    }
+
+    @Test
+    fun `a running time reads in hours and minutes`() {
+        assertEquals("24 min", formatRuntime(24u))
+        assertEquals("2 h", formatRuntime(120u))
+        assertEquals("2 h 4 min", formatRuntime(124u))
+    }
+}

android/app/src/test/java/io/narl/protonstream/ui/ScreenshotTest.kt

@@ -13,6 +13,8 @@ import androidx.test.core.app.ApplicationProvider
 import androidx.work.testing.WorkManagerTestInitHelper
 import com.github.takahirom.roborazzi.RobolectricDeviceQualifiers
 import com.github.takahirom.roborazzi.captureRoboImage
+import io.narl.protonstream.ui.theme.AppearanceState
+import io.narl.protonstream.ui.theme.ProtonFallback
 import io.narl.protonstream.ui.theme.ProtonStreamTheme
 import java.time.LocalDate
 import java.time.ZoneOffset
@@ -23,10 +25,18 @@ import org.junit.runner.RunWith
 import org.robolectric.RobolectricTestRunner
 import org.robolectric.annotation.Config
 import org.robolectric.annotation.GraphicsMode
+import uniffi.pstr_android.ArrangementRecord
 import uniffi.pstr_android.EpisodeRecord
+import uniffi.pstr_android.MetadataProvider
+import uniffi.pstr_android.MetadataSettingsRecord
+import uniffi.pstr_android.OfflineRecord
+import uniffi.pstr_android.PaletteRecord
 import uniffi.pstr_android.SeasonRecord
 import uniffi.pstr_android.ShareRecord
+import uniffi.pstr_android.ShelfRecord
 import uniffi.pstr_android.StorageUsageRecord
+import uniffi.pstr_android.TileRecord
+import uniffi.pstr_android.CastRecord
 import uniffi.pstr_android.TitleRecord
 import uniffi.pstr_android.TitleType
 
@@ -36,8 +46,9 @@ import uniffi.pstr_android.TitleType
  * The screens are about to be redesigned one by one, and a layout regression —
  * a row that wraps, a button pushed off the edge — compiles and passes every
  * other test. Here it is a changed PNG in review. No artwork is loaded: the
- * bridge is not available on the host, so every tile shows its placeholder,
- * which is also what a title without metadata looks like on a phone.
+ * bridge is not available on the host, so every tile shows its generated
+ * placeholder, which is also what a title without metadata looks like on a
+ * phone.
  */
 @RunWith(RobolectricTestRunner::class)
 @GraphicsMode(GraphicsMode.Mode.NATIVE)
@@ -48,12 +59,22 @@ class ScreenshotTest {
     @Before
     fun setUp() {
         WorkManagerTestInitHelper.initializeTestWorkManager(ApplicationProvider.getApplicationContext())
+        // The palette is process-wide and the sandbox outlives a test, so a
+        // light capture would otherwise repaint every one after it.
+        AppearanceState.apply(ProtonFallback)
+    }
+
+    private fun captureLight(name: String, content: @Composable () -> Unit) {
+        AppearanceState.apply(LATTE)
+        capture(name, content)
     }
 
     private fun capture(name: String, content: @Composable () -> Unit) {
         compose.setContent {
             ProtonStreamTheme {
-                Surface(color = MaterialTheme.colorScheme.background) { content() }
+                CompositionLocalProvider(LocalArtworkLoading provides false) {
+                    Surface(color = MaterialTheme.colorScheme.background) { content() }
+                }
             }
         }
         compose.onRoot().captureRoboImage("src/test/screenshots/$name.png")
@@ -61,13 +82,40 @@ class ScreenshotTest {
 
     @Test
     fun `the library on a phone`() = capture("library-phone") {
+        LibraryScreen(MATCHED, {}, { _, _ -> }, {}, {}, { _, _ -> }, { _, _ -> }, PaddingValues())
+    }
+
+    @Test
+    fun `the library offering posters while they are off`() = capture("library-phone-offer") {
         LibraryScreen(LIBRARY, {}, { _, _ -> }, {}, {}, { _, _ -> }, { _, _ -> }, PaddingValues())
     }
 
     @Test
     @Config(qualifiers = RobolectricDeviceQualifiers.MediumTablet)
     fun `the library on a tablet`() = capture("library-tablet") {
-        LibraryScreen(LIBRARY, {}, { _, _ -> }, {}, {}, { _, _ -> }, { _, _ -> }, PaddingValues())
+        LibraryScreen(MATCHED, {}, { _, _ -> }, {}, {}, { _, _ -> }, { _, _ -> }, PaddingValues())
+    }
+
+    @Test
+    fun `the library in the light palette`() = captureLight("library-phone-light") {
+        LibraryScreen(MATCHED, {}, { _, _ -> }, {}, {}, { _, _ -> }, { _, _ -> }, PaddingValues())
+    }
+
+    @Test
+    fun `a title in the light palette`() = captureLight("title-phone-light") {
+        TitleScreen(SERIES, true, { _, _ -> }, {}, {}, {}, { _, _ -> }, PaddingValues())
+    }
+
+    @Test
+    @Config(qualifiers = RobolectricDeviceQualifiers.MediumTablet)
+    fun `a title on a tablet`() = capture("title-tablet") {
+        TitleScreen(SERIES, true, { _, _ -> }, {}, {}, {}, { _, _ -> }, PaddingValues())
+    }
+
+    @Test
+    @Config(qualifiers = RobolectricDeviceQualifiers.MediumTablet)
+    fun `the history page on a tablet`() = capture("history-tablet") {
+        HistoryScreen(LIBRARY, { _, _ -> }, {}, { _, _ -> }, PaddingValues(), ZoneOffset.UTC, LocalDate.of(2026, 9, 21))
     }
 
     @Test
@@ -76,7 +124,7 @@ class ScreenshotTest {
         // reads it from, so the scale is set there.
         val density = LocalDensity.current
         CompositionLocalProvider(LocalDensity provides Density(density.density, fontScale = 1.5f)) {
-            LibraryScreen(LIBRARY, {}, { _, _ -> }, {}, {}, { _, _ -> }, { _, _ -> }, PaddingValues())
+            LibraryScreen(MATCHED, {}, { _, _ -> }, {}, {}, { _, _ -> }, { _, _ -> }, PaddingValues())
         }
     }
 
@@ -85,19 +133,34 @@ class ScreenshotTest {
         LibraryScreen(AppUiState(loading = false), {}, { _, _ -> }, {}, {}, { _, _ -> }, { _, _ -> }, PaddingValues())
     }
 
+    @Test
+    fun `the library while the catalog loads`() = capture("library-loading") {
+        LibraryScreen(AppUiState(), {}, { _, _ -> }, {}, {}, { _, _ -> }, { _, _ -> }, PaddingValues())
+    }
+
     @Test
     fun `a title with seasons`() = capture("title-phone") {
-        TitleScreen(SERIES, true, { _, _ -> }, {}, {}, {}, { _, _ -> }, PaddingValues())
+        TitleScreen(SERIES, true, { _, _ -> }, {}, {}, {}, { _, _ -> }, PaddingValues(), franchise = listOf(SERIES, SEQUEL))
     }
 
     @Test
     fun `the shares page`() = capture("shares-phone") {
-        SharesScreen(LIBRARY.shares, { _, _, _ -> }, { _, _, _ -> }, {}, {}, null, {}, PaddingValues())
+        SharesScreen(LIBRARY.shares, { _, _, _ -> null }, { _, _, _ -> }, {}, {}, null, {}, PaddingValues())
     }
 
     @Test
     fun `the settings page`() = capture("settings-phone") {
-        SettingsScreen(LIBRARY, { _, _, _, _ -> }, {}, {}, {}, PaddingValues())
+        SettingsScreen(LIBRARY, { _, _, _, _ -> null }, {}, {}, {}, PaddingValues(), version = "1.0.0")
+    }
+
+    @Test
+    fun `the playback settings`() = capture("settings-playback") {
+        SettingsScreen(LIBRARY, { _, _, _, _ -> null }, {}, {}, {}, PaddingValues(), SettingsPage.Playback)
+    }
+
+    @Test
+    fun `the storage settings`() = capture("settings-storage") {
+        SettingsScreen(LIBRARY, { _, _, _, _ -> null }, {}, {}, {}, PaddingValues(), SettingsPage.Storage)
     }
 
     @Test
@@ -107,12 +170,42 @@ class ScreenshotTest {
         HistoryScreen(LIBRARY, { _, _ -> }, {}, { _, _ -> }, PaddingValues(), ZoneOffset.UTC, LocalDate.of(2026, 9, 21))
     }
 
+    @Test
+    fun `the downloads page with a season saved`() = capture("downloads-phone") {
+        val saved = SERIES.seasons.first().episodes.take(2).map {
+            OfflineRecord(it.shareId, it.linkId, "revision", 1_300_000_000uL, it)
+        }
+        // One title: the fixtures reuse link ids across titles, so with the
+        // whole library the episodes would be filed under whichever came last.
+        DownloadsScreen(LIBRARY.copy(titles = listOf(SERIES), offline = saved), {}, {}, {}, {}, PaddingValues())
+    }
+
     @Test
     fun `the downloads page with nothing offline`() = capture("downloads-empty") {
         DownloadsScreen(LIBRARY, {}, {}, {}, {}, PaddingValues())
     }
 
     private companion object {
+        /** Catppuccin Latte with the default accent, as `Palette::resolve` gives it. */
+        val LATTE = PaletteRecord(
+            background = 0xFFEFF1F5u,
+            surface = 0xFFE6E9EFu,
+            sunken = 0xFFDCE0E8u,
+            card = 0xFFCCD0DAu,
+            cardHover = 0xFFBCC0CCu,
+            border = 0xFFBCC0CCu,
+            text = 0xFF4C4F69u,
+            muted = 0xFF6C6F85u,
+            accent = 0xFF732FCCu,
+            accentAlt = 0xFF1856D1u,
+            accentDim = 0xFFC4BBE4u,
+            onAccent = 0xFFEFF1F5u,
+            danger = 0xFFD20F39u,
+            elevated = 0xFFAAAEBDu,
+            dangerDim = 0xFFE7D1D5u,
+            light = true,
+        )
+
         fun episode(season: UInt, number: UInt, watched: Boolean = false, progress: Double? = null): EpisodeRecord {
             // `detail` is the filename unless the filename named the episode,
             // which is what the bridge sends.
@@ -168,6 +261,20 @@ class ScreenshotTest {
             externalUrl = null,
             manualMatch = false,
             seasons = seasons,
+            displayName = name,
+            wideUrl = null,
+            formatLabel = null,
+            seasonLabel = null,
+            studios = emptyList(),
+            directors = emptyList(),
+            tags = emptyList(),
+            airing = false,
+            nextEpisode = null,
+            nextAiringAt = null,
+            franchise = emptyList(),
+            // What the engine would pick for these fixtures: the part-watched episode.
+            continueIndex = seasons.flatMap { it.episodes }.indexOfFirst { it.resumeAt != null }
+                .takeIf { it >= 0 }?.toUInt(),
         )
 
         val SERIES = title(
@@ -178,11 +285,37 @@ class ScreenshotTest {
                 SeasonRecord(2u, "Season 2", (1u..3u).map { episode(2u, it, progress = if (it == 1u) 0.4 else null) }),
             ),
             overview = "A doctor in a countryside clinic is reborn as the child of the idol he followed.",
+        ).copy(
+            formatLabel = "TV",
+            seasonLabel = "Spring 2023",
+            studios = listOf("Doga Kobo"),
+            directors = listOf("Daisuke Hiramaki"),
+            tags = listOf("Idol", "Reincarnation"),
+            franchise = listOf("oshi-no-ko", "oshi-no-ko-film"),
+            trailerUrl = "https://www.youtube.com/watch?v=trailer",
+            cast = listOf(
+                CastRecord("Ai Hoshino", null, "Rie Takahashi", null),
+                CastRecord("Aqua", null, "Takeo Ootsuka", null),
+            ),
         )
 
+        /** The rest of [SERIES]'s franchise, for the title page's row of it. */
+        val SEQUEL = title("oshi-no-ko-film", "Oshi no Ko: The Final Act", listOf(SeasonRecord(null, "Film", listOf(episode(1u, 1u)))))
+            .copy(kind = TitleType.FILM, year = 2024u, formatLabel = "Film", franchise = SERIES.franchise)
+
         val FILM = title("akira", "Akira", listOf(SeasonRecord(null, "Film", listOf(episode(1u, 1u)))))
             .copy(kind = TitleType.FILM, year = 1988u)
 
+        /** [LIBRARY] with posters on, as the shelf above its grid implies. */
+        val MATCHED get() = LIBRARY.copy(
+            metadataSettings = MetadataSettingsRecord(
+                enabled = true,
+                provider = MetadataProvider.ANI_LIST,
+                language = "en",
+                ready = true,
+            ),
+        )
+
         val LIBRARY = AppUiState(
             loading = false,
             titles = listOf(
@@ -191,9 +324,25 @@ class ScreenshotTest {
                 title("ano-hana", "Ano Hi Mita Hana no Namae o Bokutachi wa Mada Shiranai.", listOf(SeasonRecord(1u, "Season 1", (1u..11u).map { episode(1u, it) }))),
                 title("bleach", "Bleach", listOf(SeasonRecord(1u, "Season 1", (1u..2u).map { episode(1u, it) }))),
             ),
+            // Bleach stands for one more title of its franchise, and one shelf
+            // sits above the grid: what the bridge's arrangement would give.
+            arrangement = ArrangementRecord(
+                tiles = listOf("akira", "ano-hana", "bleach", "oshi-no-ko").map {
+                    TileRecord(it, if (it == "bleach") 1u else 0u)
+                },
+                shelves = listOf(ShelfRecord("From MAPPA", listOf("oshi-no-ko", "bleach", "akira"))),
+            ),
+            // Crawled relative to the clock, so the row reads "2 h ago" on
+            // whatever day the test runs.
             shares = listOf(
-                ShareRecord("anime", "anime", true),
-                ShareRecord("films", "films", false),
+                ShareRecord(
+                    "anime",
+                    "anime",
+                    true,
+                    crawledAt = System.currentTimeMillis() / 1_000 - 2 * 3_600,
+                    crawlFiles = 120uL,
+                ),
+                ShareRecord("films", "films", false, crawlError = "the link was revoked or has expired"),
             ),
             storage = StorageUsageRecord(6_400_000_000uL, 3uL, 0uL, 1_100_000_000uL),
         )

android/app/src/test/java/io/narl/protonstream/ui/StatusTest.kt

@@ -0,0 +1,39 @@
+package io.narl.protonstream.ui
+
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertNull
+import org.junit.Assert.assertTrue
+import org.junit.Test
+import uniffi.pstr_android.TitleRecord
+import uniffi.pstr_android.TitleType
+
+class StatusTest {
+    private fun title(status: String?, airing: Boolean = false, next: Pair<UInt, Long>? = null) = TitleRecord(
+        key = "k", name = "k", year = null, kind = TitleType.SERIES, watchedCount = 0uL,
+        episodeCount = 0uL, canonicalName = null, originalName = null, overview = null,
+        metadataProvider = null, metadataId = null, metadataYear = null, metadataKind = null, posterUrl = null,
+        backdropUrl = null, rating = null, genres = emptyList(), providerEpisodeCount = null, externalUrl = null,
+        manualMatch = false, seasons = emptyList(),
+        displayName = "k", wideUrl = null, formatLabel = null, seasonLabel = null, studios = emptyList(),
+        directors = emptyList(), tags = emptyList(), airing = airing, nextEpisode = next?.first,
+        nextAiringAt = next?.second, franchise = emptyList(), continueIndex = null, status = status,
+    )
+
+    @Test
+    fun `the status chip names the next episode while one is due`() {
+        val (text, live) = statusText(title("Airing", airing = true, next = 8u to 1_800_000_000L))!!
+        assertTrue(text, text.startsWith("Airing  ·  episode 8 "))
+        assertTrue(live)
+    }
+
+    @Test
+    fun `a finished title is said plainly and is not live`() {
+        assertEquals("Finished" to false, statusText(title("Finished")))
+    }
+
+    @Test
+    fun `a title with no status and nothing airing has no chip`() {
+        assertNull(statusText(title(null)))
+        assertEquals("Airing" to true, statusText(title(null, airing = true)))
+    }
+}

android/app/src/test/java/io/narl/protonstream/ui/theme/TypeRampTest.kt

@@ -22,10 +22,10 @@ import org.junit.Test
  */
 class TypeRampTest {
     /** `Role::size()`, in the order `theme.rs` declares it. */
-    private val ramp = listOf(26f, 20f, 18f, 17f, 15f, 14f, 13f, 12f, 11f)
+    private val ramp = listOf(34f, 26f, 20f, 18f, 17f, 15f, 14f, 13f, 12f, 11f)
 
     private val expected = mapOf(
-        "displayLarge" to 26f,
+        "displayLarge" to 34f,
         "displayMedium" to 26f,
         "displaySmall" to 20f,
         "headlineLarge" to 26f,
@@ -62,12 +62,14 @@ class TypeRampTest {
     /**
      * Leading is derived from the size, so the only thing worth asserting is
      * that it *was* derived — a style that kept Material's line height carries
-     * a number with no relation to its own size.
+     * a number with no relation to its own size. The hero line is the one set
+     * tighter.
      */
     @Test
     fun `line height follows the size it belongs to`() {
         styles().forEach { (name, style) ->
-            assertEquals(name, style.fontSize.value * 1.35f, style.lineHeight.value, 0.01f)
+            val leading = if (name == "displayLarge") HERO_LEADING else LEADING
+            assertEquals(name, style.fontSize.value * leading, style.lineHeight.value, 0.01f)
         }
     }
 

crates/pstr-android/Cargo.toml

@@ -24,6 +24,7 @@ pstr-core.workspace = true
 pstr-meta.workspace = true
 pstr-stream.workspace = true
 tokio.workspace = true
+futures.workspace = true
 parking_lot.workspace = true
 thiserror.workspace = true
 uniffi.workspace = true

crates/pstr-app/Cargo.toml

@@ -25,6 +25,8 @@ tracing-subscriber.workspace = true
 eframe.workspace = true
 egui.workspace = true
 egui-phosphor.workspace = true
+# The parser egui reads fonts with, to check a system font before handing it over.
+skrifa.workspace = true
 image.workspace = true
 sha2.workspace = true
 parking_lot.workspace = true
@@ -33,9 +35,12 @@ serde_json.workspace = true
 directories.workspace = true
 chrono.workspace = true
 souvlaki.workspace = true
+wry.workspace = true
+tao.workspace = true
+
+[build-dependencies]
+embed-resource.workspace = true
 
-[dev-dependencies]
-skrifa.workspace = true
 
 [target.'cfg(target_os = "linux")'.dependencies]
 dbus.workspace = true

crates/pstr-app/build.rs

@@ -0,0 +1,15 @@
+//! Compiles `proton-stream.rc` into the Windows exe; nothing on any other
+//! target. `rc.exe` on an MSVC build, mingw's `windres` on the cross build
+//! from Linux.
+
+fn main() {
+    println!("cargo:rerun-if-changed=proton-stream.rc");
+    println!("cargo:rerun-if-changed=../../packaging/windows/proton-stream.ico");
+    if std::env::var("CARGO_CFG_TARGET_OS").as_deref() != Ok("windows") {
+        return;
+    }
+    // Only the GUI gets the icon; `pstr` is a console tool.
+    embed_resource::compile_for("proton-stream.rc", ["proton-stream"], embed_resource::NONE)
+        .manifest_optional()
+        .expect("compile the icon resource");
+}

crates/pstr-app/proton-stream.rc

@@ -0,0 +1,4 @@
+// The exe's icon. The window sets one at runtime too, but that only lasts as
+// long as the window: Explorer, the Start menu and a taskbar pin read the icon
+// out of the file, and without this one they fall back to the generic one.
+1 ICON "../../packaging/windows/proton-stream.ico"

crates/pstr-app/src/desktop_prefs.rs

@@ -11,6 +11,9 @@ use serde::{Deserialize, Serialize};
 /// What the settings page offers for the streaming cache, in GiB.
 pub const CACHE_CHOICES: [u32; 5] = [1, 2, 4, 8, 16];
 
+/// What the settings page offers for the size of everything, in percent.
+pub const TEXT_SIZE_CHOICES: [u16; 5] = [90, 100, 115, 130, 150];
+
 #[derive(Debug, Clone, Copy, PartialEq, Serialize, Deserialize)]
 // A file from an older version, or edited by hand, missing a field: the rest
 // still counts, and the missing one takes its default.
@@ -21,6 +24,15 @@ pub struct DesktopPrefs {
     pub hardware_decoding: bool,
     /// How much decrypted video the disk cache may keep.
     pub cache_gib: u32,
+    /// How the library was last arranged, so it opens that way.
+    pub filter: crate::app::Filter,
+    pub sort: pstr_core::browse::Sort,
+    pub grouped: bool,
+    /// The library's offer of posters and synopses was turned down.
+    pub metadata_offer_dismissed: bool,
+    /// How large text and controls are drawn, in percent. Per computer, not
+    /// synced: what reads well depends on the screen and how far away it is.
+    pub text_size: u16,
 }
 
 impl Default for DesktopPrefs {
@@ -28,11 +40,23 @@ impl Default for DesktopPrefs {
         Self {
             hardware_decoding: true,
             cache_gib: 4,
+            filter: crate::app::Filter::default(),
+            sort: pstr_core::browse::Sort::default(),
+            // On: a share holding a series and its three films is four tiles
+            // of the same picture otherwise.
+            grouped: true,
+            metadata_offer_dismissed: false,
+            text_size: 100,
         }
     }
 }
 
 impl DesktopPrefs {
+    /// [`Self::text_size`] as egui's zoom factor, kept to what is offered.
+    pub fn zoom(&self) -> f32 {
+        f32::from(self.text_size.clamp(50, 200)) / 100.0
+    }
+
     pub fn cache_bytes(&self) -> u64 {
         u64::from(self.cache_gib.clamp(1, 64)) << 30
     }
@@ -93,6 +117,17 @@ mod tests {
         assert!(prefs.hardware_decoding);
     }
 
+    #[test]
+    fn a_text_size_from_an_older_file_is_full_size_and_a_wild_one_is_kept_in_range() {
+        let prefs: DesktopPrefs = serde_json::from_str(r#"{ "cache_gib": 8 }"#).unwrap();
+        assert_eq!(prefs.zoom(), 1.0);
+        let wild = DesktopPrefs {
+            text_size: 900,
+            ..DesktopPrefs::default()
+        };
+        assert_eq!(wild.zoom(), 2.0);
+    }
+
     #[test]
     fn an_unparseable_file_is_never_overwritten() {
         let path = std::env::temp_dir().join(format!("pstr-desktop-{}.json", std::process::id()));

crates/pstr-app/src/lib.rs

@@ -30,5 +30,6 @@ pub mod pacing;
 pub mod playback;
 pub mod theme;
 pub mod ui;
+pub mod verify;
 pub mod video;
 pub mod window;

crates/pstr-app/src/main.rs

@@ -16,6 +16,12 @@ use anyhow::Context;
 use pstr_core::config::AppDirs;
 
 fn main() -> anyhow::Result<()> {
+    // Before anything else: a verification window is a child process of the
+    // app, and must not claim the single instance or open a library.
+    if let Some(code) = pstr_app::verify::run_if_requested() {
+        std::process::exit(code);
+    }
+
     tracing_subscriber::fmt()
         .with_env_filter(
             tracing_subscriber::EnvFilter::try_from_default_env()

crates/pstr-app/src/playback.rs

@@ -35,8 +35,8 @@ use pstr_core::catalog::CatalogNode;
 use pstr_core::library::{Episode, Title};
 use pstr_core::prefs::PlaybackPrefs;
 use pstr_player::{
-    Chapter, ChapterRole, EndReason, Player, PlayerConfig, PlayerEvent, Track, TrackKind,
-    VideoOutput,
+    Chapter, ChapterRole, EndReason, Player, PlayerConfig, PlayerEvent, StreamHandle, Track,
+    TrackKind, VideoOutput,
 };
 use pstr_stream::VideoStream;
 
@@ -147,6 +147,10 @@ pub enum Command {
     /// Move subtitles, as a percentage of the window's height. See
     /// [`Playback::lift_subtitles`].
     SetSubtitlePosition(f64),
+    /// Restyle subtitles, the line already showing included.
+    SetSubtitleStyle(pstr_core::prefs::SubtitleStyle),
+    /// Shift subtitles this many seconds later; negative is earlier.
+    SetSubtitleDelay(f64),
     /// 1.0 is normal speed.
     SetSpeed(f64),
     /// Save the current frame to this file.
@@ -184,10 +188,26 @@ pub struct Playback {
     /// Where subtitles were last put, so they are only moved when that changes
     /// rather than once a frame.
     subtitle_position: f64,
+    /// How the viewer has subtitles drawn, as last handed to this player.
+    pub subtitle_style: pstr_core::prefs::SubtitleStyle,
+    /// Where the controls would lift subtitles to. The higher of this and the
+    /// style's own position wins.
+    lifted_position: f64,
+    /// How far subtitles are shifted, in seconds. Per file rather than a
+    /// preference: an offset belongs to one release, not to the viewer.
+    pub subtitle_delay: f64,
     /// What the file contains. Empty until mpv has demuxed it.
     pub tracks: Vec<Track>,
-    /// The file's chapters, in order. Empty for a file muxed without them.
+    /// The chapters to show and act on, in order: the file's own, with
+    /// AniSkip's opening and ending cut in when the file names neither. Empty
+    /// for a file muxed without chapters that AniSkip does not know.
     pub chapters: Vec<Chapter>,
+    /// The chapters as the file has them.
+    file_chapters: Vec<Chapter>,
+    /// What AniSkip said, once it has.
+    skip_ranges: Vec<pstr_core::chapters::SkipRange>,
+    /// Whether AniSkip has been asked about this file, so it is asked once.
+    pub skips_asked: bool,
     /// What each of those chapters is, resolved against the rest of the file —
     /// see [`pstr_player::roles`]. Same length as `chapters`, and recomputed
     /// whenever either the chapters or the duration change.
@@ -259,10 +279,16 @@ impl Playback {
             paused: false,
             volume: prefs.volume,
             muted: prefs.muted,
-            subtitle_position: 100.0,
+            subtitle_position: prefs.subtitle_style.position,
+            subtitle_style: prefs.subtitle_style.clone(),
+            lifted_position: 100.0,
+            subtitle_delay: 0.0,
             speed: prefs.speed,
             tracks: Vec::new(),
             chapters: Vec::new(),
+            file_chapters: Vec::new(),
+            skip_ranges: Vec::new(),
+            skips_asked: false,
             roles: Vec::new(),
             credits_at: None,
             position: target.resume_at.unwrap_or(0.0),
@@ -282,17 +308,57 @@ impl Playback {
     /// the mouse is moving, which is exactly when someone is looking at the
     /// screen.
     pub fn lift_subtitles(&mut self, covered: f32, height: f32) {
-        let position = if covered > 0.0 && height > 0.0 {
+        self.lifted_position = if covered > 0.0 && height > 0.0 {
             (100.0 * (1.0 - f64::from(covered / height))).round()
         } else {
             100.0
         };
+        self.place_subtitles();
+    }
+
+    /// Move subtitles to [`Self::subtitle_position`], when that has changed.
+    fn place_subtitles(&mut self) {
+        let position = self.subtitle_position();
         if position != self.subtitle_position {
             self.subtitle_position = position;
             self.send(Command::SetSubtitlePosition(position));
         }
     }
 
+    /// Where subtitles go: where the style puts them, unless the controls
+    /// would cover that, in which case just above the controls.
+    ///
+    /// A styled track ignores the style's position unless it is restyled:
+    /// mpv applies `sub-pos` to it either way, and its signs were placed by
+    /// hand. The lift still applies, because a line under the seek bar cannot
+    /// be read however carefully it was placed.
+    fn subtitle_position(&self) -> f64 {
+        let styled = self
+            .selected_track(TrackKind::Subtitle)
+            .is_some_and(|track| is_styled(track.codec.as_deref()));
+        let position = if styled && !self.subtitle_style.restyle_styled {
+            100.0
+        } else {
+            self.subtitle_style.position
+        };
+        position.min(self.lifted_position)
+    }
+
+    /// Restyle the subtitles of this file, now.
+    pub fn restyle_subtitles(&mut self, style: &pstr_core::prefs::SubtitleStyle) {
+        self.subtitle_style = style.clone();
+        self.subtitle_position = self.subtitle_position();
+        let mut style = style.clone();
+        style.position = self.subtitle_position;
+        self.send(Command::SetSubtitleStyle(style));
+    }
+
+    /// Shift subtitles to `seconds`, rounded to the tenth a keypress moves.
+    pub fn set_subtitle_delay(&mut self, seconds: f64) {
+        self.subtitle_delay = (seconds * 10.0).round() / 10.0;
+        self.send(Command::SetSubtitleDelay(self.subtitle_delay));
+    }
+
     /// Whether the picture is drawn in this window rather than mpv's own.
     pub fn is_embedded(&self) -> bool {
         self.video.is_some()
@@ -338,6 +404,18 @@ impl Playback {
         (end > self.position + 0.5).then_some((label, end))
     }
 
+    /// Whether the chapters say where the credits start. Most files that are
+    /// not anime have no chapters at all.
+    pub fn knows_credits(&self) -> bool {
+        self.credits_at.is_some()
+    }
+
+    /// Seconds of the file left to play, once its length is known.
+    pub fn remaining(&self) -> Option<f64> {
+        self.duration
+            .map(|duration| (duration - self.position).max(0.0))
+    }
+
     /// Whether the playhead is inside the run of credits and preview that ends
     /// the file — what "the episode is over" means when a file states its
     /// chapters.
@@ -350,6 +428,11 @@ impl Playback {
     /// changed. Both are needed: the length of a chapter is what settles a name
     /// that could mean two things.
     fn reclassify(&mut self) {
+        self.chapters = pstr_core::chapters::with_skip_ranges(
+            &self.file_chapters,
+            &self.skip_ranges,
+            self.duration,
+        );
         self.roles = pstr_player::roles(&self.chapters, self.duration);
         self.credits_at = pstr_player::credits_start(&self.chapters, &self.roles);
     }
@@ -360,9 +443,13 @@ impl Playback {
             PlayerEvent::FileLoaded => self.loaded = true,
             PlayerEvent::Volume(volume) => self.volume = *volume,
             PlayerEvent::Muted(muted) => self.muted = *muted,
-            PlayerEvent::Tracks(tracks) => self.tracks = tracks.clone(),
+            PlayerEvent::Tracks(tracks) => {
+                self.tracks = tracks.clone();
+                // A switch between a plain and a styled track moves the line.
+                self.place_subtitles();
+            }
             PlayerEvent::Chapters(chapters) => {
-                self.chapters = chapters.clone();
+                self.file_chapters = chapters.clone();
                 self.reclassify();
             }
             PlayerEvent::Position(position) => {
@@ -395,6 +482,26 @@ impl Playback {
         }
     }
 
+    /// The file's length, when it is time to ask AniSkip where its opening
+    /// and ending are: once, after it has loaded, and only when its own
+    /// chapters name neither.
+    pub fn wants_skip_times(&self) -> Option<f64> {
+        if self.skips_asked || !self.loaded {
+            return None;
+        }
+        let own = pstr_player::roles(&self.file_chapters, self.duration);
+        let named = own
+            .iter()
+            .any(|role| matches!(role, ChapterRole::Opening | ChapterRole::Ending));
+        self.duration.filter(|duration| *duration > 0.0 && !named)
+    }
+
+    /// Take AniSkip's answer.
+    pub fn set_skip_ranges(&mut self, ranges: Vec<pstr_core::chapters::SkipRange>) {
+        self.skip_ranges = ranges;
+        self.reclassify();
+    }
+
     /// Fraction played, for the seek bar. `None` until mpv reports a duration.
     pub fn progress(&self) -> Option<f32> {
         let duration = self.duration.filter(|duration| *duration > 0.0)?;
@@ -467,6 +574,11 @@ fn build_player(
     Ok((Arc::new(player), None))
 }
 
+/// Whether a subtitle codec carries its own styling, as mpv names them.
+fn is_styled(codec: Option<&str>) -> bool {
+    matches!(codec, Some("ass" | "ssa"))
+}
+
 /// The player defaults with the viewer's preferences folded in.
 fn from_prefs(
     prefs: &PlaybackPrefs,
@@ -482,6 +594,7 @@ fn from_prefs(
             .and_then(|p| p.subtitle_language.clone())
             .or_else(|| prefs.subtitle_language.clone()),
         subtitles: show.map(|p| p.subtitles).unwrap_or(prefs.subtitles),
+        subtitle_style: prefs.subtitle_style.clone(),
         // Carried from file to file, like the volume: somebody who watches at
         // 1.25 watches the next episode at 1.25 too.
         options: vec![("speed".into(), format!("{:.2}", prefs.speed))],
@@ -504,7 +617,11 @@ fn run(
     orders: std::sync::mpsc::Receiver<Command>,
     finished: Arc<AtomicBool>,
 ) {
-    let handle = match player.play(stream) {
+    let opened = match target.resume_at {
+        Some(at) => player.play_from(stream, at),
+        None => player.play(stream),
+    };
+    let handle = match opened {
         Ok(handle) => handle,
         Err(error) => {
             engine.emit(Event::Error(format!("load {}: {error}", target.name)));
@@ -514,10 +631,18 @@ fn run(
         }
     };
 
+    // Opened while mpv opens the video, and added once it has: an external
+    // track belongs to the file loaded at the time.
+    let mut sidecars = Some(engine.runtime().spawn({
+        let engine = engine.clone();
+        let target = target.clone();
+        async move { engine.open_sidecars(&target).await }
+    }));
+    let mut subtitles: Vec<StreamHandle> = Vec::new();
+
     let mut position = target.resume_at.unwrap_or(0.0);
     let mut duration: Option<f64> = None;
     let mut watched = false;
-    let mut resumed = target.resume_at.is_none();
     let mut last_save = std::time::Instant::now();
 
     'playback: loop {
@@ -543,6 +668,10 @@ fn run(
         match &event {
             PlayerEvent::FileLoaded => {
                 duration = player.duration();
+                if let Some(opening) = sidecars.take() {
+                    let opened = engine.runtime().block_on(opening).unwrap_or_default();
+                    subtitles = add_sidecars(&engine, &target, &player, opened);
+                }
                 // The first moment there is a track list to read: mpv has
                 // demuxed the file and made its own default selection. Put the
                 // title's own choice over it before the menus are told, so they
@@ -550,14 +679,16 @@ fn run(
                 if let Some(show) = target.track_prefs.as_deref() {
                     restore_tracks(&player, show);
                 }
-                emit_tracks(&engine, id, &player);
-                // Only now is there a timeline to seek within.
-                if !resumed && let Some(at) = target.resume_at {
-                    resumed = true;
-                    if let Err(error) = player.seek_to(at) {
-                        tracing::warn!("resume at {at}: {error}");
-                    }
+                // A subtitle track picked by name stays; one mpv picked by
+                // language may be the signs and songs, not the dialogue.
+                let picked = target
+                    .track_prefs
+                    .as_deref()
+                    .is_some_and(|show| show.subtitle_title.is_some());
+                if !picked {
+                    prefer_full_subtitles(&player);
                 }
+                emit_tracks(&engine, id, &player);
             }
             PlayerEvent::Duration(value) => duration = Some(*value),
             PlayerEvent::Position(value) => {
@@ -599,6 +730,7 @@ fn run(
     // the other `Arc`, and mpv must be destroyed there, on the thread whose
     // OpenGL context its render context was built against.
     drop(handle);
+    drop(subtitles);
     drop(player);
 
     engine.release(
@@ -627,6 +759,11 @@ fn apply_command(
         Command::SetVolume(volume) => player.set_volume(volume),
         Command::SetMuted(muted) => player.set_muted(muted),
         Command::SetSubtitlePosition(percent) => player.set_subtitle_position(percent),
+        Command::SetSubtitleStyle(style) => {
+            player.apply_subtitle_style(&style);
+            Ok(())
+        }
+        Command::SetSubtitleDelay(seconds) => player.set_subtitle_delay(seconds),
         Command::SetSpeed(speed) => player.set_speed(speed),
         Command::Screenshot(path) => player.screenshot(&path),
         Command::SelectTrack(kind, track) => select_track(engine, id, player, kind, track),
@@ -713,6 +850,57 @@ fn restore_tracks(player: &Player, show: &pstr_core::catalog::TitleTrackPrefs) {
     }
 }
 
+/// Play the dialogue rather than the signs and songs mpv picked by language.
+/// Not remembered: it is the choice mpv should have made, not the viewer's.
+fn prefer_full_subtitles(player: &Player) {
+    if let Some(track) = pstr_player::full_subtitles_instead(&player.tracks())
+        && let Err(error) = player.select_track(TrackKind::Subtitle, Some(track))
+    {
+        tracing::warn!("select dialogue subtitle {track}: {error}");
+    }
+}
+
+/// Hand mpv the subtitle files paired with the video it has just loaded.
+///
+/// One is turned on only when subtitles are on and the video has none of its
+/// own playing — a file's own track was chosen by name and language already,
+/// and an external one is the fallback, not an override.
+fn add_sidecars(
+    engine: &Engine,
+    target: &PlaybackTarget,
+    player: &Player,
+    opened: Vec<(pstr_core::catalog::Sidecar, VideoStream)>,
+) -> Vec<StreamHandle> {
+    let config = from_prefs(&engine.playback_prefs(), target.track_prefs.as_deref());
+    let playing = player
+        .tracks()
+        .iter()
+        .any(|track| track.kind == TrackKind::Subtitle && track.selected);
+    let (sidecars, streams): (Vec<_>, Vec<_>) = opened.into_iter().unzip();
+    let select = (config.subtitles && !playing)
+        .then(|| {
+            pstr_core::catalog::preferred_sidecar(&sidecars, config.subtitle_language.as_deref())
+        })
+        .flatten();
+    sidecars
+        .iter()
+        .zip(streams)
+        .enumerate()
+        .filter_map(|(index, (sidecar, stream))| {
+            let title = sidecar.title.as_deref().unwrap_or("External");
+            player
+                .add_subtitle(
+                    stream,
+                    title,
+                    sidecar.language.as_deref(),
+                    select == Some(index),
+                )
+                .inspect_err(|error| tracing::warn!(%error, "add subtitle {}", sidecar.name))
+                .ok()
+        })
+        .collect()
+}
+
 /// Tell the UI what the file contains and what of it is playing.
 fn emit_tracks(engine: &Engine, id: u64, player: &Player) {
     engine.emit(Event::Player {
@@ -738,3 +926,17 @@ fn save(
         watch_state(position, duration, watched),
     );
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn only_ass_and_ssa_tracks_count_as_styled() {
+        assert!(is_styled(Some("ass")));
+        assert!(is_styled(Some("ssa")));
+        assert!(!is_styled(Some("subrip")));
+        assert!(!is_styled(Some("hdmv_pgs_subtitle")));
+        assert!(!is_styled(None));
+    }
+}

crates/pstr-app/src/theme.rs

@@ -35,6 +35,16 @@ pub const CARD_WIDTH: f32 = 232.0;
 /// Video stills are 16:9. A poster shape would letterbox every one of them.
 pub const CARD_ASPECT: f32 = 9.0 / 16.0;
 pub const CARD_GAP: f32 = 14.0;
+/// The poster grid's minimum width: narrower than a still, because a cover is
+/// read by its art rather than by detail, and six across a laptop screen is
+/// what makes a wall of covers look like a shelf.
+pub const POSTER_WIDTH: f32 = 168.0;
+/// Covers are 2:3.
+pub const POSTER_ASPECT: f32 = 3.0 / 2.0;
+/// How much a tile's picture grows under the pointer, as a fraction of its
+/// size. Half of it lands on each side, which has to fit in half of
+/// [`CARD_GAP`] at the widest card, or a lifted tile overlaps its neighbour.
+pub const TILE_LIFT: f32 = 0.04;
 
 /// The type ramp, named once.
 ///
@@ -49,6 +59,11 @@ pub const CARD_GAP: f32 = 14.0;
 /// the one monospace style in the app is egui's own, set in [`apply`].
 #[derive(Debug, Clone, Copy, PartialEq, Eq)]
 pub enum Role {
+    /// The name in the library's banner and at the top of a title's page,
+    /// where there is no logo to stand in for it. Set in Inter Display, the
+    /// cut drawn for this size: tighter and heavier than the text face, which
+    /// at forty points looks like body copy that was zoomed.
+    Hero,
     /// The name of the thing you are looking at, once per page.
     Display,
     /// An empty state, or the heading of a page that has no display line.
@@ -72,6 +87,7 @@ pub enum Role {
 impl Role {
     pub const fn size(self) -> f32 {
         match self {
+            Self::Hero => 34.0,
             Self::Display => 26.0,
             Self::Title => 20.0,
             Self::Heading => 18.0,
@@ -84,10 +100,11 @@ impl Role {
         }
     }
 
-    /// Headings are set in the semibold cut; everything below them in the
-    /// regular one.
+    /// The hero line is set in the display cut, headings in the semibold
+    /// one, and everything below them in the regular one.
     pub fn family(self) -> egui::FontFamily {
         match self {
+            Self::Hero => display(),
             Self::Display | Self::Title | Self::Heading | Self::Section => semibold(),
             _ => egui::FontFamily::Proportional,
         }
@@ -153,6 +170,9 @@ pub mod motion {
     /// Artwork arriving over its placeholder. Slower, because it replaces
     /// something rather than adding to it, and a fast swap reads as a flicker.
     pub const ARRIVE: f32 = 0.24;
+    /// One pass of the highlight across a loading skeleton. Slow, because it
+    /// is something to wait in front of, not something happening.
+    pub const SHIMMER: f32 = 1.4;
 
     /// Fast out, slow in: the curve every hand-driven transition uses.
     pub fn ease_out(t: f32) -> f32 {
@@ -164,7 +184,7 @@ pub mod motion {
 /// sets the same on every desktop. Inter, under the OFL — the licence is
 /// beside the files.
 ///
-/// Both files have their private use area mappings removed, because the
+/// All three files have their private use area mappings removed, because the
 /// Phosphor icons live there. Inter maps 745 codepoints in that area to its
 /// own alternate glyphs, and as the first font in the family it won: the
 /// refresh arrow drew as an accented letter. The glyphs themselves are still
@@ -173,6 +193,9 @@ pub mod motion {
 /// U+E000..=U+F8FF).
 const INTER: &[u8] = include_bytes!("../assets/fonts/Inter-Regular.ttf");
 const INTER_SEMIBOLD: &[u8] = include_bytes!("../assets/fonts/Inter-SemiBold.ttf");
+/// Inter Display Bold, the optical size for the hero line. Stripped like the
+/// other two.
+const INTER_DISPLAY: &[u8] = include_bytes!("../assets/fonts/InterDisplay-Bold.ttf");
 
 /// The family the headings are set in. egui has no notion of weight, so the
 /// semibold cut is a family of its own.
@@ -180,9 +203,53 @@ pub fn semibold() -> egui::FontFamily {
     egui::FontFamily::Name("semibold".into())
 }
 
+/// The family [`Role::Hero`] is set in.
+pub fn display() -> egui::FontFamily {
+    egui::FontFamily::Name("display".into())
+}
+
+/// The family the subtitle preview is drawn in: the face the chosen subtitle
+/// font resolves to, ahead of the app's own fonts, which stand in until it has
+/// loaded and for any glyph it lacks.
+pub fn subtitle_family() -> egui::FontFamily {
+    egui::FontFamily::Name("subtitle".into())
+}
+
+/// The system fonts loaded so far. Each install builds the definitions from
+/// all of them, so loading one does not drop the other.
+#[derive(Default)]
+struct SystemFonts {
+    cjk: Option<Arc<egui::FontData>>,
+    subtitle: Option<(SubtitleRequest, Arc<egui::FontData>, SubtitleFace)>,
+    /// The subtitle face last asked for, loading or loaded.
+    wanted: Option<SubtitleRequest>,
+}
+
+static SYSTEM_FONTS: parking_lot::Mutex<SystemFonts> = parking_lot::Mutex::new(SystemFonts {
+    cjk: None,
+    subtitle: None,
+    wanted: None,
+});
+
+#[derive(Debug, Clone, PartialEq, Eq)]
+struct SubtitleRequest {
+    family: String,
+    bold: bool,
+    italic: bool,
+}
+
+/// What the loaded subtitle face draws by itself. A style it lacks is one
+/// libass makes up, and so must the preview.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub struct SubtitleFace {
+    pub bold: bool,
+    pub italic: bool,
+}
+
 /// Inter, the icon font, and egui's own fonts behind them for the emoji and
-/// symbols Inter does not carry. `cjk` goes last, when there is one.
-fn font_definitions(cjk: Option<egui::FontData>) -> egui::FontDefinitions {
+/// symbols Inter does not carry. The CJK fallback goes last, when there is
+/// one.
+fn font_definitions(system: &SystemFonts) -> egui::FontDefinitions {
     use egui::FontFamily::{Monospace, Proportional};
 
     let mut fonts = egui::FontDefinitions::default();
@@ -193,6 +260,10 @@ fn font_definitions(cjk: Option<egui::FontData>) -> egui::FontDefinitions {
         "inter-semibold".into(),
         Arc::new(egui::FontData::from_static(INTER_SEMIBOLD)),
     );
+    fonts.font_data.insert(
+        "inter-display".into(),
+        Arc::new(egui::FontData::from_static(INTER_DISPLAY)),
+    );
     fonts
         .families
         .entry(Proportional)
@@ -201,21 +272,32 @@ fn font_definitions(cjk: Option<egui::FontData>) -> egui::FontDefinitions {
     // Right behind Inter. The icons are in the private use area, which the
     // bundled Inter no longer maps, so neither font shadows the other.
     egui_phosphor::add_to_fonts(&mut fonts, egui_phosphor::Variant::Regular);
-    if let Some(cjk) = cjk {
+    if let Some(cjk) = &system.cjk {
         let name = "system-cjk-fallback".to_owned();
-        fonts.font_data.insert(name.clone(), Arc::new(cjk));
+        fonts.font_data.insert(name.clone(), cjk.clone());
         for family in [Proportional, Monospace] {
             fonts.families.entry(family).or_default().push(name.clone());
         }
     }
-    let fallbacks = fonts.families[&Proportional]
+    let fallbacks: Vec<String> = fonts.families[&Proportional]
         .iter()
         .filter(|name| *name != "inter")
-        .cloned();
-    let semibold_chain = std::iter::once("inter-semibold".to_owned())
-        .chain(fallbacks)
+        .cloned()
         .collect();
-    fonts.families.insert(semibold(), semibold_chain);
+    let chain = |first: &str| {
+        std::iter::once(first.to_owned())
+            .chain(fallbacks.iter().cloned())
+            .collect()
+    };
+    fonts.families.insert(semibold(), chain("inter-semibold"));
+    fonts.families.insert(display(), chain("inter-display"));
+    let mut subtitle_chain = fonts.families[&Proportional].clone();
+    if let Some((_, face, _)) = &system.subtitle {
+        let name = "system-subtitle".to_owned();
+        fonts.font_data.insert(name.clone(), face.clone());
+        subtitle_chain.insert(0, name);
+    }
+    fonts.families.insert(subtitle_family(), subtitle_chain);
     fonts
 }
 
@@ -228,7 +310,7 @@ fn font_definitions(cjk: Option<egui::FontData>) -> egui::FontDefinitions {
 /// anyway. egui deliberately does not bundle the multi-megabyte CJK families,
 /// and native desktops already provide one.
 pub fn install_fonts(ctx: &egui::Context) {
-    ctx.set_fonts(font_definitions(None));
+    ctx.set_fonts(font_definitions(&SYSTEM_FONTS.lock()));
     let ctx = ctx.clone();
     let spawned = std::thread::Builder::new()
         .name("fonts".into())
@@ -242,13 +324,98 @@ fn install_cjk_fallback(ctx: &egui::Context) {
     let Some((path, index)) = system_cjk_font() else {
         return;
     };
-    let Ok(bytes) = std::fs::read(path) else {
+    let Ok(bytes) = std::fs::read(&path) else {
         return;
     };
+    let Some(data) = system_font_data(bytes, index) else {
+        tracing::debug!("CJK fallback {}#{index} does not parse", path.display());
+        return;
+    };
+    let mut system = SYSTEM_FONTS.lock();
+    system.cjk = Some(Arc::new(data));
+    ctx.set_fonts(font_definitions(&system));
+    ctx.request_repaint();
+}
+
+/// The face the subtitle preview should be drawn in for this font, bold and
+/// italic, once [`subtitle_family`] holds it.
+///
+/// `None` while it loads, and for good where the system cannot say which file
+/// a family is — everywhere but Linux. The first call for a font starts the
+/// load on a thread of its own, since `fc-match` and reading the file are too
+/// slow for a frame, and asks for a repaint when it is in.
+pub fn subtitle_face(
+    ctx: &egui::Context,
+    family: &str,
+    bold: bool,
+    italic: bool,
+) -> Option<SubtitleFace> {
+    let request = SubtitleRequest {
+        family: family.to_owned(),
+        bold,
+        italic,
+    };
+    let mut system = SYSTEM_FONTS.lock();
+    if let Some((loaded, _, face)) = &system.subtitle
+        && *loaded == request
+    {
+        return Some(*face);
+    }
+    if system.wanted.as_ref() != Some(&request) {
+        system.wanted = Some(request.clone());
+        let ctx = ctx.clone();
+        let spawned = std::thread::Builder::new()
+            .name("subtitle-font".into())
+            .spawn(move || install_subtitle_face(&ctx, request));
+        if let Err(error) = spawned {
+            tracing::debug!("subtitle font thread: {error}");
+        }
+    }
+    None
+}
+
+fn install_subtitle_face(ctx: &egui::Context, request: SubtitleRequest) {
+    let Some((path, index, face)) = system_subtitle_font(&request) else {
+        return;
+    };
+    let Ok(bytes) = std::fs::read(&path) else {
+        return;
+    };
+    let Some(data) = system_font_data(bytes, index) else {
+        tracing::debug!("subtitle font {}#{index} does not parse", path.display());
+        return;
+    };
+    let mut system = SYSTEM_FONTS.lock();
+    // Another font was picked while this one loaded.
+    if system.wanted.as_ref() != Some(&request) {
+        return;
+    }
+    system.subtitle = Some((request, Arc::new(data), face));
+    ctx.set_fonts(font_definitions(&system));
+    ctx.request_repaint();
+}
+
+/// A system font, if egui can read it.
+///
+/// egui panics on a font it cannot parse, and this one comes from whatever the
+/// system has installed. So it is parsed here first, the same way egui does,
+/// and a font that fails is left out rather than taking the app down.
+fn system_font_data(bytes: Vec<u8>, index: u32) -> Option<egui::FontData> {
+    skrifa::FontRef::from_index(&bytes, index).ok()?;
     let mut data = egui::FontData::from_owned(bytes);
     data.index = index;
-    ctx.set_fonts(font_definitions(Some(data)));
-    ctx.request_repaint();
+    Some(data)
+}
+
+/// The face within a font collection that fontconfig's `%{index}` names.
+///
+/// Fontconfig packs a variable font's named instance into the high 16 bits —
+/// Fedora's variable Noto Sans CJK answers 262144, instance 4 of face 0. The
+/// instance is not a face, and passing it to egui as one stopped the app at
+/// start.
+#[cfg(any(target_os = "linux", test))]
+fn fontconfig_face(index: u32) -> u32 {
+    index & 0xFFFF
 }
 
 #[cfg(target_os = "linux")]
@@ -263,10 +430,73 @@ fn system_cjk_font() -> Option<(std::path::PathBuf, u32)> {
     let index = lines
         .next()
         .and_then(|value| value.parse().ok())
+        .map(fontconfig_face)
         .unwrap_or(0);
     path.is_file().then_some((path, index))
 }
 
+/// The file fontconfig picks for a subtitle font, as libass asks for it: the
+/// family with the weight and slant wanted, falling back as libass would to
+/// whatever fontconfig likes best when the family is not installed.
+#[cfg(target_os = "linux")]
+fn system_subtitle_font(
+    request: &SubtitleRequest,
+) -> Option<(std::path::PathBuf, u32, SubtitleFace)> {
+    let output = std::process::Command::new("fc-match")
+        .args([
+            "-f",
+            "%{file}\\n%{index}\\n%{weight}\\n%{slant}",
+            &fontconfig_pattern(request),
+        ])
+        .output()
+        .ok()?;
+    let text = std::str::from_utf8(&output.stdout).ok()?;
+    let mut lines = text.lines();
+    let path = std::path::PathBuf::from(lines.next()?);
+    let mut number = || lines.next().and_then(|value| value.parse::<u32>().ok());
+    let index = number().unwrap_or(0);
+    let (weight, slant) = (number().unwrap_or(0), number().unwrap_or(0));
+    // A variable font's named instance is drawn by egui as the default one,
+    // which is upright and regular, whatever fontconfig says it matched.
+    let instance = index != fontconfig_face(index);
+    let face = SubtitleFace {
+        bold: !instance && weight >= FC_WEIGHT_BOLD,
+        italic: !instance && slant > 0,
+    };
+    path.is_file()
+        .then_some((path, fontconfig_face(index), face))
+}
+
+#[cfg(any(target_os = "linux", test))]
+const FC_WEIGHT_BOLD: u32 = 200;
+
+/// A fontconfig pattern for the request. A family name is free text, and `-`,
+/// `:`, `,` and `\\` mean something in a pattern, so those are escaped.
+#[cfg(any(target_os = "linux", test))]
+fn fontconfig_pattern(request: &SubtitleRequest) -> String {
+    let mut pattern = String::new();
+    for character in request.family.chars() {
+        if matches!(character, '-' | ':' | ',' | '\\') {
+            pattern.push('\\');
+        }
+        pattern.push(character);
+    }
+    if request.bold {
+        pattern.push_str(&format!(":weight={FC_WEIGHT_BOLD}"));
+    }
+    if request.italic {
+        pattern.push_str(":slant=100");
+    }
+    pattern
+}
+
+/// Elsewhere there is no asking which file a family is, and the preview
+/// stays in the app's own font.
+#[cfg(not(target_os = "linux"))]
+fn system_subtitle_font(_: &SubtitleRequest) -> Option<(std::path::PathBuf, u32, SubtitleFace)> {
+    None
+}
+
 #[cfg(target_os = "windows")]
 fn system_cjk_font() -> Option<(std::path::PathBuf, u32)> {
     let path = std::path::PathBuf::from(r"C:\Windows\Fonts\YuGothR.ttc");
@@ -284,6 +514,68 @@ fn system_cjk_font() -> Option<(std::path::PathBuf, u32)> {
     None
 }
 
+/// The font families installed here, by name, for the subtitle font picker.
+///
+/// `None` until they have been read. The first call starts that on a thread
+/// of its own and asks for a repaint when it is done: `fc-list` over a large
+/// font collection takes long enough to be seen as a stalled frame.
+pub fn font_families(ctx: &egui::Context) -> Option<&'static [String]> {
+    static FAMILIES: std::sync::OnceLock<Vec<String>> = std::sync::OnceLock::new();
+    static STARTED: std::sync::atomic::AtomicBool = std::sync::atomic::AtomicBool::new(false);
+    if let Some(families) = FAMILIES.get() {
+        return Some(families);
+    }
+    if !STARTED.swap(true, std::sync::atomic::Ordering::Relaxed) {
+        let ctx = ctx.clone();
+        let spawned = std::thread::Builder::new()
+            .name("font-families".into())
+            .spawn(move || {
+                let _ = FAMILIES.set(system_font_families());
+                ctx.request_repaint();
+            });
+        if let Err(error) = spawned {
+            tracing::debug!("font families thread: {error}");
+        }
+    }
+    None
+}
+
+#[cfg(target_os = "linux")]
+fn system_font_families() -> Vec<String> {
+    let Ok(output) = std::process::Command::new("fc-list")
+        .args([":", "family"])
+        .output()
+    else {
+        return Vec::new();
+    };
+    font_families_from_fc_list(&String::from_utf8_lossy(&output.stdout))
+}
+
+/// Elsewhere the picker takes a typed name only. mpv's font lookup there is
+/// the system's own, so any installed family's name works.
+#[cfg(not(target_os = "linux"))]
+fn system_font_families() -> Vec<String> {
+    Vec::new()
+}
+
+/// One family per line of `fc-list : family`, sorted and without repeats.
+///
+/// A line lists a family's names in every language it has, comma-separated,
+/// and one family appears once per style. The first name is the one libass
+/// matches on.
+#[cfg(any(target_os = "linux", test))]
+fn font_families_from_fc_list(listing: &str) -> Vec<String> {
+    let mut families: Vec<String> = listing
+        .lines()
+        .filter_map(|line| line.split(',').next())
+        .map(|family| family.trim().to_owned())
+        .filter(|family| !family.is_empty() && !family.starts_with('.'))
+        .collect();
+    families.sort_by_key(|family| family.to_lowercase());
+    families.dedup();
+    families
+}
+
 /// Every colour the app draws with, as egui wants them.
 ///
 /// The *choice* of colours is `pstr_core::appearance` — one resolution shared
@@ -531,6 +823,11 @@ pub fn ramp_fill(
 /// scrim that starts opaque and lets the picture out, `true` for one that lets
 /// the picture *into* the page — which is the one the title backdrop wants,
 /// since the page is below the band.
+///
+/// The ramp itself is white and the colour is the shape's fill, which the GPU
+/// multiplies in: one texture per direction, however many colours fade —
+/// a banner tinted per title would otherwise build a ramp for every frame of
+/// its cross-fade.
 pub fn fade_shape(
     ctx: &egui::Context,
     rect: Rect,
@@ -538,8 +835,29 @@ pub fn fade_shape(
     direction: Direction,
     arriving: bool,
 ) -> egui::Shape {
-    let texture = alpha_ramp(ctx, color, direction, arriving);
-    textured(rect, CornerRadius::ZERO, &texture)
+    let texture = alpha_ramp(ctx, Color32::WHITE, direction, arriving);
+    let mut shape = egui::epaint::RectShape::filled(rect, CornerRadius::ZERO, color);
+    shape.brush = Some(Arc::new(egui::epaint::Brush {
+        fill_texture_id: texture.id(),
+        uv: Rect::from_min_max(egui::pos2(0.0, 0.0), egui::pos2(1.0, 1.0)),
+    }));
+    shape.into()
+}
+
+/// The page colour tinted by a picture's colour, for the veils over that
+/// picture: see [`pstr_core::appearance::mood_veil`]. The page colour itself
+/// while the picture has not arrived.
+pub fn mood_veil(mood: Option<Color32>) -> Color32 {
+    let palette = palette();
+    let Some(mood) = mood else {
+        return palette.background;
+    };
+    let rgb = |c: Color32| pstr_core::appearance::Rgb::new(c.r(), c.g(), c.b());
+    color(pstr_core::appearance::mood_veil(
+        rgb(palette.background),
+        rgb(mood),
+        palette.light,
+    ))
 }
 
 /// The one gradient that is not the accent: the top bar, which runs from the
@@ -605,6 +923,43 @@ fn shadow(strength: f32, offset: [i8; 2], blur: u8, alpha: u8) -> egui::epaint::
     }
 }
 
+/// A soft highlight sweeping across a loading skeleton on a diagonal: what
+/// says the shape is waiting for something rather than empty.
+///
+/// The phase runs off the clock rather than per tile, so every skeleton on
+/// screen sweeps in step, as one surface. Asks for the next frame itself; a
+/// skeleton is only ever on screen for a moment.
+pub fn shimmer(painter: &egui::Painter, rect: Rect) {
+    let time = painter.ctx().input(|input| input.time);
+    let phase = (time / f64::from(motion::SHIMMER)).fract() as f32;
+    let span = rect.width() * 0.6;
+    let centre = rect.left() - span + phase * (rect.width() + 2.0 * span);
+    let skew = rect.height() * 0.4;
+    let highlight = if palette().light {
+        Color32::from_black_alpha(10)
+    } else {
+        Color32::from_white_alpha(12)
+    };
+    let mut mesh = egui::Mesh::default();
+    for (x, color) in [
+        (centre - span, Color32::TRANSPARENT),
+        (centre, highlight),
+        (centre + span, Color32::TRANSPARENT),
+    ] {
+        mesh.colored_vertex(egui::pos2(x + skew, rect.top()), color);
+        mesh.colored_vertex(egui::pos2(x - skew, rect.bottom()), color);
+    }
+    for quad in 0..2 {
+        let i = quad * 2;
+        mesh.add_triangle(i, i + 1, i + 2);
+        mesh.add_triangle(i + 1, i + 3, i + 2);
+    }
+    painter
+        .with_clip_rect(rect.intersect(painter.clip_rect()))
+        .add(mesh);
+    painter.ctx().request_repaint();
+}
+
 /// The hover and press film on its own, for a control whose fill was painted by
 /// somebody else — the selected tab, which sits on the pill.
 pub fn veil_over(
@@ -849,11 +1204,68 @@ const RAMP_STOPS: usize = 64;
 mod tests {
     use super::*;
 
+    #[test]
+    fn each_font_family_is_listed_once_by_its_first_name() {
+        let listing = "Noto Sans,Noto Sans Regular\nDejaVu Sans\nnoto sans mono\nNoto Sans,Noto Sans Bold\n\n.LastResort\n";
+        assert_eq!(
+            font_families_from_fc_list(listing),
+            ["DejaVu Sans", "Noto Sans", "noto sans mono"]
+        );
+    }
+
+    #[test]
+    fn a_variable_fonts_named_instance_is_not_taken_for_a_face() {
+        assert_eq!(fontconfig_face(262_144), 0);
+        assert_eq!(fontconfig_face(0x0002_0001), 1);
+        assert_eq!(fontconfig_face(2), 2);
+    }
+
+    #[test]
+    fn a_system_font_egui_cannot_read_is_left_out() {
+        assert!(system_font_data(INTER.to_vec(), 0).is_some());
+        assert!(system_font_data(INTER.to_vec(), 4).is_none());
+        assert!(system_font_data(b"not a font".to_vec(), 0).is_none());
+    }
+
+    #[test]
+    fn a_subtitle_font_is_asked_of_fontconfig_with_its_style_and_escaped() {
+        let request = |family: &str, bold, italic| SubtitleRequest {
+            family: family.to_owned(),
+            bold,
+            italic,
+        };
+        assert_eq!(
+            fontconfig_pattern(&request("Noto Sans", false, false)),
+            "Noto Sans"
+        );
+        assert_eq!(
+            fontconfig_pattern(&request("Noto Sans", true, true)),
+            "Noto Sans:weight=200:slant=100"
+        );
+        assert_eq!(
+            fontconfig_pattern(&request("A-B:C,D\\E", false, true)),
+            "A\\-B\\:C\\,D\\\\E:slant=100"
+        );
+    }
+
+    #[test]
+    fn the_subtitle_preview_family_exists_before_any_font_has_loaded() {
+        let fonts = font_definitions(&SystemFonts::default());
+        assert_eq!(
+            fonts.families[&subtitle_family()],
+            fonts.families[&egui::FontFamily::Proportional]
+        );
+    }
+
     #[test]
     fn the_bundled_inter_leaves_the_icon_codepoints_to_phosphor() {
         use skrifa::MetadataProvider as _;
 
-        for (name, bytes) in [("regular", INTER), ("semibold", INTER_SEMIBOLD)] {
+        for (name, bytes) in [
+            ("regular", INTER),
+            ("semibold", INTER_SEMIBOLD),
+            ("display", INTER_DISPLAY),
+        ] {
             let font = skrifa::FontRef::new(bytes).expect("bundled Inter parses");
             let shadowed: Vec<u32> = font
                 .charmap()

crates/pstr-app/src/ui/account.rs

@@ -0,0 +1,600 @@
+//! The Proton account, on the shares page: signing in, watch-history sync, and
+//! picking folders of the viewer's own Drive as library shares.
+//!
+//! Optional and said so: public links need no account, and the page reads the
+//! same without one. What signing in adds is spelled out next to the form,
+//! because "sign in" alone does not say why an app that streams public links
+//! would want a password.
+
+use pstr_core::account::{DriveEntry, DrivePlace, PlaceKind};
+use pstr_core::proton_sdk::ids::NodeUid;
+use pstr_core::sync::SyncReport;
+
+use crate::app::Action;
+use crate::engine::AccountStatus;
+use crate::theme;
+use crate::ui;
+use crate::ui::widgets::Named;
+
+/// What the account section holds between frames.
+#[derive(Default)]
+pub struct AccountPanel {
+    pub status: AccountStatus,
+    pub username: String,
+    pub password: String,
+    pub code: String,
+    pub mailbox: String,
+    /// A request is out and not answered yet.
+    pub busy: bool,
+    /// Why the last sign-in step was refused.
+    pub error: Option<String>,
+    /// When watch history last synced, in Unix seconds, and what it did.
+    pub synced: Option<(i64, SyncReport)>,
+    /// Why the last sync failed, until one succeeds.
+    pub sync_error: Option<String>,
+    pub browser: DriveBrowser,
+}
+
+impl AccountPanel {
+    /// Apply where the account now stands. The typed secrets go as soon as
+    /// they are not needed: a password has no business sitting in a struct for
+    /// the rest of the session.
+    pub fn set_status(&mut self, status: AccountStatus) {
+        self.busy = false;
+        match &status {
+            AccountStatus::SignedIn(_) | AccountStatus::SignedOut => {
+                self.password.clear();
+                self.code.clear();
+                self.mailbox.clear();
+                if matches!(status, AccountStatus::SignedIn(_)) {
+                    self.error = None;
+                } else {
+                    self.browser = DriveBrowser::default();
+                    self.synced = None;
+                    self.sync_error = None;
+                }
+            }
+            AccountStatus::SecondFactor => self.error = None,
+            AccountStatus::MailboxPassword => {
+                self.code.clear();
+                self.error = None;
+            }
+            AccountStatus::Unknown => {}
+        }
+        self.status = status;
+    }
+
+    pub fn refused(&mut self, error: String) {
+        self.busy = false;
+        self.error = Some(error);
+    }
+}
+
+/// Where the Drive browser is.
+#[derive(Default)]
+pub struct DriveBrowser {
+    pub open: bool,
+    /// The folders descended through, each by name. Empty means the places.
+    pub trail: Vec<(String, NodeUid)>,
+    pub places: Option<Vec<DrivePlace>>,
+    /// The listing of the folder at the end of the trail, once it arrives.
+    pub entries: Option<(NodeUid, Vec<DriveEntry>)>,
+    pub loading: bool,
+    pub error: Option<String>,
+}
+
+impl DriveBrowser {
+    pub fn places_arrived(&mut self, places: Vec<DrivePlace>) {
+        self.loading = false;
+        self.error = None;
+        self.places = Some(places);
+    }
+
+    /// Take a listing, unless the viewer has already moved on from it.
+    pub fn folder_arrived(&mut self, uid: NodeUid, entries: Vec<DriveEntry>) {
+        if self
+            .trail
+            .last()
+            .is_some_and(|(_, current)| *current == uid)
+        {
+            self.loading = false;
+            self.error = None;
+            self.entries = Some((uid, entries));
+        }
+    }
+
+    pub fn failed(&mut self, error: String) {
+        self.loading = false;
+        self.error = Some(error);
+    }
+
+    fn enter(&mut self, name: String, uid: NodeUid, actions: &mut Vec<Action>) {
+        self.trail.push((name, uid.clone()));
+        self.entries = None;
+        self.loading = true;
+        self.error = None;
+        actions.push(Action::BrowseFolder(uid));
+    }
+
+    fn up(&mut self, actions: &mut Vec<Action>) {
+        self.trail.pop();
+        self.entries = None;
+        self.error = None;
+        match self.trail.last() {
+            Some((_, uid)) => {
+                self.loading = true;
+                actions.push(Action::BrowseFolder(uid.clone()));
+            }
+            None => self.loading = self.places.is_none(),
+        }
+    }
+}
+
+/// The account card: a sign-in form, or who is signed in and how sync is doing.
+pub fn section(ui: &mut egui::Ui, panel: &mut AccountPanel, actions: &mut Vec<Action>) {
+    ui::section(ui, "Proton account");
+    ui.label(ui::muted(
+        "Optional. Signed in, your shares, settings and watch history are kept in your own \
+         Drive, so every device shows the same library and resumes where another left off, \
+         and folders of your Drive — your files, other devices, what was shared with you — \
+         can be added to the library.",
+    ));
+    ui.add_space(theme::space::L);
+
+    card(ui, |ui| match panel.status.clone() {
+        AccountStatus::Unknown => {
+            ui.horizontal(|ui| {
+                ui.add(egui::Spinner::new().size(14.0));
+                ui.label(ui::muted("reading the stored session…"));
+            });
+        }
+        AccountStatus::SignedOut => sign_in_form(ui, panel, actions),
+        AccountStatus::SecondFactor => code_form(ui, panel, actions),
+        AccountStatus::MailboxPassword => mailbox_form(ui, panel, actions),
+        AccountStatus::SignedIn(username) => signed_in(ui, panel, &username, actions),
+    });
+}
+
+fn card(ui: &mut egui::Ui, add: impl FnOnce(&mut egui::Ui)) {
+    egui::Frame::new()
+        .fill(theme::card())
+        .corner_radius(egui::CornerRadius::same(theme::radius::MD))
+        .inner_margin(egui::Margin::same(14))
+        .show(ui, |ui| {
+            ui.set_width(ui.available_width().min(640.0));
+            add(ui);
+        });
+}
+
+fn sign_in_form(ui: &mut egui::Ui, panel: &mut AccountPanel, actions: &mut Vec<Action>) {
+    ui.label(ui::muted("Address"));
+    ui.add(
+        egui::TextEdit::singleline(&mut panel.username)
+            .hint_text("you@proton.me")
+            .desired_width(f32::INFINITY),
+    );
+    ui.add_space(theme::space::M);
+    ui.label(ui::muted("Password"));
+    let field = ui.add(
+        egui::TextEdit::singleline(&mut panel.password)
+            .password(true)
+            .desired_width(f32::INFINITY),
+    );
+    ui.add_space(theme::space::L);
+    error_line(ui, panel);
+    let ready = !panel.username.trim().is_empty() && !panel.password.is_empty() && !panel.busy;
+    let submitted = field.lost_focus() && ui.input(|input| input.key_pressed(egui::Key::Enter));
+    ui.horizontal(|ui| {
+        let clicked = ui
+            .add_enabled_ui(ready, |ui| ui::accent_button(ui, "Sign in"))
+            .inner
+            .clicked();
+        if ready && (clicked || submitted) {
+            panel.busy = true;
+            panel.error = None;
+            actions.push(Action::SignIn {
+                username: panel.username.trim().to_owned(),
+                password: panel.password.clone(),
+            });
+        }
+        busy_line(ui, panel, "signing in…");
+    });
+}
+
+fn code_form(ui: &mut egui::Ui, panel: &mut AccountPanel, actions: &mut Vec<Action>) {
+    ui.label(ui::muted("Two-factor code from your authenticator app"));
+    let field = ui.add(
+        egui::TextEdit::singleline(&mut panel.code)
+            .hint_text("123456")
+            .desired_width(160.0),
+    );
+    field.request_focus();
+    ui.add_space(theme::space::S);
+    // Security keys need WebAuthn, which the sign-in here does not speak. An
+    // account with nothing else is refused before this form (`AccountStore`).
+    ui.label(ui::muted(
+        "Security keys are not supported here — use the code from your authenticator app.",
+    ));
+    ui.add_space(theme::space::L);
+    error_line(ui, panel);
+    let ready = !panel.code.trim().is_empty() && !panel.busy;
+    let submitted = field.lost_focus() && ui.input(|input| input.key_pressed(egui::Key::Enter));
+    ui.horizontal(|ui| {
+        let clicked = ui
+            .add_enabled_ui(ready, |ui| ui::accent_button(ui, "Continue"))
+            .inner
+            .clicked();
+        if ready && (clicked || submitted) {
+            panel.busy = true;
+            actions.push(Action::SubmitSecondFactor(panel.code.trim().to_owned()));
+        }
+        if ui.button("Cancel").clicked() {
+            actions.push(Action::CancelSignIn);
+        }
+        busy_line(ui, panel, "checking…");
+    });
+}
+
+fn mailbox_form(ui: &mut egui::Ui, panel: &mut AccountPanel, actions: &mut Vec<Action>) {
+    ui.label(ui::muted(
+        "This account has a separate mailbox password. It unlocks your files, and is kept \
+         in your system keyring.",
+    ));
+    ui.add_space(theme::space::S);
+    let field = ui.add(
+        egui::TextEdit::singleline(&mut panel.mailbox)
+            .password(true)
+            .hint_text("Mailbox password")
+            .desired_width(f32::INFINITY),
+    );
+    ui.add_space(theme::space::L);
+    error_line(ui, panel);
+    let ready = !panel.mailbox.is_empty() && !panel.busy;
+    let submitted = field.lost_focus() && ui.input(|input| input.key_pressed(egui::Key::Enter));
+    ui.horizontal(|ui| {
+        let clicked = ui
+            .add_enabled_ui(ready, |ui| ui::accent_button(ui, "Unlock"))
+            .inner
+            .clicked();
+        if ready && (clicked || submitted) {
+            panel.busy = true;
+            actions.push(Action::SubmitMailboxPassword(panel.mailbox.clone()));
+        }
+        if ui.button("Cancel").clicked() {
+            actions.push(Action::CancelSignIn);
+        }
+        busy_line(ui, panel, "unlocking…");
+    });
+}
+
+fn signed_in(
+    ui: &mut egui::Ui,
+    panel: &mut AccountPanel,
+    username: &str,
+    actions: &mut Vec<Action>,
+) {
+    ui.horizontal(|ui| {
+        ui.vertical(|ui| {
+            ui.label(
+                egui::RichText::new(format!(
+                    "{}  {username}",
+                    egui_phosphor::regular::USER_CIRCLE
+                ))
+                .strong(),
+            );
+            let status = match (&panel.sync_error, &panel.synced) {
+                (Some(error), _) => format!("Did not sync: {error}"),
+                (None, Some((at, report))) => sync_line(*at, report, unix_now()),
+                (None, None) => {
+                    "Library, settings and watch history sync through your Drive".to_owned()
+                }
+            };
+            ui.label(ui::muted(status));
+        });
+        ui.with_layout(egui::Layout::right_to_left(egui::Align::Center), |ui| {
+            if ui
+                .add(
+                    egui::Button::new(format!("{}  Sign out", egui_phosphor::regular::SIGN_OUT))
+                        .fill(theme::card_hover()),
+                )
+                .clicked()
+            {
+                actions.push(Action::SignOut);
+            }
+            if ui
+                .button(format!(
+                    "{}  Sync now",
+                    egui_phosphor::regular::ARROWS_CLOCKWISE
+                ))
+                .clicked()
+            {
+                actions.push(Action::SyncNow);
+            }
+        });
+    });
+}
+
+/// "Synced 3 min ago · 2 positions from other devices".
+fn sync_line(at: i64, report: &SyncReport, now: i64) -> String {
+    let mut line = format!("Synced {}", ui::ago(at, now));
+    if report.applied > 0 {
+        line.push_str(&format!(
+            "  ·  {} from other devices",
+            ui::library::plural(report.applied, "position")
+        ));
+    }
+    line
+}
+
+fn error_line(ui: &mut egui::Ui, panel: &AccountPanel) {
+    if let Some(error) = &panel.error {
+        ui.label(theme::Role::Caption.rich(error).color(theme::danger()));
+        ui.add_space(theme::space::S);
+    }
+}
+
+fn busy_line(ui: &mut egui::Ui, panel: &AccountPanel, text: &str) {
+    if panel.busy {
+        ui.add(egui::Spinner::new().size(14.0));
+        ui.label(ui::muted(text));
+    }
+}
+
+/// Browse the account's Drive and add a folder of it to the library.
+pub fn browser(
+    ui: &mut egui::Ui,
+    panel: &mut AccountPanel,
+    shares: &[pstr_core::Share],
+    actions: &mut Vec<Action>,
+) {
+    if !matches!(panel.status, AccountStatus::SignedIn(_)) {
+        return;
+    }
+    ui.add_space(theme::space::XXL);
+    ui::section(ui, "Add from your Drive");
+    let browser = &mut panel.browser;
+    if !browser.open {
+        ui.label(ui::muted(
+            "A folder of your own Drive becomes a share like any link: crawled, browsable and \
+             streamed through your account.",
+        ));
+        ui.add_space(theme::space::L);
+        if ui
+            .button(format!(
+                "{}  Browse your Drive",
+                egui_phosphor::regular::FOLDER
+            ))
+            .clicked()
+        {
+            browser.open = true;
+            if browser.places.is_none() {
+                browser.loading = true;
+                actions.push(Action::BrowsePlaces);
+            }
+        }
+        return;
+    }
+
+    card(ui, |ui| {
+        ui.horizontal(|ui| {
+            if !browser.trail.is_empty()
+                && ui
+                    .button(egui_phosphor::regular::ARROW_LEFT)
+                    .hint("Up a folder")
+                    .clicked()
+            {
+                browser.up(actions);
+            }
+            let mut crumbs = vec!["Drive".to_owned()];
+            crumbs.extend(browser.trail.iter().map(|(name, _)| name.clone()));
+            ui.label(
+                egui::RichText::new(
+                    crumbs.join(&format!("  {}  ", egui_phosphor::regular::CARET_RIGHT)),
+                )
+                .strong(),
+            );
+            ui.with_layout(egui::Layout::right_to_left(egui::Align::Center), |ui| {
+                if ui.button("Close").clicked() {
+                    browser.open = false;
+                }
+            });
+        });
+        ui.add_space(theme::space::M);
+
+        if let Some(error) = &browser.error {
+            ui.label(theme::Role::Caption.rich(error).color(theme::danger()));
+            ui.add_space(theme::space::S);
+        }
+        if browser.loading {
+            ui.horizontal(|ui| {
+                ui.add(egui::Spinner::new().size(14.0));
+                ui.label(ui::muted("listing…"));
+            });
+            return;
+        }
+
+        let mut entered = None;
+        egui::ScrollArea::vertical()
+            .max_height(320.0)
+            .auto_shrink([false, true])
+            .show(ui, |ui| match browser.trail.last() {
+                None => {
+                    for place in browser.places.iter().flatten() {
+                        let icon = match place.kind {
+                            PlaceKind::MyFiles => egui_phosphor::regular::HARD_DRIVES,
+                            PlaceKind::Device => egui_phosphor::regular::DESKTOP,
+                            PlaceKind::SharedWithMe => egui_phosphor::regular::USERS,
+                        };
+                        if row(ui, icon, &place.name, None, true).clicked() {
+                            entered = Some((place.name.clone(), place.uid.clone()));
+                        }
+                    }
+                }
+                Some(_) => {
+                    let entries = browser
+                        .entries
+                        .as_ref()
+                        .map(|(_, entries)| entries.as_slice());
+                    if entries.is_some_and(<[DriveEntry]>::is_empty) {
+                        ui.label(ui::muted("This folder is empty."));
+                    }
+                    for entry in entries.unwrap_or_default() {
+                        let (icon, detail) = if entry.is_folder {
+                            (egui_phosphor::regular::FOLDER, None)
+                        } else if entry
+                            .media_type
+                            .as_deref()
+                            .is_some_and(|media| media.starts_with("video/"))
+                        {
+                            (
+                                egui_phosphor::regular::FILE_VIDEO,
+                                entry.size.map(format_size),
+                            )
+                        } else {
+                            (egui_phosphor::regular::FILE, entry.size.map(format_size))
+                        };
+                        if row(ui, icon, &entry.name, detail.as_deref(), entry.is_folder).clicked()
+                            && entry.is_folder
+                        {
+                            entered = Some((entry.name.clone(), entry.uid.clone()));
+                        }
+                    }
+                }
+            });
+        if let Some((name, uid)) = entered {
+            browser.enter(name, uid, actions);
+        }
+
+        if let Some((name, uid)) = browser.trail.last() {
+            ui.add_space(theme::space::L);
+            let added = shares.iter().any(|share| {
+                share
+                    .folder
+                    .as_ref()
+                    .is_some_and(|folder| folder.uid() == *uid)
+            });
+            ui.horizontal(|ui| {
+                if added {
+                    ui.label(ui::muted("This folder is already in the library."));
+                } else if ui::accent_button(ui, "Add this folder").clicked() {
+                    actions.push(Action::AddAccountFolder {
+                        name: name.clone(),
+                        uid: uid.clone(),
+                    });
+                    browser.open = false;
+                }
+            });
+        }
+    });
+}
+
+/// One line of the browser. Only folders and places are clickable.
+fn row(
+    ui: &mut egui::Ui,
+    icon: &str,
+    name: &str,
+    detail: Option<&str>,
+    clickable: bool,
+) -> egui::Response {
+    let mut text = egui::text::LayoutJob::default();
+    let body = ui.style().text_styles[&egui::TextStyle::Body].clone();
+    text.append(
+        &format!("{icon}  {name}"),
+        0.0,
+        egui::TextFormat::simple(
+            body.clone(),
+            if clickable {
+                theme::text()
+            } else {
+                theme::muted()
+            },
+        ),
+    );
+    if let Some(detail) = detail {
+        text.append(
+            &format!("   {detail}"),
+            0.0,
+            egui::TextFormat::simple(body, theme::muted()),
+        );
+    }
+    let sense = if clickable {
+        egui::Sense::click()
+    } else {
+        egui::Sense::hover()
+    };
+    let response = ui.add(egui::Label::new(text).sense(sense).truncate());
+    if clickable && response.hovered() {
+        ui.ctx().set_cursor_icon(egui::CursorIcon::PointingHand);
+    }
+    response
+}
+
+fn format_size(bytes: i64) -> String {
+    let bytes = bytes.max(0) as f64;
+    const GIB: f64 = 1024.0 * 1024.0 * 1024.0;
+    const MIB: f64 = 1024.0 * 1024.0;
+    if bytes >= GIB {
+        format!("{:.1} GiB", bytes / GIB)
+    } else {
+        format!("{:.0} MiB", bytes / MIB)
+    }
+}
+
+pub(crate) fn unix_now() -> i64 {
+    std::time::SystemTime::now()
+        .duration_since(std::time::UNIX_EPOCH)
+        .map(|since| since.as_secs() as i64)
+        .unwrap_or(0)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn the_sync_line_says_how_long_ago_and_what_came_in() {
+        let quiet = SyncReport::default();
+        assert_eq!(sync_line(100, &quiet, 130), "Synced just now");
+        assert_eq!(sync_line(100, &quiet, 400), "Synced 5 min ago");
+        let busy = SyncReport {
+            applied: 2,
+            ..SyncReport::default()
+        };
+        assert_eq!(
+            sync_line(0, &busy, 7200),
+            "Synced 2 h ago  ·  2 positions from other devices"
+        );
+    }
+
+    #[test]
+    fn signing_out_forgets_what_was_typed_and_browsed() {
+        let mut panel = AccountPanel {
+            password: "secret".into(),
+            mailbox: "also secret".into(),
+            ..AccountPanel::default()
+        };
+        panel.browser.open = true;
+        panel.set_status(AccountStatus::SignedOut);
+        assert!(panel.password.is_empty() && panel.mailbox.is_empty());
+        assert!(!panel.browser.open);
+    }
+
+    #[test]
+    fn a_listing_for_a_folder_already_left_is_dropped() {
+        let uid = |link: &str| {
+            NodeUid::new(
+                pstr_core::proton_sdk::ids::VolumeId::new("v".to_owned()),
+                pstr_core::proton_sdk::ids::LinkId::new(link.to_owned()),
+            )
+        };
+        let mut browser = DriveBrowser {
+            trail: vec![("b".into(), uid("b"))],
+            loading: true,
+            ..DriveBrowser::default()
+        };
+        browser.folder_arrived(uid("a"), Vec::new());
+        assert!(browser.loading && browser.entries.is_none());
+        browser.folder_arrived(uid("b"), Vec::new());
+        assert!(!browser.loading && browser.entries.is_some());
+    }
+}

crates/pstr-app/src/ui/downloads.rs

@@ -1,6 +1,6 @@
 //! Inspectable desktop download queue.
 
-use crate::app::Action;
+use crate::app::{Action, Page};
 use crate::engine::{DownloadItem, DownloadState};
 use crate::{theme, ui};
 
@@ -222,12 +222,20 @@ fn buttons(ui: &mut egui::Ui, item: &DownloadItem, actions: &mut Vec<Action>) {
             }
         }
         DownloadState::Completed => {
+            // The point of a download is to watch it, and the library is a
+            // detour from here — offline most of all.
+            if ui::accent_button(ui, "Play").clicked() {
+                actions.push(Action::PlayResuming(item.target.clone()));
+            }
+            if ui.button("Open").on_hover_text("Go to its title").clicked() {
+                actions.push(Action::Goto(Page::Title(item.target.title_key.clone())));
+            }
             if ui
                 .button("Delete")
                 .on_hover_text("Delete the offline copy; keep the online source")
                 .clicked()
             {
-                actions.push(Action::RemoveDownload(key(), false));
+                actions.push(Action::DeleteOffline(vec![key()], item.target.caption()));
             }
         }
     }

crates/pstr-app/src/ui/history.rs

@@ -10,6 +10,7 @@ use pstr_core::library::{Episode, Library, Title, TitleKind};
 
 use crate::app::{Action, Page};
 use crate::theme;
+use crate::ui::widgets::Named;
 use crate::ui::{self, Art};
 
 const STILL: egui::Vec2 = egui::vec2(128.0, 72.0);
@@ -161,7 +162,7 @@ fn row(
                         )
                         .frame(false),
                     )
-                    .on_hover_text(if episode.is_watched() {
+                    .hint(if episode.is_watched() {
                         "Remove from history — marks it unwatched"
                     } else {
                         "Remove from history — forgets where you stopped"

crates/pstr-app/src/ui/matcher.rs

@@ -55,8 +55,8 @@ pub fn show(
                     .color(theme::text()),
             );
             ui.label(ui::muted(format!(
-                "Everything {} answers with, in its own order — nothing is scored here.",
-                provider.label()
+                "Everything {} answer with, in their own order — nothing is scored here.",
+                pstr_meta::service::chain_label(provider)
             )));
             ui.add_space(theme::space::L);
 
@@ -130,12 +130,29 @@ fn current_row(
                 )));
                 // Only worth offering when there is something to undo: with no
                 // row stored, "clear" would delete nothing.
-                if ui
+                //
+                // A match chosen by hand is asked about first: it is work the
+                // next match run does not redo.
+                let asking = ui.id().with(("forget", &matcher.title_key));
+                if ui.data(|data| data.get_temp::<bool>(asking).unwrap_or(false)) {
+                    ui.label(ui::muted("Forget the match you chose?"));
+                    if ui::danger_button(ui, "Forget").clicked() {
+                        ui.data_mut(|data| data.remove::<bool>(asking));
+                        actions.push(Action::ForgetMatch(matcher.title_key.clone()));
+                    }
+                    if ui.button("Keep").clicked() {
+                        ui.data_mut(|data| data.remove::<bool>(asking));
+                    }
+                } else if ui
                     .button("Clear")
                     .on_hover_text("Forget this match and let the next match run decide again")
                     .clicked()
                 {
-                    actions.push(Action::ForgetMatch(matcher.title_key.clone()));
+                    if *manual {
+                        ui.data_mut(|data| data.insert_temp(asking, true));
+                    } else {
+                        actions.push(Action::ForgetMatch(matcher.title_key.clone()));
+                    }
                 }
             }
             Some((None, _)) => {
@@ -262,8 +279,9 @@ fn poster(art: &mut Art<'_>, found: &TitleMetadata) -> Option<egui::TextureHandl
         .texture(&key, || engine.request_poster(key.clone(), url))
 }
 
-/// `Film · 2017 · 26 episodes · ★ 8.2`, with whatever the provider left out
-/// simply absent.
+/// `Film · 2017 · 26 episodes · ★ 8.2 · AniList`, with whatever the provider
+/// left out simply absent. The provider last, because one search asks more
+/// than one, and the same show can come back from each.
 fn facts(found: &TitleMetadata) -> String {
     let mut parts: Vec<String> = vec![
         match found.kind {
@@ -281,5 +299,6 @@ fn facts(found: &TitleMetadata) -> String {
     if let Some(rating) = found.rating {
         parts.push(format!("{} {rating:.1}", egui_phosphor::regular::STAR));
     }
+    parts.push(found.provider.label().to_string());
     parts.join("  ·  ")
 }

crates/pstr-app/src/ui/mod.rs

@@ -3,6 +3,7 @@
 //! mutating the library it is iterating: pages collect [`Action`]s and the app
 //! applies them after the frame is drawn.
 
+pub mod account;
 pub mod downloads;
 pub mod history;
 pub mod library;
@@ -20,10 +21,12 @@ use std::collections::HashMap;
 
 use egui::{Align2, Color32, CornerRadius, Rect, Sense, Stroke, Vec2};
 use pstr_core::library::{Episode, Title};
-use pstr_core::metadata::{ArtShape, EpisodeGuide, EpisodeMetadata, MetadataRecord};
+use pstr_core::metadata::{ArtShape, EpisodeGuide, EpisodeMetadata, MetadataRecord, TitleNames};
 
-use crate::engine::{Engine, ImageCache, thumbnail_key};
+use crate::app::Action;
+use crate::engine::{Engine, ImageCache, WIDE_MAX_EDGE, thumbnail_key};
 use crate::theme;
+use widgets::Named;
 
 /// Everything the pages need to draw one title's picture.
 ///
@@ -40,8 +43,12 @@ pub struct Art<'a> {
     pub metadata: &'a HashMap<String, MetadataRecord>,
     /// What they said about the episodes under those titles.
     pub episodes: &'a HashMap<String, EpisodeGuide>,
+    /// Which name a title goes by.
+    pub names: TitleNames,
 }
 
+pub use pstr_core::browse::display_name as title_name;
+
 impl Art<'_> {
     /// What the provider says about one file of a title, matched on the
     /// numbering its name states.
@@ -74,6 +81,122 @@ impl Art<'_> {
             .texture(&thumbnail_key(node), || engine.request_thumbnail(node))
     }
 
+    /// A provider's picture that belongs to no one title's tile — a cast
+    /// member's portrait — fetched like a poster the first time it is asked
+    /// for.
+    pub fn picture(&mut self, url: &str) -> Option<egui::TextureHandle> {
+        let key = format!("picture:{url}");
+        let engine = self.engine;
+        let url = url.to_owned();
+        self.posters
+            .texture(&key, || engine.request_poster(key.clone(), url))
+    }
+
+    /// The name to show for `title`. See [`title_name`].
+    pub fn name<'t>(&'t self, title: &'t Title) -> &'t str {
+        title_name(title, self.metadata, self.names)
+    }
+
+    /// A 2:3 cover for `title`, for the poster grid; whatever [`Art::of`]
+    /// has when there is none.
+    pub fn poster(&mut self, title: &Title) -> Option<(egui::TextureHandle, ArtShape)> {
+        let url = self
+            .metadata
+            .get(&title.key)
+            .and_then(|record| record.metadata.as_ref())
+            .and_then(|metadata| metadata.poster_url.clone());
+        if let Some(url) = url {
+            let key = poster_key(&title.key);
+            let engine = self.engine;
+            if let Some(texture) = self
+                .posters
+                .texture(&key, || engine.request_poster(key.clone(), url))
+            {
+                return Some((texture, ArtShape::Portrait));
+            }
+        }
+        self.of(title)
+    }
+
+    /// Art for a strip across the whole window, at full size: fanart, else
+    /// AniList's banner, else the poster blurred into a wash of its colours —
+    /// see [`crate::engine::Engine::request_ambient`] — else whatever
+    /// [`Art::of`] has.
+    ///
+    /// Its own texture rather than the tile's: a 640 px tile picture
+    /// stretched to a 1600 px hero is soft, and a 1920 px one in every tile
+    /// would be most of the texture budget.
+    pub fn wide(&mut self, title: &Title) -> Option<(egui::TextureHandle, ArtShape)> {
+        let url = self
+            .metadata
+            .get(&title.key)
+            .and_then(|record| record.metadata.as_ref())
+            .and_then(|metadata| metadata.wide_art())
+            .map(str::to_owned);
+        if let Some(url) = url {
+            let key = wide_key(&title.key);
+            let engine = self.engine;
+            if let Some(texture) = self
+                .posters
+                .texture(&key, || engine.request_art(key.clone(), url, WIDE_MAX_EDGE))
+            {
+                return Some((texture, ArtShape::Landscape));
+            }
+        } else if let Some(url) = self.poster_url(title) {
+            let key = ambient_key(&title.key);
+            let engine = self.engine;
+            if let Some(texture) = self
+                .posters
+                .texture(&key, || engine.request_ambient(key.clone(), url))
+            {
+                return Some((texture, ArtShape::Landscape));
+            }
+        }
+        self.of(title)
+    }
+
+    /// The colour of whatever [`Art::wide`] is drawing for `title`, once it
+    /// has arrived — what that title's veils are tinted with. See
+    /// [`theme::mood_veil`].
+    pub fn mood(&self, title: &Title) -> Option<egui::Color32> {
+        [wide_key, ambient_key, poster_key]
+            .into_iter()
+            .map(|key| key(&title.key))
+            // The tile's own picture last: what `wide` falls back on.
+            .chain(std::iter::once(title.key.clone()))
+            .find_map(|key| self.posters.mood(&key))
+    }
+
+    /// Whether `title` has a picture made for a strip across the window, rather
+    /// than [`Art::wide`] standing one in.
+    pub fn has_wide_art(&self, title: &Title) -> bool {
+        self.metadata
+            .get(&title.key)
+            .and_then(|record| record.metadata.as_ref())
+            .is_some_and(|metadata| metadata.wide_art().is_some())
+    }
+
+    fn poster_url(&self, title: &Title) -> Option<String> {
+        self.metadata
+            .get(&title.key)
+            .and_then(|record| record.metadata.as_ref())
+            .and_then(|metadata| metadata.poster_url.clone())
+    }
+
+    /// The title's name as lettering, trimmed to it, when the provider has
+    /// one and it has arrived. Drawn over wide art in place of the name.
+    pub fn logo(&mut self, title: &Title) -> Option<egui::TextureHandle> {
+        let url = self
+            .metadata
+            .get(&title.key)
+            .and_then(|record| record.metadata.as_ref())
+            .and_then(|metadata| metadata.logo_url.clone())?;
+        let key = logo_key(&title.key);
+        let engine = self.engine;
+        self.posters
+            .texture(&key, || engine.request_logo(key.clone(), url))
+    }
+
     /// The picture for a title, and how to fit it.
     ///
     /// Provider artwork first, then Proton's still, then nothing. That order is
@@ -104,6 +227,89 @@ impl Art<'_> {
     }
 }
 
+/// The central panel's margin around every page. Anything drawn edge to edge —
+/// the library's banner, the title page's band — reaches past it.
+pub const PAGE_MARGIN: egui::Vec2 = egui::vec2(18.0, 12.0);
+
+/// The texture key of a title's cover, beside [`Art::of`]'s, which is the
+/// title key itself.
+pub fn poster_key(title_key: &str) -> String {
+    format!("poster:{title_key}")
+}
+
+/// The texture key of a title's full-size wide art.
+pub fn wide_key(title_key: &str) -> String {
+    format!("wide:{title_key}")
+}
+
+/// The texture key of a title's poster blurred for a band.
+pub fn ambient_key(title_key: &str) -> String {
+    format!("ambient:{title_key}")
+}
+
+/// A title's logo in place of its name in Display type, when there is one to
+/// draw; `None` leaves the caller to set the name as it does.
+///
+/// At most `max_height` tall and as wide as the space allows, up to 420 px —
+/// a logo the width of the column shouts. A light palette keeps the name: a
+/// clear logo is lettering made for dark art, white as often as not, and over
+/// a near-white veil it is gone.
+pub fn logo_heading(
+    ui: &mut egui::Ui,
+    art: &mut Art<'_>,
+    title: &Title,
+    max_height: f32,
+) -> Option<egui::Response> {
+    if theme::palette().light {
+        return None;
+    }
+    let texture = art.logo(title);
+    // From nothing rather than from the name it replaces: the name is gone the
+    // frame the logo is ready, and a logo easing in reads as it arriving.
+    let shown = ui.ctx().animate_bool_with_time(
+        ui.id().with(("logo", &title.key)),
+        texture.is_some(),
+        theme::motion::ARRIVE,
+    );
+    let texture = texture?;
+    let aspect = texture.aspect_ratio().max(0.1);
+    let width = ui.available_width().min(420.0).min(max_height * aspect);
+    let size = egui::vec2(width, width / aspect);
+    Some(
+        ui.add(
+            egui::Image::new((texture.id(), size)).tint(egui::Color32::WHITE.gamma_multiply(shown)),
+        )
+        .on_hover_text(art.name(title)),
+    )
+}
+
+/// The texture key of a title's logo.
+pub fn logo_key(title_key: &str) -> String {
+    format!("logo:{title_key}")
+}
+
+/// `24 min`, `2 h 4 min`, `2 h`: a provider's running time in minutes.
+pub fn format_runtime(minutes: u32) -> String {
+    match (minutes / 60, minutes % 60) {
+        (0, minutes) => format!("{minutes} min"),
+        (hours, 0) => format!("{hours} h"),
+        (hours, minutes) => format!("{hours} h {minutes} min"),
+    }
+}
+
+/// "just now", "5 min ago", "3 h ago", "2 days ago": how long before `now`
+/// the Unix time `at` was.
+pub fn ago(at: i64, now: i64) -> String {
+    let ago = (now - at).max(0);
+    match ago {
+        0..60 => "just now".to_owned(),
+        60..3600 => format!("{} min ago", ago / 60),
+        3600..86_400 => format!("{} h ago", ago / 3600),
+        86_400..172_800 => "1 day ago".to_owned(),
+        _ => format!("{} days ago", ago / 86_400),
+    }
+}
+
 /// `1:03:47`, or `4:12` for anything under an hour.
 pub fn format_time(seconds: f64) -> String {
     if !seconds.is_finite() || seconds < 0.0 {
@@ -124,6 +330,18 @@ pub fn format_speed(speed: f64) -> String {
     format!("{}×", text.trim_end_matches('0').trim_end_matches('.'))
 }
 
+/// `+0.3 s`, `−1.2 s` or `0 s`: a subtitle delay, signed so the direction
+/// reads without knowing which way mpv counts.
+pub fn format_delay(seconds: f64) -> String {
+    if seconds.abs() < 0.05 {
+        "0 s".to_owned()
+    } else if seconds > 0.0 {
+        format!("+{seconds:.1} s")
+    } else {
+        format!("−{:.1} s", -seconds)
+    }
+}
+
 /// `1.4 GiB`, for what a file costs to watch.
 pub fn format_size(bytes: i64) -> String {
     const UNITS: [&str; 4] = ["B", "KiB", "MiB", "GiB"];
@@ -162,11 +380,53 @@ pub fn accent_button(ui: &mut egui::Ui, text: &str) -> egui::Response {
     filled(ui, text, Fill::Accent, Vec2::new(0.0, 0.0))
 }
 
+/// The button beside the accent one: the same shape, in a film of the text
+/// colour, so "Start over" next to "Resume" reads as the alternative rather
+/// than as a second, unrelated kind of control.
+pub fn tonal_button(ui: &mut egui::Ui, text: &str) -> egui::Response {
+    filled(ui, text, Fill::Tonal, Vec2::new(0.0, 0.0))
+}
+
+/// My List's button: `+ My List` to put the title on it, `✓ My List` once it
+/// is, which takes it off again.
+pub fn list_button(ui: &mut egui::Ui, key: &str, on_list: bool, actions: &mut Vec<Action>) {
+    let label = if on_list {
+        format!("{}  My List", egui_phosphor::regular::CHECK)
+    } else {
+        format!("{}  My List", egui_phosphor::regular::PLUS)
+    };
+    let response = tonal_button(ui, &label).on_hover_text(if on_list {
+        "On My List. Click to take it off"
+    } else {
+        "Put it on My List, to find it again on every device"
+    });
+    if response.clicked() {
+        actions.push(Action::SetOnList {
+            key: key.to_owned(),
+            on: !on_list,
+        });
+    }
+}
+
+/// A button laid over the picture: dark glass and white ink, whatever the
+/// theme, because what is under it is a video frame and not the page.
+pub fn glass_button(ui: &mut egui::Ui, text: &str) -> egui::Response {
+    filled(ui, text, Fill::Glass, Vec2::new(0.0, 0.0))
+}
+
 /// The search box in the top bar: a magnifier, the text, and a way to clear it.
 ///
 /// Escape inside it clears it. `focus` puts the caret in it this frame — which
 /// is what `Ctrl+F` and `/` ask for from anywhere in the library.
-pub fn search_field(ui: &mut egui::Ui, search: &mut String, focus: bool) {
+///
+/// Empty and with the caret in it, it offers the `recent` searches under it.
+/// Picking one fills the box; the return says the viewer asked to forget them.
+pub fn search_field(
+    ui: &mut egui::Ui,
+    search: &mut String,
+    focus: bool,
+    recent: &[String],
+) -> bool {
     let id = egui::Id::new("library-search");
     let width = 240.0;
     let height = ui.spacing().interact_size.y;
@@ -205,7 +465,7 @@ pub fn search_field(ui: &mut egui::Ui, search: &mut String, focus: bool) {
             .id(id)
             .frame(egui::Frame::NONE)
             .hint_text(if has_focus {
-                "Titles and filenames"
+                "Titles, episodes, people"
             } else {
                 "Search   Ctrl+F"
             })
@@ -243,12 +503,62 @@ pub fn search_field(ui: &mut egui::Ui, search: &mut String, focus: bool) {
         );
         if response
             .on_hover_cursor(egui::CursorIcon::PointingHand)
-            .on_hover_text("Clear (Esc)")
+            .hint("Clear (Esc)")
             .clicked()
         {
             search.clear();
         }
     }
+
+    // Kept up while the pointer is over it as well as while the box has the
+    // caret: pressing on it takes the caret away before the click lands.
+    let popup = id.with("recent");
+    let over = ui
+        .data(|data| data.get_temp::<bool>(popup))
+        .unwrap_or(false);
+    let mut forget = false;
+    if search.is_empty() && !recent.is_empty() && (response.has_focus() || over) {
+        let mut picked = None;
+        let shown = egui::Area::new(popup)
+            .order(egui::Order::Foreground)
+            .fixed_pos(outer.left_bottom() + Vec2::new(0.0, 6.0))
+            .show(ui.ctx(), |ui| {
+                egui::Frame::popup(ui.style()).show(ui, |ui| {
+                    ui.set_width(width - 12.0);
+                    ui.label(
+                        theme::Role::Caption
+                            .rich("Recent searches")
+                            .color(theme::muted()),
+                    );
+                    for query in recent {
+                        if ui
+                            .add(
+                                egui::Button::selectable(false, query.as_str())
+                                    .frame_when_inactive(false),
+                            )
+                            .clicked()
+                        {
+                            picked = Some(query.clone());
+                        }
+                    }
+                    ui.separator();
+                    forget = ui
+                        .add(
+                            egui::Button::selectable(false, muted("Clear recent searches"))
+                                .frame_when_inactive(false),
+                        )
+                        .clicked();
+                });
+            });
+        let over = shown.response.contains_pointer();
+        ui.data_mut(|data| data.insert_temp(popup, over && !forget && picked.is_none()));
+        if let Some(query) = picked {
+            *search = query;
+        }
+    } else {
+        ui.data_mut(|data| data.remove::<bool>(popup));
+    }
+    forget
 }
 
 /// A thin bar in the accent, for how far something has got.
@@ -306,6 +616,19 @@ pub enum Answer {
 /// inside the app — stored secrets, downloaded bytes. Everything else acts on
 /// the click.
 pub fn confirm(ctx: &egui::Context, id: &str, heading: &str, body: &str, verb: &str) -> Answer {
+    confirm_with(ctx, id, heading, body, verb, true)
+}
+
+/// [`confirm`], for a question whose yes loses nothing — a large download —
+/// and so is the accent rather than the danger colour.
+pub fn confirm_with(
+    ctx: &egui::Context,
+    id: &str,
+    heading: &str,
+    body: &str,
+    verb: &str,
+    destroys: bool,
+) -> Answer {
     let mut answer = Answer::Pending;
     let modal = egui::Modal::new(egui::Id::new(("confirm", id)))
         .frame(
@@ -326,7 +649,12 @@ pub fn confirm(ctx: &egui::Context, id: &str, heading: &str, body: &str, verb: &
             ui.label(theme::Role::Body.rich(body).color(theme::muted()));
             ui.add_space(theme::space::XL);
             ui.with_layout(egui::Layout::right_to_left(egui::Align::Center), |ui| {
-                if danger_button(ui, verb).clicked() {
+                let yes = if destroys {
+                    danger_button(ui, verb)
+                } else {
+                    accent_button(ui, verb)
+                };
+                if yes.clicked() {
                     answer = Answer::Confirmed;
                 }
                 if ui.button("Cancel").clicked() {
@@ -350,6 +678,10 @@ enum Fill {
     Ink,
     /// Nothing at rest, the hover colour under the pointer.
     None,
+    /// A film of the text colour over whatever is behind it.
+    Tonal,
+    /// Dark glass over the picture.
+    Glass,
 }
 
 /// A row of tabs with one accent pill that slides between them.
@@ -430,6 +762,7 @@ fn filled(ui: &mut egui::Ui, text: &str, fill: Fill, extra: Vec2) -> egui::Respo
     );
 
     let (rect, response) = ui.allocate_exact_size(size, Sense::click());
+    let response = response.named(text);
     if !ui.is_rect_visible(rect) {
         return response;
     }
@@ -469,6 +802,35 @@ fn filled(ui: &mut egui::Ui, text: &str, fill: Fill, extra: Vec2) -> egui::Respo
             }
             theme::muted().lerp_to_gamma(theme::text(), hover)
         }
+        Fill::Tonal => {
+            let film = if theme::palette().light {
+                Color32::from_black_alpha(16)
+            } else {
+                Color32::from_white_alpha(22)
+            };
+            ui.painter().rect_filled(rect, radius, film);
+            theme::veil_over(ui.painter(), rect, radius, lift);
+            theme::text()
+        }
+        Fill::Glass => {
+            ui.painter()
+                .rect_filled(rect, radius, Color32::from_black_alpha(140));
+            ui.painter().rect_stroke(
+                rect,
+                radius,
+                Stroke::new(1.0, Color32::from_white_alpha(18)),
+                egui::StrokeKind::Inside,
+            );
+            theme::veil_over(ui.painter(), rect, radius, lift);
+            Color32::WHITE
+        }
+    };
+    // A disabled control is drawn at part strength: the ink is what says what
+    // the button is, so that is what fades.
+    let ink = if ui.is_enabled() {
+        ink
+    } else {
+        ink.gamma_multiply(0.4)
     };
 
     let position = rect.center() - galley.size() / 2.0;
@@ -492,6 +854,9 @@ pub struct Card<'a> {
     /// sideways-scrolling shelf has no edge to reach and passes
     /// [`theme::CARD_WIDTH`].
     pub width: f32,
+    /// The picture's height over its width: [`theme::CARD_ASPECT`] for a
+    /// still, [`theme::POSTER_ASPECT`] for a cover.
+    pub aspect: f32,
 }
 
 /// Two lines of name plus one of subtitle. Fixed, because the tile is allocated
@@ -499,10 +864,10 @@ pub struct Card<'a> {
 /// different height by title length reads as broken.
 const CARD_TEXT_HEIGHT: f32 = 54.0;
 
-/// How tall [`card`] draws a tile of this width, so a grid can step over rows
-/// it does not draw.
-pub fn card_height(width: f32) -> f32 {
-    (width * theme::CARD_ASPECT).round() + CARD_TEXT_HEIGHT
+/// How tall [`card`] draws a tile of this width and shape, so a grid can step
+/// over rows it does not draw.
+pub fn card_height(width: f32, aspect: f32) -> f32 {
+    (width * aspect).round() + CARD_TEXT_HEIGHT
 }
 
 /// Draw one tile and report whether it was clicked.
@@ -515,12 +880,20 @@ pub fn card_height(width: f32) -> f32 {
 /// reads as deliberate in a way a stretched poster does not.
 pub fn card(ui: &mut egui::Ui, card: Card<'_>) -> egui::Response {
     let width = card.width;
-    let image_height = (width * theme::CARD_ASPECT).round();
+    let image_height = (width * card.aspect).round();
+    // A cover fitted into a still-shaped tile is drawn whole; into a tile its
+    // own shape, it fills it like anything else.
+    let fit = card.aspect < 1.0;
     let text_height = CARD_TEXT_HEIGHT;
     let radius = CornerRadius::same(theme::radius::MD);
 
     let (rect, response) =
         ui.allocate_exact_size(Vec2::new(width, image_height + text_height), Sense::click());
+    let response = if card.subtitle.is_empty() {
+        response.named(card.name)
+    } else {
+        response.named(format!("{}, {}", card.name, card.subtitle))
+    };
     // Reached with the arrow keys or Tab: bring it into view, before the
     // early return below would skip a tile that is just off screen.
     if response.gained_focus() {
@@ -530,18 +903,27 @@ pub fn card(ui: &mut egui::Ui, card: Card<'_>) -> egui::Response {
         return response;
     }
 
-    let image_rect = Rect::from_min_size(rect.min, Vec2::new(width, image_height));
+    let resting = Rect::from_min_size(rect.min, Vec2::new(width, image_height));
     // Hover is a value, not a flag: the border, the lift and the shadow all
     // ride it, so they arrive together rather than each snapping on its own.
     // egui drives this from wall-clock time, so it is the same speed whatever
     // the frame rate — and it needs no state kept here.
-    // Focus lights a tile the way the pointer does, so the keyboard can be
-    // followed across the grid.
+    // Focus lifts a tile the way the pointer does, and adds a ring of its own,
+    // so the keyboard can be followed across the grid.
     let hover = ui.ctx().animate_bool_with_time(
         response.id.with("hover"),
         response.hovered() || response.has_focus(),
         theme::motion::HOVER,
     );
+    let focus = ui.ctx().animate_bool_with_time(
+        response.id.with("focus"),
+        response.has_focus(),
+        theme::motion::HOVER,
+    );
+    // The picture grows towards the viewer into the gap around it, which is
+    // what says "this one" across a shelf of near-identical rectangles. The
+    // name under it stays put, so the row's text never wobbles.
+    let image_rect = resting.expand2(resting.size() * lift_per_side(width) * hover);
     // The picture arrives whenever its download finishes, several frames after
     // the tile first drew. Fading it in over the placeholder turns a wall of
     // letters popping into stills into one settle.
@@ -574,7 +956,7 @@ pub fn card(ui: &mut egui::Ui, card: Card<'_>) -> egui::Response {
                     .with_texture(texture.id(), cover_uv(size, image_rect.size())),
             );
         }
-        Some((texture, ArtShape::Portrait)) => {
+        Some((texture, ArtShape::Portrait)) if fit => {
             painter.add(
                 egui::epaint::RectShape::filled(
                     contain_rect(texture.size_vec2(), image_rect),
@@ -587,6 +969,14 @@ pub fn card(ui: &mut egui::Ui, card: Card<'_>) -> egui::Response {
                 ),
             );
         }
+        Some((texture, ArtShape::Portrait)) => {
+            painter.add(
+                egui::epaint::RectShape::filled(image_rect, radius, ink).with_texture(
+                    texture.id(),
+                    cover_uv(texture.size_vec2(), image_rect.size()),
+                ),
+            );
+        }
         None => {}
     }
 
@@ -649,9 +1039,17 @@ pub fn card(ui: &mut egui::Ui, card: Card<'_>) -> egui::Response {
             egui::StrokeKind::Inside,
         );
     }
+    if focus > 0.0 {
+        painter.rect_stroke(
+            image_rect.expand(3.0),
+            CornerRadius::same(theme::radius::MD + 3),
+            Stroke::new(2.0, theme::text().gamma_multiply(focus)),
+            egui::StrokeKind::Outside,
+        );
+    }
 
     let text_rect = Rect::from_min_size(
-        image_rect.left_bottom() + Vec2::new(0.0, 6.0),
+        resting.left_bottom() + Vec2::new(0.0, 6.0),
         Vec2::new(width, text_height - 6.0),
     );
     let painter = painter.with_clip_rect(text_rect);
@@ -682,6 +1080,146 @@ pub fn card(ui: &mut egui::Ui, card: Card<'_>) -> egui::Response {
     response.on_hover_cursor(egui::CursorIcon::PointingHand)
 }
 
+/// Every sideways row in the app: the shelves on the home page and the
+/// franchise on a title's page.
+///
+/// What runs past either edge fades into the page rather than being cut off
+/// by it, so a row says there is more without a scroll bar saying it. Under
+/// the pointer, a round button at each edge with more beyond it pages the row
+/// by most of its width: a mouse has no sideways wheel, and the bar was the
+/// only other way across.
+///
+/// The row is padded by half a gap all round inside its scroll area, and the
+/// area reaches the same half gap past the column on either side, so a lifted
+/// tile is not clipped by the area and the tiles still line up with the
+/// headings above them.
+pub fn shelf<R>(
+    ui: &mut egui::Ui,
+    id_salt: impl std::hash::Hash + std::fmt::Debug,
+    add: impl FnOnce(&mut egui::Ui) -> R,
+) -> R {
+    let half = (theme::CARD_GAP / 2.0) as i8;
+    let id = ui.id().with(("shelf", &id_salt));
+    let page = id.with("page");
+    let pending: Option<f32> = ui.ctx().data_mut(|data| data.remove_temp(page));
+    let output = egui::Frame::new()
+        .outer_margin(egui::Margin {
+            left: -half,
+            right: -half,
+            top: -half,
+            bottom: -half,
+        })
+        .show(ui, |ui| {
+            egui::ScrollArea::horizontal()
+                .id_salt(id)
+                .auto_shrink([false, true])
+                .show(ui, |ui| {
+                    if let Some(delta) = pending {
+                        ui.scroll_with_delta_animation(
+                            Vec2::new(delta, 0.0),
+                            egui::style::ScrollAnimation::duration(SHELF_PAGE_SECONDS),
+                        );
+                    }
+                    egui::Frame::new()
+                        .inner_margin(egui::Margin::same(half))
+                        .show(ui, add)
+                        .inner
+                })
+        })
+        .inner;
+
+    let rect = output.inner_rect;
+    let offset = output.state.offset.x;
+    let overflow = (output.content_size.x - rect.width()).max(0.0);
+    let ends = [
+        (offset > 1.0, false, egui_phosphor::regular::CARET_LEFT, 1.0),
+        (
+            offset < overflow - 1.0,
+            true,
+            egui_phosphor::regular::CARET_RIGHT,
+            -1.0,
+        ),
+    ];
+    let pointer_in = ui.rect_contains_pointer(rect);
+    let painter = ui.painter_at(rect);
+    for (more, right, icon, direction) in ends {
+        if !more {
+            continue;
+        }
+        let strip = if right {
+            Rect::from_min_max(egui::pos2(rect.right() - SHELF_FADE, rect.top()), rect.max)
+        } else {
+            Rect::from_min_max(
+                rect.min,
+                egui::pos2(rect.left() + SHELF_FADE, rect.bottom()),
+            )
+        };
+        painter.add(theme::fade_shape(
+            ui.ctx(),
+            strip,
+            theme::background(),
+            theme::Direction::Horizontal,
+            right,
+        ));
+
+        let button_id = id.with(right);
+        let shown = ui
+            .ctx()
+            .animate_bool_with_time(button_id, pointer_in, theme::motion::HOVER);
+        if shown == 0.0 {
+            continue;
+        }
+        let centre = egui::pos2(
+            if right {
+                rect.right() - SHELF_BUTTON / 2.0 - theme::space::M
+            } else {
+                rect.left() + SHELF_BUTTON / 2.0 + theme::space::M
+            },
+            rect.center().y,
+        );
+        let button = Rect::from_center_size(centre, Vec2::splat(SHELF_BUTTON));
+        let response = ui
+            .interact(button, button_id.with("button"), Sense::click())
+            .on_hover_cursor(egui::CursorIcon::PointingHand);
+        let response = response.named(if right { "Scroll right" } else { "Scroll left" });
+        let lit = if response.hovered() { 1.0 } else { 0.0 };
+        painter.circle_filled(
+            centre,
+            SHELF_BUTTON / 2.0,
+            Color32::from_black_alpha((150.0 + 60.0 * lit) as u8).gamma_multiply(shown),
+        );
+        painter.text(
+            centre,
+            Align2::CENTER_CENTER,
+            icon,
+            egui::FontId::proportional(18.0),
+            Color32::WHITE.gamma_multiply(shown),
+        );
+        if response.clicked() {
+            let delta = direction * rect.width() * SHELF_PAGE;
+            ui.ctx().data_mut(|data| data.insert_temp(page, delta));
+            ui.ctx().request_repaint();
+        }
+    }
+    output.inner
+}
+
+/// How wide the fade at a shelf's edge is.
+const SHELF_FADE: f32 = 56.0;
+/// The diameter of a shelf's paging buttons.
+const SHELF_BUTTON: f32 = 40.0;
+/// How much of a shelf's width one page moves: most of it, so the tile that
+/// was cut by the edge is whole on the next page.
+const SHELF_PAGE: f32 = 0.85;
+const SHELF_PAGE_SECONDS: f32 = 0.35;
+
+/// How far a lifted tile grows past each edge, as a fraction of its size:
+/// [`theme::TILE_LIFT`], but never so far that it reaches into the gap's other
+/// half, which belongs to the neighbour. A wide window makes wide tiles.
+fn lift_per_side(width: f32) -> f32 {
+    (theme::TILE_LIFT / 2.0).min((theme::CARD_GAP / 2.0 - 1.0) / width.max(1.0))
+}
+
 /// The largest centred rectangle inside `target` with `image`'s aspect ratio.
 ///
 /// The other half of [`cover_uv`]: where that one keeps the whole rectangle and
@@ -777,9 +1315,13 @@ pub struct Grid {
 /// dead space at the right of every row, and on a wide window that reads as a
 /// layout that failed to line up rather than as a margin.
 pub fn columns(available: f32) -> Grid {
-    let columns = (((available + theme::CARD_GAP) / (theme::CARD_WIDTH + theme::CARD_GAP)).floor()
-        as usize)
-        .max(1);
+    columns_of(available, theme::CARD_WIDTH)
+}
+
+/// [`columns`], for cards at least `minimum` wide.
+pub fn columns_of(available: f32, minimum: f32) -> Grid {
+    let columns =
+        (((available + theme::CARD_GAP) / (minimum + theme::CARD_GAP)).floor() as usize).max(1);
     // The gaps come out of the width before it is split. Floored, because a
     // fraction of a point times four columns is enough to push the last card
     // onto a row of its own. A window too narrow for even one full card gets a
@@ -793,8 +1335,32 @@ pub fn columns(available: f32) -> Grid {
 
 #[cfg(test)]
 mod tests {
+    #[test]
+    fn a_subtitle_delay_reads_with_its_direction() {
+        assert_eq!(super::format_delay(0.3), "+0.3 s");
+        assert_eq!(super::format_delay(-1.2), "−1.2 s");
+        assert_eq!(super::format_delay(0.0000001), "0 s");
+    }
+
     use super::*;
 
+    #[test]
+    fn a_lifted_tile_never_reaches_its_neighbour_however_wide_the_window() {
+        for available in [400.0, 1280.0, 1919.0, 2560.0, 3840.0] {
+            for minimum in [theme::CARD_WIDTH, theme::POSTER_WIDTH] {
+                let width = columns_of(available, minimum).width;
+                assert!(width * lift_per_side(width) < theme::CARD_GAP / 2.0);
+            }
+        }
+    }
+
+    #[test]
+    fn a_running_time_reads_in_hours_and_minutes() {
+        assert_eq!(format_runtime(24), "24 min");
+        assert_eq!(format_runtime(120), "2 h");
+        assert_eq!(format_runtime(124), "2 h 4 min");
+    }
+
     #[test]
     fn times_are_formatted_by_length() {
         assert_eq!(format_time(0.0), "0:00");

crates/pstr-app/src/ui/settings.rs

@@ -5,13 +5,16 @@
 //! that manages Proton Drive links, and a page that is half link management and
 //! half preferences is two pages.
 
-use pstr_core::appearance::{Accent, Appearance, Flavor};
-use pstr_core::metadata::{MetadataConfig, ProviderId};
+use pstr_core::appearance::{Accent, Appearance, Flavor, Tiles};
+use pstr_core::metadata::{MetadataConfig, ProviderId, TitleNames};
+use pstr_core::prefs::{Colour, PlaybackPrefs, SubtitleBackdrop, SubtitleStyle};
+use pstr_player::LANGUAGES;
 
 use crate::app::Action;
-use crate::desktop_prefs::{CACHE_CHOICES, DesktopPrefs};
+use crate::desktop_prefs::{CACHE_CHOICES, DesktopPrefs, TEXT_SIZE_CHOICES};
 use crate::theme;
 use crate::ui;
+use crate::ui::widgets::Named;
 
 /// The settings that are a single value rather than a form.
 ///
@@ -19,9 +22,11 @@ use crate::ui;
 /// they are read-only, and passing them one by one is what pushed this
 /// function past the argument count anybody can read.
 #[derive(Debug, Clone, Copy)]
-pub struct Prefs {
+pub struct Prefs<'a> {
     pub autoplay: bool,
     pub auto_skip: bool,
+    /// The languages, read from here.
+    pub playback: &'a PlaybackPrefs,
     pub appearance: Appearance,
     pub desktop: DesktopPrefs,
     /// What the streaming cache holds, once the shares are open.
@@ -35,7 +40,7 @@ const COLUMN: f32 = 760.0;
 pub fn show(
     ui: &mut egui::Ui,
     settings: &mut MetadataConfig,
-    prefs: Prefs,
+    prefs: Prefs<'_>,
     api_key: &mut String,
     actions: &mut Vec<Action>,
 ) {
@@ -51,8 +56,9 @@ pub fn show(
                 ui.vertical(|ui| {
                     ui.set_width(width);
                     ui.add_space(theme::space::M);
-                    appearance_form(ui, prefs.appearance, actions);
+                    appearance_form(ui, prefs.appearance, prefs.desktop, actions);
                     playback_form(ui, prefs, actions);
+                    subtitle_form(ui, &prefs.playback.subtitle_style, actions);
                     storage_form(ui, prefs, actions);
                     metadata_form(ui, settings, api_key, actions);
                     about(ui);
@@ -66,7 +72,12 @@ pub fn show(
 /// Every control here repaints the whole window the moment it is clicked —
 /// there is no "apply" — because the preview *is* the app. A swatch row that
 /// only changed a small square would be asking someone to imagine the result.
-fn appearance_form(ui: &mut egui::Ui, appearance: Appearance, actions: &mut Vec<Action>) {
+fn appearance_form(
+    ui: &mut egui::Ui,
+    appearance: Appearance,
+    desktop: DesktopPrefs,
+    actions: &mut Vec<Action>,
+) {
     ui::widgets::settings_group(ui, "Appearance", None, |ui| {
         ui.add_space(theme::space::L);
         ui.label(theme::Role::Body.rich("Palette").color(theme::text()));
@@ -75,6 +86,7 @@ fn appearance_form(ui: &mut egui::Ui, appearance: Appearance, actions: &mut Vec<
         ui.horizontal_wrapped(|ui| {
             for flavor in Flavor::ALL {
                 if palette_card(ui, appearance, flavor)
+                    .named(flavor.label())
                     .on_hover_text(flavor.description())
                     .clicked()
                     && appearance.flavor != flavor
@@ -102,6 +114,62 @@ fn appearance_form(ui: &mut egui::Ui, appearance: Appearance, actions: &mut Vec<
             }
         });
 
+        ui::widgets::settings_row(
+            ui,
+            "Text size",
+            Some("Everything grows with it. Kept on this computer only."),
+            |ui| {
+                let choices: Vec<(u16, String)> = TEXT_SIZE_CHOICES
+                    .iter()
+                    .map(|&percent| (percent, format!("{percent}%")))
+                    .collect();
+                let labels: Vec<(u16, &str)> = choices
+                    .iter()
+                    .map(|(percent, label)| (*percent, label.as_str()))
+                    .collect();
+                if let Some(text_size) = ui::widgets::segmented(ui, desktop.text_size, &labels) {
+                    actions.push(Action::SetDesktopPrefs(DesktopPrefs {
+                        text_size,
+                        ..desktop
+                    }));
+                }
+            },
+        );
+        ui::widgets::settings_row(
+            ui,
+            "Library tiles",
+            Some("Covers, or 16:9 stills. Covers are the art every matched title has."),
+            |ui| {
+                let choices: Vec<(Tiles, &str)> = Tiles::ALL
+                    .iter()
+                    .map(|tiles| (*tiles, tiles.label()))
+                    .collect();
+                if let Some(tiles) = ui::widgets::segmented(ui, appearance.tiles, &choices) {
+                    actions.push(Action::SetAppearance(Appearance {
+                        tiles,
+                        ..appearance
+                    }));
+                }
+            },
+        );
+        ui::widgets::settings_row(
+            ui,
+            "Title names",
+            Some("The name a matched title goes by. Its other names still find it in search."),
+            |ui| {
+                let choices: Vec<(TitleNames, &str)> = TitleNames::ALL
+                    .iter()
+                    .map(|names| (*names, names.label()))
+                    .collect();
+                if let Some(names) = ui::widgets::segmented(ui, appearance.names, &choices) {
+                    actions.push(Action::SetAppearance(Appearance {
+                        names,
+                        ..appearance
+                    }));
+                }
+            },
+        );
+
         let mut gradients = appearance.gradients;
         ui::widgets::settings_row(
             ui,
@@ -230,22 +298,24 @@ fn swatch(ui: &mut egui::Ui, appearance: Appearance, accent: Accent) -> egui::Re
         }
     }
     response
-        .on_hover_text(accent.label())
+        .hint(accent.label())
         .on_hover_cursor(egui::CursorIcon::PointingHand)
 }
 
 /// The playback settings that are not per-file.
 ///
-/// Volume, audio language, subtitle language and speed are all set from the
-/// player itself, where a viewer can hear the result.
-fn playback_form(ui: &mut egui::Ui, prefs: Prefs, actions: &mut Vec<Action>) {
+/// Volume and speed are set from the player itself, where a viewer can hear
+/// the result. The languages are here as well as there: what a first episode
+/// opens with is decided before there is a player to choose from.
+fn playback_form(ui: &mut egui::Ui, prefs: Prefs<'_>, actions: &mut Vec<Action>) {
     ui::widgets::settings_group(
         ui,
         "Playback",
         Some(
-            "Volume, audio, subtitles and speed are set from the player, and remembered from there.",
+            "Volume and speed are set from the player. A language chosen in the player for one show is kept for that show.",
         ),
         |ui| {
+            languages(ui, prefs.playback, actions);
             let mut autoplay = prefs.autoplay;
             ui::widgets::settings_row(
                 ui,
@@ -287,8 +357,442 @@ fn playback_form(ui: &mut egui::Ui, prefs: Prefs, actions: &mut Vec<Action>) {
     );
 }
 
+/// The audio and subtitle languages every file opens with, until a show has a
+/// choice of its own.
+fn languages(ui: &mut egui::Ui, playback: &PlaybackPrefs, actions: &mut Vec<Action>) {
+    let name = |tag: &Option<String>| match tag {
+        Some(tag) => pstr_player::language_name(tag),
+        None => "The file's default".to_owned(),
+    };
+    let audio = playback.audio_language.clone();
+    ui::widgets::settings_row(
+        ui,
+        "Audio language",
+        Some("Played when a file has it."),
+        |ui| {
+            egui::ComboBox::from_id_salt("audio-language")
+                .selected_text(name(&audio))
+                .show_ui(ui, |ui| {
+                    for choice in
+                        std::iter::once(None).chain(LANGUAGES.map(|tag| Some(tag.to_owned())))
+                    {
+                        if ui
+                            .selectable_label(audio == choice, name(&choice))
+                            .clicked()
+                            && audio != choice
+                        {
+                            actions.push(Action::SetLanguages {
+                                audio: choice,
+                                subtitles: playback.subtitles,
+                                subtitle: playback.subtitle_language.clone(),
+                            });
+                        }
+                    }
+                });
+        },
+    );
+    // Off, the file's default, or a language: "off" is a decision of its
+    // own, which no language expresses.
+    let subtitle = playback
+        .subtitles
+        .then(|| playback.subtitle_language.clone());
+    let subtitle_name = |choice: &Option<Option<String>>| match choice {
+        None => "Off".to_owned(),
+        Some(tag) => name(tag),
+    };
+    ui::widgets::settings_row(
+        ui,
+        "Subtitles",
+        Some("Shown when a file has them in this language."),
+        |ui| {
+            egui::ComboBox::from_id_salt("subtitle-language")
+                .selected_text(subtitle_name(&subtitle))
+                .show_ui(ui, |ui| {
+                    let choices = [None, Some(None)]
+                        .into_iter()
+                        .chain(LANGUAGES.map(|tag| Some(Some(tag.to_owned()))));
+                    for choice in choices {
+                        if ui
+                            .selectable_label(subtitle == choice, subtitle_name(&choice))
+                            .clicked()
+                            && subtitle != choice
+                        {
+                            actions.push(Action::SetLanguages {
+                                audio: playback.audio_language.clone(),
+                                subtitles: choice.is_some(),
+                                subtitle: choice.flatten(),
+                            });
+                        }
+                    }
+                });
+        },
+    );
+}
+
+/// How subtitles look, with a sample line to judge it by.
+///
+/// Every change reaches a playing file as it is made, so the film itself is
+/// the other preview. A styled track takes none of it unless it is asked to;
+/// see [`SubtitleStyle`].
+fn subtitle_form(ui: &mut egui::Ui, style: &SubtitleStyle, actions: &mut Vec<Action>) {
+    ui::widgets::settings_group(
+        ui,
+        "Subtitles",
+        Some(
+            "Changes show on the playing video straight away. Plain subtitles (SRT) take all of this; styled ones (ASS) keep their own look unless you restyle them below.",
+        ),
+        |ui| {
+            let mut chosen = style.clone();
+            ui.add_space(theme::space::L);
+            subtitle_preview(ui, &chosen);
+            ui.add_space(theme::space::L);
+
+            ui::widgets::settings_row(ui, "Size", None, |ui| {
+                percent_slider(
+                    ui,
+                    &mut chosen.scale,
+                    SubtitleStyle::MIN_SCALE..=SubtitleStyle::MAX_SCALE,
+                );
+            });
+            ui::widgets::settings_row(
+                ui,
+                "Position",
+                Some("How far up the picture the line sits."),
+                |ui| subtitle_position_slider(ui, &mut chosen.position),
+            );
+            ui::widgets::settings_row(
+                ui,
+                "Font",
+                Some(if cfg!(target_os = "linux") {
+                    "Any font installed here."
+                } else {
+                    "Any font installed here. The sample above is drawn in the app's own font."
+                }),
+                |ui| {
+                    ui::widgets::toggle(ui, &mut chosen.italic, "Italic");
+                    ui::widgets::toggle(ui, &mut chosen.bold, "Bold");
+                    font_picker(ui, &mut chosen.font);
+                },
+            );
+            ui::widgets::settings_row(ui, "Text colour", None, |ui| {
+                colour_button(ui, &mut chosen.colour);
+            });
+            ui::widgets::settings_row(
+                ui,
+                "Background",
+                Some("A box reads on bright scenes; an outline hides less of the picture."),
+                |ui| {
+                    let choices =
+                        SubtitleBackdrop::ALL.map(|backdrop| (backdrop, backdrop.label()));
+                    if let Some(backdrop) = ui::widgets::segmented(ui, chosen.backdrop, &choices) {
+                        chosen.backdrop = backdrop;
+                    }
+                },
+            );
+            match chosen.backdrop {
+                SubtitleBackdrop::Outline => {
+                    ui::widgets::settings_row(ui, "Outline", None, |ui| {
+                        colour_button(ui, &mut chosen.outline_colour);
+                        ui.add(
+                            egui::Slider::new(
+                                &mut chosen.outline_size,
+                                0.0..=SubtitleStyle::MAX_OUTLINE,
+                            )
+                            .step_by(0.05)
+                            .fixed_decimals(1),
+                        );
+                    });
+                }
+                SubtitleBackdrop::Box => {
+                    ui::widgets::settings_row(
+                        ui,
+                        "Box colour",
+                        Some("Its opacity is how much of the picture shows through."),
+                        |ui| colour_button(ui, &mut chosen.box_colour),
+                    );
+                }
+            }
+            ui::widgets::settings_row(ui, "Shadow", Some("How far it falls. 0 is none."), |ui| {
+                colour_button(ui, &mut chosen.shadow_colour);
+                ui.add(
+                    egui::Slider::new(&mut chosen.shadow_offset, 0.0..=SubtitleStyle::MAX_SHADOW)
+                        .step_by(0.1)
+                        .fixed_decimals(1),
+                );
+            });
+            ui::widgets::settings_row(
+                ui,
+                "Blur",
+                Some("Softens the edges. Not shown in the sample."),
+                |ui| {
+                    ui.add(
+                        egui::Slider::new(&mut chosen.blur, 0.0..=SubtitleStyle::MAX_BLUR)
+                            .step_by(0.1)
+                            .fixed_decimals(1),
+                    );
+                },
+            );
+            ui::widgets::settings_row(
+                ui,
+                "Restyle styled subtitles",
+                Some(
+                    "Draw styled (ASS) dialogue in this style too, size and position included. Signs, songs and karaoke can come out wrong.",
+                ),
+                |ui| {
+                    ui::widgets::toggle(ui, &mut chosen.restyle_styled, "");
+                },
+            );
+            ui::widgets::settings_row(ui, "Reset", Some("Back to mpv's own look."), |ui| {
+                if ui
+                    .add_enabled(
+                        *style != SubtitleStyle::default(),
+                        egui::Button::new("Reset"),
+                    )
+                    .clicked()
+                {
+                    chosen = SubtitleStyle::default();
+                }
+            });
+
+            if chosen != *style {
+                actions.push(Action::SetSubtitleStyle(chosen.sanitized()));
+            }
+        },
+    );
+}
+
+/// A scale as a percentage slider, 100% being mpv's own size.
+pub(crate) fn percent_slider(
+    ui: &mut egui::Ui,
+    scale: &mut f64,
+    range: std::ops::RangeInclusive<f64>,
+) -> egui::Response {
+    let mut percent = *scale * 100.0;
+    let response = ui.add(
+        egui::Slider::new(&mut percent, range.start() * 100.0..=range.end() * 100.0)
+            .step_by(5.0)
+            .suffix("%")
+            .fixed_decimals(0),
+    );
+    *scale = percent / 100.0;
+    response
+}
+
+/// Where the line sits, 0 at the top of the picture and 100 at the bottom —
+/// shown the other way up, as height above the bottom edge, which is how
+/// anyone would describe moving subtitles up.
+pub(crate) fn subtitle_position_slider(ui: &mut egui::Ui, position: &mut f64) -> egui::Response {
+    let mut height = 100.0 - *position;
+    let response = ui.add(
+        egui::Slider::new(&mut height, 0.0..=90.0)
+            .step_by(1.0)
+            .suffix("% up")
+            .fixed_decimals(0),
+    );
+    *position = 100.0 - height;
+    response
+}
+
+/// A swatch that opens a colour wheel with an opacity slider.
+fn colour_button(ui: &mut egui::Ui, colour: &mut Colour) {
+    let [r, g, b, a] = colour.to_array();
+    let mut picked = egui::Color32::from_rgba_unmultiplied(r, g, b, a);
+    // The `Color32` form rather than `Hsva`, because egui remembers the hue
+    // behind it: rebuilt from RGB each frame, black and grey have none, and
+    // the wheel would snap back to red under the mouse.
+    let response = egui::color_picker::color_edit_button_srgba(
+        ui,
+        &mut picked,
+        egui::color_picker::Alpha::OnlyBlend,
+    );
+    // Only on a change: a round trip through premultiplied alpha can nudge
+    // an untouched colour by a step.
+    if response.changed() {
+        *colour = Colour::from(picked.to_srgba_unmultiplied());
+    }
+}
+
+/// The font: the installed families to pick from, and a box to type any name
+/// into — the only way on a system whose families the app cannot list.
+fn font_picker(ui: &mut egui::Ui, font: &mut Option<String>) {
+    let filter_id = egui::Id::new("subtitle-font-filter");
+    let mut filter: String = ui.data(|data| data.get_temp(filter_id)).unwrap_or_default();
+    let families = theme::font_families(ui.ctx());
+    egui::ComboBox::from_id_salt("subtitle-font")
+        .selected_text(font.as_deref().unwrap_or("Default"))
+        .width(200.0)
+        .height(320.0)
+        // Not on any click: the search box is clicked into.
+        .close_behavior(egui::PopupCloseBehavior::CloseOnClickOutside)
+        .show_ui(ui, |ui| {
+            ui.add(
+                egui::TextEdit::singleline(&mut filter)
+                    .hint_text("Search or type a font name")
+                    .desired_width(f32::INFINITY),
+            )
+            .request_focus();
+            let typed = filter.trim();
+            if ui.selectable_label(font.is_none(), "Default").clicked() {
+                *font = None;
+                ui.close();
+            }
+            let wanted = typed.to_lowercase();
+            let mut exact = false;
+            for family in families.unwrap_or_default() {
+                if !family.to_lowercase().contains(&wanted) {
+                    continue;
+                }
+                exact |= family.eq_ignore_ascii_case(typed);
+                let label = egui::RichText::new(family.as_str());
+                if ui
+                    .selectable_label(font.as_deref() == Some(family.as_str()), label)
+                    .clicked()
+                {
+                    *font = Some(family.clone());
+                    ui.close();
+                }
+            }
+            if families.is_none() {
+                ui.label(ui::muted("Reading the installed fonts…"));
+            }
+            if !typed.is_empty() && !exact && ui.button(format!("Use “{typed}”")).clicked() {
+                *font = Some(typed.to_owned());
+                ui.close();
+            }
+        });
+    ui.data_mut(|data| data.insert_temp(filter_id, filter));
+}
+
+/// A sample line, half on a bright sky and half on night, drawn in the
+/// chosen style — so whether it reads on both is visible before a film is.
+///
+/// An approximation. The font is the face fontconfig picks for the chosen one,
+/// as libass's is, but only on Linux; elsewhere, and while it loads, it is the
+/// app's own. A bold or italic the face lacks is made up, as libass does, and
+/// there is no blur. Proportions follow mpv's, where sizes are in pixels of a
+/// 38-pixel font.
+fn subtitle_preview(ui: &mut egui::Ui, style: &SubtitleStyle) {
+    const HEIGHT: f32 = 132.0;
+    /// mpv's `sub-font-size`, the unit every other size is relative to.
+    const MPV_FONT: f32 = 38.0;
+    let width = ui.available_width();
+    let (rect, _) = ui.allocate_exact_size(egui::vec2(width, HEIGHT), egui::Sense::hover());
+    let painter = ui.painter_at(rect);
+    let radius = egui::CornerRadius::same(theme::radius::MD);
+
+    // Sky above haze on the left, a night street on the right.
+    let half = egui::Rect::from_min_max(rect.min, egui::pos2(rect.center().x, rect.max.y));
+    let mut sky = egui::Mesh::default();
+    sky.colored_vertex(half.left_top(), egui::Color32::from_rgb(0x8E, 0xC5, 0xF0));
+    sky.colored_vertex(half.right_top(), egui::Color32::from_rgb(0xB8, 0xDC, 0xF8));
+    sky.colored_vertex(
+        half.right_bottom(),
+        egui::Color32::from_rgb(0xFA, 0xF7, 0xEE),
+    );
+    sky.colored_vertex(
+        half.left_bottom(),
+        egui::Color32::from_rgb(0xF2, 0xF0, 0xE8),
+    );
+    sky.add_triangle(0, 1, 2);
+    sky.add_triangle(0, 2, 3);
+    painter.rect_filled(rect, radius, egui::Color32::from_rgb(0x14, 0x16, 0x22));
+    painter.add(sky);
+
+    let font_px = 22.0 * style.scale as f32;
+    let unit = font_px / MPV_FONT;
+    let face = theme::subtitle_face(
+        ui.ctx(),
+        style.font.as_deref().unwrap_or(SubtitleStyle::DEFAULT_FONT),
+        style.bold,
+        style.italic,
+    );
+    let (family, made_up_bold, made_up_italic) = match face {
+        Some(face) => (
+            theme::subtitle_family(),
+            style.bold && !face.bold,
+            style.italic && !face.italic,
+        ),
+        None if style.bold => (theme::semibold(), false, style.italic),
+        None => (egui::FontFamily::Proportional, false, style.italic),
+    };
+    let job = egui::text::LayoutJob::single_section(
+        "Can you read this on both sides?".to_owned(),
+        egui::TextFormat {
+            font_id: egui::FontId::new(font_px, family),
+            color: egui::Color32::PLACEHOLDER,
+            italics: made_up_italic,
+            ..Default::default()
+        },
+    );
+    let galley = painter.layout_job(job);
+    let size = galley.size();
+    // Bottom of the line at `position` percent down, as mpv places it, kept
+    // inside the strip.
+    let margin = 8.0;
+    let bottom = rect.top() + HEIGHT * style.position as f32 / 100.0 - margin;
+    let top = bottom
+        .min(rect.bottom() - margin)
+        .max(rect.top() + margin + size.y)
+        - size.y;
+    let at = egui::pos2(rect.center().x - size.x / 2.0, top);
+    let colour = |colour: Colour| {
+        let [r, g, b, a] = colour.to_array();
+        egui::Color32::from_rgba_unmultiplied(r, g, b, a)
+    };
+
+    let shadow = style.shadow_offset as f32 * unit;
+    match style.backdrop {
+        SubtitleBackdrop::Box => {
+            let padding = 6.0 * unit;
+            let line = egui::Rect::from_min_size(at, size).expand(padding);
+            if shadow > 0.0 {
+                painter.rect_filled(
+                    line.translate(egui::vec2(shadow, shadow)),
+                    0.0,
+                    colour(style.shadow_colour),
+                );
+            }
+            painter.rect_filled(line, 0.0, colour(style.box_colour));
+        }
+        SubtitleBackdrop::Outline => {
+            let outline = style.outline_size as f32 * unit;
+            let rings = |offset: egui::Vec2, ink: egui::Color32| {
+                if outline <= 0.0 {
+                    painter.galley_with_override_text_color(at + offset, galley.clone(), ink);
+                    return;
+                }
+                for step in 0..8 {
+                    let angle = step as f32 * std::f32::consts::TAU / 8.0;
+                    let ring = egui::vec2(angle.cos(), angle.sin()) * outline;
+                    painter.galley_with_override_text_color(
+                        at + offset + ring,
+                        galley.clone(),
+                        ink,
+                    );
+                }
+            };
+            if shadow > 0.0 {
+                rings(egui::vec2(shadow, shadow), colour(style.shadow_colour));
+            }
+            if outline > 0.0 {
+                rings(egui::Vec2::ZERO, colour(style.outline_colour));
+            }
+        }
+    }
+    if made_up_bold {
+        // libass thickens a face with no bold by a stroke of its own colour.
+        let thicken = (font_px / 40.0).max(0.5);
+        painter.galley_with_override_text_color(
+            at + egui::vec2(thicken, 0.0),
+            galley.clone(),
+            colour(style.colour),
+        );
+    }
+    painter.galley_with_override_text_color(at, galley, colour(style.colour));
+}
+
 /// The streaming cache: how big it may get, and a way to empty it.
-fn storage_form(ui: &mut egui::Ui, prefs: Prefs, actions: &mut Vec<Action>) {
+fn storage_form(ui: &mut egui::Ui, prefs: Prefs<'_>, actions: &mut Vec<Action>) {
     ui::widgets::settings_group(
         ui,
         "Storage",
@@ -369,7 +873,9 @@ fn metadata_form(
             "A share filled by the Proton Drive desktop client carries no thumbnails, so \
                  without this every tile is a pair of initials. Turning it on sends the titles \
                  in your library — not your files, and nothing about what you have watched — to \
-                 the provider you choose, over HTTPS, each time a new one appears.",
+                 the provider you choose, over HTTPS, each time a new one appears. With AniList, \
+                 a title it has nothing for is then sent to TVmaze, and the ids AniList matched — \
+                 not the titles — go to ani.zip for episode names and wide artwork.",
         ));
         ui.add_space(theme::space::L);
 
@@ -383,7 +889,7 @@ fn metadata_form(
         if settings.enabled {
             ui.add_space(theme::space::L);
             ui.label(ui::muted("Provider"));
-            for provider in ProviderId::ALL {
+            for provider in ProviderId::CHOOSABLE {
                 if ui
                     .radio(settings.provider == provider, provider.label())
                     .on_hover_text(provider.description())
@@ -395,28 +901,35 @@ fn metadata_form(
                 }
             }
 
+            // TMDB's is the only key there is: the provider's with TMDB chosen,
+            // and with AniList, the art of films TVDB has none for.
+            ui.add_space(theme::space::L);
             if settings.provider.needs_api_key() {
-                ui.add_space(theme::space::L);
-                ui.label(ui::muted(format!("{} API key", settings.provider.label())));
-                ui.horizontal(|ui| {
-                    ui.add(
-                        egui::TextEdit::singleline(api_key)
-                            .password(true)
-                            .hint_text("v3 API key")
-                            .desired_width(300.0),
-                    );
-                    if ui.button("Save key").clicked() {
-                        actions.push(Action::SetApiKey {
-                            provider: settings.provider,
-                            key: std::mem::take(api_key),
-                        });
-                    }
-                });
+                ui.label(ui::muted("TMDB API key"));
+            } else {
                 ui.label(ui::muted(
-                    "Stored in your system keyring, never in a config file. Leave the box \
-                         empty and save to forget it.",
+                    "TMDB API key, optional. With one, films get TMDB's backdrops and logos, \
+                         asked for by the film's TMDB id alone.",
                 ));
             }
+            ui.horizontal(|ui| {
+                ui.add(
+                    egui::TextEdit::singleline(api_key)
+                        .password(true)
+                        .hint_text("v3 API key")
+                        .desired_width(300.0),
+                );
+                if ui.button("Save key").clicked() {
+                    actions.push(Action::SetApiKey {
+                        provider: ProviderId::Tmdb,
+                        key: std::mem::take(api_key),
+                    });
+                }
+            });
+            ui.label(ui::muted(
+                "Stored in your system keyring, never in a config file. Leave the box \
+                     empty and save to forget it.",
+            ));
 
             ui.add_space(theme::space::L);
             ui.horizontal(|ui| {

crates/pstr-app/src/ui/shares.rs

@@ -6,7 +6,10 @@
 //! below is the only place a link is ever visible, and only while it is being
 //! typed.
 
+use std::collections::HashMap;
+
 use pstr_core::Share;
+use pstr_core::catalog::CrawlRecord;
 use pstr_core::library::Library;
 
 use crate::app::{Action, ShareForm};
@@ -16,8 +19,10 @@ use crate::ui;
 pub fn show(
     ui: &mut egui::Ui,
     shares: &[Share],
+    crawls: &HashMap<String, CrawlRecord>,
     library: &Library,
     form: &mut ShareForm,
+    account: &mut ui::account::AccountPanel,
     actions: &mut Vec<Action>,
 ) {
     egui::ScrollArea::vertical()
@@ -35,15 +40,26 @@ pub fn show(
                     .iter()
                     .filter(|title| title.share_ids.contains(&share.id))
                     .count();
-                share_row(ui, share, titles, actions);
+                share_row(ui, share, titles, crawls.get(&share.id), form, actions);
             }
 
             ui.add_space(theme::space::XXL);
             add_form(ui, shares, form, actions);
+
+            ui.add_space(theme::space::XXL);
+            ui::account::section(ui, account, actions);
+            ui::account::browser(ui, account, shares, actions);
         });
 }
 
-fn share_row(ui: &mut egui::Ui, share: &Share, titles: usize, actions: &mut Vec<Action>) {
+fn share_row(
+    ui: &mut egui::Ui,
+    share: &Share,
+    titles: usize,
+    crawl: Option<&CrawlRecord>,
+    form: &mut ShareForm,
+    actions: &mut Vec<Action>,
+) {
     egui::Frame::new()
         .fill(theme::card())
         .corner_radius(egui::CornerRadius::same(theme::radius::MD))
@@ -56,10 +72,29 @@ fn share_row(ui: &mut egui::Ui, share: &Share, titles: usize, actions: &mut Vec<
                     // What is in it, rather than what it is called inside the
                     // app. The id is still a hover away for a bug report.
                     let mut detail = ui::library::plural(titles, "title");
+                    if share.folder.is_some() {
+                        detail.push_str("  ·  from your Drive");
+                    }
                     if share.has_custom_password {
                         detail.push_str("  ·  password protected");
                     }
+                    match crawl {
+                        Some(crawl) if crawl.crawled_at > 0 => {
+                            detail.push_str("  ·  crawled ");
+                            detail.push_str(&ui::ago(crawl.crawled_at, crate::engine::unix_now()));
+                        }
+                        _ => detail.push_str("  ·  not crawled yet"),
+                    }
                     ui.label(ui::muted(detail)).on_hover_text(&share.id);
+                    // Why the last look failed, until one succeeds: a link
+                    // revoked upstream otherwise just stops growing.
+                    if let Some(error) = crawl.and_then(|crawl| crawl.error.as_deref()) {
+                        ui.label(
+                            theme::Role::Caption
+                                .rich(format!("Last crawl failed: {error}"))
+                                .color(theme::danger()),
+                        );
+                    }
                 });
 
                 ui.with_layout(egui::Layout::right_to_left(egui::Align::Center), |ui| {
@@ -73,12 +108,121 @@ fn share_row(ui: &mut egui::Ui, share: &Share, titles: usize, actions: &mut Vec<
                     if ui.button("Crawl").clicked() {
                         actions.push(Action::Crawl(Some(share.id.clone())));
                     }
+                    if ui.button("Rename").clicked() {
+                        form.renaming = Some(share.id.clone());
+                        form.rename_to = share.name.clone();
+                    }
+                    // Not for a folder of the account, which has no link.
+                    if share.folder.is_none()
+                        && ui
+                            .button("Re-enter link")
+                            .on_hover_text(
+                                "For a keyring that lost the link, or a password that changed. \
+                                 The library, history and downloads stay.",
+                            )
+                            .clicked()
+                    {
+                        form.repairing = Some(share.id.clone());
+                        form.repair_url.clear();
+                        form.repair_password.clear();
+                    }
                 });
             });
+            if form.repairing.as_deref() == Some(share.id.as_str()) {
+                repair_form(ui, share, form, actions);
+            }
+            if form.renaming.as_deref() == Some(share.id.as_str()) {
+                rename_form(ui, share, form, actions);
+            }
         });
     ui.add_space(theme::space::S);
 }
 
+/// A new name for a share, in its own row. Enter saves, as everywhere else.
+fn rename_form(ui: &mut egui::Ui, share: &Share, form: &mut ShareForm, actions: &mut Vec<Action>) {
+    ui.add_space(theme::space::M);
+    ui.horizontal(|ui| {
+        let field = ui.add(
+            egui::TextEdit::singleline(&mut form.rename_to)
+                .hint_text("Name")
+                .desired_width(320.0),
+        );
+        let ready = !form.rename_to.trim().is_empty();
+        let entered = field.lost_focus() && ui_enter_pressed(ui.ctx());
+        if ui
+            .add_enabled_ui(ready, |ui| ui::accent_button(ui, "Save"))
+            .inner
+            .clicked()
+            || (ready && entered)
+        {
+            actions.push(Action::RenameShare {
+                id: share.id.clone(),
+                name: form.rename_to.trim().to_owned(),
+            });
+        }
+        if ui.button("Cancel").clicked() {
+            form.renaming = None;
+        }
+    });
+}
+
+/// The same link again, and a password if it has one, for a share already in
+/// the library.
+fn repair_form(ui: &mut egui::Ui, share: &Share, form: &mut ShareForm, actions: &mut Vec<Action>) {
+    ui.add_space(theme::space::M);
+    ui.add(
+        egui::TextEdit::singleline(&mut form.repair_url)
+            .password(true)
+            .hint_text("The share link, including everything after the #")
+            .desired_width(f32::INFINITY),
+    );
+    ui.add_space(theme::space::S);
+    ui.add(
+        egui::TextEdit::singleline(&mut form.repair_password)
+            .password(true)
+            .hint_text("Link password, if it has one")
+            .desired_width(f32::INFINITY),
+    );
+    ui.add_space(theme::space::S);
+    let problem = (!form.repair_url.trim().is_empty())
+        .then(|| pstr_core::shares::share_token(form.repair_url.trim()).err())
+        .flatten();
+    if let Some(problem) = &problem {
+        ui.label(
+            theme::Role::Caption
+                .rich(problem.to_string())
+                .color(theme::danger()),
+        );
+    }
+    ui.horizontal(|ui| {
+        let ready = !form.repair_url.trim().is_empty() && problem.is_none();
+        if ui
+            .add_enabled_ui(ready, |ui| ui::accent_button(ui, "Save"))
+            .inner
+            .clicked()
+        {
+            actions.push(Action::RepairShare {
+                id: share.id.clone(),
+                url: form.repair_url.trim().to_owned(),
+                password: Some(form.repair_password.clone())
+                    .filter(|password| !password.is_empty()),
+            });
+        }
+        if ui.button("Cancel").clicked() {
+            form.repairing = None;
+        }
+    });
+}
+
+/// The add form's link field, which the library's empty state focuses.
+pub fn link_field_id() -> egui::Id {
+    egui::Id::new("share-link")
+}
+
+fn ui_enter_pressed(ctx: &egui::Context) -> bool {
+    ctx.input(|input| input.key_pressed(egui::Key::Enter))
+}
+
 fn add_form(ui: &mut egui::Ui, shares: &[Share], form: &mut ShareForm, actions: &mut Vec<Action>) {
     ui::section(ui, "Add a share");
     ui.label(ui::muted(
@@ -94,24 +238,28 @@ fn add_form(ui: &mut egui::Ui, shares: &[Share], form: &mut ShareForm, actions:
         .show(ui, |ui| {
             ui.set_width(ui.available_width().min(640.0));
 
-            ui.label(ui::muted("Name"));
-            ui.add(
-                egui::TextEdit::singleline(&mut form.name)
-                    .hint_text("Anime")
-                    .desired_width(f32::INFINITY),
-            );
-            ui.add_space(theme::space::M);
+            // Enter in any field of the form submits it, as the sign-in
+            // form's do.
+            let mut entered = false;
+            let mut submitted_from = |response: egui::Response| {
+                entered |= response.lost_focus() && ui_enter_pressed(&response.ctx);
+            };
 
             ui.label(ui::muted("Link"));
             ui.horizontal(|ui| {
                 let paste = 60.0;
-                let field = egui::Id::new("share-link");
-                ui.add(
-                    egui::TextEdit::singleline(&mut form.url)
-                        .id(field)
-                        .password(true)
-                        .hint_text("https://drive.proton.me/urls/…#…")
-                        .desired_width(ui.available_width() - paste),
+                let field = link_field_id();
+                if std::mem::take(&mut form.focus) {
+                    ui.memory_mut(|memory| memory.request_focus(field));
+                }
+                submitted_from(
+                    ui.add(
+                        egui::TextEdit::singleline(&mut form.url)
+                            .id(field)
+                            .password(true)
+                            .hint_text("https://drive.proton.me/urls/…#…")
+                            .desired_width(ui.available_width() - paste),
+                    ),
                 );
                 // The link is masked, so pasting is the only sensible way in —
                 // and a button says that more plainly than the field does.
@@ -136,20 +284,31 @@ fn add_form(ui: &mut egui::Ui, shares: &[Share], form: &mut ShareForm, actions:
             }
             ui.add_space(theme::space::M);
 
+            ui.label(ui::muted("Name (optional)"));
+            submitted_from(
+                ui.add(
+                    egui::TextEdit::singleline(&mut form.name)
+                        .hint_text("The shared folder's own name")
+                        .desired_width(f32::INFINITY),
+                ),
+            );
+            ui.add_space(theme::space::M);
+
             ui::widgets::toggle(ui, &mut form.has_password, "The link asks for a password");
             if form.has_password {
                 ui.add_space(theme::space::S);
-                ui.add(
-                    egui::TextEdit::singleline(&mut form.password)
-                        .password(true)
-                        .hint_text("Link password")
-                        .desired_width(f32::INFINITY),
+                submitted_from(
+                    ui.add(
+                        egui::TextEdit::singleline(&mut form.password)
+                            .password(true)
+                            .hint_text("Link password")
+                            .desired_width(f32::INFINITY),
+                    ),
                 );
             }
 
             ui.add_space(theme::space::L);
-            let ready = !form.name.trim().is_empty()
-                && !form.url.trim().is_empty()
+            let ready = !form.url.trim().is_empty()
                 && problem.is_none()
                 && (!form.has_password || !form.password.is_empty())
                 && !form.sending;
@@ -159,11 +318,11 @@ fn add_form(ui: &mut egui::Ui, shares: &[Share], form: &mut ShareForm, actions:
                 ui.add_space(theme::space::S);
             }
             ui.horizontal(|ui| {
-                if ui
-                    .add_enabled_ui(ready, |ui| ui::accent_button(ui, "Add and crawl"))
+                let clicked = ui
+                    .add_enabled_ui(ready, |ui| ui::accent_button(ui, "Add share"))
                     .inner
-                    .clicked()
-                {
+                    .clicked();
+                if clicked || (ready && entered) {
                     actions.push(Action::AddShare {
                         name: form.name.trim().to_string(),
                         url: form.url.trim().to_string(),
@@ -176,8 +335,8 @@ fn add_form(ui: &mut egui::Ui, shares: &[Share], form: &mut ShareForm, actions:
                 if form.sending {
                     ui.add(egui::Spinner::new().size(14.0));
                     ui.label(ui::muted("adding…"));
-                } else if form.name.trim().is_empty() || form.url.trim().is_empty() {
-                    ui.label(ui::muted("A name and a link are needed."));
+                } else if form.url.trim().is_empty() {
+                    ui.label(ui::muted("Paste a share link to add it."));
                 }
             });
         });
@@ -211,6 +370,7 @@ mod tests {
             name: "anime".into(),
             token: token.into(),
             has_custom_password: false,
+            folder: None,
         }
     }
 

crates/pstr-app/src/ui/shortcuts.rs

@@ -36,9 +36,13 @@ const GROUPS: &[(&str, &[(&str, &str)])] = &[
             ("N  /  P", "Next and previous episode"),
             ("[  /  ]", "Slower and faster"),
             ("S", "Skip the opening or the credits"),
+            ("Z  /  X", "Subtitles 0.1 s earlier and later"),
             ("E", "The list of episodes"),
             ("F  or  double-click", "Fullscreen"),
-            ("Esc", "Leave fullscreen, then the player"),
+            (
+                "Esc",
+                "Close a panel, leave fullscreen, then leave the player",
+            ),
         ],
     ),
 ];

crates/pstr-app/src/ui/title.rs

@@ -8,6 +8,7 @@ use crate::app::{Action, Page};
 use crate::engine::{DownloadItem, DownloadKey, DownloadState};
 use crate::playback::PlaybackTarget;
 use crate::theme;
+use crate::ui::widgets::Named;
 use crate::ui::{self, Art, Card};
 
 pub struct OfflineView<'a> {
@@ -15,14 +16,29 @@ pub struct OfflineView<'a> {
     pub files: &'a std::collections::HashSet<DownloadKey>,
 }
 
+/// Where the title stands beyond its own files.
+pub struct Context<'a> {
+    /// The keys of its whole franchise in release order, if it has one.
+    pub franchise: Option<&'a [String]>,
+    /// The keys of the titles most like it, best first.
+    pub similar: &'a [String],
+    pub on_list: bool,
+}
+
 pub fn show(
     ui: &mut egui::Ui,
     art: &mut Art<'_>,
     library: &Library,
     key: &str,
+    context: Context<'_>,
     offline: OfflineView<'_>,
     actions: &mut Vec<Action>,
 ) {
+    let Context {
+        franchise,
+        similar,
+        on_list,
+    } = context;
     let Some(title) = library.get(key) else {
         // The catalog was replaced under the page — a recrawl that dropped this
         // title. Nothing to show, so go back rather than draw an empty shell.
@@ -30,7 +46,7 @@ pub fn show(
         return;
     };
 
-    if back_link(ui).clicked() {
+    if back_link(ui, "Library").clicked() {
         actions.push(Action::Goto(Page::Library));
     }
     ui.add_space(theme::space::S);
@@ -38,9 +54,25 @@ pub fn show(
     egui::ScrollArea::vertical()
         .auto_shrink([false, false])
         .show(ui, |ui| {
-            header(ui, art, title, &offline, actions);
+            header(ui, art, title, on_list, &offline, actions);
             ui.add_space(theme::space::XL);
 
+            if let Some(keys) = franchise {
+                let members: Vec<&Title> = keys.iter().filter_map(|key| library.get(key)).collect();
+                if members.len() > 1 {
+                    ui::section(ui, "In this franchise");
+                    cover_row(
+                        ui,
+                        art,
+                        ("franchise", &title.key),
+                        Some(title),
+                        &members,
+                        actions,
+                    );
+                    ui.add_space(theme::space::XL);
+                }
+            }
+
             // One season at a time, picked from a row of pills, rather than
             // every season stacked as a collapsing header: a four-season show
             // was a page of headers to scroll past to reach the one being
@@ -74,7 +106,27 @@ pub fn show(
                         .enumerate()
                         .map(|(index, label)| (index, label.as_str()))
                         .collect();
-                    if let Some(index) = ui::widgets::segmented(ui, picked, &choices) {
+                    // A long-running show's row of pills ran off the page;
+                    // past a handful it is a list to pick from instead.
+                    let chosen = if choices.len() > SEASON_PILLS {
+                        egui::ComboBox::from_id_salt(("season-list", &title.key))
+                            .selected_text(labels[picked].as_str())
+                            .height(360.0)
+                            .show_ui(ui, |ui| {
+                                let mut chosen = None;
+                                for &(index, label) in &choices {
+                                    if ui.selectable_label(index == picked, label).clicked() {
+                                        chosen = Some(index);
+                                    }
+                                }
+                                chosen
+                            })
+                            .inner
+                            .flatten()
+                    } else {
+                        ui::widgets::segmented(ui, picked, &choices)
+                    };
+                    if let Some(index) = chosen {
                         picked = index;
                         ui.data_mut(|data| data.insert_temp(picked_id, index));
                     }
@@ -86,6 +138,7 @@ pub fn show(
                 )));
                 ui.with_layout(egui::Layout::right_to_left(egui::Align::Center), |ui| {
                     season_download(ui, title, season, &offline, actions);
+                    season_watched(ui, title, season, actions);
                 });
             });
             ui.add_space(theme::space::L);
@@ -97,9 +150,175 @@ pub fn show(
                 episode_row(ui, art, title, season, episode, &offline, actions);
             }
             ui.add_space(theme::space::L);
+
+            let cast = art
+                .metadata
+                .get(&title.key)
+                .and_then(|record| record.metadata.as_ref())
+                .and_then(|found| found.details.as_ref())
+                .map(|details| details.cast.clone())
+                .unwrap_or_default();
+            if !cast.is_empty() {
+                ui.add_space(theme::space::L);
+                ui::section(ui, "Cast");
+                cast_row(ui, art, &title.key, &cast, actions);
+                ui.add_space(theme::space::L);
+            }
+
+            // Under the episodes rather than over them: it is where to go
+            // once this one is done, not what the page is for.
+            let similar: Vec<&Title> = similar.iter().filter_map(|key| library.get(key)).collect();
+            if !similar.is_empty() {
+                ui.add_space(theme::space::L);
+                ui::section(ui, "More like this");
+                cover_row(ui, art, ("similar", &title.key), None, &similar, actions);
+                ui.add_space(theme::space::L);
+            }
         });
 }
 
+/// The characters, each a round portrait over their name and who voices
+/// them. A voice actor opens every title in the library they are in.
+fn cast_row(
+    ui: &mut egui::Ui,
+    art: &mut Art<'_>,
+    key: &str,
+    cast: &[pstr_core::metadata::CastMember],
+    actions: &mut Vec<Action>,
+) {
+    const SIZE: f32 = 88.0;
+    ui::shelf(ui, ("cast", key), |ui| {
+        ui.horizontal_top(|ui| {
+            ui.spacing_mut().item_spacing.x = theme::space::L;
+            for (i, member) in cast.iter().enumerate() {
+                let tile = ui.allocate_ui(egui::vec2(SIZE + 16.0, SIZE + 52.0), |ui| {
+                    ui.vertical_centered(|ui| {
+                        let (rect, _) =
+                            ui.allocate_exact_size(egui::vec2(SIZE, SIZE), egui::Sense::hover());
+                        let picture = member
+                            .character_image
+                            .as_deref()
+                            .or(member.actor_image.as_deref())
+                            .and_then(|url| art.picture(url));
+                        let painter = ui.painter();
+                        match picture {
+                            Some(texture) => {
+                                let shape = egui::epaint::RectShape::filled(
+                                    rect,
+                                    egui::CornerRadius::same((SIZE / 2.0) as u8),
+                                    egui::Color32::WHITE,
+                                )
+                                .with_texture(
+                                    texture.id(),
+                                    super::cover_uv(texture.size_vec2(), rect.size()),
+                                );
+                                painter.add(shape);
+                            }
+                            None => {
+                                painter.circle_filled(rect.center(), SIZE / 2.0, theme::card());
+                            }
+                        }
+                        ui.add(
+                            egui::Label::new(
+                                theme::Role::Caption
+                                    .rich(&member.character)
+                                    .color(theme::text()),
+                            )
+                            .truncate()
+                            .selectable(false),
+                        );
+                        if let Some(actor) = &member.actor {
+                            ui.add(
+                                egui::Label::new(ui::muted(actor))
+                                    .truncate()
+                                    .selectable(false),
+                            );
+                        }
+                        rect
+                    })
+                    .inner
+                });
+                // The whole tile opens the actor's page, names included, not only the portrait.
+                let Some(actor) = &member.actor else { continue };
+                let response = ui
+                    .interact(
+                        tile.response.rect,
+                        ui.id().with(("cast", i)),
+                        egui::Sense::click(),
+                    )
+                    .on_hover_cursor(egui::CursorIcon::PointingHand)
+                    .on_hover_text(format!("Everything in the library with {actor}"));
+                if response.hovered() {
+                    ui.painter().circle_stroke(
+                        tile.inner.center(),
+                        SIZE / 2.0,
+                        egui::Stroke::new(2.0, theme::accent()),
+                    );
+                }
+                if response.clicked() {
+                    actions.push(Action::Goto(Page::Browse {
+                        facet: pstr_core::discover::Facet::Person(actor.clone()),
+                        from: Some(key.to_owned()),
+                    }));
+                }
+            }
+        });
+    });
+}
+
+/// A row of covers: every title of the franchise in release order, with
+/// `current` marked rather than left out, so the row says where it sits in
+/// the story — or, with no `current`, the titles like this one.
+fn cover_row(
+    ui: &mut egui::Ui,
+    art: &mut Art<'_>,
+    id: impl std::hash::Hash + std::fmt::Debug,
+    current: Option<&Title>,
+    members: &[&Title],
+    actions: &mut Vec<Action>,
+) {
+    ui::shelf(ui, id, |ui| {
+        ui.horizontal(|ui| {
+            ui.spacing_mut().item_spacing.x = theme::CARD_GAP;
+            for member in members {
+                let here = current.is_some_and(|current| member.key == current.key);
+                let picture = art.poster(member);
+                let found = art
+                    .metadata
+                    .get(&member.key)
+                    .and_then(|record| record.metadata.as_ref());
+                let what = found
+                    .and_then(|found| found.details.as_ref())
+                    .and_then(|details| details.format_label())
+                    .unwrap_or(match member.kind {
+                        TitleKind::Series => "Series",
+                        TitleKind::Film => "Film",
+                    });
+                let year = found
+                    .and_then(|found| found.year)
+                    .or(member.year)
+                    .map(|year| format!("  ·  {year}"))
+                    .unwrap_or_default();
+                let response = ui::card(
+                    ui,
+                    Card {
+                        art: picture,
+                        name: art.name(member),
+                        subtitle: format!("{what}{year}"),
+                        progress: member.resume().and_then(|e| e.progress()).map(|v| v as f32),
+                        badge: here.then(|| "Here".to_owned()),
+                        width: 128.0,
+                        aspect: theme::POSTER_ASPECT,
+                    },
+                );
+                if !here && response.clicked() {
+                    actions.push(Action::Goto(Page::Title(member.key.clone())));
+                }
+            }
+        });
+    });
+}
+
 /// A title's poster, at the poster's own shape, with how far into it the
 /// viewer is along its foot.
 fn poster(ui: &mut egui::Ui, texture: &egui::TextureHandle, progress: Option<f64>) {
@@ -126,9 +345,10 @@ fn poster(ui: &mut egui::Ui, texture: &egui::TextureHandle, progress: Option<f64
 }
 
 /// "← Library", as a link rather than a button: it is navigation, and a
-/// filled button beside the page's real actions competed with them.
-fn back_link(ui: &mut egui::Ui) -> egui::Response {
-    let text = theme::Role::Label.rich(format!("{}  Library", egui_phosphor::regular::ARROW_LEFT));
+/// filled button beside the page's real actions competed with them. `to`
+/// names where it goes.
+pub(crate) fn back_link(ui: &mut egui::Ui, to: &str) -> egui::Response {
+    let text = theme::Role::Label.rich(format!("{}  {to}", egui_phosphor::regular::ARROW_LEFT));
     let response = ui.add(egui::Label::new(text.color(theme::muted())).sense(egui::Sense::click()));
     if response.hovered() {
         ui.painter().hline(
@@ -143,6 +363,29 @@ fn back_link(ui: &mut egui::Ui) -> egui::Response {
 }
 
 /// Download, or delete, a whole season.
+/// Mark a whole season seen, or unseen once it all is — for someone who
+/// watched it elsewhere and joins the show here.
+fn season_watched(ui: &mut egui::Ui, title: &Title, season: &Season, actions: &mut Vec<Action>) {
+    let all = season.episodes.iter().all(|episode| episode.is_watched());
+    let label = if all {
+        "Mark season unwatched"
+    } else {
+        "Mark season watched"
+    };
+    if ui::tonal_button(ui, label).clicked() {
+        actions.push(Action::MarkEpisodes {
+            key: title.key.clone(),
+            links: season
+                .episodes
+                .iter()
+                .map(|e| (e.node.share_id.clone(), e.node.link_id.clone()))
+                .collect(),
+            watched: !all,
+            what: format!("{} {}", title.name, season.label()),
+        });
+    }
+}
+
 fn season_download(
     ui: &mut egui::Ui,
     title: &Title,
@@ -158,9 +401,10 @@ fn season_download(
             .on_hover_text("Delete the offline copies; keep the online source")
             .clicked()
         {
-            for key in season_keys {
-                actions.push(Action::RemoveDownload(key, false));
-            }
+            actions.push(Action::DeleteOffline(
+                season_keys,
+                format!("{} {}", title.name, season.label()),
+            ));
         }
     } else if ui
         .button("Download season")
@@ -182,6 +426,7 @@ fn header(
     ui: &mut egui::Ui,
     art: &mut Art<'_>,
     title: &Title,
+    on_list: bool,
     offline: &OfflineView<'_>,
     actions: &mut Vec<Action>,
 ) {
@@ -190,16 +435,19 @@ fn header(
     let record = art.metadata.get(&title.key);
     let found = record.and_then(|record| record.metadata.clone());
     let by_hand = record.is_some_and(|record| record.manual);
-    // Asked for once and used twice: the same picture is the poster beside the
-    // text and the banner behind all of it.
-    let picture = art.of(title);
+    // The cover beside the text, and the widest, largest picture there is
+    // behind all of it — two textures, because the band is drawn across the
+    // whole window and a tile-sized one stretched that far is soft.
+    let picture = art.poster(title);
+    let wide = art.wide(title);
 
     // Reserved before the header is laid out, because the band is as tall as
     // whatever the header comes to — a fixed height would clip a long overview
     // on one title and leave a gap under a short one on the next.
-    let backdrop = picture
+    let backdrop = wide
         .as_ref()
         .map(|(texture, _)| (texture.clone(), ui.painter().add(egui::Shape::Noop)));
+    let shown = art.name(title).to_owned();
 
     ui.add_space(theme::space::S);
     ui.horizontal_top(|ui| {
@@ -214,11 +462,12 @@ fn header(
                     ui,
                     Card {
                         art: picture,
-                        name: &title.name,
+                        name: &shown,
                         subtitle: String::new(),
                         progress: title.resume().and_then(|e| e.progress()).map(|v| v as f32),
                         badge: None,
                         width: theme::CARD_WIDTH,
+                        aspect: theme::CARD_ASPECT,
                     },
                 );
             }
@@ -229,21 +478,55 @@ fn header(
             // Text in a column a person can read, with the picture to the
             // right of it rather than under it.
             ui.set_max_width(ui.available_width().min(820.0));
-            ui.label(theme::Role::Display.rich(&title.name).strong());
-            // The provider's name for it, when it is not the one the files use.
-            // Worth showing rather than replacing the filename's: a viewer
-            // should be able to tell what the match actually matched.
-            if let Some(found) = &found
-                && found.name != title.name
-            {
+            if ui::logo_heading(ui, art, title, 120.0).is_none() {
+                ui.label(theme::Role::Hero.rich(&shown).color(theme::text()));
+            }
+            // Whichever of the share's name and the provider's is not the one
+            // shown. Worth showing rather than only replacing: a viewer should
+            // be able to tell what the match actually matched, and find the
+            // folder it came from.
+            let other = found
+                .as_ref()
+                .map(|found| {
+                    if shown == found.name {
+                        title.name.clone()
+                    } else {
+                        found.name.clone()
+                    }
+                })
+                .filter(|other| *other != shown);
+            if let Some(other) = other {
                 ui.label(ui::muted(format!(
-                    "also known as {}{}",
-                    found.name,
+                    "also known as {other}{}",
                     if by_hand { " (chosen by hand)" } else { "" }
                 )));
             }
             ui.add_space(theme::space::XS);
             ui.label(ui::muted(meta_line(title, found.as_ref())));
+            // What the files are, rather than what the title is: set apart
+            // from the line above as small outlined marks, the way a box
+            // prints them.
+            //
+            // After where the title stands, which is the one fact here that
+            // changes week to week.
+            let quality = title.quality().badges();
+            let status = found
+                .as_ref()
+                .and_then(|found| found.details.as_ref())
+                .and_then(|details| status_text(details, now()));
+            if !quality.is_empty() || status.is_some() {
+                ui.add_space(theme::space::XS);
+                ui.horizontal(|ui| {
+                    ui.spacing_mut().item_spacing.x = theme::space::XS;
+                    if let Some((text, live)) = &status {
+                        ui::widgets::status_chip(ui, text, *live);
+                        ui.add_space(theme::space::XS);
+                    }
+                    for badge in quality {
+                        ui::widgets::spec_badge(ui, badge);
+                    }
+                });
+            }
             ui.add_space(theme::space::L);
 
             ui.horizontal(|ui| {
@@ -270,8 +553,7 @@ fn header(
                     }
                     // Beside the button it is the alternative to.
                     if resuming
-                        && ui
-                            .button("Start over")
+                        && ui::tonal_button(ui, "Start over")
                             .on_hover_text("Play from the beginning")
                             .clicked()
                     {
@@ -281,20 +563,17 @@ fn header(
                             None,
                         )));
                     }
+                    ui::list_button(ui, &title.key, on_list, actions);
                     let title_keys: Vec<_> = title.episodes().map(key_of).collect();
                     let all_offline = title_keys.iter().all(|key| offline.files.contains(key));
                     if all_offline {
-                        if ui
-                            .button("Delete show")
+                        if ui::tonal_button(ui, "Delete show")
                             .on_hover_text("Delete the offline copies; keep the online source")
                             .clicked()
                         {
-                            for key in title_keys {
-                                actions.push(Action::RemoveDownload(key, false));
-                            }
+                            actions.push(Action::DeleteOffline(title_keys, title.name.clone()));
                         }
-                    } else if ui
-                        .button("Download show")
+                    } else if ui::tonal_button(ui, "Download show")
                         .on_hover_text("Download every episode for disconnected playback")
                         .clicked()
                     {
@@ -329,13 +608,15 @@ fn header(
                 // wrongly. Offered whether or not anything matched: the two
                 // cases it exists for are a title with no poster at all and a
                 // title wearing someone else's.
-                if ui
-                    .button(match &found {
+                if ui::tonal_button(
+                    ui,
+                    match &found {
                         Some(_) => "Change match",
                         None => "Match…",
-                    })
-                    .on_hover_text("Search the metadata provider and pick the entry yourself")
-                    .clicked()
+                    },
+                )
+                .on_hover_text("Search the metadata provider and pick the entry yourself")
+                .clicked()
                 {
                     actions.push(Action::OpenMatcher(title.key.clone()));
                 }
@@ -343,14 +624,14 @@ fn header(
 
             if let Some(found) = &found {
                 ui.add_space(theme::space::L);
-                description(ui, found);
+                description(ui, found, &title.key, actions);
             }
         });
     });
 
     if let Some((texture, index)) = backdrop {
         ui.add_space(theme::space::L);
-        band(ui, &texture, index);
+        band(ui, &texture, index, art.mood(title));
     }
 }
 
@@ -364,10 +645,15 @@ fn header(
 /// page colour so text laid over it stays readable whatever the still happens to
 /// be, and a fade into the page along the bottom so the band ends rather than
 /// stops.
-fn band(ui: &mut egui::Ui, texture: &egui::TextureHandle, index: egui::layers::ShapeIdx) {
+fn band(
+    ui: &mut egui::Ui,
+    texture: &egui::TextureHandle,
+    index: egui::layers::ShapeIdx,
+    mood: Option<egui::Color32>,
+) {
     // Full width of the window, not of the content: the panel's own margin is
     // what the band has to reach past, or it reads as a picture in a box.
-    const BLEED: f32 = 18.0;
+    const BLEED: f32 = super::PAGE_MARGIN.x;
     let content = ui.min_rect();
     let rect = egui::Rect::from_min_max(
         egui::pos2(ui.max_rect().left() - BLEED, content.top()),
@@ -401,7 +687,12 @@ fn band(ui: &mut egui::Ui, texture: &egui::TextureHandle, index: egui::layers::S
     //
     // Heavier still when there is no fade coming, since then these are the only
     // things standing between the text and the picture.
+    //
+    // Both in the page colour tinted by the picture's own, so each title's
+    // page carries its light; the fade at the bottom stays the page's, since
+    // that is what it ends in.
     let ramps = theme::ramps_on();
+    let veil = theme::mood_veil(mood);
     layers.push(
         egui::epaint::RectShape::filled(
             rect,
@@ -409,7 +700,7 @@ fn band(ui: &mut egui::Ui, texture: &egui::TextureHandle, index: egui::layers::S
             // Lighter with the ramps on: the horizontal one below is solid
             // where the text is, so this coat only has to calm the picture's
             // right side, not make it disappear.
-            theme::background().gamma_multiply(if ramps { 0.72 } else { 0.94 }),
+            veil.gamma_multiply(if ramps { 0.72 } else { 0.94 }),
         )
         .into(),
     );
@@ -421,7 +712,7 @@ fn band(ui: &mut egui::Ui, texture: &egui::TextureHandle, index: egui::layers::S
         layers.push(theme::fade_shape(
             ui.ctx(),
             text_side,
-            theme::background(),
+            veil,
             theme::Direction::Horizontal,
             // Solid at the left, where the poster and the text are.
             false,
@@ -448,12 +739,68 @@ fn band(ui: &mut egui::Ui, texture: &egui::TextureHandle, index: egui::layers::S
 }
 
 /// What the provider had to say. Only ever drawn under a match.
-fn description(ui: &mut egui::Ui, found: &TitleMetadata) {
-    if !found.genres.is_empty() {
+///
+/// Its genres, studios and director are chips that open every title in the
+/// library sharing them.
+fn description(ui: &mut egui::Ui, found: &TitleMetadata, key: &str, actions: &mut Vec<Action>) {
+    use pstr_core::discover::Facet;
+    let browse = |facet: Facet| {
+        Action::Goto(Page::Browse {
+            facet,
+            from: Some(key.to_owned()),
+        })
+    };
+    let details = found.details.as_ref();
+    let tags = details
+        .map(|details| details.tags.as_slice())
+        .unwrap_or_default();
+    if !found.genres.is_empty() || !tags.is_empty() {
         ui.horizontal_wrapped(|ui| {
             ui.spacing_mut().item_spacing.x = 6.0;
             for genre in &found.genres {
-                ui::widgets::chip(ui, genre);
+                if ui::widgets::link_chip(ui, genre)
+                    .on_hover_text(format!("Every {genre} title"))
+                    .clicked()
+                {
+                    actions.push(browse(Facet::Genre(genre.clone())));
+                }
+            }
+            // After the genres and quieter than them: a tag is the
+            // provider's community describing it, not what it is filed as.
+            for tag in tags.iter().take(5) {
+                ui.label(ui::muted(tag));
+            }
+        });
+        ui.add_space(theme::space::M);
+    }
+    // Who made it, out of the grey line and onto chips, so the names lead
+    // somewhere.
+    let studios = details
+        .map(|details| &details.studios[..details.studios.len().min(2)])
+        .unwrap_or_default();
+    let directors = details
+        .map(|details| &details.directors[..details.directors.len().min(1)])
+        .unwrap_or_default();
+    if !studios.is_empty() || !directors.is_empty() {
+        ui.horizontal_wrapped(|ui| {
+            ui.spacing_mut().item_spacing.x = 6.0;
+            for (label, names, facet) in [
+                ("Studio", studios, Facet::Studio as fn(String) -> Facet),
+                ("Director", directors, Facet::Person),
+            ] {
+                if names.is_empty() {
+                    continue;
+                }
+                ui.label(ui::muted(label));
+                for name in names {
+                    if ui::widgets::link_chip(ui, name)
+                        .on_hover_text(format!("Everything in the library by {name}"))
+                        .clicked()
+                    {
+                        actions.push(browse(facet(name.clone())));
+                    }
+                }
+                ui.add_space(theme::space::S);
             }
         });
         ui.add_space(theme::space::M);
@@ -495,12 +842,28 @@ fn description(ui: &mut egui::Ui, found: &TitleMetadata) {
             }
         }
     }
-    if let Some(url) = &found.url {
+    let trailer = details
+        .and_then(|details| details.trailer.as_ref())
+        .and_then(|trailer| trailer.url());
+    if found.url.is_some() || trailer.is_some() {
         ui.add_space(theme::space::M);
-        ui.hyperlink_to(
-            ui::muted(format!("More on {}", found.provider.label())),
-            url,
-        );
+        ui.horizontal(|ui| {
+            // In the browser: the app itself never requests the trailer.
+            if let Some(trailer) = &trailer {
+                ui.hyperlink_to(
+                    ui::muted(format!("{}  Trailer", egui_phosphor::regular::FILM_STRIP)),
+                    trailer,
+                )
+                .on_hover_text("Opens in your browser");
+                ui.add_space(theme::space::L);
+            }
+            if let Some(url) = &found.url {
+                ui.hyperlink_to(
+                    ui::muted(format!("More on {}", found.provider.label())),
+                    url,
+                );
+            }
+        });
     }
 }
 
@@ -519,6 +882,15 @@ fn meta_line(title: &Title, found: Option<&TitleMetadata>) -> String {
     if let Some(year) = title.year {
         parts.push(year.to_string());
     }
+    // A film's running time is what it costs to start it. A series' is its
+    // episodes', which each row says.
+    if title.kind == TitleKind::Film
+        && let Some(minutes) = found
+            .and_then(|found| found.details.as_ref())
+            .and_then(|details| details.runtime)
+    {
+        parts.push(ui::format_runtime(minutes));
+    }
     if title.kind == TitleKind::Series {
         if title.seasons.len() > 1 {
             parts.push(ui::library::plural(title.seasons.len(), "season"));
@@ -530,6 +902,12 @@ fn meta_line(title: &Title, found: Option<&TitleMetadata>) -> String {
         parts.push(format!("{watched} watched"));
     }
 
+    if let Some(season) = found
+        .and_then(|found| found.details.as_ref())
+        .and_then(|details| details.season_label())
+    {
+        parts.push(season);
+    }
     if let Some(found) = found {
         if let Some(rating) = found.rating {
             parts.push(format!("{} {rating:.1}", egui_phosphor::regular::STAR));
@@ -547,6 +925,37 @@ fn meta_line(title: &Title, found: Option<&TitleMetadata>) -> String {
     parts.join("  ·  ")
 }
 
+/// The most seasons picked from a row of pills; past it, a list.
+const SEASON_PILLS: usize = 5;
+
+/// Unix seconds, now.
+fn now() -> i64 {
+    std::time::SystemTime::now()
+        .duration_since(std::time::UNIX_EPOCH)
+        .map_or(0, |since| since.as_secs() as i64)
+}
+
+/// What the status chip says — `Airing · episode 8 Sat 1 Nov, 14:00`,
+/// `Finished` — and whether more is coming.
+fn status_text(details: &pstr_core::metadata::TitleDetails, now: i64) -> Option<(String, bool)> {
+    let next = details.next_airing(now);
+    let label = details.status_label().or(next.map(|_| "Airing"))?;
+    let live = next.is_some() || details.is_airing();
+    Some(match next {
+        Some((episode, at)) => {
+            let when = chrono::DateTime::from_timestamp(at, 0)
+                .map(|at| {
+                    at.with_timezone(&chrono::Local)
+                        .format("%a %-d %b, %H:%M")
+                        .to_string()
+                })
+                .unwrap_or_default();
+            (format!("{label}  ·  episode {episode} {when}"), live)
+        }
+        None => (label.to_owned(), live),
+    })
+}
+
 /// How big an episode's still is drawn.
 const STILL: egui::Vec2 = egui::vec2(160.0, 90.0);
 
@@ -567,6 +976,7 @@ fn episode_row(
             found.name.clone(),
             found.overview.clone(),
             found.air_date.clone(),
+            found.runtime,
         )
     });
     let watched = episode.is_watched();
@@ -598,14 +1008,17 @@ fn episode_row(
                     .unwrap_or_default();
                 let name = found
                     .as_ref()
-                    .and_then(|(name, _, _)| name.clone())
+                    .and_then(|(name, ..)| name.clone())
                     .unwrap_or_else(|| episode.detail().to_string());
                 let mut job = egui::text::LayoutJob::default();
                 if !numbering.is_empty() {
                     job.append(
                         &format!("{numbering}   "),
                         0.0,
-                        egui::TextFormat::simple(egui::FontId::monospace(13.0), theme::muted()),
+                        egui::TextFormat::simple(
+                            egui::FontId::new(theme::Role::Label.size(), theme::semibold()),
+                            theme::muted(),
+                        ),
                     );
                 }
                 job.append(
@@ -628,9 +1041,10 @@ fn episode_row(
                 ui.label(ui::muted(details(
                     episode,
                     found.as_ref().and_then(|f| f.2.as_deref()),
+                    found.as_ref().and_then(|f| f.3),
                 )));
 
-                if let Some((_, Some(overview), _)) = &found {
+                if let Some((_, Some(overview), ..)) = &found {
                     let mut job = egui::text::LayoutJob::simple(
                         overview.clone(),
                         theme::Role::Caption.font(),
@@ -650,14 +1064,33 @@ fn episode_row(
             let cluster = egui::vec2(ui.available_width(), STILL.y);
             let layout = egui::Layout::right_to_left(egui::Align::Center);
             ui.allocate_ui_with_layout(cluster, layout, |ui| {
-                if ui::widgets::watched_mark(ui, watched)
-                    .on_hover_text(if watched {
-                        "Mark unwatched"
-                    } else {
-                        "Mark watched"
-                    })
-                    .clicked()
-                {
+                let mark = ui::widgets::watched_mark(ui, watched).on_hover_text(if watched {
+                    "Mark unwatched. Right-click for more."
+                } else {
+                    "Mark watched. Right-click for more."
+                });
+                // Joining a show partway is the usual reason to mark
+                // anything, and one tick per earlier episode is a chore.
+                mark.context_menu(|ui| {
+                    if ui.button("Mark watched up to here").clicked() {
+                        let links = title
+                            .episodes()
+                            .take(
+                                title
+                                    .position_of(&episode.node.share_id, &episode.node.link_id)
+                                    .map_or(0, |at| at + 1),
+                            )
+                            .map(|e| (e.node.share_id.clone(), e.node.link_id.clone()))
+                            .collect();
+                        actions.push(Action::MarkEpisodes {
+                            key: title.key.clone(),
+                            links,
+                            watched: true,
+                            what: format!("{} up to {}", title.name, episode.label()),
+                        });
+                    }
+                });
+                if mark.clicked() {
                     actions.push(Action::SetWatched {
                         share_id: episode.node.share_id.clone(),
                         link_id: episode.node.link_id.clone(),
@@ -683,9 +1116,9 @@ fn episode_row(
     ui.add_space(theme::space::XXS);
 }
 
-/// The grey line under an episode's name: when it aired, how big it is, and
-/// where it would resume.
-fn details(episode: &Episode, air_date: Option<&str>) -> String {
+/// The grey line under an episode's name: when it aired, how long it runs,
+/// how big it is, and where it would resume.
+fn details(episode: &Episode, air_date: Option<&str>, runtime: Option<u32>) -> String {
     let mut parts = Vec::new();
     if let Some(at) = episode.resume_at() {
         let left = episode
@@ -700,6 +1133,9 @@ fn details(episode: &Episode, air_date: Option<&str>) -> String {
     if let Some(date) = air_date {
         parts.push(date.to_owned());
     }
+    if let Some(minutes) = runtime {
+        parts.push(ui::format_runtime(minutes));
+    }
     match episode.node.size {
         // A file the share says is empty is one that will not play — an upload
         // that never finished, usually. Worth saying on the row rather than
@@ -726,6 +1162,7 @@ pub(crate) fn still(
     actions: &mut Vec<Action>,
 ) {
     let (rect, response) = ui.allocate_exact_size(size, egui::Sense::click());
+    let response = response.named(format!("Play {}", episode.label()));
     if !ui.is_rect_visible(rect) {
         return;
     }
@@ -734,12 +1171,20 @@ pub(crate) fn still(
     painter.rect_filled(rect, radius, theme::card_hover());
     // Asked for only once the row is on screen: a season of twenty-five is
     // twenty-five requests, and most of them are never scrolled to.
-    if let Some(texture) = art.still(&title.key, episode) {
+    let texture = art.still(&title.key, episode);
+    // Faded in like a tile's art, so a season's stills settle rather than pop.
+    let art_in = ui.ctx().animate_bool_with_time(
+        response.id.with("art"),
+        texture.is_some(),
+        theme::motion::ARRIVE,
+    );
+    if let Some(texture) = texture {
         let tint = if watched {
             egui::Color32::from_gray(150)
         } else {
             egui::Color32::WHITE
-        };
+        }
+        .gamma_multiply(art_in);
         painter.add(
             egui::epaint::RectShape::filled(rect, radius, tint)
                 .with_texture(texture.id(), ui::cover_uv(texture.size_vec2(), rect.size())),
@@ -800,6 +1245,21 @@ pub(crate) fn still(
         theme::accent_fill(&painter, played, radius, 0.0);
     }
 
+    // Seen, said on the picture as well as by the mark at the row's end: a
+    // season is scanned by its stills, and a dimmed one alone read as one that
+    // had not loaded.
+    if watched {
+        let corner = rect.right_top() + egui::vec2(-14.0, 14.0);
+        painter.circle_filled(corner, 9.0, theme::accent());
+        painter.text(
+            corner,
+            egui::Align2::CENTER_CENTER,
+            egui_phosphor::regular::CHECK,
+            theme::Role::Micro.font(),
+            theme::on_accent(),
+        );
+    }
+
     if response
         .on_hover_cursor(egui::CursorIcon::PointingHand)
         .on_hover_text(if episode.resume_at().is_some() {
@@ -831,7 +1291,7 @@ fn download(
             .on_hover_text("Available offline. Click to delete the copy; the share keeps the file.")
             .clicked()
         {
-            actions.push(Action::RemoveDownload(key, false));
+            actions.push(Action::DeleteOffline(vec![key], episode.label()));
         }
         return;
     }
@@ -883,3 +1343,36 @@ fn key_of(episode: &Episode) -> DownloadKey {
         link_id: episode.node.link_id.clone(),
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn details(status: &str, next: Option<(u32, i64)>) -> pstr_core::metadata::TitleDetails {
+        pstr_core::metadata::TitleDetails {
+            status: Some(status.to_owned()),
+            next_episode: next.map(|(episode, _)| episode),
+            next_airing_at: next.map(|(_, at)| at),
+            ..Default::default()
+        }
+    }
+
+    #[test]
+    fn the_status_chip_says_when_the_next_episode_airs_and_only_while_it_is_ahead() {
+        let (text, live) = status_text(&details("RELEASING", Some((8, 2_000))), 1_000).unwrap();
+        assert!(text.starts_with("Airing  ·  episode 8 "), "{text}");
+        assert!(live);
+        // Fetched a while ago: the date has passed, so it says nothing of it.
+        let (text, live) = status_text(&details("RELEASING", Some((8, 500))), 1_000).unwrap();
+        assert_eq!(text, "Airing");
+        assert!(live);
+        assert_eq!(
+            status_text(&details("FINISHED", None), 1_000),
+            Some(("Finished".to_owned(), false))
+        );
+        assert_eq!(
+            status_text(&pstr_core::metadata::TitleDetails::default(), 0),
+            None
+        );
+    }
+}

crates/pstr-app/src/ui/toast.rs

@@ -9,6 +9,7 @@ use egui::{Align2, Color32, CornerRadius, Sense, Stroke, Vec2};
 
 use crate::app::Action;
 use crate::theme;
+use crate::ui::widgets::Named;
 
 /// How long a message stays up.
 const SECONDS: f64 = 5.0;
@@ -52,6 +53,17 @@ impl Toasts {
         self.push_inner(now, text.into(), false, Some((label, action)));
     }
 
+    /// An error with a button on it — "Retry".
+    pub fn push_error_with(
+        &mut self,
+        now: f64,
+        text: impl Into<String>,
+        label: &'static str,
+        action: Action,
+    ) {
+        self.push_inner(now, text.into(), true, Some((label, action)));
+    }
+
     fn push_inner(
         &mut self,
         now: f64,
@@ -203,7 +215,7 @@ fn card(ui: &mut egui::Ui, toast: &Toast) -> Pressed {
                     [c + Vec2::new(-d, d), c + Vec2::new(d, -d)],
                     Stroke::new(1.5, ink),
                 );
-                if response.on_hover_text("Dismiss").clicked() {
+                if response.hint("Dismiss").clicked() {
                     pressed = Pressed::Close;
                 }
                 if let Some((label, _)) = &toast.action {

crates/pstr-app/src/ui/transport.rs

@@ -11,12 +11,15 @@
 //! and neither mutates: this module draws.
 
 use egui::{Color32, CornerRadius, Rect, Sense, Stroke, Vec2, pos2};
+use pstr_core::prefs::SubtitleStyle;
 use pstr_player::{MAX_VOLUME, Track, TrackKind};
 
 use crate::app::{Action, Adjacent, Page};
 use crate::playback::{Command, Playback};
 use crate::theme;
 use crate::ui;
+use crate::ui::player::{PlayerPanel, SleepChoice};
+use crate::ui::widgets::Named;
 
 /// Height of the clickable seek bar. Comfortably larger than the few pixels it
 /// draws, because a seek bar you have to aim at is a seek bar nobody uses.
@@ -40,6 +43,9 @@ const ROW_HEIGHT_FULL: f32 = 44.0;
 /// The same, for the library strip. See [`ROW_HEIGHT_FULL`].
 const ROW_HEIGHT_MINI: f32 = 34.0;
 
+/// The speeds on offer, and the steps `[` and `]` walk.
+pub const SPEEDS: [f64; 8] = [0.5, 0.75, 1.0, 1.25, 1.5, 1.75, 2.0, 3.0];
+
 /// Whether there is a file before and after this one in the same title.
 #[derive(Debug, Clone, Copy, Default)]
 pub struct Neighbours {
@@ -52,6 +58,8 @@ pub fn full(
     ui: &mut egui::Ui,
     playback: &Playback,
     neighbours: Neighbours,
+    panel: Option<PlayerPanel>,
+    sleep: Option<SleepChoice>,
     actions: &mut Vec<Action>,
 ) {
     seek_bar(ui, playback, actions, 6.0);
@@ -97,13 +105,11 @@ pub fn full(
             }));
         }
 
-        // Right cluster: everything that is a choice rather than a move.
+        // Right cluster: everything that is a choice rather than a move. Each
+        // opens its panel down the right of the picture rather than a menu
+        // under the pointer: a list of twelve chapters is read, not aimed at.
         ui.with_layout(egui::Layout::right_to_left(egui::Align::Center), |ui| {
-            track_menus(ui, playback, actions);
-            ui.add_space(theme::space::M);
-            speed_menu(ui, playback, actions);
-            ui.add_space(theme::space::M);
-            chapter_menu(ui, playback, actions);
+            panel_buttons(ui, playback, panel, sleep, actions);
             ui.add_space(theme::space::M);
             volume(ui, playback, actions);
         });
@@ -163,7 +169,7 @@ pub fn mini(
                         egui::StrokeKind::Inside,
                     );
                 }
-                if response.on_hover_text("Show the picture again").clicked() {
+                if response.hint("Show the picture again").clicked() {
                     actions.push(Action::Goto(Page::Player));
                 }
             }
@@ -313,7 +319,7 @@ fn play_pause(ui: &mut egui::Ui, playback: &Playback, actions: &mut Vec<Action>,
     }
 
     if response
-        .on_hover_text(if playback.paused {
+        .hint(if playback.paused {
             "Play (Space)"
         } else {
             "Pause (Space)"
@@ -354,7 +360,7 @@ fn step_button(
         enabled,
         egui::Button::new(theme::Role::Subhead.rich(label)).min_size(Vec2::new(38.0, 30.0)),
     );
-    if response.on_hover_text(hover).clicked() {
+    if response.hint(hover).clicked() {
         push(actions);
     }
 }
@@ -436,7 +442,7 @@ fn volume(ui: &mut egui::Ui, playback: &Playback, actions: &mut Vec<Action>) {
     };
     if ui
         .button(theme::Role::Subhead.rich(icon))
-        .on_hover_text(format!("Mute (M) — {:.0}%", playback.volume))
+        .hint(format!("Mute (M) — {:.0}%", playback.volume))
         .clicked()
     {
         actions.push(Action::ToggleMute);
@@ -469,6 +475,8 @@ fn track_menus(ui: &mut egui::Ui, playback: &Playback, actions: &mut Vec<Action>
             }
             ui.separator();
             track_options(ui, &subtitles, TrackKind::Subtitle, actions);
+            ui.separator();
+            subtitle_adjustments(ui, playback, actions);
         })
         .response
         .on_hover_text("Subtitle track");
@@ -488,6 +496,49 @@ fn track_menus(ui: &mut egui::Ui, playback: &Playback, actions: &mut Vec<Action>
     }
 }
 
+/// What is worth changing mid-episode without a trip to Settings: the size and
+/// place of the line, and its timing for a release that is out of step.
+pub fn subtitle_adjustments(ui: &mut egui::Ui, playback: &Playback, actions: &mut Vec<Action>) {
+    let mut style = playback.subtitle_style.clone();
+    egui::Grid::new("subtitle-adjustments")
+        .num_columns(2)
+        .spacing([theme::space::M, theme::space::S])
+        .show(ui, |ui| {
+            ui.label("Size");
+            ui::settings::percent_slider(
+                ui,
+                &mut style.scale,
+                SubtitleStyle::MIN_SCALE..=SubtitleStyle::MAX_SCALE,
+            );
+            ui.end_row();
+
+            ui.label("Position");
+            ui::settings::subtitle_position_slider(ui, &mut style.position);
+            ui.end_row();
+
+            ui.label("Delay");
+            ui.horizontal(|ui| {
+                if ui.button("−").on_hover_text("Earlier (Z)").clicked() {
+                    actions.push(Action::NudgeSubtitleDelay(-0.1));
+                }
+                ui.label(ui::format_delay(playback.subtitle_delay));
+                if ui.button("+").on_hover_text("Later (X)").clicked() {
+                    actions.push(Action::NudgeSubtitleDelay(0.1));
+                }
+                if ui
+                    .add_enabled(playback.subtitle_delay != 0.0, egui::Button::new("Reset"))
+                    .clicked()
+                {
+                    actions.push(Action::ResetSubtitleDelay);
+                }
+            });
+            ui.end_row();
+        });
+    if style != playback.subtitle_style {
+        actions.push(Action::SetSubtitleStyle(style.sanitized()));
+    }
+}
+
 fn track_options(ui: &mut egui::Ui, tracks: &[&Track], kind: TrackKind, actions: &mut Vec<Action>) {
     for track in tracks {
         if ui.selectable_label(track.selected, track.label()).clicked() {
@@ -500,53 +551,73 @@ fn track_options(ui: &mut egui::Ui, tracks: &[&Track], kind: TrackKind, actions:
     }
 }
 
-/// How fast it plays. Says so on the button only when it is not normal speed,
-/// because that is the one case worth noticing at a glance.
-fn speed_menu(ui: &mut egui::Ui, playback: &Playback, actions: &mut Vec<Action>) {
-    let label = if (playback.speed - 1.0).abs() < 1e-6 {
-        "Speed".to_owned()
-    } else {
-        format!("Speed · {}", ui::format_speed(playback.speed))
+/// The buttons that open the player's panels, right to left: tracks, speed,
+/// chapters, sleep. Each shows only when there is a choice to make, and says
+/// what is chosen when that is worth noticing at a glance.
+fn panel_buttons(
+    ui: &mut egui::Ui,
+    playback: &Playback,
+    open: Option<PlayerPanel>,
+    sleep: Option<SleepChoice>,
+    actions: &mut Vec<Action>,
+) {
+    let mut button = |ui: &mut egui::Ui, panel: PlayerPanel, text: String, hint: &str| {
+        let response = if open == Some(panel) {
+            ui::accent_button(ui, &text)
+        } else {
+            ui::glass_button(ui, &text)
+        };
+        if response.on_hover_text(hint).clicked() {
+            actions.push(Action::TogglePanel(panel));
+        }
+        ui.add_space(theme::space::S);
     };
-    ui.menu_button(label, |ui| {
-        for speed in [0.5, 0.75, 1.0, 1.25, 1.5, 1.75, 2.0] {
-            if ui
-                .selectable_label(
-                    (playback.speed - speed).abs() < 1e-6,
-                    ui::format_speed(speed),
-                )
-                .clicked()
-            {
-                actions.push(Action::SetSpeed(speed));
-                ui.close();
-            }
-        }
-    })
-    .response
-    .on_hover_text("Playback speed ([ and ])");
-}
 
-/// Jump to a chapter. Only drawn for a file that has more than one, which for
-/// most releases means anime and not much else.
-fn chapter_menu(ui: &mut egui::Ui, playback: &Playback, actions: &mut Vec<Action>) {
-    if playback.chapters.len() < 2 {
-        return;
+    let subtitles = playback.tracks_of(TrackKind::Subtitle).count();
+    let audio = playback.tracks_of(TrackKind::Audio).count();
+    if subtitles > 0 || audio > 1 {
+        let shown = match playback.selected_track(TrackKind::Subtitle) {
+            Some(track) => short(track),
+            None if subtitles > 0 => "Off".to_owned(),
+            None => playback
+                .selected_track(TrackKind::Audio)
+                .map(short)
+                .unwrap_or_default(),
+        };
+        button(
+            ui,
+            PlayerPanel::Tracks,
+            format!("{}  {shown}", egui_phosphor::regular::SUBTITLES),
+            "Audio and subtitles",
+        );
     }
-    let current = playback.chapter().map(|chapter| chapter.index);
-    ui.menu_button("Chapters", |ui| {
-        for chapter in &playback.chapters {
-            let label = format!("{}   {}", ui::format_time(chapter.start), chapter.label());
-            if ui
-                .selectable_label(current == Some(chapter.index), label)
-                .clicked()
-            {
-                actions.push(Action::Player(Command::SeekTo(chapter.start)));
-                ui.close();
-            }
-        }
-    })
-    .response
-    .on_hover_text("Chapters");
+    let speed = if (playback.speed - 1.0).abs() < 1e-6 {
+        egui_phosphor::regular::GAUGE.to_owned()
+    } else {
+        format!(
+            "{}  {}",
+            egui_phosphor::regular::GAUGE,
+            ui::format_speed(playback.speed)
+        )
+    };
+    button(ui, PlayerPanel::Speed, speed, "Playback speed ([ and ])");
+    // Only for a file with more than one, which for most releases means anime
+    // and not much else.
+    if playback.chapters.len() > 1 {
+        button(
+            ui,
+            PlayerPanel::Chapters,
+            egui_phosphor::regular::LIST_NUMBERS.to_owned(),
+            "Chapters",
+        );
+    }
+    let moon = egui_phosphor::regular::MOON;
+    let sleep = match sleep {
+        None => moon.to_owned(),
+        Some(SleepChoice::EndOfEpisode) => format!("{moon}  End"),
+        Some(SleepChoice::Minutes(left)) => format!("{moon}  {left} min"),
+    };
+    button(ui, PlayerPanel::Sleep, sleep, "Sleep timer");
 }
 
 /// A track in as few words as fit on a button: what distinguishes it from the
@@ -566,6 +637,13 @@ fn seek_bar(ui: &mut egui::Ui, playback: &Playback, actions: &mut Vec<Action>, t
     let width = ui.available_width();
     let (rect, response) =
         ui.allocate_exact_size(Vec2::new(width, SEEK_HIT_HEIGHT), Sense::click_and_drag());
+    response.widget_info(|| {
+        egui::WidgetInfo::slider(
+            playback.duration.is_some(),
+            playback.position,
+            format!("Position, {}", ui::format_time(playback.position)),
+        )
+    });
 
     let active = response.hovered() || response.dragged();
     // Grows rather than jumps when the pointer arrives.