chore(release): bump version to 1.7.0

fix(app): the subtitle preview is drawn in the chosen font
The preview drew every font in the app's own Inter, so picking one changed nothing on screen. On Linux it now asks fontconfig for the face libass would use — the family with the weight and slant wanted, or fontconfig's fallback when it is not installed — loads it on a thread of its own and draws the sample in it. A bold or italic the face lacks is made up, as libass does. Windows and macOS have no fc-match and keep the app's font, as the hint there still says. The CJK fallback and the subtitle face are now both kept, so installing one no longer drops the other.
2026-11-04 16:57:00 +01:00 · 2026-10-28 02:43:25 +01:00 · 2026-10-27 23:08:43 +01:00 · 2026-10-27 22:44:35 +01:00 · 2026-10-27 22:25:53 +01:00 · 2026-10-27 19:50:26 +01:00
169 changed files with 26372 additions and 1577 deletions
@@ -23,11 +23,11 @@ jobs:

      - uses: Swatinem/rust-cache@v2.9.1

-      # libmpv for pstr-player.
-      - name: Install libmpv
+      # libmpv for pstr-player, WebKitGTK for the CAPTCHA window.
+      - name: Install libmpv and WebKitGTK
        run: |
          sudo apt-get update
-          sudo apt-get install -y libmpv-dev
+          sudo apt-get install -y libmpv-dev libwebkit2gtk-4.1-dev

      - run: cargo fmt --all -- --check

@@ -0,0 +1,71 @@
+name: iOS
+
+on:
+  push:
+    branches: [main]
+  workflow_call:
+  pull_request:
+    paths:
+      - 'ios/**'
+      - 'android/app/src/main/res/font/**'
+      - 'android/app/src/main/assets/licenses/**'
+      - 'crates/pstr-android/**'
+      - 'crates/pstr-core/**'
+      - 'crates/pstr-meta/**'
+      - 'crates/pstr-stream/**'
+      - 'Cargo.toml'
+      - 'Cargo.lock'
+      - 'scripts/build-ios.sh'
+      - '.github/workflows/ios.yml'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+env:
+  CARGO_TERM_COLOR: always
+
+jobs:
+  build:
+    name: Unit tests and unsigned .ipa
+    runs-on: macos-15
+    steps:
+      - uses: actions/checkout@v7
+
+      - id: toolchain
+        uses: dtolnay/rust-toolchain@stable
+        with:
+          toolchain: '1.96'
+          targets: aarch64-apple-ios,aarch64-apple-ios-sim
+
+      - name: Restore the Rust target tree
+        uses: actions/cache@v6
+        with:
+          path: |
+            ~/.cargo/registry
+            ~/.cargo/git
+            target
+          key: rust-target-ios-${{ steps.toolchain.outputs.cachekey }}-${{ hashFiles('Cargo.lock') }}
+          restore-keys: rust-target-ios-${{ steps.toolchain.outputs.cachekey }}-
+
+      - name: Install XcodeGen
+        run: brew install xcodegen
+
+      - name: Bindings
+        run: scripts/build-ios.sh bindings
+
+      - name: Unit tests on the simulator
+        run: scripts/build-ios.sh test
+
+      # SideStore and AltStore re-sign whatever they install with the viewer's
+      # own Apple ID, so the release artifact is unsigned.
+      - name: Unsigned .ipa
+        run: |
+          scripts/build-ios.sh rust
+          scripts/build-ios.sh ipa
+
+      - uses: actions/upload-artifact@v7
+        with:
+          name: ios
+          path: dist/*.ipa
+          if-no-files-found: error
@@ -76,7 +76,7 @@ jobs:
      - name: Install build dependencies
        run: |
          sudo apt-get update
-          sudo apt-get install -y libmpv-dev rpm
+          sudo apt-get install -y libmpv-dev libwebkit2gtk-4.1-dev rpm

      - name: Gate
        run: |
@@ -150,10 +150,17 @@ jobs:
      signed_release: true
    secrets: inherit

+  # The unsigned .ipa: SideStore and AltStore re-sign it with the viewer's own
+  # Apple ID when they install it.
+  ios:
+    name: iOS
+    needs: verify
+    uses: ./.github/workflows/ios.yml
+
  publish:
    name: Publish
    if: startsWith(github.ref, 'refs/tags/')
-    needs: [linux, windows, android]
+    needs: [linux, windows, android, ios]
    runs-on: ubuntu-24.04
    permissions:
      contents: write
@@ -172,6 +179,10 @@ jobs:
        with:
          name: android
          path: artifacts
+      - uses: actions/download-artifact@v8
+        with:
+          name: ios
+          path: artifacts

      - name: Checksums
        run: |
@@ -0,0 +1,68 @@
+name: Wiki
+
+# docs/ is the source of the GitHub wiki. Every change to the documentation
+# checks its links; a push to main publishes the result, so the wiki follows
+# main. Pull requests only check: nothing unmerged reaches the wiki. Run it from
+# the Actions tab to publish another ref, such as a release tag.
+on:
+  push:
+    branches: [main]
+    paths:
+      - 'docs/**'
+      - 'images/**'
+      - 'README.md'
+      - 'scripts/publish-wiki.sh'
+      - '.github/workflows/wiki.yml'
+  pull_request:
+    paths:
+      - 'docs/**'
+      - 'images/**'
+      - 'README.md'
+      - 'scripts/publish-wiki.sh'
+      - '.github/workflows/wiki.yml'
+  workflow_dispatch:
+    inputs:
+      ref:
+        description: 'Tag or branch to publish'
+        required: false
+        default: 'main'
+        type: string
+
+permissions:
+  contents: read
+
+jobs:
+  check:
+    name: Check documentation links
+    runs-on: ubuntu-24.04
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          ref: ${{ inputs.ref || github.sha }}
+
+      - name: Check links
+        run: scripts/publish-wiki.sh --check "$RUNNER_TEMP"
+
+  publish:
+    name: Publish to the wiki
+    needs: check
+    # Pull requests never publish.
+    if: github.event_name != 'pull_request'
+    runs-on: ubuntu-24.04
+    concurrency:
+      group: wiki-publish
+      cancel-in-progress: false
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          ref: ${{ inputs.ref || github.sha }}
+
+      - name: Publish
+        env:
+          WIKI_REMOTE: https://x-access-token:${{ github.token }}@github.com/${{ github.repository }}.wiki.git
+        run: |
+          git config --global user.name 'github-actions[bot]'
+          git config --global user.email '41898282+github-actions[bot]@users.noreply.github.com'
+          scripts/publish-wiki.sh --push "$RUNNER_TEMP"
@@ -11,7 +11,7 @@ members = [
 ]

 [workspace.package]
-version = "1.1.3"
+version = "1.7.0"
 edition = "2024"
 license = "MIT"
 repository = "https://github.com/narrrl/proton-stream"
@@ -28,8 +28,8 @@ authors = ["Nils Pukropp <contact@narl.io>"]
 opt-level = 2

 [workspace.dependencies]
-proton-sdk = { version = "0.7.2" }
-proton-drive-rs = { version = "0.7.2" }
+proton-sdk = { version = "0.9.0" }
+proton-drive-rs = { version = "0.9.0" }

 # Internal crates.
 pstr-core = { path = "crates/pstr-core" }
@@ -54,6 +54,8 @@ directories = "5"
 # Local dates for the history page. Already in the tree through the SDK.
 chrono = { version = "0.4", default-features = false, features = ["clock"] }
 sha2 = "0.10"
+# The id a watch-history file is named by. Already in the tree through the SDK.
+getrandom = "0.3"
 # `bundled` so a Windows build needs no system SQLite.
 rusqlite = { version = "0.32", features = ["bundled"] }
 # The share URL fragment and the custom password are both secrets; they go in
@@ -71,8 +73,10 @@ keyring = { version = "3" }
 clap = { version = "4", features = ["derive"] }
 # The UI. `glow` rather than `wgpu` because step two of the player hands mpv an
 # `MPV_RENDER_API_TYPE_OPENGL` context, and that has to be the same context
-# eframe is drawing into.
+# eframe is drawing into. `accesskit` hands the widget tree to the platform's
+# screen reader (AT-SPI, UI Automation, NSAccessibility).
 eframe = { version = "0.35", default-features = false, features = [
+    "accesskit",
    "default_fonts",
    "glow",
    "wayland",
@@ -105,6 +109,12 @@ windows-sys = "0.61"
 tauri-winrt-notification = "0.8"
 # The exe's own icon resource, which is what Explorer and a taskbar pin draw.
 embed-resource = "3"
+# Proton's CAPTCHA page, which reports success by posting a message to its
+# host, so it needs a webview this app controls. Run in a child process of its
+# own (`pstr-app::verify`): tao and eframe's winit cannot share an event loop.
+# WebKitGTK on Linux, WebView2 on Windows, WKWebView on macOS.
+wry = { version = "0.57", default-features = false, features = ["os-webview"] }
+tao = { version = "0.37", default-features = false, features = ["rwh_06"] }
 rpassword = "7"
 libloading = "0.8"
 lru = "0.18"
@@ -26,6 +26,23 @@ indicator while a crawl runs, but not the crawl's progress.
 Not yet verified on a device; the host gate (ktlint, unit and screenshot
 tests) passes, and Android lint runs in CI.

+A source review on 2026-10-12 found these still short of the text below:
+
+- **Title page.** The backdrop scrolls away with the back button instead of
+  collapsing to a pinned bar, and the icon row has no mark-watched action.
+- **Episode rows** show the file size where runtime was asked for.
+- **Player episode list** is a bottom sheet in landscape too, not a side
+  panel.
+- **Storage** has a usage bar for the streaming cache only; offline episodes
+  have none.
+- **Metadata language** is still a free-text field.
+- **Touch targets.** The player's icons are 40 dp, under the 48 dp floor.
+- **Screenshots** do not cover the player, and only the library is taken at
+  font scale 1.5.
+
+Share rows now say how many files the last crawl found, when it ran and why it
+failed (section 2, Shares), as of the catalog's `share_crawls` table.
+
 ## 0. CI (done)

 Every `Android` workflow run since August failed in `:app:buildRustHost`:
@@ -1,79 +1,145 @@
+<div align="center">
+
+<img src="images/logo.svg" alt="" width="112" height="112">
+
 # proton-stream

-A Netflix-style cross-platform client for **Proton Drive public links**.
+**Your Proton Drive, streaming.** A Netflix-style library for the videos in your Proton Drive and
+the share links people send you, on Linux, Windows, Android, Android TV and iOS.

-Paste a share URL and its password; get a browsable, streamable library. No
-Proton account, no server to host, no download step — episodes start playing in
-seconds and the seek bar works.
+**[proton-stream.narl.io](https://proton-stream.narl.io)**

-Built on [`proton-sdk-rs`](https://github.com/narrrl/proton-sdk-rs), a pure-Rust
-Proton Drive SDK.
+[![CI](https://github.com/narrrl/proton-stream/actions/workflows/ci.yml/badge.svg)](https://github.com/narrrl/proton-stream/actions/workflows/ci.yml)
+[![Release](https://img.shields.io/github/v/release/narrrl/proton-stream?sort=semver)](https://github.com/narrrl/proton-stream/releases/latest)
+[![License: MIT / GPL-3.0](https://img.shields.io/badge/license-MIT%20%2F%20GPL--3.0-blue.svg)](#license)
+[![Rust 1.96+](https://img.shields.io/badge/rust-1.96%2B-orange.svg)](https://www.rust-lang.org)
+[![Buy me a coffee](https://img.shields.io/badge/Buy%20me%20a%20coffee-FFDD00?logo=buymeacoffee&logoColor=black)](https://buymeacoffee.com/narl)
+
+<img src="images/desktop-home.png" alt="The library in the desktop app" width="820">
+
+</div>
+
+> [!IMPORTANT]
+> This is an **unofficial**, community-built client. It is not affiliated with, endorsed by, or
+> supported by Proton AG. "Proton" and "Proton Drive" are trademarks of Proton AG, used here only
+> to describe what the software talks to. It provides no content: it plays what you keep in
+> Proton Drive or what is shared with you.
+
+## Features
+
+**Library**
+
+- **Public share links or your own Drive.** Paste a share link, with its password if it has one,
+  or sign in and pick folders of your Drive. Any number of them merge into one library.
+- **Seasons and episodes from your folders.** The folder names the show, the file name gives the
+  season and episode, and a file without numbers is a film.
+- **Posters, synopses and shelves**, from AniList or TMDB, **off by default**: shelves such as
+  *Directed by* and *From MADHOUSE*, a franchise folded into one tile, and a hand-picked match
+  that is never overwritten.
+- **Filters and sorting:** series, films, watching, not started, downloaded; by name, last watched,
+  last added, air date, rating or popularity.
+
+**Player**
+
+- **Streams, never downloads first.** Episodes start in seconds, and a seek fetches only what it
+  lands on.
+- **libmpv inside the app's own window:** HEVC 10-bit, HDR and ASS subtitles with hardware
+  decoding, and no transcoding.
+- **Skip the opening and the ending** by chapter, an **Up next** countdown, and next and previous
+  episode.
+- **Subtitle files beside the video** (`.srt`, `.ass`, `.ssa`, `.vtt`), and **the dialogue track
+  over *Signs & Songs***. Audio and subtitle choices are remembered for each show.
+
+**Everywhere**
+
+- **Resume on any device.** Sign in, and your place in every episode, your shares and your
+  settings sync through your own Drive.
+- **Downloads** of an episode, a season or a show, to play offline.
+- **Android 12+ and Android TV** with Material 3, background audio and new-episode
+  notifications; **iOS 17+** as a SwiftUI port for SideStore and AltStore.
+- **Themes:** a near-black default, four Catppuccin flavours and Persona 5, each with nine accents.
+- **Full keyboard control** on the desktop, and the `pstr` command line.
+
+<table>
+  <tr>
+    <td width="50%"><img src="images/desktop-library.png" alt="The whole library, filtered and sorted"></td>
+    <td width="50%">
+      <img src="images/android-home.png" alt="Android: home" width="24%">
+      <img src="images/android-library.png" alt="Android: all titles" width="24%">
+      <img src="images/android-title.png" alt="Android: a title page" width="24%">
+      <img src="images/android-episodes.png" alt="Android: episodes and downloads" width="24%">
+    </td>
+  </tr>
+</table>
+
+## Install
+
+Every [release](https://github.com/narrrl/proton-stream/releases/latest) has:
+
+| Platform | Download |
+|---|---|
+| Debian, Ubuntu | `proton-stream_<version>-1_amd64.deb` |
+| Fedora | `proton-stream-<version>-1.x86_64.rpm` |
+| Other Linux | `proton-stream-<version>-x86_64-unknown-linux-gnu.tar.gz` |
+| Windows | `proton-stream-<version>-x64.msi`, or the portable `…-x86_64-windows.zip` |
+| Android, Android TV | `proton-stream-<version>-android.apk` |
+| iOS, iPadOS | `proton-stream-<version>-ios.ipa`, for SideStore or AltStore |
+
+```bash
+sudo apt install ./proton-stream_*_amd64.deb     # Debian, Ubuntu
+sudo dnf install ./proton-stream-*.x86_64.rpm    # Fedora
+cd packaging && makepkg -si                      # Arch, from a checkout
+```
+
+Then open **Proton Stream**, paste a share link on the **Shares** page (or press **Ctrl+V**), and
+the library fills in. [Getting started](docs/GETTING_STARTED.md) walks through it, and
+[Installation](docs/INSTALL.md) covers every platform, updating and uninstalling.
+
+## Documentation
+
+The [wiki](https://github.com/narrrl/proton-stream/wiki) is generated from [`docs/`](docs/) on
+every push to `main`:
+
+- [Getting started](docs/GETTING_STARTED.md), [Installation](docs/INSTALL.md) and the
+  [FAQ](docs/FAQ.md)
+- [User guide](docs/USER_GUIDE.md), [Account and sync](docs/ACCOUNT_AND_SYNC.md) and
+  [Android and iOS](docs/MOBILE.md)
+- [Command-line reference](docs/CLI.md), [Privacy](docs/PRIVACY.md) and
+  [Troubleshooting](docs/TROUBLESHOOTING.md)
+- For contributors: [Development](docs/DEVELOPMENT.md), [Architecture](docs/ARCHITECTURE.md),
+  [Testing](docs/TESTING.md), [Android](docs/ANDROID.md) and [iOS](docs/IOS.md)

 ## Why it works

-A Proton Drive file's content blocks are each a self-contained PGP packet
-decrypted under one shared session key. There is no sequential streaming session
-to resume, so seeking costs exactly the blocks the seek lands on — a 2 GB episode
-is playable without downloading 2 GB of it.
+A Proton Drive file's content blocks are each a self-contained PGP packet decrypted under one
+shared session key. There is no sequential streaming session to resume, so seeking costs exactly
+the blocks the seek lands on: a 2 GB episode plays without downloading 2 GB of it.

-## Status
+On a 761 MiB, 26-minute 1080p HEVC episode over a real password-protected link: **2.3 s to first
+frame, about 1.5 s to resume after dragging to an arbitrary point, and 61 MiB fetched for the
+first 38 seconds of playback.** Watch it again and the disk cache serves it with **no network at
+all**: 0.3 s to first frame.

-Early, but it is an app now: the picture lands **inside the window**, not in an
-mpv window of its own. The SDK streaming surface, the catalog, the streaming
-layer and the player are done and verified against a real share, and the app has
-a library wall, a page per title with seasons and episodes,
-resume-where-you-left-off, an overlay with a chapter-marked seek bar, a skip
-button for openings and endings, next/previous episode with an "up next"
-countdown, optional metadata, themes and share management. What is left is mostly sidecar subtitle files
-(`.srt`/`.ass` beside the video are invisible to the crawl today) and running the
-macOS packaging on a real Mac. See `docs/DEVELOPMENT.md`.
+The player is fed through an in-process mpv stream callback, not a local HTTP server, so there is
+no port another process could ask for the plaintext. [Architecture](docs/ARCHITECTURE.md) has the
+whole data flow.

-A native Android 12+ client is under `android/`, sharing the Rust catalog and
-streaming implementation through UniFFI. It features a modern Material 3 interface,
-an immersive fullscreen player with auto-hiding controls, and offline downloads.
-Its toolchain, emulator, signing, and release instructions are in [`docs/ANDROID.md`](docs/ANDROID.md).
+Built on [`proton-sdk-rs`](https://github.com/narrrl/proton-sdk-rs), a pure-Rust Proton Drive
+SDK.

-```bash
-cargo run --release -p pstr-app          # the app
-proton-stream 'https://drive.proton.me/urls/TOKEN#fragment'   # open the Add form with a link
-```
+## Privacy

-One window at a time: a second launch brings the open window forward and
-hands it any share link it was given, then exits.
+- **No server, no telemetry.** Each app talks to Proton and to nothing else, unless you turn on
+  posters and descriptions, which sends your title names to AniList or TMDB.
+- **The part of a share link after `#` is its decryption key.** It, any link password and your
+  Proton session live in the system credential store (Secret Service, Credential Manager, the
+  Android Keystore, the iOS Keychain), never in a config file.
+- **Sync is end-to-end encrypted.** Watch history, shares and settings travel through your own
+  Drive, one file per device.
+- **The block cache and downloads hold decrypted video** in your cache and data folders. Size or
+  empty the cache in **Settings → Storage**.

-The `pstr` CLI does the same work headlessly, and is what tells you which layer
-is broken:
-
-```bash
-cargo run -p pstr-cli -- add --name anime 'https://drive.proton.me/urls/TOKEN#fragment'
-cargo run -p pstr-cli -- crawl
-cargo run -p pstr-cli -- list
-cargo run -p pstr-cli -- metadata                      # opt-in; off unless configured
-cargo run --release -p pstr-cli -- play --file Frieren --disk-cache
-cargo run --release -p pstr-cli -- bench --file Frieren --verify
-```
-
-On a 761 MiB, 26-minute 1080p HEVC episode over a real password-protected link:
-**2.3 s to first frame, ~1.5 s to resume after dragging to an arbitrary point,
-61 MiB fetched for the first 38 seconds of playback.** Watch it again and the
-disk cache serves it with **no network at all** — 0.3 s to first frame.
-
-`bench` measures the same file without a player, reporting cold seek latency,
-sustained throughput and peak memory, and `--verify` cross-checks a mid-file read
-against the SDK's own range download.
-
-## Design
-
-| | |
-|---|---|
-| Topology | Fat client. No server; each viewer's app talks to Proton directly. |
-| Auth | Public links only — but several, merged into one library. |
-| Player | Embedded libmpv, drawing into the app's own GL surface: HEVC 10-bit, HDR and ASS subtitles with hardware decode. Volume, audio-track, subtitle and chapter pickers; skip-the-opening; next/previous episode and autoplay. The language picked is preferred for the next file too. |
-| Transcoding | None. mpv demuxes and decodes natively. |
-| UI | egui/eframe on glow; mpv renders into the same GL context. |
-| Themes | The shipped near-black palette, Catppuccin Latte, Frappé, Macchiato and Mocha, and a Persona 5 one — black, white and one loud red, which is what the Red accent is there for — each with a choice of nine accents, drawn as a gradient unless you turn that off. Picked on the Settings page, applied without a restart. |
-| Metadata | Filename parsing, with optional AniList/TMDB enrichment — **off by default**, because enabling it sends your library's titles to a third party. It brings posters, synopses, fanart and per-episode titles and synopses (for AniList, from ani.zip, which is sent the matched ids); a title the scorer refuses to guess about can be pinned by hand, and a pinned match is never overwritten. The library sorts by name, watch, add or air date, rating and popularity, folds a franchise into one tile, and shelves titles by director, studio and genre. See [docs/METADATA.md](docs/METADATA.md). |
-| Platforms | Linux and Windows; macOS packaging is written but has not been run on a Mac. A native Android 12+ client is available featuring a Material 3 UI and immersive fullscreen playback. |
+[Privacy](docs/PRIVACY.md) lists every connection and every file.

 ## Building

@@ -81,47 +147,26 @@ Rust 2024, MSRV 1.96.

 ```bash
 cargo build --release
+cargo run --release -p pstr-app                    # the app
+cargo run -p pstr-cli -- add --name anime 'URL'    # the same work, headless
 ```

-`pstr-player` needs libmpv development headers (`mpv` ≥ 2.0). On Windows those
-come from the separate **mpv-dev** archive rather than mpv's player build, and
-`libmpv-2.dll` ships next to the executable. The Proton SDK crates come from
-crates.io; nothing here builds against a sibling checkout.
+`pstr-player` needs libmpv development headers (`mpv` ≥ 2.0), and on Linux `pstr-app` needs
+WebKitGTK 4.1's, for the CAPTCHA window. The Proton SDK crates come from crates.io.

-Installable artifacts — tarball, `.deb`, `.rpm`, Arch package, `.app`/`.dmg`,
-and a portable `.zip` plus an `.msi` on Windows — are produced by
-`scripts/build.sh` and `scripts\build.ps1`; `packaging/README.md` has the
-per-platform detail.
-
-Android builds use JDK 17, Android SDK 36/NDK 28, Gradle 8.13, `cargo-ndk`, and
-UniFFI. Run `bash scripts/build-android.sh debug` after installing that toolchain;
-see [`docs/ANDROID.md`](docs/ANDROID.md) for exact setup and release signing.
-
-## Privacy
-
- The share URL fragment **is** the decryption password. It and any custom
-  password live in the OS credential store — Secret Service on Linux, Credential
-  Manager on Windows — never in a config file.
- Nothing leaves your machine except requests to Proton, unless you turn metadata
-  enrichment on. The player is fed through an in-process mpv stream callback, not
-  a local HTTP server: there is no port for another process on the machine to ask
-  for the plaintext, and mpv is handed an opaque token rather than a URL that
-  would put a share secret in its log and window title.
- The block cache holds decrypted content. It lives in your cache directory,
-  can be deleted at any time the app is not running, and can be sized or
-  emptied from Settings → Storage.
- A share link given as a command-line argument is visible to other users of
-  the machine in the process list while that launch runs, and may land in
-  shell history. Pasting it into the window (Ctrl+V) does neither.
- The desktop's media widget is handed the title, the episode and a `file://`
-  path to artwork already on disk — never a provider URL, so the shell never
-  contacts a metadata provider on its own.
+- **Release artifacts:** `scripts/build.sh` (tarball, `.deb`, `.rpm`, Arch, macOS) and
+  `scripts/build-windows.sh` or `scripts\build.ps1` (`.zip`, `.msi`). See
+  [`packaging/README.md`](packaging/README.md).
+- **Android:** JDK 17, Android SDK 36, NDK 28, `cargo-ndk`, then
+  `scripts/build-android.sh debug`. See [`docs/ANDROID.md`](docs/ANDROID.md).
+- **iOS:** macOS with Xcode and XcodeGen, then `scripts/build-ios.sh all`. See
+  [`docs/IOS.md`](docs/IOS.md).

 ## License

-The shared Rust crates and desktop application are MIT licensed. The Android
-application and its combined native distribution are GPL-3.0-or-later; see
-[`android/LICENSE.md`](android/LICENSE.md) and the bundled-component notices.
-The desktop application embeds the Inter typeface, under the SIL Open Font
+The shared Rust crates and desktop application are MIT licensed. The Android and iOS applications
+and their combined native distributions are GPL-3.0-or-later; see
+[`android/LICENSE.md`](android/LICENSE.md), [`ios/LICENSE.md`](ios/LICENSE.md) and the bundled
+component notices. The desktop application embeds the Inter typeface, under the SIL Open Font
 License 1.1 ([`crates/pstr-app/assets/fonts/Inter-OFL.txt`](crates/pstr-app/assets/fonts/Inter-OFL.txt)),
 and the Phosphor icon font, under MIT.
@@ -7,6 +7,13 @@
    <uses-permission android:name="android.permission.FOREGROUND_SERVICE_DATA_SYNC" />
    <uses-permission android:name="android.permission.FOREGROUND_SERVICE_MEDIA_PLAYBACK" />

+    <!--
+      Android TV: listed in its launcher, and installable without a touch
+      screen. Neither is required, so phones are offered the same build.
+    -->
+    <uses-feature android:name="android.software.leanback" android:required="false" />
+    <uses-feature android:name="android.hardware.touchscreen" android:required="false" />
+
    <application
        android:name=".ProtonStreamApplication"
        android:allowBackup="false"
@@ -14,6 +21,7 @@
        android:enableOnBackInvokedCallback="true"
        tools:targetApi="33"
        android:icon="@mipmap/ic_launcher"
+        android:banner="@drawable/tv_banner"
        android:label="@string/app_name"
        android:supportsRtl="true"
        android:theme="@style/Theme.ProtonStream">
@@ -35,11 +43,11 @@
            android:configChanges="screenSize|smallestScreenSize|screenLayout|orientation|uiMode|density|fontScale|locale|layoutDirection|keyboardHidden"
            android:exported="true"
            android:launchMode="singleTask"
-            android:supportsPictureInPicture="true"
            android:resizeableActivity="true">
            <intent-filter>
                <action android:name="android.intent.action.MAIN" />
                <category android:name="android.intent.category.LAUNCHER" />
+                <category android:name="android.intent.category.LEANBACK_LAUNCHER" />
            </intent-filter>
            <!--
              Proton Drive public links. autoVerify="false", said explicitly:
@@ -27,6 +27,7 @@ extern "C" {
 #include <string_view>
 #include <thread>
 #include <utility>
+#include <vector>

 namespace {

@@ -202,7 +203,7 @@ struct PlaybackState {
    /// and must not be attributed to the file being loaded.
    bool loading = false;
    /// The picture's display size, once mpv has decoded enough to know it.
-    /// Zero until then, and the aspect Picture-in-Picture is given.
+    /// Zero until then.
    double video_width = 0.0;
    double video_height = 0.0;
    /// Which loaded file this state describes. Bumped by every load, so a
@@ -210,6 +211,17 @@ struct PlaybackState {
    /// episode one — which is the difference between resuming an episode where
    /// the viewer left it and resuming it where the *previous* one ended.
    int64_t generation = 0;
+    /// mpv has loaded this generation's file and made its own track pick,
+    /// which is the first moment the pick can be second-guessed.
+    bool loaded = false;
+};
+
+/// A subtitle file published for mpv, and what to call it.
+struct Subtitle {
+    uint64_t handle = 0;
+    std::string title;
+    std::string language;
+    bool select = false;
 };

 class Player {
@@ -338,7 +350,10 @@ class Player {
            state_.generation = generation;
            state_.loading = true;
            error_.clear();
+            for (const auto &subtitle : pending_subtitles_) released_.push_back(subtitle.handle);
+            pending_subtitles_.clear();
        }
+        flush_released();
        const std::string url = "pstr://" + std::to_string(handle);
        const char *command[] = {"loadfile", url.c_str(), nullptr};
        if (mpv_command(mpv_, command) < 0) {
@@ -372,6 +387,27 @@ class Player {
        mpv_command(mpv_, command);
    }

+    /// A subtitle file beside the file of load `generation`, added once mpv
+    /// has that file loaded: an external track belongs to the file open at
+    /// the time. Handed over for a file already replaced, it is released
+    /// instead. `select` turns it on, but only when the file has no subtitle
+    /// of its own playing.
+    void add_subtitle(int64_t generation, Subtitle subtitle) {
+        bool now = false;
+        {
+            std::lock_guard lock(state_mutex_);
+            if (generation != state_.generation) {
+                released_.push_back(subtitle.handle);
+            } else if (loaded_generation_ == generation) {
+                now = true;
+            } else {
+                pending_subtitles_.push_back(std::move(subtitle));
+            }
+        }
+        flush_released();
+        if (now) attach_subtitle(subtitle);
+    }
+
    PlaybackState state() const {
        std::lock_guard lock(state_mutex_);
        return state_;
@@ -395,6 +431,8 @@ class Player {
            char *lang_raw = nullptr;
            char *title_raw = nullptr;
            int selected = 0;
+            int is_default = 0;
+            int forced = 0;
            mpv_get_property(mpv_, (base + "id").c_str(), MPV_FORMAT_INT64, &id);
            mpv_get_property(mpv_, (base + "type").c_str(), MPV_FORMAT_STRING, &type_raw);
            MpvString type(type_raw);
@@ -403,10 +441,14 @@ class Player {
            mpv_get_property(mpv_, (base + "title").c_str(), MPV_FORMAT_STRING, &title_raw);
            MpvString title(title_raw);
            mpv_get_property(mpv_, (base + "selected").c_str(), MPV_FORMAT_FLAG, &selected);
+            mpv_get_property(mpv_, (base + "default").c_str(), MPV_FORMAT_FLAG, &is_default);
+            mpv_get_property(mpv_, (base + "forced").c_str(), MPV_FORMAT_FLAG, &forced);
            if (i) json += ',';
            json += "{\"id\":" + std::to_string(id) + ",\"type\":\"" + escape(type.get()) +
                    "\",\"language\":\"" + escape(lang.get()) + "\",\"title\":\"" +
-                    escape(title.get()) + "\",\"selected\":" + (selected ? "true" : "false") + "}";
+                    escape(title.get()) + "\",\"selected\":" + (selected ? "true" : "false") +
+                    ",\"default\":" + (is_default ? "true" : "false") +
+                    ",\"forced\":" + (forced ? "true" : "false") + "}";
        }
        return json + ']';
    }
@@ -434,6 +476,35 @@ class Player {
    }

  private:
+    void attach_subtitle(const Subtitle &subtitle) {
+        bool showing = false;
+        if (char *sid = mpv_get_property_string(mpv_, "sid")) {
+            showing = std::strcmp(sid, "no") != 0;
+            mpv_free(sid);
+        }
+        const std::string url = "pstr://" + std::to_string(subtitle.handle);
+        std::vector<const char *> command{
+            "sub-add", url.c_str(), subtitle.select && !showing ? "select" : "auto",
+            subtitle.title.c_str()};
+        if (!subtitle.language.empty()) command.push_back(subtitle.language.c_str());
+        command.push_back(nullptr);
+        // On failure mpv may never have opened it, so nothing will close it.
+        // Releasing one it did open and close is a no-op.
+        if (mpv_command(mpv_, command.data()) < 0) pstr_android_stream_release(subtitle.handle);
+    }
+
+    /// Release the subtitle streams queued under `state_mutex_`, outside it:
+    /// a release runs Rust destructors, which must not run under a lock a
+    /// reader of the state may be waiting on.
+    void flush_released() {
+        std::vector<uint64_t> handles;
+        {
+            std::lock_guard lock(state_mutex_);
+            handles.swap(released_);
+        }
+        for (const uint64_t handle : handles) pstr_android_stream_release(handle);
+    }
+
    struct MpvFree {
        void operator()(char *value) const noexcept { if (value) mpv_free(value); }
    };
@@ -534,6 +605,17 @@ class Player {
            if (event->event_id == MPV_EVENT_FILE_LOADED) {
                const double start = pending_start_.exchange(0.0);
                if (start > 0.0) set_double("time-pos", start);
+                std::vector<Subtitle> ready;
+                {
+                    std::lock_guard lock(state_mutex_);
+                    // Mid-load, this is the outgoing file finishing its load.
+                    if (!state_.loading) {
+                        loaded_generation_ = state_.generation;
+                        state_.loaded = true;
+                        ready.swap(pending_subtitles_);
+                    }
+                }
+                for (const auto &subtitle : ready) attach_subtitle(subtitle);
            }
            if (event->event_id == MPV_EVENT_END_FILE) {
                const auto *end = static_cast<mpv_event_end_file *>(event->data);
@@ -757,6 +839,12 @@ class Player {
    bool surface_changed_ = false;
    std::atomic<bool> frame_ready_{false};
    std::atomic<double> pending_start_{0.0};
+    /// The load generation whose file mpv has loaded, under `state_mutex_`.
+    int64_t loaded_generation_ = -1;
+    /// Subtitles handed over before their file loaded, under `state_mutex_`.
+    std::vector<Subtitle> pending_subtitles_;
+    /// Streams to release once `state_mutex_` is let go.
+    std::vector<uint64_t> released_;
 };

 Player *from(jlong handle) { return reinterpret_cast<Player *>(handle); }
@@ -850,6 +938,17 @@ extern "C" JNIEXPORT jboolean JNICALL Java_io_narl_protonstream_playback_NativeM
                : JNI_FALSE);
    });
 }
+extern "C" JNIEXPORT void JNICALL Java_io_narl_protonstream_playback_NativeMpvHost_nativeAddSubtitle(JNIEnv *env, jobject, jlong handle, jlong generation, jlong stream, jstring title, jstring language, jboolean select) noexcept {
+    c_boundary([=] {
+        Subtitle subtitle{static_cast<uint64_t>(stream), {}, {}, select == JNI_TRUE};
+        auto *p = from(handle);
+        if (!p || !utf8(env, title, subtitle.title) || !utf8(env, language, subtitle.language)) {
+            pstr_android_stream_release(subtitle.handle);
+            return;
+        }
+        p->add_subtitle(generation, std::move(subtitle));
+    });
+}
 extern "C" JNIEXPORT void JNICALL Java_io_narl_protonstream_playback_NativeMpvHost_nativePause(JNIEnv *, jobject, jlong h, jboolean value) noexcept {
    c_boundary([=] { if (auto *p = from(h)) p->pause(value == JNI_TRUE); });
 }
@@ -881,8 +980,9 @@ extern "C" JNIEXPORT jdoubleArray JNICALL Java_io_narl_protonstream_playback_Nat
                                  state.video_width, state.video_height,
                                  static_cast<jdouble>(state.end_reason),
                                  state.buffering ? 1.0 : 0.0, state.cache_percent,
-                                  state.seeking ? 1.0 : 0.0, state.cached_until};
-        constexpr jsize kFields = 14;
+                                  state.seeking ? 1.0 : 0.0, state.cached_until,
+                                  state.loaded ? 1.0 : 0.0};
+        constexpr jsize kFields = 15;
        jdoubleArray result = env->NewDoubleArray(kFields);
        if (!result) return static_cast<jdoubleArray>(nullptr);
        env->SetDoubleArrayRegion(result, 0, kFields, values);
@@ -1,53 +1,38 @@
 package io.narl.protonstream

 import android.Manifest
-import android.app.PendingIntent
-import android.app.PictureInPictureParams
-import android.app.RemoteAction
-import android.content.BroadcastReceiver
 import android.content.ComponentName
 import android.content.Context
 import android.content.Intent
-import android.content.IntentFilter
 import android.content.ServiceConnection
 import android.content.pm.PackageManager
-import android.content.res.Configuration
-import android.graphics.Rect
-import android.graphics.drawable.Icon
 import android.os.Build
 import android.os.Bundle
 import android.os.IBinder
-import android.util.Rational
 import androidx.activity.ComponentActivity
 import androidx.activity.compose.setContent
 import androidx.activity.enableEdgeToEdge
 import androidx.activity.result.contract.ActivityResultContracts
 import androidx.compose.runtime.mutableStateOf
-import androidx.compose.runtime.snapshotFlow
-import androidx.core.content.ContextCompat
 import androidx.core.graphics.drawable.toDrawable
 import androidx.core.view.WindowCompat
 import androidx.lifecycle.lifecycleScope
 import io.narl.protonstream.native.NativeRuntime
-import io.narl.protonstream.playback.MpvPlaybackState
 import io.narl.protonstream.playback.NativeMpvHost
 import io.narl.protonstream.playback.PlaybackService
 import io.narl.protonstream.settings.SettingsStore
+import io.narl.protonstream.sync.NewEpisodesWorker
+import io.narl.protonstream.sync.WatchSyncWorker
 import io.narl.protonstream.ui.ProtonStreamApp
 import io.narl.protonstream.ui.theme.AppearanceState
 import io.narl.protonstream.ui.theme.ProtonStreamTheme
-import kotlinx.coroutines.ExperimentalCoroutinesApi
 import kotlinx.coroutines.flow.distinctUntilChanged
 import kotlinx.coroutines.flow.filterNotNull
-import kotlinx.coroutines.flow.flatMapLatest
-import kotlinx.coroutines.flow.flowOf
-import kotlinx.coroutines.flow.map
 import kotlinx.coroutines.launch
 import uniffi.pstr_android.PaletteRecord

 class MainActivity : ComponentActivity() {
    private val playerHost = mutableStateOf<NativeMpvHost?>(null)
-    private val inPictureInPicture = mutableStateOf(false)

    /** A share link handed over by a browser or the share sheet, until the Add form takes it. */
    private val incomingShareLink = mutableStateOf<String?>(null)
@@ -68,30 +53,10 @@ class MainActivity : ComponentActivity() {
        }
    }

-    /**
-     * The transport behind the buttons Android draws over the PiP window.
-     *
-     * A broadcast rather than a service intent: PiP is one of the states in
-     * which a background service start is refused, and the receiver is
-     * registered for as long as the activity that owns the window exists.
-     */
-    private val pictureInPictureControls = object : BroadcastReceiver() {
-        override fun onReceive(context: Context?, intent: Intent?) {
-            val host = playerHost.value ?: return
-            when (intent?.getStringExtra(EXTRA_CONTROL)) {
-                CONTROL_PLAY -> host.setPaused(false)
-                CONTROL_PAUSE -> host.setPaused(true)
-                CONTROL_NEXT -> host.onSkipNext?.invoke()
-                CONTROL_PREVIOUS -> host.onSkipPrevious?.invoke()
-            }
-        }
-    }
-
    private val notificationPermission = registerForActivityResult(
        ActivityResultContracts.RequestPermission(),
    ) { /* Downloads remain usable; Android suppresses their notifications if denied. */ }

-    @OptIn(ExperimentalCoroutinesApi::class)
    override fun onCreate(savedInstanceState: Bundle?) {
        super.onCreate(savedInstanceState)
        // Before anything draws. The palette decides the window's own
@@ -115,34 +80,17 @@ class MainActivity : ComponentActivity() {
            playbackConnection,
            Context.BIND_AUTO_CREATE,
        )
-        ContextCompat.registerReceiver(
-            this,
-            pictureInPictureControls,
-            IntentFilter(ACTION_PIP_CONTROL),
-            ContextCompat.RECEIVER_NOT_EXPORTED,
-        )
+        NewEpisodesWorker.schedule(this)
        if (
            Build.VERSION.SDK_INT >= Build.VERSION_CODES.TIRAMISU &&
            checkSelfPermission(Manifest.permission.POST_NOTIFICATIONS) != PackageManager.PERMISSION_GRANTED
        ) {
            notificationPermission.launch(Manifest.permission.POST_NOTIFICATIONS)
        }
-        // Auto-enter has to be armed *before* the gesture that would use it:
-        // building the params inside onUserLeaveHint is too late for the swipe
-        // home that gesture navigation sends, which never calls it. Re-register
-        // whenever the picture's shape or the transport's does.
-        lifecycleScope.launch {
-            snapshotFlow { playerHost.value }
-                .flatMapLatest { host -> host?.state ?: flowOf(null) }
-                .map { state -> PictureInPictureShape.of(state) }
-                .distinctUntilChanged()
-                .collect { shape -> runCatching { setPictureInPictureParams(shape.params()) } }
-        }
        setContent {
            ProtonStreamTheme {
                ProtonStreamApp(
                    playerHost.value,
-                    inPictureInPicture.value,
                    shareLink = incomingShareLink.value,
                    onShareLinkTaken = { incomingShareLink.value = null },
                )
@@ -177,27 +125,7 @@ class MainActivity : ComponentActivity() {
        intent.shareLink()?.let { incomingShareLink.value = it }
    }

-    override fun onUserLeaveHint() {
-        super.onUserLeaveHint()
-        // The backstop for launchers that still send this instead of arming
-        // auto-enter. Entering twice is not an error; not entering at all is.
-        if (playerHost.value?.hasActivePlayback == true && !isInPictureInPictureMode) {
-            runCatching {
-                enterPictureInPictureMode(PictureInPictureShape.of(playerHost.value?.state?.value).params())
-            }
-        }
-    }
-
-    override fun onPictureInPictureModeChanged(isInPictureInPictureMode: Boolean, newConfig: Configuration) {
-        super.onPictureInPictureModeChanged(isInPictureInPictureMode, newConfig)
-        // The window is now a thumbnail with its own controls. Anything the
-        // player would draw over it — the transport, the title bar, the skip
-        // offer — is unreadable at that size and covers the picture.
-        inPictureInPicture.value = isInPictureInPictureMode
-    }
-
    override fun onDestroy() {
-        runCatching { unregisterReceiver(pictureInPictureControls) }
        if (bound) {
            unbindService(playbackConnection)
            bound = false
@@ -207,89 +135,14 @@ class MainActivity : ComponentActivity() {

    override fun onStop() {
        super.onStop()
+        // Where the viewer stopped is what their other devices want next, and
+        // a process in the background may not live to the next timed sync.
+        if (!isChangingConfigurations) WatchSyncWorker.enqueue(this)
        if (
            !isChangingConfigurations &&
-            !isInPictureInPictureMode &&
            !SettingsStore(this).backgroundAudio
        ) {
            playerHost.value?.stop()
        }
    }
-
-    /** Everything the PiP window's shape depends on, and nothing that polls. */
-    private data class PictureInPictureShape(
-        val active: Boolean,
-        val paused: Boolean,
-        val width: Int,
-        val height: Int,
-    ) {
-        companion object {
-            fun of(state: MpvPlaybackState?): PictureInPictureShape = PictureInPictureShape(
-                active = state != null && state.duration > 0.0 && !state.ended,
-                paused = state?.paused != false,
-                width = state?.videoWidth?.toInt() ?: 0,
-                height = state?.videoHeight?.toInt() ?: 0,
-            )
-        }
-    }
-
-    private fun PictureInPictureShape.params(): PictureInPictureParams =
-        PictureInPictureParams.Builder()
-            .setAspectRatio(aspectRatio(width, height))
-            .setAutoEnterEnabled(active)
-            .setSeamlessResizeEnabled(false)
-            // The player owns the whole window, so the picture's rectangle is
-            // the window's. Without it the transition into PiP cross-fades from
-            // a screenshot instead of shrinking the video that is already there.
-            .setSourceRectHint(windowBounds())
-            .setActions(
-                listOf(
-                    remoteAction(android.R.drawable.ic_media_previous, "Previous episode", CONTROL_PREVIOUS, 11),
-                    if (paused) remoteAction(android.R.drawable.ic_media_play, "Play", CONTROL_PLAY, 12)
-                    else remoteAction(android.R.drawable.ic_media_pause, "Pause", CONTROL_PAUSE, 13),
-                    remoteAction(android.R.drawable.ic_media_next, "Next episode", CONTROL_NEXT, 14),
-                ),
-            )
-            .build()
-
-    private fun windowBounds(): Rect = window.decorView.let { Rect(0, 0, it.width, it.height) }
-
-    private fun remoteAction(icon: Int, label: String, control: String, requestCode: Int): RemoteAction =
-        RemoteAction(
-            Icon.createWithResource(this, icon),
-            label,
-            label,
-            PendingIntent.getBroadcast(
-                this,
-                requestCode,
-                Intent(ACTION_PIP_CONTROL).setPackage(packageName).putExtra(EXTRA_CONTROL, control),
-                PendingIntent.FLAG_IMMUTABLE or PendingIntent.FLAG_UPDATE_CURRENT,
-            ),
-        )
-
-    private companion object {
-        const val ACTION_PIP_CONTROL = "io.narl.protonstream.PIP_CONTROL"
-        const val EXTRA_CONTROL = "control"
-        const val CONTROL_PLAY = "play"
-        const val CONTROL_PAUSE = "pause"
-        const val CONTROL_NEXT = "next"
-        const val CONTROL_PREVIOUS = "previous"
-
-        /**
-         * Android refuses a window narrower than 1:2.39 or taller than 2.39:1,
-         * and refuses the request outright rather than clamping it — so a
-         * 2.40:1 scope release would take PiP away entirely.
-         */
-        fun aspectRatio(width: Int, height: Int): Rational {
-            if (width <= 0 || height <= 0) return Rational(16, 9)
-            val ratio = width.toDouble() / height
-            return when {
-                ratio > MAX_RATIO -> Rational(239, 100)
-                ratio < 1 / MAX_RATIO -> Rational(100, 239)
-                else -> Rational(width, height)
-            }
-        }
-
-        const val MAX_RATIO = 2.39
-    }
 }
@@ -2,10 +2,15 @@ package io.narl.protonstream

 import android.app.Application
 import io.narl.protonstream.native.NativeRuntime
+import io.narl.protonstream.settings.SettingsStore

 class ProtonStreamApplication : Application() {
    override fun onCreate() {
        super.onCreate()
        NativeRuntime.initialize(this)
+        // SharedPreferences reads its file on first use, and the first use was
+        // on the main thread — in the playback service's start callback among
+        // others. Read here, off it, and every later read is from memory.
+        Thread({ SettingsStore.preload(this) }, "settings-preload").start()
    }
 }
@@ -13,6 +13,8 @@ data class RetainedDownload(
    val total: Long = 0,
    val status: String = STATUS_QUEUED,
    val error: String? = null,
+    /** Recent transfer rate while running; 0 when unknown or not running. */
+    val bytesPerSecond: Long = 0,
 ) {
    val key: String get() = "$shareId\u001f$linkId"

@@ -99,6 +101,7 @@ class DownloadStateStore(context: Context) {
        .put("total", record.total)
        .put("status", record.status)
        .put("error", record.error)
+        .put("rate", record.bytesPerSecond)
        .toString()

    private fun decode(encoded: String): RetainedDownload {
@@ -112,6 +115,7 @@ class DownloadStateStore(context: Context) {
            total = json.optLong("total"),
            status = json.optString("status", RetainedDownload.STATUS_QUEUED),
            error = json.optString("error").takeIf(String::isNotBlank),
+            bytesPerSecond = json.optLong("rate"),
        )
    }

@@ -1,11 +1,15 @@
 package io.narl.protonstream.download

+import android.Manifest
 import android.app.NotificationChannel
 import android.app.NotificationManager
+import android.content.pm.PackageManager
 import android.content.pm.ServiceInfo
 import android.content.Context
+import android.os.Build
 import android.os.SystemClock
 import androidx.core.app.NotificationCompat
+import androidx.core.content.ContextCompat
 import androidx.work.CoroutineWorker
 import androidx.work.Data
 import androidx.work.ForegroundInfo
@@ -25,20 +29,39 @@ class OfflineDownloadWorker(
 ) : CoroutineWorker(appContext, parameters) {
    override suspend fun doWork(): Result {
        createNotificationChannel()
-        setForeground(createForegroundInfo(0))
        val shareId = inputData.getString(KEY_SHARE_ID) ?: return Result.failure(error("missing share"))
        val volumeId = inputData.getString(KEY_VOLUME_ID) ?: return Result.failure(error("missing volume"))
        val linkId = inputData.getString(KEY_LINK_ID) ?: return Result.failure(error("missing link"))
        val label = inputData.getString(KEY_LABEL) ?: linkId
        val store = DownloadStateStore(applicationContext)
+        setForeground(createForegroundInfo(label, null))
+        postSummary(store)
+        try {
+            return transfer(store, shareId, volumeId, linkId, label)
+        } finally {
+            postSummary(store)
+        }
+    }
+
+    private suspend fun transfer(
+        store: DownloadStateStore,
+        shareId: String,
+        volumeId: String,
+        linkId: String,
+        label: String,
+    ): Result {
+        // Queued, not running: the engine lets two downloads transfer at once
+        // and holds the rest back, and only the first progress report means
+        // this one has a slot.
        var retained = store.get(shareId, linkId)
            ?: RetainedDownload(shareId, volumeId, linkId, label)
-        retained = retained.copy(status = RetainedDownload.STATUS_RUNNING, error = null)
+        retained = retained.copy(status = RetainedDownload.STATUS_QUEUED, error = null, bytesPerSecond = 0)
        store.put(retained)

        val observer = object : DownloadObserver {
            private var reportedAt = 0L
            private var reportedPercent = -1
+            private val rate = TransferRate()

            /**
             * Called once per 4 MiB block — a dozen times a second on a fast
@@ -51,13 +74,14 @@ class OfflineDownloadWorker(
                val percent = if (total == 0UL) 0 else ((downloaded * 100UL) / total).toInt()
                val now = SystemClock.elapsedRealtime()
                val complete = total > 0UL && downloaded >= total
+                val bytesPerSecond = rate.sample(downloaded.toLong(), now)
                if (!complete && percent == reportedPercent && now - reportedAt < PROGRESS_INTERVAL_MS) {
                    return
                }
                reportedAt = now
                reportedPercent = percent
                setProgressAsync(workDataOf(KEY_DOWNLOADED to downloaded.toLong(), KEY_TOTAL to total.toLong()))
-                setForegroundAsync(createForegroundInfo(percent))
+                setForegroundAsync(createForegroundInfo(label, percent))
                // Under the store's lock: `pause()` is a concurrent writer, and
                // this read-modify-write used to put RUNNING back over the
                // viewer's PAUSED and then report the download as cancelled.
@@ -66,6 +90,7 @@ class OfflineDownloadWorker(
                    current.copy(
                        downloaded = downloaded.toLong(),
                        total = total.toLong(),
+                        bytesPerSecond = bytesPerSecond,
                        status = when (current.status) {
                            RetainedDownload.STATUS_PAUSED,
                            RetainedDownload.STATUS_CANCELLED,
@@ -114,12 +139,20 @@ class OfflineDownloadWorker(
        )
    }

-    private fun createForegroundInfo(progress: Int): ForegroundInfo {
+    /**
+     * This episode's line, under [GROUP]: a season is fourteen workers, and
+     * fourteen loose notifications saying the same thing named nothing.
+     * [progress] is a percentage, or null while waiting for a download slot.
+     */
+    private fun createForegroundInfo(label: String, progress: Int?): ForegroundInfo {
        val notification = NotificationCompat.Builder(applicationContext, CHANNEL_ID)
            .setSmallIcon(io.narl.protonstream.R.drawable.ic_launcher_foreground)
-            .setContentTitle("Making episode available offline")
-            .setProgress(100, progress, progress == 0)
+            .setContentTitle(label)
+            .setContentText(if (progress == null) "Waiting to download" else "$progress %")
+            .setProgress(100, progress ?: 0, progress == null || progress == 0)
            .setOngoing(true)
+            .setOnlyAlertOnce(true)
+            .setGroup(GROUP)
            .build()
        return ForegroundInfo(
            stableNotificationId(id),
@@ -128,6 +161,36 @@ class OfflineDownloadWorker(
        )
    }

+    /**
+     * The one line the group folds into — "Downloading 12 episodes" — or none
+     * once nothing is left to download. Posted as each worker starts and
+     * ends rather than on progress, which each episode's own line carries.
+     */
+    private fun postSummary(store: DownloadStateStore) {
+        val manager = applicationContext.getSystemService(NotificationManager::class.java)
+        val left = store.records().count {
+            it.status == RetainedDownload.STATUS_QUEUED || it.status == RetainedDownload.STATUS_RUNNING
+        }
+        if (left == 0) {
+            manager.cancel(SUMMARY_ID)
+            return
+        }
+        val allowed = Build.VERSION.SDK_INT < Build.VERSION_CODES.TIRAMISU ||
+            ContextCompat.checkSelfPermission(applicationContext, Manifest.permission.POST_NOTIFICATIONS) ==
+            PackageManager.PERMISSION_GRANTED
+        if (!allowed) return
+        manager.notify(
+            SUMMARY_ID,
+            NotificationCompat.Builder(applicationContext, CHANNEL_ID)
+                .setSmallIcon(io.narl.protonstream.R.drawable.ic_launcher_foreground)
+                .setContentTitle(if (left == 1) "Downloading 1 episode" else "Downloading $left episodes")
+                .setOnlyAlertOnce(true)
+                .setGroup(GROUP)
+                .setGroupSummary(true)
+                .build(),
+        )
+    }
+
    private fun error(message: String) = Data.Builder().putString(KEY_ERROR, message).build()

    companion object {
@@ -140,11 +203,45 @@ class OfflineDownloadWorker(
        const val KEY_TOTAL = "total"
        private const val MAX_RETRIES = 3
        private const val CHANNEL_ID = "offline-downloads"
+        private const val GROUP = "offline-downloads"
+
+        /** Below [stableNotificationId]'s range, so no episode's line replaces it. */
+        internal const val SUMMARY_ID = 1

        /** Shortest gap between two identical-looking progress reports. */
        private const val PROGRESS_INTERVAL_MS = 1_000L
    }
 }

+/**
+ * Bytes per second over roughly the last few seconds.
+ *
+ * Progress arrives once per 4 MiB block, so on a slow link the bar moves in
+ * steps seconds apart; a rate beside it is what tells a slow download from a
+ * stuck one. Smoothed, because one block that took a little longer than the
+ * last would otherwise halve the figure for a moment.
+ */
+internal class TransferRate {
+    private var lastBytes = -1L
+    private var lastAt = 0L
+    private var smoothed = 0.0
+
+    /** Record [bytes] transferred at [now] (milliseconds) and return the rate. */
+    fun sample(bytes: Long, now: Long): Long {
+        if (lastBytes < 0 || bytes < lastBytes) {
+            lastBytes = bytes
+            lastAt = now
+            return smoothed.toLong()
+        }
+        val elapsed = now - lastAt
+        if (elapsed <= 0) return smoothed.toLong()
+        val instant = (bytes - lastBytes) * 1000.0 / elapsed
+        smoothed = if (smoothed > 0.0) 0.7 * smoothed + 0.3 * instant else instant
+        lastBytes = bytes
+        lastAt = now
+        return smoothed.toLong()
+    }
+}
+
 internal fun stableNotificationId(workId: UUID): Int =
-    (workId.hashCode() and Int.MAX_VALUE).coerceAtLeast(1)
+    (workId.hashCode() and Int.MAX_VALUE).coerceAtLeast(OfflineDownloadWorker.SUMMARY_ID + 1)
@@ -19,7 +19,10 @@ import java.util.concurrent.locks.ReentrantLock
 import kotlin.concurrent.withLock
 import uniffi.pstr_android.ChapterPlan
 import uniffi.pstr_android.ChapterRecord
+import uniffi.pstr_android.SubtitleFilesRecord
+import uniffi.pstr_android.SubtitleTrackRecord
 import uniffi.pstr_android.chapterPlan
+import uniffi.pstr_android.fullSubtitlesInstead

 /**
 * Why the open file ended, mirroring `pstr_player::EndReason` so both clients
@@ -85,9 +88,9 @@ data class MpvPlaybackState(
 /**
 * What is on screen, for the surfaces that are not the player.
 *
- * The media session, its notification and Picture-in-Picture all have to name
- * the episode, and none of them can reach the composition that knows it. The
- * player publishes this once per episode and they read it.
+ * The media session and its notification have to name the episode, and
+ * neither can reach the composition that knows it. The player publishes this
+ * once per episode and they read it.
 */
 data class NowPlaying(
    val media: String,
@@ -107,6 +110,10 @@ data class MpvTrack(
    val language: String,
    val title: String,
    val selected: Boolean,
+    /** The container marks it as the default choice. */
+    val isDefault: Boolean = false,
+    /** The container marks it as forced: on-screen text only, by convention. */
+    val forced: Boolean = false,
 ) {
    val label: String get() = listOf(language, title).filter(String::isNotBlank)
        .joinToString(" — ").ifBlank { "${type.replaceFirstChar(Char::uppercase)} $id" }
@@ -128,14 +135,16 @@ class NativeMpvHost private constructor(private val nativeHandle: Long) : Libmpv
    @Volatile private var currentMedia: String? = null
    @Volatile private var currentGeneration: Double = -1.0
    @Volatile private var plannedFor: Pair<Double, Long>? = null
+    /** The load generation whose subtitle pick has been looked at. */
+    @Volatile private var subtitlesCheckedFor: Double = -1.0
    var onPlaybackStarted: (() -> Unit)? = null
    var onStateChanged: ((MpvPlaybackState) -> Unit)? = null
    var onExplicitStop: (() -> Unit)? = null
    /**
     * Where a transport outside the player sends previous/next.
     *
-     * The player owns which episode is open, so the notification, the lock
-     * screen and Picture-in-Picture cannot walk the playlist themselves. Both
+     * The player owns which episode is open, so the notification and the lock
+     * screen cannot walk the playlist themselves. Both
     * run on the main thread, which is where the player's state lives.
     */
    var onSkipPrevious: (() -> Unit)? = null
@@ -245,7 +254,7 @@ class NativeMpvHost private constructor(private val nativeHandle: Long) : Libmpv
     */
    fun beginTransition() { mutableAdvancing.value = true }

-    /** Names the open episode for the media session, its notification and PiP. */
+    /** Names the open episode for the media session and its notification. */
    fun publish(playing: NowPlaying?) { mutableNowPlaying.value = playing }

    fun setPaused(paused: Boolean) {
@@ -292,6 +301,30 @@ class NativeMpvHost private constructor(private val nativeHandle: Long) : Libmpv

    override fun releaseNativeStream(nativeHandle: ULong) = pstrAndroidStreamRelease(nativeHandle.toLong())

+    /**
+     * Hand mpv the subtitle files beside [media], the episode [play] loaded.
+     *
+     * Native code holds them until mpv has the file loaded, since an external
+     * track belongs to the file open at the time, and releases them instead
+     * if another episode has been loaded since. [SubtitleFilesRecord.preferred]
+     * is turned on only when the file has no subtitle of its own playing;
+     * pass [subtitles] false to turn none on.
+     */
+    fun addSubtitles(media: String, files: SubtitleFilesRecord, subtitles: Boolean) {
+        val generation = currentGeneration.toLong()
+        val added = withOpenHandle { handle ->
+            files.files.forEachIndexed { index, file ->
+                if (currentMedia == media) {
+                    val select = subtitles && files.preferred == index.toUInt()
+                    nativeAddSubtitle(handle, generation, file.handle.toLong(), file.title, file.language, select)
+                } else {
+                    pstrAndroidStreamRelease(file.handle.toLong())
+                }
+            }
+        }
+        if (added == null) files.files.forEach { pstrAndroidStreamRelease(it.handle.toLong()) }
+    }
+
    private fun startPolling() {
        if (poller?.isActive == true) return
        // Off the main thread deliberately: `nativeState` and `nativeTracks`
@@ -322,6 +355,12 @@ class NativeMpvHost private constructor(private val nativeHandle: Long) : Libmpv
                    // both of which are the main thread's.
                    withContext(Dispatchers.Main) { onStateChanged?.invoke(next) }
                    refreshChapters(next)
+                    if (values[LOADED] != 0.0 && values.generation() == currentGeneration &&
+                        subtitlesCheckedFor != currentGeneration
+                    ) {
+                        subtitlesCheckedFor = currentGeneration
+                        preferFullSubtitles()
+                    }
                }
                withOpenHandle(::nativeTakeError)?.let { mutableProblem.value = it }
                if (tick++ % 4 == 0) refreshTracks()
@@ -359,13 +398,32 @@ class NativeMpvHost private constructor(private val nativeHandle: Long) : Libmpv
        }
    }

+    /**
+     * Play the dialogue rather than the signs and songs mpv picked by language
+     * (`pstr_core::subtitles`). Not remembered: it is the choice mpv should
+     * have made, not the viewer's.
+     */
+    private fun preferFullSubtitles() {
+        refreshTracks()
+        val subtitles = mutableTracks.value.filter { it.type == "sub" }
+        val id = fullSubtitlesInstead(
+            subtitles.map {
+                SubtitleTrackRecord(it.id, it.language, it.title, it.isDefault, it.forced, it.selected)
+            },
+        ) ?: return
+        subtitles.firstOrNull { it.id == id }?.let(::selectTrack)
+    }
+
    private fun refreshTracks() {
        runCatching {
            val encoded = withOpenHandle(::nativeTracks) ?: return
            val values = JSONArray(encoded)
            List(values.length()) { index ->
                values.getJSONObject(index).run {
-                    MpvTrack(getLong("id"), getString("type"), getString("language"), getString("title"), getBoolean("selected"))
+                    MpvTrack(
+                        getLong("id"), getString("type"), getString("language"), getString("title"),
+                        getBoolean("selected"), optBoolean("default"), optBoolean("forced"),
+                    )
                }
            }
        }.onSuccess { mutableTracks.value = it }
@@ -414,6 +472,14 @@ class NativeMpvHost private constructor(private val nativeHandle: Long) : Libmpv
        subtitles: Boolean,
        hardwareDecoding: Boolean,
    ): Boolean
+    private external fun nativeAddSubtitle(
+        handle: Long,
+        generation: Long,
+        stream: Long,
+        title: String,
+        language: String?,
+        select: Boolean,
+    )
    private external fun nativePause(handle: Long, paused: Boolean)
    private external fun nativeSeek(handle: Long, position: Double)
    private external fun nativeVolume(handle: Long, volume: Double)
@@ -434,7 +500,7 @@ class NativeMpvHost private constructor(private val nativeHandle: Long) : Libmpv

    companion object {
        /** Fields `nativeState` fills, in the order `pstr_mpv.cpp` writes them. */
-        private const val FIELDS = 14
+        private const val FIELDS = 15
        private const val GENERATION = 6
        private const val WIDTH = 7
        private const val HEIGHT = 8
@@ -443,6 +509,7 @@ class NativeMpvHost private constructor(private val nativeHandle: Long) : Libmpv
        private const val CACHE_PERCENT = 11
        private const val SEEKING = 12
        private const val CACHED_UNTIL = 13
+        private const val LOADED = 14

        init {
            System.loadLibrary("pstr_android")
@@ -19,9 +19,11 @@ import android.media.session.MediaSession
 import android.media.session.PlaybackState
 import android.os.Binder
 import android.os.IBinder
+import android.os.SystemClock
 import androidx.core.content.ContextCompat
 import io.narl.protonstream.MainActivity
 import io.narl.protonstream.R
+import io.narl.protonstream.native.NativeRuntime
 import io.narl.protonstream.settings.SettingsStore
 import io.narl.protonstream.ui.loadArtwork
 import io.narl.protonstream.ui.loadThumbnail
@@ -33,9 +35,11 @@ import kotlinx.coroutines.cancel
 import kotlinx.coroutines.delay
 import kotlinx.coroutines.flow.first
 import kotlinx.coroutines.launch
+import kotlinx.coroutines.runBlocking
+import kotlinx.coroutines.withContext
 import kotlinx.coroutines.withTimeoutOrNull

-/** Owns libmpv so audio survives Activity recreation, rotation and PiP. */
+/** Owns libmpv so audio survives Activity recreation and rotation. */
 class PlaybackService : Service() {
    inner class PlaybackBinder : Binder() {
        val host: NativeMpvHost? get() = this@PlaybackService.host
@@ -81,6 +85,9 @@ class PlaybackService : Service() {
    private var notified: NotificationShape? = null
    /** The pending teardown, held so an episode transition can call it off. */
    private var retire: Job? = null
+    /** The open episode's latest reading, which [track] saves. */
+    private var lastReading: MpvPlaybackState? = null
+    private var lastSave = 0L
    /** The episode's artwork, and the source key it was fetched for. */
    private var artwork: Pair<String, Bitmap>? = null
    private val binder = PlaybackBinder()
@@ -115,7 +122,7 @@ class PlaybackService : Service() {
                }
                mediaSession.isActive = true
            }
-            onStateChanged = { updateSession(it) }
+            onStateChanged = { updateSession(it); track(it) }
            onExplicitStop = { retirePlayback() }
        }
        mediaSession = MediaSession(this, "proton-stream").apply {
@@ -164,6 +171,22 @@ class PlaybackService : Service() {
        return START_NOT_STICKY
    }

+    /**
+     * Swiped away from Recents. With background audio on, this service would
+     * otherwise play on with no screen to return to and no autoplay, so it
+     * saves where the episode got to and stops.
+     */
+    override fun onTaskRemoved(rootIntent: Intent?) {
+        lastReading?.let { reading ->
+            // Bounded and on this thread: the process may go as soon as the
+            // service stops, and a save launched into its scope would go with it.
+            runBlocking { withTimeoutOrNull(SAVE_ON_EXIT_MS) { withContext(Dispatchers.IO) { save(reading) } } }
+        }
+        host?.stop()
+        retirePlayback()
+        super.onTaskRemoved(rootIntent)
+    }
+
    override fun onDestroy() {
        scope.cancel()
        runCatching { unregisterReceiver(becomingNoisy) }
@@ -225,6 +248,52 @@ class PlaybackService : Service() {
        return audioManager.requestAudioFocus(request) == AudioManager.AUDIOFOCUS_REQUEST_GRANTED
    }

+    /**
+     * Keep the resume position from here rather than from the player screen.
+     *
+     * This service outlives the activity whenever background audio is on, and a
+     * position the screen alone kept stopped being saved the moment the screen
+     * went. Readings are attributed by [MpvPlaybackState.media], so an episode
+     * change saves the outgoing episode's last reading before the new one's.
+     */
+    private fun track(state: MpvPlaybackState) {
+        val media = state.media ?: return
+        if (state.duration <= 0.0) return
+        val previous = lastReading
+        lastReading = state
+        val now = SystemClock.elapsedRealtime()
+        val due = when {
+            previous != null && previous.media != media -> {
+                scope.launch(Dispatchers.IO) { save(previous) }
+                true
+            }
+            state.ended -> previous?.ended != true
+            state.paused -> previous?.paused != true
+            else -> now - lastSave >= SAVE_EVERY_MS
+        }
+        if (due) {
+            lastSave = now
+            scope.launch(Dispatchers.IO) { save(state) }
+        }
+    }
+
+    private suspend fun save(state: MpvPlaybackState) {
+        val media = state.media ?: return
+        // Played to the end, or near enough that what is left is credits. A
+        // failure or a stop also "ends", and recording either as watched would
+        // retire an episode nobody saw.
+        val watched = state.endReason == EndReason.Eof || state.position >= state.duration * WATCHED_FRACTION
+        runCatching {
+            NativeRuntime.engine().saveWatchState(
+                media.substringBeforeLast(':'),
+                media.substringAfterLast(':'),
+                state.position.coerceIn(0.0, state.duration),
+                state.duration,
+                watched,
+            )
+        }
+    }
+
    private fun updateSession(state: MpvPlaybackState) {
        refreshSession(state, host?.nowPlaying?.value)
        if (state.ended) scheduleRetire() else cancelRetire()
@@ -419,6 +488,9 @@ class PlaybackService : Service() {
        private const val TRANSITION_GRACE_MS = 30_000L
        /** How far the volume drops for a navigation prompt or a notification. */
        private const val DUCK_FACTOR = 0.3
+        private const val SAVE_EVERY_MS = 5_000L
+        /** How long a swipe from Recents may hold the main thread to save. */
+        private const val SAVE_ON_EXIT_MS = 2_000L

        /** Catppuccin Mocha mauve, the accent the app is themed with. */
        private const val ACCENT = 0xFFCBA6F7.toInt()
@@ -5,6 +5,7 @@ import android.content.pm.ActivityInfo
 import android.view.SurfaceHolder
 import android.view.SurfaceView
 import android.view.WindowManager
+import android.view.accessibility.AccessibilityManager
 import androidx.activity.compose.BackHandler
 import androidx.compose.animation.AnimatedVisibility
 import androidx.compose.animation.fadeIn
@@ -12,13 +13,13 @@ import androidx.compose.animation.fadeOut
 import androidx.compose.foundation.Canvas
 import androidx.compose.foundation.background
 import androidx.compose.foundation.clickable
-import androidx.compose.foundation.interaction.MutableInteractionSource
 import androidx.compose.foundation.layout.Arrangement
 import androidx.compose.foundation.layout.Box
 import androidx.compose.foundation.layout.Column
 import androidx.compose.foundation.layout.Row
 import androidx.compose.foundation.layout.fillMaxSize
 import androidx.compose.foundation.layout.width
+import androidx.compose.foundation.layout.widthIn
 import androidx.compose.foundation.layout.fillMaxWidth
 import androidx.compose.foundation.layout.heightIn
 import androidx.compose.foundation.layout.padding
@@ -38,6 +39,7 @@ import androidx.compose.material.icons.filled.Close
 import androidx.compose.material.icons.filled.Speed
 import androidx.compose.material.icons.filled.Forward30
 import androidx.compose.material.icons.filled.Fullscreen
+import androidx.compose.material.icons.filled.MoreVert
 import androidx.compose.material.icons.filled.FullscreenExit
 import androidx.compose.material.icons.filled.Pause
 import androidx.compose.material.icons.filled.PlayArrow
@@ -47,6 +49,8 @@ import androidx.compose.material.icons.filled.SkipPrevious
 import androidx.compose.material.icons.filled.Subtitles
 import androidx.compose.material3.AlertDialog
 import androidx.compose.material3.CircularProgressIndicator
+import androidx.compose.material3.DropdownMenu
+import androidx.compose.material3.DropdownMenuItem
 import androidx.compose.material3.ExperimentalMaterial3Api
 import androidx.compose.material3.Icon
 import androidx.compose.material3.IconButton
@@ -58,9 +62,23 @@ import androidx.compose.runtime.DisposableEffect
 import androidx.compose.runtime.LaunchedEffect
 import androidx.compose.runtime.collectAsState
 import androidx.compose.runtime.getValue
+import androidx.compose.runtime.mutableIntStateOf
 import androidx.compose.runtime.mutableStateOf
 import androidx.compose.runtime.remember
 import androidx.compose.runtime.rememberCoroutineScope
+import androidx.compose.runtime.rememberUpdatedState
+import androidx.compose.foundation.gestures.detectTapGestures
+import androidx.compose.ui.focus.FocusRequester
+import androidx.compose.ui.focus.focusRequester
+import androidx.compose.foundation.focusable
+import androidx.compose.ui.input.key.Key
+import androidx.compose.ui.input.key.KeyEventType
+import androidx.compose.ui.input.key.key
+import androidx.compose.ui.input.key.onKeyEvent
+import androidx.compose.ui.input.key.type
+import androidx.compose.ui.input.pointer.pointerInput
+import androidx.compose.ui.semantics.onClick
+import androidx.compose.ui.semantics.semantics
 import androidx.compose.runtime.setValue
 import androidx.compose.ui.Alignment
 import androidx.compose.ui.Modifier
@@ -70,6 +88,7 @@ import androidx.compose.ui.graphics.Color
 import androidx.compose.ui.platform.LocalContext
 import androidx.compose.ui.platform.LocalDensity
 import androidx.compose.ui.platform.LocalWindowInfo
+import androidx.compose.ui.text.style.TextAlign
 import androidx.compose.ui.text.style.TextOverflow
 import androidx.compose.ui.unit.dp
 import androidx.compose.ui.viewinterop.AndroidView
@@ -106,6 +125,7 @@ import uniffi.pstr_android.EpisodeRecord
 import uniffi.pstr_android.TitleRecord
 import uniffi.pstr_android.TrackPreferencesRecord
 import uniffi.pstr_android.skipOffer
+import kotlin.math.ceil
 import kotlin.math.roundToInt

 /** How long the controls stay up after a tap. */
@@ -114,8 +134,17 @@ private const val CONTROLS_SECONDS = 4L
 /** How long the "up next" card counts down before it loads the next episode. */
 private const val UP_NEXT_SECONDS = 10

+/** How far a double tap on either side of the picture seeks. */
+private const val DOUBLE_TAP_SECONDS = 10
+
+/** How long the double-tap seek mark stays up. */
+private const val NUDGE_MS = 700L
+
+/** How close to the end the next episode's opening blocks are fetched. */
+private const val WARM_NEXT_SECONDS = 120.0
+
 /** Past this much of an episode it counts as watched. */
-private const val WATCHED_FRACTION = 0.9
+internal const val WATCHED_FRACTION = 0.9

 /** The loudest this app plays. Matches `pstr_core::prefs`, which stores it. */
 private const val MAX_VOLUME = 100f
@@ -126,23 +155,22 @@ private const val MAX_VOLUME = 100f
 * Below it — a phone held upright — the transport row is already five controls
 * wide, and the device's own volume keys are the better answer.
 */
-private val VOLUME_SLIDER_MIN_WIDTH = 600.dp
+private val VOLUME_SLIDER_MIN_WIDTH = 720.dp
+
+/** Narrower than this, the pickers past subtitles go behind "More". */
+private val INLINE_CONTROLS_MIN_WIDTH = 560.dp

 /**
 * The player, as its own screen on the activity's own window.
 *
- * Not a dialog: a dialog window has its own insets, cannot be told to draw into
- * the display cutout, and hands Picture-in-Picture the wrong window. Owning the
- * activity window is what makes "fullscreen" mean the whole panel, notch
- * included.
+ * Not a dialog: a dialog window has its own insets and cannot be told to draw
+ * into the display cutout. Owning the activity window is what makes
+ * "fullscreen" mean the whole panel, notch included.
 *
 * [episodes] is the title's episodes in display order and [index] the one that is
 * open, which is what previous/next and autoplay walk. The index is hoisted so
 * that it survives process recreation with the rest of the navigation state —
 * this screen is destroyed and rebuilt by a dark-mode toggle like any other.
- *
- * In [inPictureInPicture] the window is a thumbnail with the system's own
- * controls over it, so this screen draws the picture and nothing else.
 */
@Composable
 fun PlayerScreen(
@@ -150,7 +178,6 @@ fun PlayerScreen(
    episodes: List<EpisodeRecord>,
    index: Int,
    host: LibmpvHost?,
-    inPictureInPicture: Boolean,
    minimized: Boolean,
    onIndexChange: (Int) -> Unit,
    onSaveProgress: (EpisodeRecord, Double, Double, Boolean) -> Unit,
@@ -189,8 +216,16 @@ fun PlayerScreen(
    }

    val key = mediaKey(episode)
-    val session = remember(key) { RustStreamSession(episode) }
+    // Retry opens the episode again from scratch: a new stream, through the
+    // bridge's session refresh, from where the failed one stopped.
+    var attempt by remember(key) { mutableIntStateOf(0) }
+    var retryFrom by remember(key) { mutableStateOf<Double?>(null) }
+    val session = remember(key, attempt) { RustStreamSession(episode) }
    var playbackError by remember(key) { mutableStateOf<String?>(null) }
+    // From the click until mpv has the file: the share session, the revision
+    // and its block list all come first, and on a slow link that is seconds of
+    // black screen unless something says so.
+    var opening by remember(key, attempt) { mutableStateOf(true) }

    LaunchedEffect(session, host) {
        runCatching {
@@ -209,7 +244,7 @@ fun PlayerScreen(
                    size = session.size(),
                    // A finished episode restarts rather than resuming three
                    // seconds from its own credits.
-                    startPosition = watch?.takeUnless { it.watched }?.positionSecs ?: 0.0,
+                    startPosition = retryFrom ?: watch?.takeUnless { it.watched }?.positionSecs ?: 0.0,
                    audioLanguage = show?.audioLanguage ?: global.audioLanguage,
                    subtitleLanguage = show?.subtitleLanguage ?: global.subtitleLanguage,
                    subtitles = show?.subtitles ?: global.subtitles,
@@ -223,12 +258,21 @@ fun PlayerScreen(
                startup.audioLanguage, startup.subtitleLanguage, startup.subtitles,
                SettingsStore(context).hardwareDecoding,
            )
+
            // After the load, because mpv keeps none of the three across one.
            nativeHost.setVolume(startup.volume)
            nativeHost.setMuted(startup.muted)
            nativeHost.setSpeed(startup.speed)
            session.transferToPlayer()
+            // While mpv opens the episode, and off the spinner's path: the host
+            // holds them until it has the file.
+            launch(Dispatchers.IO) {
+                val files = NativeRuntime.engine()
+                    .openSubtitles(episode.shareId, episode.linkId, startup.subtitleLanguage)
+                nativeHost.addSubtitles(key, files, startup.subtitles)
+            }
        }.onFailure { playbackError = it.message ?: "Playback failed" }
+        opening = false
    }

    // Per episode: the stream Rust holds open. The surface is the screen's, not
@@ -266,12 +310,8 @@ fun PlayerScreen(
            )
        }
    }
-    LaunchedEffect(key) {
-        while (true) {
-            delay(5_000)
-            save()
-        }
-    }
+    // The five-second save is PlaybackService's, which outlives this screen;
+    // these are the moments only the screen sees.
    DisposableEffect(key) { onDispose { save() } }

    val next = episodes.getOrNull(index + 1)
@@ -294,9 +334,8 @@ fun PlayerScreen(
        onIndexChange(target)
    }

-    // What the media notification, the lock screen and Picture-in-Picture show.
-    // None of them can reach this composition, and all three have to name the
-    // episode rather than the app.
+    // What the media notification and the lock screen show. Neither can reach
+    // this composition, and both have to name the episode rather than the app.
    LaunchedEffect(key, index, episodes.size, title.key) {
        nativeHost.publish(
            NowPlaying(
@@ -324,8 +363,10 @@ fun PlayerScreen(

    // Autoplay fires on a clean end of file only, and only for this episode's
    // own reading — never on a failure, and never on the outgoing file's.
+    // Cancelled from the end-of-file card: the viewer chose to stay.
+    var stay by remember(key) { mutableStateOf(false) }
    LaunchedEffect(state.endReason, state.media) {
-        if (state.endReason == EndReason.Eof && state.media == key && autoplay && next != null) advance()
+        if (state.endReason == EndReason.Eof && state.media == key && autoplay && !stay && next != null) advance()
    }
    // A file mpv could not play ends like any other. Saying so is the whole
    // difference between a broken episode and an app that silently skipped one.
@@ -334,14 +375,42 @@ fun PlayerScreen(
            playbackError = "This episode could not be played."
        }
    }
+    // A stall that does not clear is a dropped connection far more often than
+    // a slow one, and "Buffering…" for ever offers no way out of it.
+    LaunchedEffect(state.buffering, key, attempt) {
+        if (state.buffering) {
+            delay(STALL_LIMIT_MS)
+            playbackError = "Still loading. The connection may have dropped."
+        }
+    }
    // What mpv itself complained about, which the play call never sees: by the
    // time a header turns out to be unreadable it has long since returned.
    val problem by nativeHost.problem.collectAsState()
    LaunchedEffect(problem) { problem?.let { playbackError = it } }

-    val offer = remember(chapters, key, (state.position * 4).roundToInt()) {
+    // Whether mpv's readings are this episode's. Not while the next one opens:
+    // the last one's credits play on until it is loaded, and read against the
+    // new index they offered the episode after the next as up next.
+    val playingThis = state.media == key
+    val offer = remember(chapters, key, playingThis, (state.position * 4).roundToInt()) {
+        if (!playingThis) return@remember null
        runCatching { skipOffer(chapters, state.position) }.getOrNull()
    }
+    // Near the end, fetch the next episode's opening blocks, so autoplay or
+    // "Play now" starts from the cache. The last two minutes or the credits,
+    // whichever comes first: late enough that stopping after one episode has
+    // not cost a download, early enough to matter.
+    val nearEnd = playingThis && state.duration > 0.0 && (
+        state.duration - state.position < WARM_NEXT_SECONDS ||
+            chapters.creditsStart?.let { state.position >= it } == true
+        )
+    LaunchedEffect(key, nearEnd) {
+        val upcoming = next ?: return@LaunchedEffect
+        if (!nearEnd) return@LaunchedEffect
+        runCatching {
+            NativeRuntime.engine().warmEpisode(upcoming.shareId, upcoming.volumeId, upcoming.linkId)
+        }
+    }
    // Auto-skip is offered once per chapter: seeking back into an opening on
    // purpose must not be undone by the setting that skipped it.
    val skipped = remember(key) { mutableSetOf<Long>() }
@@ -352,31 +421,105 @@ fun PlayerScreen(
    }

    var landscapeLocked by remember { mutableStateOf(false) }
+    // Set by the rotation button: from then on the viewer decides.
+    var rotationChosen by remember { mutableStateOf(false) }
+    // A wide picture fills a phone only on its side, so it turns there by
+    // itself, once per episode, until the viewer picks for themselves.
+    LaunchedEffect(key, playingThis, state.videoWidth > state.videoHeight) {
+        if (!playingThis || rotationChosen || landscapeLocked) return@LaunchedEffect
+        if (state.videoHeight > 0.0 && state.videoWidth > state.videoHeight) {
+            landscapeLocked = activity?.lockLandscape() ?: false
+        }
+    }
    var showControls by remember { mutableStateOf(true) }
-    LaunchedEffect(showControls, state.paused) {
-        if (showControls && !state.paused) {
+    // TalkBack moves between controls by swiping, and a control that fades
+    // four seconds after it is reached cannot be found again.
+    val exploring = rememberTouchExploration()
+    LaunchedEffect(exploring) { if (exploring) showControls = true }
+    LaunchedEffect(showControls, state.paused, exploring) {
+        if (showControls && !state.paused && !exploring) {
            delay(CONTROLS_SECONDS * 1_000)
            showControls = false
        }
    }
-    // Everything this screen draws over the picture is sized for a phone panel
-    // and unreadable in a thumbnail, and Android supplies its own transport
-    // there. Leaving PiP must find the controls up rather than mid-timeout.
-    val overlays = !inPictureInPicture
-    LaunchedEffect(inPictureInPicture) { if (!inPictureInPicture) showControls = true }
-
+    // Which side was double-tapped, shown for a moment so the seek is seen
+    // to have happened; the count makes a second tap on one side show again.
+    var nudge by remember { mutableStateOf<Pair<Int, Int>?>(null) }
+    LaunchedEffect(nudge) {
+        if (nudge != null) {
+            delay(NUDGE_MS)
+            nudge = null
+        }
+    }
+    val current by rememberUpdatedState(state)
+    // Where a remote's keys land while the controls are down. Once they are
+    // up, the D-pad moves between their buttons as it does anywhere else.
+    val keys = remember { FocusRequester() }
+    LaunchedEffect(showControls) { if (!showControls) runCatching { keys.requestFocus() } }
    if (minimized) return

    Box(
        Modifier
            .fillMaxSize()
            .background(Color.Black)
-            .clickable(
-                interactionSource = remember { MutableInteractionSource() },
-                indication = null,
-                enabled = overlays,
-                onClick = { showControls = !showControls },
-            ),
+            // A TV remote, a keyboard: left and right seek as a double tap
+            // does, the middle button brings the controls up, and play/pause
+            // and space do what they say.
+            .focusRequester(keys)
+            .onKeyEvent { event ->
+                if (event.type != KeyEventType.KeyDown) return@onKeyEvent false
+                when (event.key) {
+                    Key.DirectionLeft, Key.DirectionRight -> {
+                        if (showControls) return@onKeyEvent false
+                        val seconds = if (event.key == Key.DirectionLeft) -DOUBLE_TAP_SECONDS else DOUBLE_TAP_SECONDS
+                        host.seek((current.position + seconds).coerceAtLeast(0.0))
+                        nudge = seconds to (nudge?.second ?: 0) + 1
+                        true
+                    }
+                    Key.DirectionCenter, Key.Enter, Key.NumPadEnter, Key.DirectionUp, Key.DirectionDown -> {
+                        if (showControls) return@onKeyEvent false
+                        showControls = true
+                        true
+                    }
+                    Key.MediaPlayPause, Key.Spacebar -> {
+                        host.setPaused(!current.paused)
+                        showControls = true
+                        true
+                    }
+                    Key.MediaPlay -> { host.setPaused(false); true }
+                    Key.MediaPause -> { host.setPaused(true); true }
+                    else -> false
+                }
+            }
+            .focusable()
+            // Double-tap a side to seek ten seconds, as every phone video
+            // player has taught; the middle plays or pauses. A single tap
+            // waits out the double-tap timeout, which is the price of both.
+            .pointerInput(host) {
+                detectTapGestures(
+                    onTap = { showControls = !showControls },
+                    onDoubleTap = { offset ->
+                        val third = size.width / 3f
+                        val seconds = when {
+                            offset.x < third -> -DOUBLE_TAP_SECONDS
+                            offset.x > size.width - third -> DOUBLE_TAP_SECONDS
+                            else -> 0
+                        }
+                        if (seconds == 0) {
+                            host.setPaused(!current.paused)
+                        } else {
+                            host.seek((current.position + seconds).coerceAtLeast(0.0))
+                            nudge = seconds to (nudge?.second ?: 0) + 1
+                        }
+                    },
+                )
+            }
+            .semantics {
+                onClick(label = if (showControls) "Hide controls" else "Show controls") {
+                    showControls = !showControls
+                    true
+                }
+            },
    ) {
        AndroidView(
            modifier = Modifier.fillMaxSize(),
@@ -393,7 +536,7 @@ fun PlayerScreen(
        )

        AnimatedVisibility(
-            visible = overlays && showControls,
+            visible = showControls,
            modifier = Modifier.align(Alignment.TopStart),
            enter = fadeIn(),
            exit = fadeOut(),
@@ -450,7 +593,7 @@ fun PlayerScreen(
        }

        AnimatedVisibility(
-            visible = overlays && showControls,
+            visible = showControls,
            modifier = Modifier.align(Alignment.BottomCenter),
            enter = fadeIn(),
            exit = fadeOut(),
@@ -468,7 +611,10 @@ fun PlayerScreen(
                episodes = episodes,
                playing = index,
                onEpisode = { jumpTo(it) },
-                onRotate = { landscapeLocked = activity?.toggleLandscape() ?: false },
+                onRotate = {
+                    rotationChosen = true
+                    landscapeLocked = activity?.toggleLandscape() ?: false
+                },
                landscapeLocked = landscapeLocked,
            )
        }
@@ -476,7 +622,7 @@ fun PlayerScreen(
        // Drawn whether or not the rest of the controls are up: an opening lasts
        // ninety seconds, and a button you have to wake with a tap is one nobody
        // reaches in time.
-        offer?.takeIf { overlays && !autoSkip }?.let { skip ->
+        offer?.takeIf { !autoSkip }?.let { skip ->
            TonalButton(
                onClick = { nativeHost.seek(skip.target) },
                modifier = Modifier
@@ -486,21 +632,59 @@ fun PlayerScreen(
            ) { Text(skip.label) }
        }

+        nudge?.let { (seconds, _) ->
+            Box(
+                Modifier
+                    .align(if (seconds < 0) Alignment.CenterStart else Alignment.CenterEnd)
+                    .padding(horizontal = 48.dp)
+                    .size(72.dp)
+                    .clip(CircleShape)
+                    .background(MaterialTheme.colorScheme.scrim.copy(alpha = 0.5f)),
+                contentAlignment = Alignment.Center,
+            ) {
+                Text(if (seconds < 0) "−${-seconds} s" else "+$seconds s", color = Color.White)
+            }
+        }
+
+        // A file with no chapters has no credits to count over, so the card
+        // takes its last seconds instead: without it the next episode cut in
+        // with no warning and no way to stay. Counted on the file's own clock,
+        // so it reaches zero at the end of file, which is what advances.
+        val tailLeft = (state.duration - state.position).takeIf {
+            chapters.creditsStart == null && state.duration > UP_NEXT_SECONDS * 6 && it <= UP_NEXT_SECONDS
+        }
        UpNextCard(
            next = next,
-            visible = overlays && autoplay && !state.paused &&
-                chapters.creditsStart?.let { state.position >= it } == true,
+            visible = autoplay && !stay && !state.paused && !state.ended && playingThis &&
+                (tailLeft != null || chapters.creditsStart?.let { state.position >= it } == true),
+            secondsLeft = tailLeft?.let { ceil(it).toInt() },
            onPlayNow = { advance() },
+            onStay = { stay = true },
            modifier = Modifier
                .align(Alignment.BottomEnd)
                .windowInsetsPadding(WindowInsets.safeDrawing)
                .padding(end = 16.dp, bottom = if (showControls) 132.dp else 24.dp),
        )

+        // Played to the end with nothing starting after it: the last episode,
+        // autoplay off, or the viewer stayed. A black screen said none of that.
+        if (playingThis && state.endReason == EndReason.Eof && (next == null || !autoplay || stay)) {
+            EndCard(
+                finished = episode.label,
+                show = title.displayName,
+                next = next,
+                onPlayNext = { advance() },
+                // mpv unloads a file at its end, so this opens it again.
+                onReplay = { retryFrom = 0.0; attempt++ },
+                onClose = onClose,
+                modifier = Modifier.align(Alignment.Center),
+            )
+        }
+
        // Only while nothing else explains the still picture: an error is the
        // more useful thing to say, and a spinner over it reads as "still
        // trying".
-        if (state.stalled && playbackError == null) {
+        if ((opening || state.stalled) && playbackError == null) {
            Column(
                Modifier
                    .align(Alignment.Center)
@@ -512,10 +696,13 @@ fun PlayerScreen(
                    color = MaterialTheme.colorScheme.primary,
                    modifier = Modifier.size(36.dp),
                )
-                if (state.buffering) {
+                if (opening || state.buffering) {
                    Text(
-                        state.cachePercent.takeIf { it > 0.0 }
-                            ?.let { "Buffering… ${it.roundToInt()}%" } ?: "Buffering…",
+                        when {
+                            opening -> "Opening ${episode.label}…"
+                            state.cachePercent > 0.0 -> "Buffering… ${state.cachePercent.roundToInt()}%"
+                            else -> "Buffering…"
+                        },
                        color = MaterialTheme.colorScheme.onSurface,
                        style = MaterialTheme.typography.labelMedium,
                        modifier = Modifier.padding(top = 12.dp),
@@ -536,14 +723,29 @@ fun PlayerScreen(
                // Dismissible, because the message is not always fatal — a
                // subtitle track that failed to load leaves an episode that
                // plays perfectly well behind an error that used to be permanent.
-                QuietButton(onClick = { playbackError = null; nativeHost.clearProblem() }) {
-                    Text("Dismiss", color = MaterialTheme.colorScheme.onErrorContainer)
+                Row {
+                    QuietButton(onClick = { playbackError = null; nativeHost.clearProblem() }) {
+                        Text("Dismiss", color = MaterialTheme.colorScheme.onErrorContainer)
+                    }
+                    QuietButton(
+                        onClick = {
+                            retryFrom = state.position.takeIf { state.media == key && it > 0.0 } ?: retryFrom
+                            playbackError = null
+                            nativeHost.clearProblem()
+                            attempt++
+                        },
+                    ) {
+                        Text("Retry", color = MaterialTheme.colorScheme.onErrorContainer)
+                    }
                }
            }
        }
    }
 }

+/** How long a stall lasts before the player offers to open the episode again. */
+private const val STALL_LIMIT_MS = 20_000L
+
 private data class Startup(
    val nativeHandle: ULong,
    val size: ULong,
@@ -588,6 +790,26 @@ private fun ImmersiveWindow(activity: Activity?) {
    }
 }

+/** Lock to landscape. Reports whether it is. */
+private fun Activity.lockLandscape(): Boolean {
+    requestedOrientation = ActivityInfo.SCREEN_ORIENTATION_SENSOR_LANDSCAPE
+    return true
+}
+
+/** Whether TalkBack, or anything else that explores by touch, is on. */
+@Composable
+private fun rememberTouchExploration(): Boolean {
+    val context = LocalContext.current
+    val manager = remember(context) { context.getSystemService(AccessibilityManager::class.java) }
+    var exploring by remember { mutableStateOf(manager?.isTouchExplorationEnabled == true) }
+    DisposableEffect(manager) {
+        val listener = AccessibilityManager.TouchExplorationStateChangeListener { exploring = it }
+        manager?.addTouchExplorationStateChangeListener(listener)
+        onDispose { manager?.removeTouchExplorationStateChangeListener(listener) }
+    }
+    return exploring
+}
+
 /** Lock to landscape, or hand rotation back to the sensor. Reports which. */
 private fun Activity.toggleLandscape(): Boolean {
    val lock = requestedOrientation != ActivityInfo.SCREEN_ORIENTATION_SENSOR_LANDSCAPE
@@ -634,8 +856,15 @@ private fun PlayerControls(
    }
    val duration = state.duration.toFloat().coerceAtLeast(1f)
    val density = LocalDensity.current
-    val roomForVolume = with(density) {
-        LocalWindowInfo.current.containerSize.width.toDp() >= VOLUME_SLIDER_MIN_WIDTH
+    val width = with(density) { LocalWindowInfo.current.containerSize.width.toDp() }
+    val roomForVolume = width >= VOLUME_SLIDER_MIN_WIDTH
+    // A phone in portrait has room for the transport and two more buttons at
+    // a thumb's size. The rest go behind "More" there rather than off the edge.
+    val roomForAll = width >= INLINE_CONTROLS_MIN_WIDTH
+    val toggleMute = {
+        host.setMuted(!state.muted)
+        scope.launch(Dispatchers.IO) { rememberVolume(muted = !state.muted) }
+        Unit
    }

    Column(
@@ -697,45 +926,80 @@ private fun PlayerControls(
                CompactIcon(Icons.Default.SkipNext, "Next episode", enabled = hasNext, onClick = onNext)
            }
            Row(verticalAlignment = Alignment.CenterVertically) {
-                if (episodes.size > 1) {
-                    CompactIcon(Icons.Default.VideoLibrary, "Episodes") { showEpisodes = true }
-                }
-                if (chapters.size > 1) {
-                    CompactIcon(Icons.AutoMirrored.Filled.Toc, "Chapters") { showChapters = true }
-                }
-                CompactIcon(Icons.Default.Speed, "Playback speed") { showSpeeds = true }
-                CompactIcon(Icons.Default.Audiotrack, "Audio track") { choosing = "audio" }
-                CompactIcon(Icons.Default.Subtitles, "Subtitles") { choosing = "sub" }
-                CompactIcon(
-                    if (state.muted) Icons.AutoMirrored.Filled.VolumeOff else Icons.AutoMirrored.Filled.VolumeUp,
-                    "Mute",
-                ) {
-                    host.setMuted(!state.muted)
-                    scope.launch(Dispatchers.IO) { rememberVolume(muted = !state.muted) }
-                }
-                // The app's own volume, which is not the device's: a file
-                // mastered quiet is turned up here and stays up for the next
-                // one. Only where there is room for it — a phone in portrait
-                // has the system volume keys and no width to spare.
-                if (roomForVolume) {
-                    var dragging by remember { mutableStateOf<Float?>(null) }
-                    Slider(
-                        value = dragging ?: state.volume.toFloat().coerceIn(0f, MAX_VOLUME),
-                        onValueChange = { dragging = it; host.setVolume(it.toDouble()) },
-                        onValueChangeFinished = {
-                            val chosen = dragging?.toDouble()
-                            dragging = null
-                            chosen?.let { scope.launch(Dispatchers.IO) { rememberVolume(volume = it) } }
-                        },
-                        valueRange = 0f..MAX_VOLUME,
-                        modifier = Modifier.width(96.dp),
+                if (!roomForAll) {
+                    CompactIcon(Icons.Default.Subtitles, "Subtitles") { choosing = "sub" }
+                    var more by remember { mutableStateOf(false) }
+                    Box {
+                        CompactIcon(Icons.Default.MoreVert, "More") { more = true }
+                        DropdownMenu(expanded = more, onDismissRequest = { more = false }) {
+                            val entries = buildList {
+                                if (episodes.size > 1) add(Triple(Icons.Default.VideoLibrary, "Episodes") { showEpisodes = true })
+                                if (chapters.size > 1) add(Triple(Icons.AutoMirrored.Filled.Toc, "Chapters") { showChapters = true })
+                                add(Triple(Icons.Default.Speed, "Playback speed") { showSpeeds = true })
+                                add(Triple(Icons.Default.Audiotrack, "Audio track") { choosing = "audio" })
+                                add(
+                                    Triple(
+                                        if (state.muted) Icons.AutoMirrored.Filled.VolumeUp else Icons.AutoMirrored.Filled.VolumeOff,
+                                        if (state.muted) "Unmute" else "Mute",
+                                        toggleMute,
+                                    ),
+                                )
+                                add(
+                                    Triple(
+                                        if (landscapeLocked) Icons.Default.FullscreenExit else Icons.Default.Fullscreen,
+                                        if (landscapeLocked) "Unlock rotation" else "Lock to landscape",
+                                        onRotate,
+                                    ),
+                                )
+                            }
+                            entries.forEach { (icon, label, action) ->
+                                DropdownMenuItem(
+                                    text = { Text(label) },
+                                    leadingIcon = { Icon(icon, contentDescription = null) },
+                                    onClick = { more = false; action() },
+                                )
+                            }
+                        }
+                    }
+                } else {
+                    if (episodes.size > 1) {
+                        CompactIcon(Icons.Default.VideoLibrary, "Episodes") { showEpisodes = true }
+                    }
+                    if (chapters.size > 1) {
+                        CompactIcon(Icons.AutoMirrored.Filled.Toc, "Chapters") { showChapters = true }
+                    }
+                    CompactIcon(Icons.Default.Speed, "Playback speed") { showSpeeds = true }
+                    CompactIcon(Icons.Default.Audiotrack, "Audio track") { choosing = "audio" }
+                    CompactIcon(Icons.Default.Subtitles, "Subtitles") { choosing = "sub" }
+                    CompactIcon(
+                        if (state.muted) Icons.AutoMirrored.Filled.VolumeOff else Icons.AutoMirrored.Filled.VolumeUp,
+                        if (state.muted) "Unmute" else "Mute",
+                        onClick = toggleMute,
+                    )
+                    // The app's own volume, which is not the device's: a file
+                    // mastered quiet is turned up here and stays up for the next
+                    // one. Only where there is room for it — a phone in portrait
+                    // has the system volume keys and no width to spare.
+                    if (roomForVolume) {
+                        var dragging by remember { mutableStateOf<Float?>(null) }
+                        Slider(
+                            value = dragging ?: state.volume.toFloat().coerceIn(0f, MAX_VOLUME),
+                            onValueChange = { dragging = it; host.setVolume(it.toDouble()) },
+                            onValueChangeFinished = {
+                                val chosen = dragging?.toDouble()
+                                dragging = null
+                                chosen?.let { scope.launch(Dispatchers.IO) { rememberVolume(volume = it) } }
+                            },
+                            valueRange = 0f..MAX_VOLUME,
+                            modifier = Modifier.width(96.dp),
+                        )
+                    }
+                    CompactIcon(
+                        if (landscapeLocked) Icons.Default.FullscreenExit else Icons.Default.Fullscreen,
+                        if (landscapeLocked) "Unlock rotation" else "Lock to landscape",
+                        onClick = onRotate,
                    )
                }
-                CompactIcon(
-                    if (landscapeLocked) Icons.Default.FullscreenExit else Icons.Default.Fullscreen,
-                    if (landscapeLocked) "Unlock rotation" else "Lock to landscape",
-                    onClick = onRotate,
-                )
            }
        }
    }
@@ -996,24 +1260,31 @@ private fun EpisodeChooser(
 *
 * "Watch till the end" holds for the rest of the file: someone who wants the
 * post-credits scene should have to say so once, not once every ten seconds.
+ *
+ * With [secondsLeft] the card counts down the end of a file that has no credits
+ * chapter, on the file's own clock; the end of file is what advances, and the
+ * second button is "Cancel", since there are no credits to watch.
 */
@Composable
 private fun UpNextCard(
    next: EpisodeRecord?,
    visible: Boolean,
+    secondsLeft: Int?,
    onPlayNow: () -> Unit,
+    onStay: () -> Unit,
    modifier: Modifier = Modifier,
 ) {
    var held by remember(next?.linkId) { mutableStateOf(false) }
-    var remaining by remember(next?.linkId) { mutableStateOf(UP_NEXT_SECONDS) }
+    var counted by remember(next?.linkId) { mutableStateOf(UP_NEXT_SECONDS) }
+    val remaining = secondsLeft ?: counted
    val upNext = next
    val showing = visible && upNext != null && !held
-    LaunchedEffect(showing) {
-        if (!showing) return@LaunchedEffect
-        remaining = UP_NEXT_SECONDS
-        while (remaining > 0) {
+    LaunchedEffect(showing, secondsLeft == null) {
+        if (!showing || secondsLeft != null) return@LaunchedEffect
+        counted = UP_NEXT_SECONDS
+        while (counted > 0) {
            delay(1_000)
-            remaining -= 1
+            counted -= 1
        }
        onPlayNow()
    }
@@ -1076,8 +1347,49 @@ private fun UpNextCard(
                )
            }
        }
-        QuietButton(onClick = { held = true }, modifier = Modifier.padding(top = 4.dp)) {
-            Text("Watch till the end")
+        if (secondsLeft != null) {
+            QuietButton(onClick = { held = true; onStay() }, modifier = Modifier.padding(top = 4.dp)) {
+                Text("Cancel")
+            }
+        } else {
+            QuietButton(onClick = { held = true }, modifier = Modifier.padding(top = 4.dp)) {
+                Text("Watch till the end")
+            }
+        }
+    }
+}
+
+/** What the player says once an episode ends and nothing starts after it. */
+@Composable
+private fun EndCard(
+    finished: String,
+    show: String,
+    next: EpisodeRecord?,
+    onPlayNext: () -> Unit,
+    onReplay: () -> Unit,
+    onClose: () -> Unit,
+    modifier: Modifier = Modifier,
+) {
+    Column(
+        modifier
+            .widthIn(max = 360.dp)
+            .background(MaterialTheme.colorScheme.surfaceContainerHighest, MaterialTheme.shapes.medium)
+            .padding(20.dp),
+        horizontalAlignment = Alignment.CenterHorizontally,
+    ) {
+        Text(
+            if (next == null) "That was the last episode of $show" else "Finished $finished",
+            color = MaterialTheme.colorScheme.onSurface,
+            style = MaterialTheme.typography.titleMedium,
+            textAlign = TextAlign.Center,
+        )
+        Row(Modifier.padding(top = 12.dp), verticalAlignment = Alignment.CenterVertically) {
+            if (next != null) {
+                AccentButton(onClick = onPlayNext) { Text("Play next") }
+            } else {
+                QuietButton(onClick = onReplay) { Text("Watch again") }
+            }
+            QuietButton(onClick = onClose, modifier = Modifier.padding(start = 8.dp)) { Text("Close") }
        }
    }
 }
@@ -1119,12 +1431,14 @@ private fun CompactIcon(
    enabled: Boolean = true,
    onClick: () -> Unit,
 ) {
-    IconButton(onClick = onClick, enabled = enabled, modifier = Modifier.size(40.dp)) {
+    // 48dp: the smallest target Android's accessibility guidance allows, and
+    // the size a thumb on a moving train actually hits.
+    IconButton(onClick = onClick, enabled = enabled, modifier = Modifier.size(48.dp)) {
        Icon(
            icon,
            contentDescription = description,
            tint = if (enabled) Color.White else Color.White.copy(alpha = 0.35f),
-            modifier = Modifier.size(22.dp),
+            modifier = Modifier.size(24.dp),
        )
    }
 }
@@ -1,6 +1,7 @@
 package io.narl.protonstream.settings

 import android.content.Context
+import androidx.core.content.edit

 /**
 * The settings that are Android's alone.
@@ -35,6 +36,31 @@ class SettingsStore(context: Context) {
        get() = preferences.getInt(KEY_CACHE_BUDGET_GIB, DEFAULT_CACHE_BUDGET_GIB)
        set(value) { preferences.edit().putInt(KEY_CACHE_BUDGET_GIB, value).apply() }

+    /** How the library was last sorted, as a `LibrarySort` name; null for the default. */
+    var librarySort: String?
+        get() = preferences.getString(KEY_LIBRARY_SORT, null)
+        set(value) { preferences.edit { putString(KEY_LIBRARY_SORT, value) } }
+
+    /** The library's offer of posters and synopses was turned down. */
+    var metadataOfferDismissed: Boolean
+        get() = preferences.getBoolean(KEY_METADATA_OFFER_DISMISSED, false)
+        set(value) { preferences.edit { putBoolean(KEY_METADATA_OFFER_DISMISSED, value) } }
+
+    /** Which titles the library last showed, as a `LibraryFilter` name; null for all. */
+    var libraryFilter: String?
+        get() = preferences.getString(KEY_LIBRARY_FILTER, null)
+        set(value) { preferences.edit { putString(KEY_LIBRARY_FILTER, value) } }
+
+    /** Whether the library folds each franchise into one tile. */
+    var libraryGrouped: Boolean
+        get() = preferences.getBoolean(KEY_LIBRARY_GROUPED, true)
+        set(value) { preferences.edit { putBoolean(KEY_LIBRARY_GROUPED, value) } }
+
+    /** Whether a background crawl may say that a show gained episodes. */
+    var newEpisodeNotifications: Boolean
+        get() = preferences.getBoolean(KEY_NEW_EPISODE_NOTIFICATIONS, true)
+        set(value) { preferences.edit { putBoolean(KEY_NEW_EPISODE_NOTIFICATIONS, value) } }
+
    companion object {
        /** The desktop's range, in the steps a phone's storage is bought in. */
        val CACHE_BUDGET_CHOICES = listOf(1, 2, 4, 8, 16)
@@ -44,10 +70,20 @@ class SettingsStore(context: Context) {

        fun gibToBytes(gib: Int): ULong = gib.toULong() * 1024uL * 1024uL * 1024uL

+        /** Load the file into memory, so no later read waits on the disk. */
+        fun preload(context: Context) {
+            context.getSharedPreferences(NAME, Context.MODE_PRIVATE).all
+        }
+
        private const val NAME = "proton_stream_settings"
        private const val KEY_WIFI_ONLY = "wifi_only"
        private const val KEY_BACKGROUND_AUDIO = "background_audio"
        private const val KEY_HARDWARE_DECODING = "hardware_decoding"
        private const val KEY_CACHE_BUDGET_GIB = "cache_budget_gib"
+        private const val KEY_LIBRARY_SORT = "library_sort"
+        private const val KEY_LIBRARY_GROUPED = "library_grouped"
+        private const val KEY_LIBRARY_FILTER = "library_filter"
+        private const val KEY_NEW_EPISODE_NOTIFICATIONS = "new_episode_notifications"
+        private const val KEY_METADATA_OFFER_DISMISSED = "metadata_offer_dismissed"
    }
 }
@@ -0,0 +1,136 @@
+package io.narl.protonstream.sync
+
+import android.Manifest
+import android.app.NotificationChannel
+import android.app.NotificationManager
+import android.app.PendingIntent
+import android.content.Context
+import android.content.Intent
+import android.content.pm.PackageManager
+import android.os.Build
+import androidx.core.app.NotificationCompat
+import androidx.core.app.NotificationManagerCompat
+import androidx.work.Constraints
+import androidx.work.CoroutineWorker
+import androidx.work.ExistingPeriodicWorkPolicy
+import androidx.work.NetworkType
+import androidx.work.PeriodicWorkRequestBuilder
+import androidx.work.WorkManager
+import androidx.work.WorkerParameters
+import io.narl.protonstream.MainActivity
+import io.narl.protonstream.R
+import io.narl.protonstream.native.NativeRuntime
+import io.narl.protonstream.settings.SettingsStore
+import uniffi.pstr_android.NewEpisodesRecord
+import java.util.concurrent.TimeUnit
+
+/**
+ * Look at the shares while the app is away, and say when a show gained episodes.
+ *
+ * The app crawls a share it has not looked at for six hours whenever it opens,
+ * which finds a new episode only once someone opens it to look. This runs the
+ * same crawl on WorkManager's schedule instead. It only reports files the
+ * crawl itself found, so a share the app crawled since says nothing twice.
+ */
+class NewEpisodesWorker(
+    appContext: Context,
+    parameters: WorkerParameters,
+) : CoroutineWorker(appContext, parameters) {
+    override suspend fun doWork(): Result {
+        if (!SettingsStore(applicationContext).newEpisodeNotifications) return Result.success()
+        val news = runCatching { NativeRuntime.engine().crawlForNews() }.getOrElse { return Result.retry() }
+        if (news.isNotEmpty()) post(news)
+        return Result.success()
+    }
+
+    private fun post(news: List<NewEpisodesRecord>) {
+        if (
+            Build.VERSION.SDK_INT >= Build.VERSION_CODES.TIRAMISU &&
+            applicationContext.checkSelfPermission(Manifest.permission.POST_NOTIFICATIONS) !=
+            PackageManager.PERMISSION_GRANTED
+        ) {
+            return
+        }
+        val manager = applicationContext.getSystemService(NotificationManager::class.java)
+        manager.createNotificationChannel(
+            NotificationChannel(CHANNEL_ID, "New episodes", NotificationManager.IMPORTANCE_DEFAULT).apply {
+                description = "A show in your library gained episodes"
+            },
+        )
+        val open = PendingIntent.getActivity(
+            applicationContext,
+            0,
+            Intent(applicationContext, MainActivity::class.java),
+            PendingIntent.FLAG_IMMUTABLE or PendingIntent.FLAG_UPDATE_CURRENT,
+        )
+        val compat = NotificationManagerCompat.from(applicationContext)
+        // One per show, keyed by it, so a second crawl's news for the same show
+        // replaces the first rather than stacking under it.
+        news.forEach { item ->
+            val notification = NotificationCompat.Builder(applicationContext, CHANNEL_ID)
+                .setSmallIcon(R.drawable.ic_notification_stream)
+                .setContentTitle(item.title)
+                .setContentText(describe(item))
+                .setContentIntent(open)
+                .setGroup(GROUP)
+                .setAutoCancel(true)
+                .build()
+            compat.notify(item.titleKey, NOTIFICATION_ID, notification)
+        }
+        if (news.size > 1) {
+            val summary = NotificationCompat.Builder(applicationContext, CHANNEL_ID)
+                .setSmallIcon(R.drawable.ic_notification_stream)
+                .setContentTitle("New episodes")
+                .setContentText(news.joinToString { it.title })
+                .setContentIntent(open)
+                .setGroup(GROUP)
+                .setGroupSummary(true)
+                .setAutoCancel(true)
+                .build()
+            compat.notify(SUMMARY_TAG, NOTIFICATION_ID, summary)
+        }
+    }
+
+    companion object {
+        private const val WORK_NAME = "new-episodes"
+        private const val CHANNEL_ID = "new-episodes"
+        private const val GROUP = "io.narl.protonstream.NEW_EPISODES"
+        private const val SUMMARY_TAG = "new-episodes-summary"
+        private const val NOTIFICATION_ID = 7
+        private const val INTERVAL_HOURS = 6L
+
+        /** What one show's notification says: "S01E04 and 2 more". */
+        fun describe(news: NewEpisodesRecord): String {
+            val more = news.count.toInt() - 1
+            val first = news.first
+            return when {
+                first == null -> if (news.count == 1u) "1 new episode" else "${news.count} new episodes"
+                more == 0 -> "$first is new"
+                more == 1 -> "$first and 1 more are new"
+                else -> "$first and $more more are new"
+            }
+        }
+
+        /**
+         * Keep the periodic look scheduled, or cancel it when the viewer
+         * turned it off. Called on every launch; keeping an existing schedule
+         * means a launch does not push the next look back.
+         */
+        fun schedule(context: Context) {
+            val work = WorkManager.getInstance(context.applicationContext)
+            if (!SettingsStore(context).newEpisodeNotifications) {
+                work.cancelUniqueWork(WORK_NAME)
+                return
+            }
+            val request = PeriodicWorkRequestBuilder<NewEpisodesWorker>(INTERVAL_HOURS, TimeUnit.HOURS)
+                .setConstraints(
+                    Constraints.Builder()
+                        .setRequiredNetworkType(NetworkType.CONNECTED)
+                        .setRequiresBatteryNotLow(true)
+                        .build(),
+                )
+                .build()
+            work.enqueueUniquePeriodicWork(WORK_NAME, ExistingPeriodicWorkPolicy.KEEP, request)
+        }
+    }
+}
@@ -0,0 +1,56 @@
+package io.narl.protonstream.sync
+
+import android.content.Context
+import androidx.work.BackoffPolicy
+import androidx.work.Constraints
+import androidx.work.CoroutineWorker
+import androidx.work.ExistingWorkPolicy
+import androidx.work.NetworkType
+import androidx.work.OneTimeWorkRequestBuilder
+import androidx.work.WorkManager
+import androidx.work.WorkerParameters
+import io.narl.protonstream.native.NativeRuntime
+import uniffi.pstr_android.AccountState
+import java.util.concurrent.TimeUnit
+
+/**
+ * One watch-history sync after the app leaves the screen.
+ *
+ * The model's timer only runs while the app is alive, and Android is free to
+ * kill a process in the background without notice — so the position the
+ * viewer stopped at would wait for the next launch to reach their other
+ * devices. Handed to WorkManager instead, it goes as soon as there is a
+ * network, even if the process is gone by then.
+ */
+class WatchSyncWorker(
+    appContext: Context,
+    parameters: WorkerParameters,
+) : CoroutineWorker(appContext, parameters) {
+    override suspend fun doWork(): Result {
+        val engine = NativeRuntime.engine()
+        return runCatching { engine.syncWatchHistory() }.fold(
+            onSuccess = { Result.success() },
+            onFailure = {
+                // Signed out by the engine — the session ended — is not
+                // something a retry fixes; a dropped connection is.
+                val signedOut = runCatching { engine.accountState() }.getOrNull() == AccountState.SignedOut
+                if (signedOut || runAttemptCount >= MAX_ATTEMPTS) Result.failure() else Result.retry()
+            },
+        )
+    }
+
+    companion object {
+        private const val WORK_NAME = "watch-history-sync"
+        private const val MAX_ATTEMPTS = 3
+
+        /** Replacing: one pending sync covers every position saved before it runs. */
+        fun enqueue(context: Context) {
+            val request = OneTimeWorkRequestBuilder<WatchSyncWorker>()
+                .setConstraints(Constraints.Builder().setRequiredNetworkType(NetworkType.CONNECTED).build())
+                .setBackoffCriteria(BackoffPolicy.EXPONENTIAL, 30, TimeUnit.SECONDS)
+                .build()
+            WorkManager.getInstance(context.applicationContext)
+                .enqueueUniqueWork(WORK_NAME, ExistingWorkPolicy.REPLACE, request)
+        }
+    }
+}
@@ -0,0 +1,507 @@
+package io.narl.protonstream.ui
+
+import android.annotation.SuppressLint
+import android.os.Handler
+import android.os.Looper
+import android.webkit.JavascriptInterface
+import android.webkit.WebResourceRequest
+import android.webkit.WebView
+import android.webkit.WebViewClient
+import androidx.activity.compose.BackHandler
+import androidx.compose.foundation.clickable
+import androidx.compose.foundation.layout.Arrangement
+import androidx.compose.foundation.layout.Box
+import androidx.compose.foundation.layout.Column
+import androidx.compose.foundation.layout.PaddingValues
+import androidx.compose.foundation.layout.Row
+import androidx.compose.foundation.layout.fillMaxSize
+import androidx.compose.foundation.layout.fillMaxWidth
+import androidx.compose.foundation.layout.height
+import androidx.compose.foundation.layout.padding
+import androidx.compose.foundation.lazy.LazyColumn
+import androidx.compose.foundation.lazy.items
+import androidx.compose.foundation.text.KeyboardOptions
+import androidx.compose.material.icons.Icons
+import androidx.compose.material.icons.automirrored.filled.ArrowBack
+import androidx.compose.material.icons.filled.AccountCircle
+import androidx.compose.material.icons.filled.Close
+import androidx.compose.material.icons.filled.Computer
+import androidx.compose.material.icons.filled.Folder
+import androidx.compose.material.icons.filled.FolderShared
+import androidx.compose.material.icons.filled.InsertDriveFile
+import androidx.compose.material.icons.filled.Logout
+import androidx.compose.material.icons.filled.Movie
+import androidx.compose.material.icons.filled.MoreVert
+import androidx.compose.material.icons.filled.Storage
+import androidx.compose.material.icons.filled.Sync
+import androidx.compose.material3.AlertDialog
+import androidx.compose.material3.Card
+import androidx.compose.material3.CircularProgressIndicator
+import androidx.compose.material3.DropdownMenu
+import androidx.compose.material3.DropdownMenuItem
+import androidx.compose.material3.ExperimentalMaterial3Api
+import androidx.compose.material3.Icon
+import androidx.compose.material3.IconButton
+import androidx.compose.material3.ListItem
+import androidx.compose.material3.ListItemDefaults
+import androidx.compose.material3.MaterialTheme
+import androidx.compose.material3.OutlinedTextField
+import androidx.compose.material3.Scaffold
+import androidx.compose.material3.Text
+import androidx.compose.material3.TopAppBar
+import androidx.compose.runtime.Composable
+import androidx.compose.runtime.LaunchedEffect
+import androidx.compose.runtime.getValue
+import androidx.compose.runtime.mutableStateListOf
+import androidx.compose.runtime.mutableStateOf
+import androidx.compose.runtime.remember
+import androidx.compose.runtime.setValue
+import androidx.compose.ui.Alignment
+import androidx.compose.ui.Modifier
+import androidx.compose.ui.graphics.Color
+import androidx.compose.ui.text.font.FontWeight
+import androidx.compose.ui.text.input.KeyboardType
+import androidx.compose.ui.text.input.PasswordVisualTransformation
+import androidx.compose.ui.text.style.TextOverflow
+import androidx.compose.ui.unit.dp
+import androidx.compose.ui.viewinterop.AndroidView
+import androidx.compose.ui.window.Dialog
+import androidx.compose.ui.window.DialogProperties
+import androidx.compose.ui.window.SecureFlagPolicy
+import io.narl.protonstream.native.NativeRuntime
+import io.narl.protonstream.ui.theme.AccentButton
+import io.narl.protonstream.ui.theme.TonalButton
+import uniffi.pstr_android.AccountState
+import uniffi.pstr_android.DriveEntryRecord
+import uniffi.pstr_android.DrivePlaceRecord
+import uniffi.pstr_android.PlaceType
+import uniffi.pstr_android.verificationToken
+
+/** What the account card and its dialogs can ask the model for. */
+internal data class AccountActions(
+    val signIn: (String, String, String?) -> Unit,
+    val submitSecondFactor: (String) -> Unit,
+    val submitMailboxPassword: (String) -> Unit,
+    val cancelSignIn: () -> Unit,
+    val dismissVerification: () -> Unit,
+    val signOut: () -> Unit,
+    val syncNow: () -> Unit,
+    val addFolder: (String, String, String) -> Unit,
+    val onError: (Throwable) -> Unit,
+)
+
+/**
+ * The Proton account, at the top of the shares page: why one would sign in,
+ * or who is signed in and how watch-history sync is doing.
+ */
+@Composable
+internal fun AccountCard(
+    account: AccountUiState,
+    actions: AccountActions,
+    onSignIn: () -> Unit,
+    onBrowse: () -> Unit,
+) {
+    val state = account.state ?: return
+    Card(Modifier.fillMaxWidth().padding(horizontal = 16.dp, vertical = 8.dp)) {
+        if (state is AccountState.SignedIn) {
+            var menu by remember { mutableStateOf(false) }
+            ListItem(
+                headlineContent = { Text(state.username, fontWeight = FontWeight.SemiBold) },
+                supportingContent = { Text(syncLine(account, System.currentTimeMillis())) },
+                leadingContent = {
+                    Icon(Icons.Default.AccountCircle, contentDescription = null, tint = MaterialTheme.colorScheme.primary)
+                },
+                trailingContent = {
+                    Box {
+                        IconButton(onClick = { menu = true }) {
+                            Icon(Icons.Default.MoreVert, contentDescription = "Account actions")
+                        }
+                        DropdownMenu(expanded = menu, onDismissRequest = { menu = false }) {
+                            DropdownMenuItem(
+                                text = { Text("Sync now") },
+                                leadingIcon = { Icon(Icons.Default.Sync, contentDescription = null) },
+                                onClick = { menu = false; actions.syncNow() },
+                            )
+                            DropdownMenuItem(
+                                text = { Text("Sign out") },
+                                leadingIcon = { Icon(Icons.Default.Logout, contentDescription = null) },
+                                onClick = { menu = false; actions.signOut() },
+                            )
+                        }
+                    }
+                },
+                colors = ListItemDefaults.colors(containerColor = Color.Transparent),
+            )
+            TonalButton(
+                onClick = onBrowse,
+                modifier = Modifier.padding(start = 16.dp, end = 16.dp, bottom = 16.dp),
+            ) {
+                Icon(Icons.Default.Folder, contentDescription = null)
+                Text("Add from your Drive", Modifier.padding(start = 8.dp))
+            }
+        } else {
+            Column(Modifier.padding(16.dp), verticalArrangement = Arrangement.spacedBy(8.dp)) {
+                Text("Proton account", style = MaterialTheme.typography.titleMedium)
+                Text(
+                    "Optional. Signed in, your shares, settings and watch history are kept in your own " +
+                        "Drive, so every device shows the same library and resumes where another left off, " +
+                        "and folders of your Drive can join the library.",
+                    style = MaterialTheme.typography.bodyMedium,
+                    color = MaterialTheme.colorScheme.onSurfaceVariant,
+                )
+                TonalButton(onClick = onSignIn) { Text("Sign in") }
+            }
+        }
+    }
+}
+
+/** "Synced 3 min ago · 2 from other devices", or why it did not. */
+internal fun syncLine(account: AccountUiState, now: Long): String {
+    account.syncError?.let { return "Did not sync: $it" }
+    val at = account.syncedAt ?: return "Library, settings and watch history sync through your Drive"
+    val minutes = ((now - at).coerceAtLeast(0) / 60_000).toInt()
+    val ago = when {
+        minutes < 1 -> "just now"
+        minutes < 60 -> "$minutes min ago"
+        else -> "${minutes / 60} h ago"
+    }
+    val applied = if (account.applied > 0) " · ${account.applied} from other devices" else ""
+    return "Synced $ago$applied"
+}
+
+/**
+ * Signing in, one step at a time: address and password, then a second-factor
+ * code or the mailbox password if the account has them, with Proton's CAPTCHA
+ * over the top when it asks for one.
+ */
+@Composable
+internal fun SignInDialog(account: AccountUiState, actions: AccountActions, onDismiss: () -> Unit) {
+    var username by remember { mutableStateOf("") }
+    var password by remember { mutableStateOf("") }
+    var code by remember { mutableStateOf("") }
+    var mailbox by remember { mutableStateOf("") }
+    val state = account.state
+    LaunchedEffect(state) {
+        if (state is AccountState.SignedIn) onDismiss()
+    }
+    val dismiss = {
+        if (state == AccountState.SecondFactor || state == AccountState.MailboxPassword) actions.cancelSignIn()
+        onDismiss()
+    }
+    AlertDialog(
+        onDismissRequest = dismiss,
+        properties = DialogProperties(securePolicy = SecureFlagPolicy.SecureOn),
+        title = { Text("Sign in to Proton") },
+        text = {
+            Column(verticalArrangement = Arrangement.spacedBy(8.dp)) {
+                when (state) {
+                    AccountState.SecondFactor -> {
+                        OutlinedTextField(
+                            code,
+                            { code = it },
+                            label = { Text("Code from your authenticator app") },
+                            singleLine = true,
+                            keyboardOptions = KeyboardOptions(keyboardType = KeyboardType.NumberPassword),
+                        )
+                        Text(SECURITY_KEY_NOTE, style = MaterialTheme.typography.bodySmall)
+                    }
+                    AccountState.MailboxPassword -> {
+                        Text(
+                            "This account has a separate mailbox password. It unlocks your files.",
+                            style = MaterialTheme.typography.bodySmall,
+                        )
+                        PasswordField(mailbox, { mailbox = it }, "Mailbox password")
+                    }
+                    else -> {
+                        OutlinedTextField(
+                            username,
+                            { username = it },
+                            label = { Text("Address") },
+                            singleLine = true,
+                            keyboardOptions = KeyboardOptions(keyboardType = KeyboardType.Email),
+                        )
+                        PasswordField(password, { password = it }, "Password")
+                    }
+                }
+                account.error?.let { Text(it, color = MaterialTheme.colorScheme.error) }
+                if (account.busy) CircularProgressIndicator(Modifier.padding(top = 4.dp))
+            }
+        },
+        confirmButton = {
+            when (state) {
+                AccountState.SecondFactor -> AccentButton(
+                    onClick = { actions.submitSecondFactor(code.trim()) },
+                    enabled = code.isNotBlank() && !account.busy,
+                ) { Text("Continue") }
+                AccountState.MailboxPassword -> AccentButton(
+                    onClick = { actions.submitMailboxPassword(mailbox) },
+                    enabled = mailbox.isNotEmpty() && !account.busy,
+                ) { Text("Unlock") }
+                else -> AccentButton(
+                    onClick = { actions.signIn(username.trim(), password, null) },
+                    enabled = username.isNotBlank() && password.isNotEmpty() && !account.busy,
+                ) { Text("Sign in") }
+            }
+        },
+        dismissButton = { TonalButton(onClick = dismiss) { Text("Cancel") } },
+    )
+    account.verificationUrl?.let { url ->
+        VerificationDialog(
+            url = url,
+            onToken = { token -> actions.signIn(username.trim(), password, token) },
+            onDismiss = actions.dismissVerification,
+        )
+    }
+}
+
+@Composable
+private fun PasswordField(value: String, onChange: (String) -> Unit, label: String) = OutlinedTextField(
+    value,
+    onChange,
+    label = { Text(label) },
+    singleLine = true,
+    visualTransformation = PasswordVisualTransformation(),
+    keyboardOptions = KeyboardOptions(keyboardType = KeyboardType.Password),
+)
+
+/**
+ * Proton's hosted CAPTCHA, which it puts in front of a sign-in it does not
+ * recognise — a new network, a VPN exit.
+ *
+ * In a WebView rather than the browser because the page reports success by
+ * posting a message to its host, not by redirecting: a browser has nowhere to
+ * post it back to. The page targets `window.parent`, which for a top-level
+ * page is the page itself, so a listener on its own window hears it.
+ */
+@SuppressLint("SetJavaScriptEnabled") // The verification page is a script; it does not run without.
+@Composable
+private fun VerificationDialog(url: String, onToken: (String) -> Unit, onDismiss: () -> Unit) {
+    Dialog(onDismissRequest = onDismiss, properties = DialogProperties(usePlatformDefaultWidth = false)) {
+        Card(Modifier.fillMaxWidth().padding(16.dp).height(560.dp)) {
+            Row(verticalAlignment = Alignment.CenterVertically) {
+                Text(
+                    "Confirm you are human",
+                    style = MaterialTheme.typography.titleMedium,
+                    modifier = Modifier.weight(1f).padding(start = 16.dp),
+                )
+                IconButton(onClick = onDismiss) { Icon(Icons.Default.Close, contentDescription = "Cancel") }
+            }
+            AndroidView(
+                modifier = Modifier.fillMaxSize(),
+                factory = { context ->
+                    val main = Handler(Looper.getMainLooper())
+                    var answered = false
+                    WebView(context).apply {
+                        settings.javaScriptEnabled = true
+                        settings.domStorageEnabled = true
+                        addJavascriptInterface(
+                            object {
+                                @JavascriptInterface
+                                fun post(message: String) {
+                                    // Every message the page posts lands here,
+                                    // most of them its own chatter.
+                                    val token = verificationToken(message) ?: return
+                                    main.post {
+                                        if (!answered) {
+                                            answered = true
+                                            onToken(token)
+                                        }
+                                    }
+                                }
+                            },
+                            "pstrVerification",
+                        )
+                        webViewClient = object : WebViewClient() {
+                            override fun onPageStarted(view: WebView, url: String?, favicon: android.graphics.Bitmap?) {
+                                view.evaluateJavascript(VERIFICATION_BRIDGE, null)
+                            }
+
+                            override fun onPageFinished(view: WebView, url: String?) {
+                                view.evaluateJavascript(VERIFICATION_BRIDGE, null)
+                            }
+
+                            // The bridge above is reachable by whatever the
+                            // frame shows, so the frame stays on Proton.
+                            override fun shouldOverrideUrlLoading(view: WebView, request: WebResourceRequest) =
+                                !isProtonPage(request.url.scheme, request.url.host)
+                        }
+                        loadUrl(url)
+                    }
+                },
+            )
+        }
+    }
+}
+
+/**
+ * Security keys need WebAuthn, which the sign-in here does not speak. An account
+ * with nothing else is refused before this form (`AccountStore::sign_in`).
+ */
+private const val SECURITY_KEY_NOTE =
+    "Security keys are not supported here — use the code from your authenticator app."
+
+/** Installed once per page, at start and again at finish in case the first ran too early. */
+private const val VERIFICATION_BRIDGE = """
+if (!window.__pstrVerification) {
+    window.__pstrVerification = true;
+    window.addEventListener('message', function (event) {
+        try {
+            pstrVerification.post(typeof event.data === 'string' ? event.data : JSON.stringify(event.data));
+        } catch (e) {}
+    });
+}
+"""
+
+/** Whether a page is Proton's own, over HTTPS. */
+internal fun isProtonPage(scheme: String?, host: String?): Boolean =
+    scheme == "https" && host != null && (host == "proton.me" || host.endsWith(".proton.me"))
+
+/**
+ * Walk the account's Drive and add a folder of it to the library.
+ *
+ * Full screen, because a Drive is deep and a dialog's height is a few rows of
+ * it. Listings are asked for here rather than through the model: they are
+ * this dialog's alone, and gone when it closes.
+ */
+@OptIn(ExperimentalMaterial3Api::class)
+@Composable
+internal fun DriveBrowserDialog(
+    actions: AccountActions,
+    onDismiss: () -> Unit,
+) {
+    val trail = remember { mutableStateListOf<Pair<String, DrivePlaceRecord>>() }
+    var places by remember { mutableStateOf<List<DrivePlaceRecord>?>(null) }
+    var entries by remember { mutableStateOf<List<DriveEntryRecord>?>(null) }
+    var error by remember { mutableStateOf<String?>(null) }
+    val current = trail.lastOrNull()?.second
+
+    LaunchedEffect(current) {
+        error = null
+        if (current == null) {
+            if (places == null) {
+                runCatching { NativeRuntime.engine().drivePlaces() }
+                    .onSuccess { places = it }
+                    .onFailure { error = it.message }
+            }
+        } else {
+            entries = null
+            runCatching { NativeRuntime.engine().driveFolder(current.volumeId, current.linkId) }
+                .onSuccess { entries = it }
+                .onFailure { error = it.message }
+        }
+    }
+
+    Dialog(onDismissRequest = onDismiss, properties = DialogProperties(usePlatformDefaultWidth = false)) {
+        BackHandler(enabled = trail.isNotEmpty()) { trail.removeAt(trail.lastIndex) }
+        Scaffold(
+            topBar = {
+                TopAppBar(
+                    title = {
+                        Text(
+                            trail.lastOrNull()?.first ?: "Your Drive",
+                            maxLines = 1,
+                            overflow = TextOverflow.Ellipsis,
+                        )
+                    },
+                    navigationIcon = {
+                        IconButton(onClick = { if (trail.isEmpty()) onDismiss() else trail.removeAt(trail.lastIndex) }) {
+                            Icon(
+                                if (trail.isEmpty()) Icons.Default.Close else Icons.AutoMirrored.Filled.ArrowBack,
+                                contentDescription = if (trail.isEmpty()) "Close" else "Up a folder",
+                            )
+                        }
+                    },
+                )
+            },
+            bottomBar = {
+                // A folder already in the library is refused by the engine,
+                // with a message saying so.
+                val folder = current ?: return@Scaffold
+                Row(Modifier.fillMaxWidth().padding(16.dp), horizontalArrangement = Arrangement.End) {
+                    AccentButton(
+                        onClick = {
+                            actions.addFolder(trail.last().first, folder.volumeId, folder.linkId)
+                            onDismiss()
+                        },
+                    ) { Text("Add this folder") }
+                }
+            },
+        ) { padding ->
+            Box(Modifier.fillMaxSize().padding(padding)) {
+                val loading = error == null && (if (current == null) places == null else entries == null)
+                when {
+                    error != null -> EmptyState("Could not list this", error.orEmpty())
+                    loading -> CircularProgressIndicator(Modifier.align(Alignment.Center))
+                    current == null -> LazyColumn(contentPadding = PaddingValues(vertical = 8.dp)) {
+                        items(places.orEmpty(), key = { "${it.volumeId}/${it.linkId}" }) { place ->
+                            DriveRow(
+                                icon = when (place.kind) {
+                                    PlaceType.MY_FILES -> Icons.Default.Storage
+                                    PlaceType.DEVICE -> Icons.Default.Computer
+                                    PlaceType.SHARED_WITH_ME -> Icons.Default.FolderShared
+                                },
+                                name = place.name,
+                                detail = null,
+                                onClick = { trail.add(place.name to place) },
+                            )
+                        }
+                    }
+                    entries.orEmpty().isEmpty() -> EmptyState("Empty folder", "Nothing to add from here.")
+                    else -> LazyColumn(contentPadding = PaddingValues(vertical = 8.dp)) {
+                        items(entries.orEmpty(), key = { "${it.volumeId}/${it.linkId}" }) { entry ->
+                            DriveRow(
+                                icon = when {
+                                    entry.isFolder -> Icons.Default.Folder
+                                    entry.isVideo -> Icons.Default.Movie
+                                    else -> Icons.Default.InsertDriveFile
+                                },
+                                name = entry.name,
+                                detail = entry.size?.let(::formatBytes),
+                                onClick = if (entry.isFolder) {
+                                    {
+                                        trail.add(
+                                            entry.name to DrivePlaceRecord(
+                                                PlaceType.MY_FILES,
+                                                entry.name,
+                                                entry.volumeId,
+                                                entry.linkId,
+                                            ),
+                                        )
+                                    }
+                                } else {
+                                    null
+                                },
+                            )
+                        }
+                    }
+                }
+            }
+        }
+    }
+}
+
+@Composable
+private fun DriveRow(
+    icon: androidx.compose.ui.graphics.vector.ImageVector,
+    name: String,
+    detail: String?,
+    onClick: (() -> Unit)?,
+) {
+    ListItem(
+        headlineContent = { Text(name, maxLines = 2, overflow = TextOverflow.Ellipsis) },
+        supportingContent = detail?.let { { Text(it) } },
+        leadingContent = {
+            Icon(
+                icon,
+                contentDescription = null,
+                tint = if (onClick != null) {
+                    MaterialTheme.colorScheme.primary
+                } else {
+                    MaterialTheme.colorScheme.onSurfaceVariant
+                },
+            )
+        },
+        colors = ListItemDefaults.colors(containerColor = Color.Transparent),
+        modifier = if (onClick != null) Modifier.clickable(onClick = onClick) else Modifier,
+    )
+}
@@ -25,7 +25,10 @@ import kotlinx.coroutines.flow.callbackFlow
 import kotlinx.coroutines.channels.awaitClose
 import kotlinx.coroutines.withContext
 import io.narl.protonstream.native.NativeRuntime
+import io.narl.protonstream.settings.SettingsStore
+import io.narl.protonstream.ui.theme.AppearanceState
 import uniffi.pstr_android.ArrangementRecord
+import uniffi.pstr_android.LibraryFilter
 import uniffi.pstr_android.LibrarySort
 import uniffi.pstr_android.ShareRecord
 import uniffi.pstr_android.TitleRecord
@@ -36,10 +39,17 @@ import uniffi.pstr_android.MetadataSettingsRecord
 import uniffi.pstr_android.StorageUsageRecord
 import uniffi.pstr_android.EpisodeRecord
 import uniffi.pstr_android.WatchStateRecord
+import uniffi.pstr_android.AccountState
+import uniffi.pstr_android.SignInOutcome
+import uniffi.pstr_android.SyncRecord
+import kotlinx.coroutines.delay
+import kotlinx.coroutines.isActive

 data class AppUiState(
    val loading: Boolean = true,
    val refreshing: Boolean = false,
+    /** A crawl is running, which the banner offers to stop. */
+    val crawling: Boolean = false,
    val query: String = "",
    val titles: List<TitleRecord> = emptyList(),
    /**
@@ -48,6 +58,7 @@ data class AppUiState(
     * when the grid falls back to [titles] as they are.
     */
    val arrangement: ArrangementRecord? = null,
+    val filter: LibraryFilter = LibraryFilter.ALL,
    val sort: LibrarySort = LibrarySort.NAME,
    val grouped: Boolean = true,
    val shares: List<ShareRecord> = emptyList(),
@@ -60,8 +71,33 @@ data class AppUiState(
    ),
    val storage: StorageUsageRecord = StorageUsageRecord(0uL, 0uL, 0uL, 0uL),
    val message: String? = null,
+    /**
+     * What is running in the background right now, said in a banner for as
+     * long as it runs: an add, a crawl, a match, a sync. Without it a
+     * minute-long crawl looked like a tap that did nothing.
+     */
+    val activity: String? = null,
    /** What Undo on [message] puts back, when the message offers one. */
    val undo: List<WatchSnapshot>? = null,
+    val account: AccountUiState = AccountUiState(),
+)
+
+/** The Proton account: where a sign-in stands, and how sync is doing. */
+data class AccountUiState(
+    /** Null until the bridge has said. */
+    val state: AccountState? = null,
+    /** A sign-in step is out and not answered yet. */
+    val busy: Boolean = false,
+    /** Why the last sign-in step was refused. */
+    val error: String? = null,
+    /** The CAPTCHA page Proton wants solved before it accepts the sign-in. */
+    val verificationUrl: String? = null,
+    /** When watch history last synced, in epoch milliseconds. */
+    val syncedAt: Long? = null,
+    /** Positions the last sync took from other devices. */
+    val applied: Int = 0,
+    /** Why the last sync failed, until one succeeds. */
+    val syncError: String? = null,
 )

 /**
@@ -76,6 +112,21 @@ class AppViewModel(context: Context, private val workManager: WorkManager) : Vie
    private val mutableState = MutableStateFlow(AppUiState())
    private val searchQuery = MutableStateFlow("")
    val state: StateFlow<AppUiState> = mutableState.asStateFlow()
+    /** Launch and coming back both ask; one crawl answers. */
+    private var catchingUp = false
+
+    /**
+     * Every banner line whose work is still running, oldest first. Touched on
+     * the main thread only, as everything in [viewModelScope] is.
+     */
+    private val activities = mutableListOf<Pair<Long, String>>()
+    private var nextActivity = 0L
+
+    /** Crawls running now; main thread only, like [activities]. */
+    private var crawlsRunning = 0
+
+    /** Set by [stopCrawl], so a queue of shares stops rather than going on to the next. */
+    private var crawlStopped = false

    init {
        if (!NativeRuntime.tlsReady) {
@@ -83,7 +134,37 @@ class AppViewModel(context: Context, private val workManager: WorkManager) : Vie
                it.copy(message = "Certificate verification is unavailable; Proton requests will fail")
            }
        }
-        reload()
+        // The arrangement first, so the first grid is drawn the way the viewer
+        // left it rather than A–Z and then re-sorted under them.
+        viewModelScope.launch {
+            val (filter, sort, grouped) = withContext(Dispatchers.IO) {
+                SettingsStore(appContext).run {
+                    Triple(
+                        libraryFilter?.let { name -> LibraryFilter.entries.firstOrNull { it.name == name } },
+                        librarySort?.let { name -> LibrarySort.entries.firstOrNull { it.name == name } },
+                        libraryGrouped,
+                    )
+                }
+            }
+            mutableState.update { it.copy(filter = filter ?: it.filter, sort = sort ?: it.sort, grouped = grouped) }
+            reload()
+        }
+        catchUp()
+        viewModelScope.launch {
+            val account = runCatching { withContext(Dispatchers.IO) { NativeRuntime.engine().accountState() } }
+                .getOrDefault(AccountState.SignedOut)
+            updateAccount { it.copy(state = account) }
+            // While the app is alive, on top of after sign-in and whenever the
+            // player closes. Cheap when nothing changed: one folder listing,
+            // and no upload.
+            while (isActive) {
+                syncWatchHistory()
+                // A sync WatchSyncWorker ran while the app was away may have
+                // brought shares this one has not crawled.
+                catchUp()
+                delay(SYNC_INTERVAL_MS)
+            }
+        }
        viewModelScope.launch {
            searchQuery.debounce(300).distinctUntilChanged().collect { reloadLibrary(it) }
        }
@@ -96,10 +177,27 @@ class AppViewModel(context: Context, private val workManager: WorkManager) : Vie
        }
    }

-    /** Reorder the grid, or fold or unfold its franchises. */
+    /** Sort and fold the library, and keep both for the next launch. */
    fun arrange(sort: LibrarySort, grouped: Boolean) {
        mutableState.update { it.copy(sort = sort, grouped = grouped) }
-        viewModelScope.launch { reloadLibrary(mutableState.value.query) }
+        viewModelScope.launch {
+            withContext(Dispatchers.IO) {
+                SettingsStore(appContext).apply {
+                    librarySort = sort.name
+                    libraryGrouped = grouped
+                }
+            }
+            reloadLibrary(mutableState.value.query)
+        }
+    }
+
+    /** Narrow the grid to some titles, and keep the choice for the next launch. */
+    fun filter(filter: LibraryFilter) {
+        mutableState.update { it.copy(filter = filter) }
+        viewModelScope.launch {
+            withContext(Dispatchers.IO) { SettingsStore(appContext).libraryFilter = filter.name }
+            reloadLibrary(mutableState.value.query)
+        }
    }

    fun search(query: String) {
@@ -109,14 +207,72 @@ class AppViewModel(context: Context, private val workManager: WorkManager) : Vie

    fun refresh() {
        viewModelScope.launch {
-            mutableState.update { it.copy(refreshing = true, message = null) }
-            runCatching { withContext(Dispatchers.IO) { NativeRuntime.engine().crawl(null) } }
-                .onFailure { error -> mutableState.update { it.copy(message = error.message) } }
-            mutableState.update { it.copy(refreshing = false) }
-            reload()
+            busy("Refreshing the library…") {
+                mutableState.update { it.copy(message = null) }
+                runCatching { crawlShares(null) }
+                    .onFailure { error -> mutableState.update { it.copy(message = error.message) } }
+            }
+            reloadNow()
+            matchAfterCrawl()
        }
    }

+    /**
+     * Look up whatever a crawl brought that has no answer yet: a new show, or
+     * a new episode its stored guide cannot name. When everything already has
+     * one the bridge asks nothing, so this is cheap after every crawl.
+     */
+    private suspend fun matchAfterCrawl() {
+        val settings = mutableState.value.metadataSettings
+        if (settings.enabled && settings.ready) match(force = false, quiet = true)
+    }
+
+    /**
+     * Say [what] in the activity banner while [work] runs.
+     *
+     * The banner shows the newest line still running. Work overlaps — a sync
+     * starts during a crawl and ends after it — so each line is removed by
+     * itself rather than by putting back whatever was showing before, which
+     * once brought back a finished crawl's line and spun it forever.
+     */
+    private suspend fun busy(what: String, work: suspend () -> Unit) {
+        val token = nextActivity++
+        activities += token to what
+        showActivity()
+        try {
+            work()
+        } finally {
+            activities.removeAll { it.first == token }
+            showActivity()
+        }
+    }
+
+    /** Crawl one share, or all with null, with the banner offering Stop meanwhile. */
+    private suspend fun crawlShares(id: String?) {
+        crawlsRunning++
+        mutableState.update { it.copy(crawling = true) }
+        try {
+            withContext(Dispatchers.IO) { NativeRuntime.engine().crawl(id) }
+        } finally {
+            crawlsRunning--
+            mutableState.update { it.copy(crawling = crawlsRunning > 0) }
+        }
+    }
+
+    /**
+     * Stop the crawls running now. Shares already read stay in the library;
+     * the one being read keeps what it had.
+     */
+    fun stopCrawl() {
+        crawlStopped = true
+        viewModelScope.launch(Dispatchers.IO) { NativeRuntime.engine().stopCrawl() }
+    }
+
+    private fun showActivity() {
+        val newest = activities.lastOrNull()?.second
+        mutableState.update { it.copy(activity = newest, refreshing = newest != null) }
+    }
+
    /**
     * Recrawl one share rather than the whole library.
     *
@@ -127,11 +283,14 @@ class AppViewModel(context: Context, private val workManager: WorkManager) : Vie
     */
    fun refreshShare(id: String) {
        viewModelScope.launch {
-            mutableState.update { it.copy(refreshing = true, message = null) }
-            runCatching { withContext(Dispatchers.IO) { NativeRuntime.engine().crawl(id) } }
-                .onFailure { error -> mutableState.update { it.copy(message = error.message) } }
-            mutableState.update { it.copy(refreshing = false) }
-            reload()
+            val name = mutableState.value.shares.firstOrNull { it.id == id }?.name ?: "the share"
+            busy("Reading $name…") {
+                mutableState.update { it.copy(message = null) }
+                runCatching { crawlShares(id) }
+                    .onFailure { error -> mutableState.update { it.copy(message = error.message) } }
+            }
+            reloadNow()
+            matchAfterCrawl()
        }
    }

@@ -144,26 +303,100 @@ class AppViewModel(context: Context, private val workManager: WorkManager) : Vie
     * changed.
     */
    fun matchTitles(force: Boolean) {
-        viewModelScope.launch {
-            mutableState.update { it.copy(refreshing = true, message = null) }
+        viewModelScope.launch { match(force) }
+    }
+
+    /**
+     * With [quiet], a run nobody asked for says nothing when it found nothing
+     * to do.
+     */
+    private suspend fun match(force: Boolean, quiet: Boolean = false) {
+        busy("Looking up titles…") {
            runCatching { withContext(Dispatchers.IO) { NativeRuntime.engine().matchTitles(force) } }
-                .onSuccess { summary -> mutableState.update { it.copy(message = describe(summary)) } }
+                .onSuccess { summary ->
+                    if (!quiet || !summary.isEmpty()) {
+                        mutableState.update { it.copy(message = describe(summary)) }
+                    }
+                }
                .onFailure { error -> mutableState.update { it.copy(message = error.message) } }
-            mutableState.update { it.copy(refreshing = false) }
-            reload()
+        }
+        reloadNow()
+    }
+
+    private fun MatchSummary.isEmpty() = matched == 0u && unmatched == 0u && failed == 0u && episodes == 0u
+
+    /**
+     * Add a link, and return why it was refused, if it was.
+     *
+     * The link is opened before anything is stored, so the form can stay up
+     * with the reason under it and a retry is a retry — not "already in the
+     * library" for a share that never opened. Only the new share is crawled:
+     * another share that fails to open must not make this one look broken.
+     */
+    suspend fun addShare(name: String, url: String, password: String?): String? {
+        val share = runCatching {
+            withContext(Dispatchers.IO) {
+                NativeRuntime.engine().addShare(name, url, password?.takeIf(String::isNotBlank))
+            }
+        }.getOrElse { return it.message ?: "That link could not be added" }
+        reload()
+        viewModelScope.launch { crawlAdded(listOf(share.id), announce = true) }
+        return null
+    }
+
+    /**
+     * Crawl shares that are new here — added on this device or by sync — then
+     * match them when enrichment is on.
+     */
+    private suspend fun crawlAdded(ids: List<String>, announce: Boolean) {
+        if (ids.isEmpty()) return
+        val before = mutableState.value.titles.map { it.key }.toSet()
+        val failed = mutableListOf<String>()
+        crawlStopped = false
+        for (id in ids) {
+            if (crawlStopped) break
+            val name = mutableState.value.shares.firstOrNull { it.id == id }?.name ?: "the new share"
+            busy("Reading $name…") {
+                runCatching { crawlShares(id) }
+                    .onFailure { failed += "$name: ${it.message}" }
+            }
+        }
+        reloadNow()
+        // A catch-up is the app's doing, not the viewer's: a failure goes on
+        // the share's row rather than in their face, and only news is said.
+        if (failed.isNotEmpty() && announce) {
+            mutableState.update { it.copy(message = failed.joinToString("\n")) }
+            return
+        }
+        matchAfterCrawl()
+        if (announce) {
+            val added = (mutableState.value.titles.map { it.key }.toSet() - before).size
+            mutableState.update { it.copy(message = if (added == 1) "1 title added" else "$added titles added") }
+        } else {
+            val files = mutableState.value.shares.filter { it.id in ids }.sumOf { it.crawlAdded ?: 0uL }
+            if (files > 0uL) {
+                mutableState.update { it.copy(message = if (files == 1uL) "1 new file" else "$files new files") }
+            }
        }
    }

-    fun addShare(name: String, url: String, password: String?) {
+    /**
+     * Crawl shares due a look: ones the catalog has nothing of — brought by a
+     * sync that ran in [io.narl.protonstream.sync.WatchSyncWorker], or an add
+     * whose crawl never finished — and ones not crawled for six hours, so new
+     * episodes turn up without a pull to refresh.
+     */
+    fun catchUp() {
+        if (catchingUp) return
+        catchingUp = true
        viewModelScope.launch {
-            runCatching {
-                withContext(Dispatchers.IO) {
-                    val engine = NativeRuntime.engine()
-                    engine.addShare(name, url, password?.takeIf(String::isNotBlank))
-                    engine.crawl(null)
-                }
-            }.onFailure { error -> mutableState.update { it.copy(message = error.message) } }
-            reload()
+            try {
+                val ids = runCatching { withContext(Dispatchers.IO) { NativeRuntime.engine().uncrawledShares() } }
+                    .getOrDefault(emptyList())
+                crawlAdded(ids, announce = false)
+            } finally {
+                catchingUp = false
+            }
        }
    }

@@ -185,6 +418,16 @@ class AppViewModel(context: Context, private val workManager: WorkManager) : Vie
                    engine.crawl(id)
                }
            }.onFailure(::reportError)
+            reloadNow()
+            matchAfterCrawl()
+        }
+    }
+
+    /** Call a share something else. The library, history and downloads stay. */
+    fun renameShare(id: String, name: String) {
+        viewModelScope.launch {
+            runCatching { withContext(Dispatchers.IO) { NativeRuntime.engine().renameShare(id, name) } }
+                .onFailure(::reportError)
            reload()
        }
    }
@@ -212,16 +455,187 @@ class AppViewModel(context: Context, private val workManager: WorkManager) : Vie

    fun dismissMessage() = mutableState.update { it.copy(message = null, undo = null) }

+    private fun updateAccount(change: (AccountUiState) -> AccountUiState) =
+        mutableState.update { it.copy(account = change(it.account)) }
+
+    /**
+     * Start signing in, or start again with [verificationToken] once the
+     * CAPTCHA from a first try is solved.
+     */
+    fun signIn(username: String, password: String, verificationToken: String? = null) =
+        signInStep { engine -> engine.signIn(username, password, verificationToken) }
+
+    fun submitSecondFactor(code: String) = signInStep { engine -> engine.submitSecondFactor(code) }
+
+    fun submitMailboxPassword(password: String) =
+        signInStep(keepStepOnFailure = true) { engine -> engine.submitMailboxPassword(password) }
+
+    fun cancelSignIn() {
+        updateAccount { AccountUiState(state = AccountState.SignedOut) }
+        viewModelScope.launch { runCatching { NativeRuntime.engine().cancelSignIn() } }
+    }
+
+    /** The CAPTCHA page closed without a token. */
+    fun dismissVerification() = updateAccount { it.copy(verificationUrl = null, busy = false) }
+
+    private fun signInStep(
+        keepStepOnFailure: Boolean = false,
+        step: suspend (uniffi.pstr_android.AndroidEngine) -> SignInOutcome,
+    ) {
+        updateAccount { it.copy(busy = true, error = null, verificationUrl = null) }
+        viewModelScope.launch {
+            runCatching { withContext(Dispatchers.IO) { step(NativeRuntime.engine()) } }
+                .onSuccess { outcome ->
+                    when (outcome) {
+                        is SignInOutcome.Done -> {
+                            updateAccount {
+                                AccountUiState(state = AccountState.SignedIn(outcome.username))
+                            }
+                            mutableState.update { it.copy(message = "Signed in as ${outcome.username}") }
+                            syncWatchHistory()
+                            reload()
+                        }
+                        SignInOutcome.SecondFactor ->
+                            updateAccount { it.copy(state = AccountState.SecondFactor, busy = false) }
+                        SignInOutcome.MailboxPassword ->
+                            updateAccount { it.copy(state = AccountState.MailboxPassword, busy = false) }
+                        is SignInOutcome.HumanVerification ->
+                            updateAccount { it.copy(verificationUrl = outcome.url) }
+                    }
+                }
+                .onFailure { error ->
+                    updateAccount {
+                        it.copy(
+                            busy = false,
+                            error = error.message ?: "Sign-in failed",
+                            // A refused code spends the half-made session.
+                            state = if (keepStepOnFailure) it.state else AccountState.SignedOut,
+                        )
+                    }
+                }
+        }
+    }
+
+    fun signOut() {
+        viewModelScope.launch {
+            runCatching { withContext(Dispatchers.IO) { NativeRuntime.engine().signOut() } }
+                .onFailure(::reportError)
+            updateAccount { AccountUiState(state = AccountState.SignedOut) }
+            reload()
+        }
+    }
+
+    /** Sync now, from a tap: says so when it is done. */
+    fun syncNow() {
+        viewModelScope.launch {
+            if (syncWatchHistory()) {
+                val applied = mutableState.value.account.applied
+                mutableState.update {
+                    it.copy(
+                        message = if (applied > 0) {
+                            "Watch history synced, $applied from other devices"
+                        } else {
+                            "Watch history is up to date"
+                        },
+                    )
+                }
+            }
+        }
+    }
+
+    /**
+     * Pull other devices' positions in and push this one's out. Quiet: it runs
+     * on a timer, and a failure is shown on the account card rather than as a
+     * snackbar every five minutes of an offline evening. Returns whether it
+     * synced.
+     */
+    private suspend fun syncWatchHistory(): Boolean {
+        if (mutableState.value.account.state !is AccountState.SignedIn) return false
+        return runCatching { withContext(Dispatchers.IO) { NativeRuntime.engine().syncWatchHistory() } }
+            .fold(
+                onSuccess = { report ->
+                    if (report == null) return false
+                    updateAccount {
+                        it.copy(
+                            syncedAt = System.currentTimeMillis(),
+                            applied = report.applied.toInt(),
+                            syncError = null,
+                        )
+                    }
+                    takeSynced(report)
+                    true
+                },
+                onFailure = { error ->
+                    val state = runCatching { NativeRuntime.engine().accountState() }.getOrNull()
+                    updateAccount { it.copy(state = state ?: it.state, syncError = error.message) }
+                    // Signed out by the engine: the session ended, and that is
+                    // worth interrupting for, unlike a dropped connection.
+                    if (state == AccountState.SignedOut) reportError(error)
+                    false
+                },
+            )
+    }
+
+    /**
+     * What another device changed: its shares crawled or dropped here, its
+     * settings repainted.
+     */
+    private suspend fun takeSynced(report: SyncRecord) {
+        if (report.sharesRemoved.isNotEmpty()) {
+            withContext(Dispatchers.IO) {
+                val downloads = DownloadStateStore(appContext)
+                report.sharesRemoved.forEach { id ->
+                    workManager.cancelAllWorkByTag(DownloadCoordinator.shareTag(id)).result.get()
+                    downloads.removeShare(id)
+                }
+            }
+        }
+        if (report.settingsChanged) AppearanceState.reload()
+        if (report.applied > 0u || report.titles > 0u || report.settingsChanged || report.sharesRemoved.isNotEmpty()) {
+            reloadNow()
+        }
+        if (report.sharesAdded.isNotEmpty()) {
+            crawlAdded(report.sharesAdded, announce = false)
+            val count = report.sharesAdded.size
+            mutableState.update {
+                it.copy(message = if (count == 1) "A share arrived from another device" else "$count shares arrived from other devices")
+            }
+        }
+    }
+
+    /** After the player closes: where it stopped is what another device wants next. */
+    fun playerClosed() {
+        reload()
+        viewModelScope.launch { syncWatchHistory() }
+    }
+
+    fun addAccountFolder(name: String, volumeId: String, linkId: String) {
+        viewModelScope.launch {
+            runCatching {
+                withContext(Dispatchers.IO) { NativeRuntime.engine().addAccountFolder(name, volumeId, linkId) }
+            }.onSuccess { share ->
+                reload()
+                crawlAdded(listOf(share.id), announce = true)
+            }.onFailure(::reportError)
+        }
+    }
+
    /**
     * Every episode of a title watched or unwatched, with an Undo: a whole
     * title's positions are what this throws away, and a mis-tap on a tile's
     * menu should not cost them.
     */
-    fun setTitleWatched(title: TitleRecord, watched: Boolean) {
-        val episodes = title.seasons.flatMap { it.episodes }
+    fun setTitleWatched(title: TitleRecord, watched: Boolean) =
+        markEpisodes(title.seasons.flatMap { it.episodes }, watched, title.displayName)
+
+    /**
+     * Some episodes seen or unseen — a season, or a whole title — with an
+     * Undo; [what] names them in the message.
+     */
+    fun markEpisodes(episodes: List<EpisodeRecord>, watched: Boolean, what: String) {
        changeWatch(
-            episodes,
-            "${title.displayName} marked ${if (watched) "watched" else "unwatched"}",
+            episodes.filter { it.watched != watched },
+            "$what marked ${if (watched) "watched" else "unwatched"}",
        ) { engine, episode, before ->
            val duration = before?.durationSecs
            engine.saveWatchState(
@@ -269,14 +683,7 @@ class AppViewModel(context: Context, private val workManager: WorkManager) : Vie
                withContext(Dispatchers.IO) {
                    val engine = NativeRuntime.engine()
                    snapshots.forEach { snapshot ->
-                        val state = snapshot.state
-                        engine.saveWatchState(
-                            snapshot.shareId,
-                            snapshot.linkId,
-                            state?.positionSecs ?: 0.0,
-                            state?.durationSecs,
-                            state?.watched ?: false,
-                        )
+                        engine.restoreWatchState(snapshot.shareId, snapshot.linkId, snapshot.state)
                    }
                }
            }.onFailure(::reportError)
@@ -310,22 +717,27 @@ class AppViewModel(context: Context, private val workManager: WorkManager) : Vie
        mutableState.update { it.copy(message = error.message ?: "Unexpected error") }
    }

-    fun saveMetadataSettings(enabled: Boolean, provider: MetadataProvider, language: String, apiKey: String) {
-        viewModelScope.launch {
-            runCatching {
-                withContext(Dispatchers.IO) {
-                    val engine = NativeRuntime.engine()
-                    if (provider == MetadataProvider.TMDB && apiKey.isNotBlank()) {
-                        engine.setMetadataApiKey(provider, apiKey)
-                    }
-                    engine.setMetadataSettings(MetadataSettingsRecord(enabled, provider, language, true))
-                    if (enabled) engine.matchTitles(false) else null
+    /**
+     * Store the enrichment settings, and return why not, if they were not.
+     *
+     * The page shows the new settings as soon as they are stored; the match
+     * run that follows can take minutes and says so in the activity banner.
+     */
+    suspend fun saveMetadataSettings(enabled: Boolean, provider: MetadataProvider, language: String, apiKey: String): String? {
+        val stored = runCatching {
+            withContext(Dispatchers.IO) {
+                val engine = NativeRuntime.engine()
+                if (provider == MetadataProvider.TMDB && apiKey.isNotBlank()) {
+                    engine.setMetadataApiKey(provider, apiKey)
                }
-            }.onSuccess { summary ->
-                summary?.let { mutableState.update { state -> state.copy(message = describe(it)) } }
-            }.onFailure(::reportError)
-            reload()
-        }
+                engine.setMetadataSettings(MetadataSettingsRecord(enabled, provider, language, true))
+                engine.metadataSettings()
+            }
+        }.getOrElse { return it.message ?: "The settings could not be saved" }
+        mutableState.update { it.copy(metadataSettings = stored) }
+        reloadNow()
+        if (enabled) viewModelScope.launch { match(force = false) }
+        return null
    }

    fun reloadAfterMetadataChange() = reload()
@@ -408,24 +820,8 @@ class AppViewModel(context: Context, private val workManager: WorkManager) : Vie
     * at its duration where one is known, so the progress bar agrees with the
     * tick.
     */
-    fun setWatched(episode: EpisodeRecord, watched: Boolean) {
-        viewModelScope.launch {
-            runCatching {
-                withContext(Dispatchers.IO) {
-                    val engine = NativeRuntime.engine()
-                    val duration = engine.watchState(episode.shareId, episode.linkId)?.durationSecs
-                    engine.saveWatchState(
-                        episode.shareId,
-                        episode.linkId,
-                        if (watched) duration ?: 0.0 else 0.0,
-                        duration,
-                        watched,
-                    )
-                }
-            }.onFailure(::reportError)
-            reload()
-        }
-    }
+    /** One episode's tick, with the same Undo a season's has. */
+    fun setWatched(episode: EpisodeRecord, watched: Boolean) = markEpisodes(listOf(episode), watched, episode.label)

    fun removeAllOffline() {
        viewModelScope.launch {
@@ -452,40 +848,43 @@ class AppViewModel(context: Context, private val workManager: WorkManager) : Vie
    }

    private fun reload() {
-        viewModelScope.launch {
-            runCatching {
-                withContext(Dispatchers.IO) {
-                    val engine = NativeRuntime.engine()
-                    // Here rather than inside `library()`, which is read-only
-                    // and cached: a full reload is the one place that has
-                    // already paid for a walk of the offline files.
-                    engine.pruneOfflineFiles()
-                    val current = mutableState.value
-                    val query = current.query.takeIf(String::isNotBlank)
-                    Reloaded(
-                        engine.shares(),
-                        engine.library(query),
-                        engine.arrangement(query, current.sort, current.grouped),
-                        engine.offlineFiles(),
-                        engine.metadataSettings(),
-                        engine.storageUsage(),
-                    )
-                }
-            }.onSuccess { result ->
-                    mutableState.update { it.copy(
-                        loading = false,
-                        shares = result.shares,
-                        titles = result.titles,
-                        arrangement = result.arrangement,
-                        offline = result.offline,
-                        metadataSettings = result.metadataSettings,
-                        storage = result.storage,
-                    ) }
-                }
-                .onFailure { error ->
-                    mutableState.update { it.copy(loading = false, message = error.message) }
-                }
-        }
+        viewModelScope.launch { reloadNow() }
+    }
+
+    /** [reload], for a caller that goes on to read what it loaded. */
+    private suspend fun reloadNow() {
+        runCatching {
+            withContext(Dispatchers.IO) {
+                val engine = NativeRuntime.engine()
+                // Here rather than inside `library()`, which is read-only
+                // and cached: a full reload is the one place that has
+                // already paid for a walk of the offline files.
+                engine.pruneOfflineFiles()
+                val current = mutableState.value
+                val query = current.query.takeIf(String::isNotBlank)
+                Reloaded(
+                    engine.shares(),
+                    engine.library(query),
+                    engine.arrangement(query, current.filter, current.sort, current.grouped),
+                    engine.offlineFiles(),
+                    engine.metadataSettings(),
+                    engine.storageUsage(),
+                )
+            }
+        }.onSuccess { result ->
+                mutableState.update { it.copy(
+                    loading = false,
+                    shares = result.shares,
+                    titles = result.titles,
+                    arrangement = result.arrangement,
+                    offline = result.offline,
+                    metadataSettings = result.metadataSettings,
+                    storage = result.storage,
+                ) }
+            }
+            .onFailure { error ->
+                mutableState.update { it.copy(loading = false, message = error.message) }
+            }
    }

    private suspend fun reloadLibrary(query: String) {
@@ -494,13 +893,17 @@ class AppViewModel(context: Context, private val workManager: WorkManager) : Vie
            withContext(Dispatchers.IO) {
                val engine = NativeRuntime.engine()
                val search = query.takeIf(String::isNotBlank)
-                engine.library(search) to engine.arrangement(search, current.sort, current.grouped)
+                engine.library(search) to engine.arrangement(search, current.filter, current.sort, current.grouped)
            }
        }.onSuccess { (titles, arrangement) ->
            mutableState.update { it.copy(titles = titles, arrangement = arrangement) }
        }.onFailure { error -> mutableState.update { it.copy(message = error.message) } }
    }

+    private companion object {
+        const val SYNC_INTERVAL_MS = 5 * 60 * 1000L
+    }
+
    class Factory(private val context: Context, private val workManager: WorkManager) : ViewModelProvider.Factory {
        @Suppress("UNCHECKED_CAST")
        override fun <T : ViewModel> create(modelClass: Class<T>): T = AppViewModel(context, workManager) as T
@@ -1,5 +1,6 @@
 package io.narl.protonstream.ui

+import android.net.ConnectivityManager
 import androidx.compose.animation.AnimatedVisibilityScope
 import androidx.compose.animation.ExperimentalSharedTransitionApi
 import androidx.compose.animation.SharedTransitionScope
@@ -8,6 +9,8 @@ import androidx.compose.foundation.layout.Column
 import androidx.compose.foundation.layout.PaddingValues
 import androidx.compose.foundation.layout.RowScope
 import androidx.compose.foundation.layout.fillMaxSize
+import androidx.compose.foundation.layout.padding
+import androidx.compose.material3.AlertDialog
 import androidx.compose.material3.ExperimentalMaterial3Api
 import androidx.compose.material3.MaterialTheme
 import androidx.compose.material3.Text
@@ -15,10 +18,22 @@ import androidx.compose.material3.TopAppBar
 import androidx.compose.material3.TopAppBarColors
 import androidx.compose.material3.TopAppBarDefaults
 import androidx.compose.runtime.Composable
+import androidx.compose.runtime.getValue
+import androidx.compose.runtime.mutableStateOf
+import androidx.compose.runtime.remember
+import androidx.compose.runtime.setValue
 import androidx.compose.runtime.staticCompositionLocalOf
 import androidx.compose.ui.Alignment
 import androidx.compose.ui.Modifier
+import androidx.compose.ui.platform.LocalContext
 import androidx.compose.ui.input.nestedscroll.nestedScroll
+import androidx.compose.ui.text.style.TextAlign
+import androidx.compose.ui.unit.dp
+import io.narl.protonstream.download.DownloadCoordinator
+import io.narl.protonstream.download.RetainedDownload
+import io.narl.protonstream.settings.SettingsStore
+import io.narl.protonstream.ui.theme.AccentButton
+import io.narl.protonstream.ui.theme.TonalButton
 import uniffi.pstr_android.EpisodeRecord

 /**
@@ -92,21 +107,33 @@ internal fun Modifier.sharedArt(key: String): Modifier {
 }

@Composable
-internal fun EmptyState(title: String, body: String) {
+internal fun EmptyState(title: String, body: String, action: Pair<String, () -> Unit>? = null) {
    Box(Modifier.fillMaxSize(), contentAlignment = Alignment.Center) {
-        Column(horizontalAlignment = Alignment.CenterHorizontally) {
-            Text(title, style = MaterialTheme.typography.titleMedium)
-            Text(body, style = MaterialTheme.typography.bodyMedium)
+        Column(Modifier.padding(horizontal = 32.dp), horizontalAlignment = Alignment.CenterHorizontally) {
+            Text(title, style = MaterialTheme.typography.titleMedium, textAlign = TextAlign.Center)
+            Text(
+                body,
+                style = MaterialTheme.typography.bodyMedium,
+                color = MaterialTheme.colorScheme.onSurfaceVariant,
+                textAlign = TextAlign.Center,
+                modifier = Modifier.padding(top = 4.dp),
+            )
+            action?.let { (label, onClick) ->
+                AccentButton(onClick = onClick, modifier = Modifier.padding(top = 16.dp)) { Text(label) }
+            }
        }
    }
 }

 /**
- * Where Play on a title lands: the most recently played part-watched episode,
- * else the first unwatched one, else the first — the desktop's `next_up`.
+ * Where Play on a title lands: what Continue watching offers
+ * ([TitleRecord.continueIndex]), else the most recently played part-watched
+ * episode, else the first unwatched one, else the first — the desktop's
+ * `next_up`.
 */
-internal fun nextUpIndex(playlist: List<EpisodeRecord>): Int =
-    playlist.withIndex().filter { it.value.resumeAt != null }.maxByOrNull { it.value.lastPlayed }?.index
+internal fun nextUpIndex(playlist: List<EpisodeRecord>, continueIndex: UInt? = null): Int =
+    continueIndex?.toInt()?.takeIf { it in playlist.indices }
+        ?: playlist.withIndex().filter { it.value.resumeAt != null }.maxByOrNull { it.value.lastPlayed }?.index
        ?: playlist.indexOfFirst { !it.watched }.takeIf { it >= 0 }
        ?: 0

@@ -120,6 +147,80 @@ internal fun formatBytes(bytes: ULong): String {
    }
 }

+/**
+ * Download episodes, asking first when it is more than one: a season or a
+ * show is tens of gigabytes, and one tap should not fill a phone. The
+ * question says how many and how big. Call it in composition; it draws the
+ * dialog where it is called and returns what starts the download.
+ */
+@Composable
+internal fun rememberDownload(): (List<EpisodeRecord>, String) -> Unit {
+    val context = LocalContext.current
+    var asking by remember { mutableStateOf<Pair<List<EpisodeRecord>, String>?>(null) }
+    asking?.let { (episodes, what) ->
+        val bytes = episodes.sumOf { it.size ?: 0uL }
+        AlertDialog(
+            onDismissRequest = { asking = null },
+            title = { Text("Download ${episodes.size} episodes of $what?") },
+            text = {
+                Text(
+                    "They are kept on this device for watching without a connection" +
+                        (if (bytes > 0uL) " — about ${formatBytes(bytes)}" else "") +
+                        ". Delete them from Downloads.",
+                )
+            },
+            confirmButton = {
+                AccentButton(onClick = {
+                    asking = null
+                    DownloadCoordinator.enqueue(context, episodes)
+                }) { Text("Download") }
+            },
+            dismissButton = { TonalButton(onClick = { asking = null }) { Text("Cancel") } },
+        )
+    }
+    return remember(context) {
+        { episodes, what ->
+            val wanted = episodes.filterNot(EpisodeRecord::offline)
+            if (wanted.size > 1) asking = wanted to what else DownloadCoordinator.enqueue(context, wanted)
+        }
+    }
+}
+
+/**
+ * One line under a download that has not finished: "Running · 120.0 MiB of
+ * 1.2 GiB · 2.4 MiB/s", or "Queued" while it waits for a slot — or, given a
+ * [waitingFor], what it is really waiting on.
+ */
+internal fun downloadStatusLine(download: RetainedDownload, waitingFor: String? = null): String = listOfNotNull(
+    waitingFor?.takeIf { download.status == RetainedDownload.STATUS_QUEUED }
+        ?: download.status.replaceFirstChar { it.uppercase() },
+    download.total.takeIf { it > 0L && download.downloaded > 0L }?.let {
+        "${formatBytes(download.downloaded.toULong())} of ${formatBytes(it.toULong())}"
+    },
+    download.bytesPerSecond
+        .takeIf { it > 0L && download.status == RetainedDownload.STATUS_RUNNING }
+        ?.let { "${formatBytes(it.toULong())}/s" },
+).joinToString(" · ")
+
+/**
+ * Why a queued download is not running, when it is not merely a free slot:
+ * WorkManager holds a Wi-Fi-only download back on mobile data without a word,
+ * and "Queued" for an hour on the bus reads as stuck. Re-read whenever [key]
+ * changes — the download's own updates are the clock.
+ */
+@Composable
+internal fun rememberQueueReason(key: Any?): String? {
+    val context = LocalContext.current
+    return remember(key) {
+        val network = context.getSystemService(ConnectivityManager::class.java)
+        when {
+            network?.activeNetwork == null -> "Waiting for a connection"
+            SettingsStore(context).wifiOnly && network.isActiveNetworkMetered -> "Waiting for Wi-Fi"
+            else -> null
+        }
+    }
+}
+
 /**
 * What an episode row is headed with: "1. Mother and Children".
 *
@@ -3,6 +3,7 @@ package io.narl.protonstream.ui
 import androidx.compose.foundation.layout.Box
 import androidx.compose.foundation.layout.Column
 import androidx.compose.foundation.layout.PaddingValues
+import androidx.compose.foundation.clickable
 import androidx.compose.foundation.layout.Row
 import androidx.compose.foundation.layout.aspectRatio
 import androidx.compose.foundation.layout.fillMaxSize
@@ -16,6 +17,7 @@ import androidx.compose.material.icons.filled.Close
 import androidx.compose.material.icons.filled.Pause
 import androidx.compose.material.icons.filled.PlayArrow
 import androidx.compose.material.icons.outlined.Delete
+import androidx.compose.material.icons.outlined.Info
 import androidx.compose.material3.AlertDialog
 import androidx.compose.material3.Icon
 import androidx.compose.material3.IconButton
@@ -40,7 +42,7 @@ import androidx.work.WorkManager
 import io.narl.protonstream.download.DownloadCoordinator
 import io.narl.protonstream.download.DownloadStateStore
 import io.narl.protonstream.download.RetainedDownload
-import io.narl.protonstream.ui.theme.AccentButton
+import io.narl.protonstream.ui.theme.DangerButton
 import io.narl.protonstream.ui.theme.AccentProgress
 import io.narl.protonstream.ui.theme.TonalButton
 import uniffi.pstr_android.OfflineRecord
@@ -58,6 +60,8 @@ internal fun DownloadsScreen(
    onResume: (RetainedDownload) -> Unit,
    onDeletePartial: (RetainedDownload) -> Unit,
    padding: PaddingValues,
+    onPlay: (TitleRecord, Int) -> Unit = { _, _ -> },
+    onOpen: (TitleRecord) -> Unit = {},
 ) {
    val context = LocalContext.current
    val work = WorkManager.getInstance(context).getWorkInfosByTagLiveData(DownloadCoordinator.TAG)
@@ -122,7 +126,7 @@ internal fun DownloadsScreen(
                    )
                }
                items(group.files, key = { "${it.shareId}/${it.linkId}" }) { file ->
-                    SavedRow(file, group.title, onDelete = { deleting = file })
+                    SavedRow(file, group.title, onDelete = { deleting = file }, onPlay = onPlay, onOpen = onOpen)
                }
            }
        }
@@ -138,7 +142,7 @@ internal fun DownloadsScreen(
                )
            },
            confirmButton = {
-                AccentButton(onClick = {
+                DangerButton(onClick = {
                    deleting = null
                    onRemove(file)
                }) { Text("Delete") }
@@ -160,9 +164,23 @@ private fun SectionHeading(title: String, caption: String? = null) {

 /** A saved episode: its still, what it is, its size, and a way to remove it. */
@Composable
-private fun SavedRow(file: OfflineRecord, title: TitleRecord?, onDelete: () -> Unit) {
+private fun SavedRow(
+    file: OfflineRecord,
+    title: TitleRecord?,
+    onDelete: () -> Unit,
+    onPlay: (TitleRecord, Int) -> Unit,
+    onOpen: (TitleRecord) -> Unit,
+) {
    val episode = file.episode
+    // What a download is for: tapping it plays it, from where it was left,
+    // without going back through the library to find it.
+    val index = title?.seasons?.flatMap(SeasonRecord::episodes)?.indexOfFirst { it.linkId == file.linkId } ?: -1
    ListItem(
+        modifier = if (title != null && index >= 0) {
+            Modifier.clickable(onClickLabel = "Play") { onPlay(title, index) }
+        } else {
+            Modifier
+        },
        leadingContent = {
            RemoteArtwork(
                episode?.stillUrl ?: title?.backdropUrl,
@@ -179,8 +197,15 @@ private fun SavedRow(file: OfflineRecord, title: TitleRecord?, onDelete: () -> U
            Text(listOfNotNull(episode?.label, formatBytes(file.size)).joinToString(" · "))
        },
        trailingContent = {
-            IconButton(onClick = onDelete) {
-                Icon(Icons.Outlined.Delete, contentDescription = "Delete download")
+            Row {
+                title?.let {
+                    IconButton(onClick = { onOpen(it) }) {
+                        Icon(Icons.Outlined.Info, contentDescription = "Open ${it.displayName}")
+                    }
+                }
+                IconButton(onClick = onDelete) {
+                    Icon(Icons.Outlined.Delete, contentDescription = "Delete download")
+                }
            }
        },
        colors = ListItemDefaults.colors(containerColor = Color.Transparent),
@@ -204,14 +229,7 @@ private fun PartialRow(
        headlineContent = { Text(download.label, maxLines = 2, overflow = TextOverflow.Ellipsis) },
        supportingContent = {
            Column {
-                Text(
-                    listOfNotNull(
-                        download.status.replaceFirstChar { it.uppercase() },
-                        download.total.takeIf { it > 0L }?.let {
-                            "${formatBytes(download.downloaded.toULong())} of ${formatBytes(it.toULong())}"
-                        },
-                    ).joinToString(" · "),
-                )
+                Text(downloadStatusLine(download, rememberQueueReason(download)))
                if (download.total > 0L) {
                    AccentProgress(
                        progress = { (download.downloaded.toFloat() / download.total).coerceIn(0f, 1f) },
@@ -19,6 +19,10 @@ import androidx.compose.foundation.layout.Row
 import androidx.compose.ui.graphics.Brush
 import io.narl.protonstream.ui.theme.AccentButton
 import io.narl.protonstream.ui.theme.TonalButton
+import androidx.compose.material3.Surface
+import androidx.compose.ui.platform.LocalContext
+import io.narl.protonstream.settings.SettingsStore
+import io.narl.protonstream.ui.theme.QuietButton
 import java.time.LocalDate
 import androidx.compose.foundation.combinedClickable
 import androidx.compose.material.icons.filled.CheckCircle
@@ -35,8 +39,6 @@ import androidx.compose.runtime.getValue
 import androidx.compose.runtime.mutableStateOf
 import androidx.compose.runtime.setValue
 import androidx.compose.ui.graphics.vector.ImageVector
-import androidx.compose.ui.platform.LocalContext
-import io.narl.protonstream.download.DownloadCoordinator
 import androidx.compose.foundation.layout.Arrangement
 import androidx.compose.foundation.layout.Box
 import androidx.compose.foundation.layout.Column
@@ -61,6 +63,7 @@ import androidx.compose.material.icons.filled.Search
 import androidx.compose.material3.ExperimentalMaterial3Api
 import androidx.compose.material3.Icon
 import androidx.compose.material3.IconButton
+import androidx.compose.material3.FilterChip
 import androidx.compose.material3.MaterialTheme
 import androidx.compose.material3.Text
 import androidx.compose.material3.TextField
@@ -70,6 +73,9 @@ import androidx.compose.runtime.Composable
 import androidx.compose.runtime.remember
 import androidx.compose.ui.Alignment
 import androidx.compose.ui.Modifier
+import androidx.compose.ui.semantics.contentDescription
+import androidx.compose.ui.semantics.semantics
+import androidx.compose.ui.semantics.clearAndSetSemantics
 import androidx.compose.ui.draw.clip
 import androidx.compose.ui.graphics.Color
 import androidx.compose.ui.text.font.FontWeight
@@ -82,6 +88,7 @@ import androidx.compose.material3.DropdownMenu
 import androidx.compose.material3.DropdownMenuItem
 import androidx.compose.material3.HorizontalDivider
 import uniffi.pstr_android.EpisodeRecord
+import uniffi.pstr_android.LibraryFilter
 import uniffi.pstr_android.LibrarySort
 import uniffi.pstr_android.SeasonRecord
 import uniffi.pstr_android.TitleRecord
@@ -96,11 +103,50 @@ import uniffi.pstr_android.TitleType
 private const val CONTINUE_WATCHING_MAX = 12

 /** One row of the continue-watching shelf: which episode, and where it sits. */
-private data class Resumable(val title: TitleRecord, val episode: EpisodeRecord, val index: Int)
+private data class Resumable(
+    val title: TitleRecord,
+    val episode: EpisodeRecord,
+    val index: Int,
+    /** When the title was last played, which orders the shelf. */
+    val lastPlayed: Long,
+)

 /** One tile of the grid: the title drawn, and how many more of its franchise it stands for. */
 private data class Tile(val title: TitleRecord, val folded: Int)

+/** The desktop's names for the filters, from `browse::Filter::label`. */
+internal fun LibraryFilter.label(): String = when (this) {
+    LibraryFilter.ALL -> "All"
+    LibraryFilter.SERIES -> "Series"
+    LibraryFilter.FILMS -> "Films"
+    LibraryFilter.WATCHING -> "Watching"
+    LibraryFilter.UNWATCHED -> "Not started"
+    LibraryFilter.DOWNLOADED -> "Downloaded"
+}
+
+/** The offer of posters and synopses, and its two answers. */
+internal class MetadataOffer(val onOpenSettings: () -> Unit, val onDismiss: () -> Unit)
+
+@Composable
+private fun MetadataOfferCard(offer: MetadataOffer) {
+    Surface(color = MaterialTheme.colorScheme.surfaceContainer, shape = MaterialTheme.shapes.medium) {
+        Column(Modifier.fillMaxWidth().padding(start = 16.dp, end = 8.dp, top = 12.dp, bottom = 4.dp)) {
+            Text("Add posters and synopses?", style = MaterialTheme.typography.titleSmall)
+            Text(
+                "Turning it on in Settings sends the titles in your library — not your files, and " +
+                    "nothing about what you have watched — to AniList or TMDB.",
+                style = MaterialTheme.typography.bodySmall,
+                color = MaterialTheme.colorScheme.onSurfaceVariant,
+                modifier = Modifier.padding(top = 4.dp, end = 8.dp),
+            )
+            Row(Modifier.align(Alignment.End)) {
+                QuietButton(onClick = offer.onDismiss) { Text("Not now") }
+                QuietButton(onClick = offer.onOpenSettings) { Text("Open settings") }
+            }
+        }
+    }
+}
+
 /** A row above the grid: titles that share a director, a studio or a genre. */
 private data class Shelf(val label: String, val titles: List<TitleRecord>)

@@ -118,22 +164,31 @@ internal fun LibraryScreen(
    onMatchChanged: () -> Unit = {},
    onError: (Throwable) -> Unit = {},
    onArrange: (LibrarySort, Boolean) -> Unit = { _, _ -> },
+    onAddShare: () -> Unit = {},
+    onOpenSettings: () -> Unit = {},
+    onFilter: (LibraryFilter) -> Unit = {},
 ) {
+    val download = rememberDownload()
    val context = LocalContext.current
+    // Posters and synopses, offered once there is a library to put them on
+    // and never turned on unasked: switching them on sends title names out.
+    var offerDismissed by remember { mutableStateOf(SettingsStore(context).metadataOfferDismissed) }
    // What a long press opened a menu for: a title, or a Continue watching card.
    var menuFor by remember { mutableStateOf<TitleRecord?>(null) }
    var menuResume by remember { mutableStateOf<Resumable?>(null) }
    var matching by remember { mutableStateOf<TitleRecord?>(null) }
    // Most recently played first, one episode per show: a shelf that lists four
    // episodes of the same series is a shelf with room for nothing else.
+    // What to go on with is the engine's call (`continueIndex`): the
+    // part-watched episode, or the one after the episode finished last.
    val resumable = remember(state.titles) {
        state.titles.mapNotNull { title ->
+            val index = title.continueIndex?.toInt() ?: return@mapNotNull null
            val playlist = title.seasons.flatMap(SeasonRecord::episodes)
-            playlist.withIndex()
-                .filter { it.value.resumeAt != null && !it.value.watched }
-                .maxByOrNull { it.value.lastPlayed }
-                ?.let { Resumable(title, it.value, it.index) }
-        }.sortedByDescending { it.episode.lastPlayed }.take(CONTINUE_WATCHING_MAX)
+            playlist.getOrNull(index)?.let { episode ->
+                Resumable(title, episode, index, playlist.maxOf { it.lastPlayed })
+            }
+        }.sortedByDescending { it.lastPlayed }.take(CONTINUE_WATCHING_MAX)
    }
    // Search is an icon until it is wanted: a permanent field above the
    // library spent a band of every visit on something used in few of them.
@@ -179,9 +234,16 @@ internal fun LibraryScreen(
                    "Nothing matches",
                    "No title in the library is called “${state.query.trim()}”.",
                )
+                // A share just added: say it is being looked through, rather
+                // than offer to add the one that is already filling the page.
+                state.titles.isEmpty() && state.activity != null -> EmptyState(
+                    "Looking through the share",
+                    "${state.activity} Its titles appear here once it has been listed.",
+                )
                state.titles.isEmpty() -> EmptyState(
                    "Your library is empty",
-                    "Add a Proton Drive public link under Shares, then refresh.",
+                    "Add a Proton Drive share link, and everything playable behind it shows up here.",
+                    action = "Add a share" to onAddShare,
                )
                else -> LibraryGrid(
                    state,
@@ -190,6 +252,15 @@ internal fun LibraryScreen(
                    onTitle,
                    onTitleMenu = { menuFor = it },
                    onResumeMenu = { menuResume = it },
+                    onFilter = onFilter,
+                    metadataOffer = if (state.metadataSettings.enabled || offerDismissed) {
+                        null
+                    } else {
+                        MetadataOffer(onOpenSettings) {
+                            offerDismissed = true
+                            SettingsStore(context).metadataOfferDismissed = true
+                        }
+                    },
                )
            }
        }
@@ -199,10 +270,10 @@ internal fun LibraryScreen(
        val allWatched = title.episodeCount > 0uL && title.watchedCount == title.episodeCount
        TileMenu(title.displayName, title.caption(), onDismiss = { menuFor = null }) {
            MenuRow(Icons.Default.PlayArrow, if (playlist.any { it.resumeAt != null }) "Resume" else "Play") {
-                onResume(title, nextUpIndex(playlist))
+                onResume(title, nextUpIndex(playlist, title.continueIndex))
            }
            MenuRow(Icons.Default.Info, "Open") { onTitle(title) }
-            MenuRow(Icons.Default.Download, "Download all") { DownloadCoordinator.enqueue(context, playlist) }
+            MenuRow(Icons.Default.Download, "Download all") { download(playlist, title.displayName) }
            MenuRow(
                if (allWatched) Icons.Outlined.CheckCircle else Icons.Default.CheckCircle,
                if (allWatched) "Mark unwatched" else "Mark watched",
@@ -384,6 +455,8 @@ private fun LibraryGrid(
    onTitle: (TitleRecord) -> Unit,
    onTitleMenu: (TitleRecord) -> Unit,
    onResumeMenu: (Resumable) -> Unit,
+    onFilter: (LibraryFilter) -> Unit = {},
+    metadataOffer: MetadataOffer? = null,
 ) {
    // The arrangement names titles by key; before it has arrived, the titles
    // as they came are the grid.
@@ -410,6 +483,9 @@ private fun LibraryGrid(
        // opening the app wants is almost always the thing they were part way
        // through. Inside the grid rather than pinned over it, so the shelf
        // scrolls away with the rest.
+        if (metadataOffer != null && state.query.isBlank()) {
+            item(key = "metadata-offer", span = { GridItemSpan(maxLineSpan) }) { MetadataOfferCard(metadataOffer) }
+        }
        val featured = if (state.query.isBlank()) featured(state.titles, resumable) else null
        featured?.let { title ->
            item(key = "featured", span = { GridItemSpan(maxLineSpan) }) {
@@ -441,7 +517,10 @@ private fun LibraryGrid(
            }
        }
        if (state.query.isBlank()) {
-            shelves.forEach { shelf ->
+            // Only over the whole library: under a filter, a shelf of titles
+            // the grid below is hiding reads as the filter not working. The
+            // bridge leaves them out too; this covers the frame before it.
+            shelves.takeIf { state.filter == LibraryFilter.ALL }.orEmpty().forEach { shelf ->
                item(key = "shelf-${shelf.label}", span = { GridItemSpan(maxLineSpan) }) {
                    Column {
                        Text(shelf.label, style = MaterialTheme.typography.titleMedium)
@@ -462,9 +541,29 @@ private fun LibraryGrid(
                    }
                }
            }
-            if (resumable.isNotEmpty() || shelves.isNotEmpty()) {
-                item(key = "library-heading", span = { GridItemSpan(maxLineSpan) }) {
-                    Text("All titles", style = MaterialTheme.typography.titleMedium, modifier = Modifier.padding(top = 8.dp))
+            item(key = "library-heading", span = { GridItemSpan(maxLineSpan) }) {
+                Column {
+                    if (resumable.isNotEmpty() || shelves.isNotEmpty()) {
+                        Text("All titles", style = MaterialTheme.typography.titleMedium, modifier = Modifier.padding(top = 8.dp))
+                    }
+                    LazyRow(horizontalArrangement = Arrangement.spacedBy(8.dp)) {
+                        items(LibraryFilter.entries, key = { it.name }) { filter ->
+                            FilterChip(
+                                selected = filter == state.filter,
+                                onClick = { onFilter(filter) },
+                                label = { Text(filter.label()) },
+                            )
+                        }
+                    }
+                }
+            }
+            if (tiles.isEmpty() && state.filter != LibraryFilter.ALL) {
+                item(key = "filtered-out", span = { GridItemSpan(maxLineSpan) }) {
+                    Text(
+                        "Nothing in the library fits that filter.",
+                        style = MaterialTheme.typography.bodyMedium,
+                        color = MaterialTheme.colorScheme.onSurfaceVariant,
+                    )
                }
            }
        }
@@ -567,7 +666,7 @@ private fun FeaturedBanner(title: TitleRecord, resume: Resumable?, onPlay: (Int)
                )
            }
            Row(horizontalArrangement = Arrangement.spacedBy(8.dp), modifier = Modifier.padding(top = 12.dp)) {
-                AccentButton(onClick = { onPlay(resume?.index ?: nextUpIndex(playlist)) }) {
+                AccentButton(onClick = { onPlay(resume?.index ?: nextUpIndex(playlist, title.continueIndex)) }) {
                    Icon(Icons.Default.PlayArrow, contentDescription = null)
                    Spacer(Modifier.width(6.dp))
                    Text(if (resume != null) "Resume" else "Play")
@@ -585,14 +684,16 @@ private fun ContinueCard(entry: Resumable, onClick: () -> Unit, onLongClick: ()
        Modifier
            .width(220.dp)
            .clip(MaterialTheme.shapes.medium)
-            .combinedClickable(onClick = onClick, onLongClick = onLongClick),
+            .combinedClickable(onClick = onClick, onLongClick = onLongClick, onLongClickLabel = "More for this episode"),
    ) {
        Box(Modifier.fillMaxWidth().aspectRatio(16f / 9f).clip(MaterialTheme.shapes.medium)) {
+            // Named by the text under it; read as well, the name came twice.
            RemoteArtwork(
                entry.episode.stillUrl ?: entry.title.backdropUrl,
                entry.title.displayName,
-                Modifier.fillMaxSize(),
+                Modifier.fillMaxSize().clearAndSetSemantics {},
                fallback = entry.episode.thumbnailSource,
+                maxEdge = 220.dp,
            )
            entry.episode.progress?.let { progress ->
                AccentProgress(
@@ -609,7 +710,11 @@ private fun ContinueCard(entry: Resumable, onClick: () -> Unit, onLongClick: ()
            modifier = Modifier.padding(top = 8.dp),
        )
        Text(
-            listOfNotNull(entry.episode.label, entry.episode.timeLeft()).joinToString(" · "),
+            if (entry.episode.resumeAt == null) {
+                "Next: ${entry.episode.label}"
+            } else {
+                listOfNotNull(entry.episode.label, entry.episode.timeLeft()).joinToString(" · ")
+            },
            style = MaterialTheme.typography.bodySmall,
            color = MaterialTheme.colorScheme.onSurfaceVariant,
            maxLines = 1,
@@ -638,7 +743,7 @@ private fun PosterTile(
    Column(
        modifier
            .clip(MaterialTheme.shapes.medium)
-            .combinedClickable(onClick = onClick, onLongClick = onLongClick),
+            .combinedClickable(onClick = onClick, onLongClick = onLongClick, onLongClickLabel = "More for this title"),
    ) {
        Box {
            RemoteArtwork(
@@ -647,8 +752,11 @@ private fun PosterTile(
                (if (shared) Modifier.sharedArt(title.key) else Modifier)
                    .fillMaxWidth()
                    .aspectRatio(2f / 3f)
-                    .clip(MaterialTheme.shapes.medium),
+                    .clip(MaterialTheme.shapes.medium)
+                    .clearAndSetSemantics {},
                fallback = title.thumbnailSource,
+                // The tile's height, at the widest a grid column gets.
+                maxEdge = 280.dp,
            )
            if (folded > 0) {
                Text(
@@ -660,7 +768,8 @@ private fun PosterTile(
                        .padding(6.dp)
                        .clip(MaterialTheme.shapes.small)
                        .background(Color.Black.copy(alpha = 0.7f))
-                        .padding(horizontal = 6.dp, vertical = 2.dp),
+                        .padding(horizontal = 6.dp, vertical = 2.dp)
+                        .semantics { contentDescription = "and $folded more" },
                )
            }
        }
@@ -1,5 +1,16 @@
 package io.narl.protonstream.ui

+import androidx.compose.ui.semantics.LiveRegionMode
+import androidx.compose.ui.semantics.liveRegion
+import androidx.compose.ui.semantics.semantics
+import androidx.compose.material3.CircularProgressIndicator
+import androidx.compose.foundation.layout.Arrangement
+import androidx.compose.foundation.background
+import androidx.compose.animation.slideOutVertically
+import androidx.compose.animation.slideInVertically
+import androidx.compose.animation.fadeOut
+import androidx.compose.animation.fadeIn
+import androidx.compose.animation.AnimatedVisibility
 import androidx.activity.compose.BackHandler
 import androidx.compose.animation.AnimatedContent
 import androidx.compose.animation.ExperimentalSharedTransitionApi
@@ -65,6 +76,7 @@ import androidx.compose.ui.text.style.TextOverflow
 import androidx.compose.ui.unit.dp
 import androidx.lifecycle.viewmodel.compose.viewModel
 import androidx.work.WorkManager
+import io.narl.protonstream.ui.theme.QuietButton
 import io.narl.protonstream.ui.theme.accentNavigationColors
 import uniffi.pstr_android.TitleRecord
 import uniffi.pstr_android.EpisodeRecord
@@ -98,7 +110,6 @@ private enum class Destination(val label: String, val icon: ImageVector) {
@Composable
 fun ProtonStreamApp(
    playerHost: LibmpvHost? = null,
-    inPictureInPicture: Boolean = false,
    shareLink: String? = null,
    onShareLinkTaken: () -> Unit = {},
    model: AppViewModel = viewModel(
@@ -123,6 +134,7 @@ fun ProtonStreamApp(
    // is what says so. Saved, because a rotation must not throw the viewer back
    // into the video they had just left.
    var playerMinimized by rememberSaveable { mutableStateOf(false) }
+    var addingShare by remember { mutableStateOf(false) }

    val selectedTitle = state.titles.firstOrNull { it.key == selectedTitleKey }
    val playing = playingTitleKey
@@ -216,6 +228,12 @@ fun ProtonStreamApp(
                                onMatchChanged = model::reloadAfterMetadataChange,
                                onError = model::reportError,
                                onArrange = model::arrange,
+                                onAddShare = {
+                                    destination = Destination.Shares
+                                    addingShare = true
+                                },
+                                onOpenSettings = { destination = Destination.Settings },
+                                onFilter = model::filter,
                                )
                        }
                        val titlePane = @Composable { selected: TitleRecord ->
@@ -232,6 +250,7 @@ fun ProtonStreamApp(
                                model::reloadAfterMetadataChange,
                                model::setWatched,
                                body,
+                                onMarkEpisodes = model::markEpisodes,
                                franchise = selected.franchise.mapNotNull { key ->
                                    state.titles.firstOrNull { it.key == key }
                                },
@@ -263,13 +282,35 @@ fun ProtonStreamApp(
                    }
                    Destination.Shares -> SharesScreen(
                        state.shares,
-                        model::addShare,
+                        { name, url, password ->
+                            // The first share is the library: watch it fill
+                            // rather than stay on a form that has done its job.
+                            val first = state.titles.isEmpty()
+                            model.addShare(name, url, password).also { refusal ->
+                                if (refusal == null && first) destination = Destination.Library
+                            }
+                        },
                        model::repairShare,
                        model::refreshShare,
                        model::removeShare,
-                        shareLink,
-                        onShareLinkTaken,
+                        // The empty library's button opens the form as a
+                        // pasted link would, only with nothing in it.
+                        shareLink ?: "".takeIf { addingShare },
+                        { addingShare = false; onShareLinkTaken() },
                        body,
+                        account = state.account,
+                        accountActions = AccountActions(
+                            signIn = model::signIn,
+                            submitSecondFactor = model::submitSecondFactor,
+                            submitMailboxPassword = model::submitMailboxPassword,
+                            cancelSignIn = model::cancelSignIn,
+                            dismissVerification = model::dismissVerification,
+                            signOut = model::signOut,
+                            syncNow = model::syncNow,
+                            addFolder = model::addAccountFolder,
+                            onError = model::reportError,
+                        ),
+                        onRename = model::renameShare,
                    )
                    Destination.History -> HistoryScreen(
                        state,
@@ -289,6 +330,15 @@ fun ProtonStreamApp(
                        model::resumeDownload,
                        model::deletePartial,
                        body,
+                        onPlay = { title, index ->
+                            playingTitleKey = title.key
+                            playingIndex = index
+                            playerMinimized = false
+                        },
+                        onOpen = { title ->
+                            destination = Destination.Library
+                            selectedTitleKey = title.key
+                        },
                    )
                    Destination.Settings -> SettingsScreen(
                        state,
@@ -308,29 +358,35 @@ fun ProtonStreamApp(
                    onClose = {
                        playingTitleKey = null
                        playerMinimized = false
-                        model.reloadAfterMetadataChange()
+                        model.playerClosed()
                    },
                    modifier = Modifier
                        .align(Alignment.BottomCenter)
                        .padding(bottom = padding.calculateBottomPadding() + 8.dp),
                )
            }
+            ActivityBanner(
+                state.activity,
+                onStop = model::stopCrawl.takeIf { state.crawling },
+                modifier = Modifier
+                    .align(Alignment.BottomCenter)
+                    .padding(bottom = body.calculateBottomPadding() + 8.dp),
+            )
            }
        }
    }

    // Drawn over the scaffold rather than instead of it. The player owns the
    // whole window while it is up — it is a screen, not a dialog over one, which
-    // is what lets it draw into the cutout and hand the right window to
-    // Picture-in-Picture — but the page behind it stays composed, so leaving the
-    // player finds the title page where it was rather than rebuilt from the top.
+    // is what lets it draw into the cutout — but the page behind it stays
+    // composed, so leaving the player finds the title page where it was rather
+    // than rebuilt from the top.
    playing?.let { request ->
        PlayerScreen(
            title = request.title,
            episodes = request.episodes,
            index = request.index,
            host = playerHost,
-            inPictureInPicture = inPictureInPicture,
            minimized = playerMinimized,
            onIndexChange = { playingIndex = it },
            onSaveProgress = model::saveProgress,
@@ -338,7 +394,7 @@ fun ProtonStreamApp(
            onClose = {
                playingTitleKey = null
                playerMinimized = false
-                model.reloadAfterMetadataChange()
+                model.playerClosed()
            },
        )
    }
@@ -388,3 +444,37 @@ private fun MiniTransport(
        }
    }
 }
+
+/**
+ * What the app is busy with, for as long as it is: a spinner and one line.
+ * Not dismissible and not timed — it goes when the work does.
+ */
+@Composable
+private fun ActivityBanner(activity: String?, onStop: (() -> Unit)?, modifier: Modifier = Modifier) {
+    AnimatedVisibility(
+        visible = activity != null,
+        modifier = modifier,
+        enter = fadeIn() + slideInVertically { it },
+        exit = fadeOut() + slideOutVertically { it },
+    ) {
+        // Held through the exit, so the line does not blank before it fades.
+        var shown by remember { mutableStateOf(activity.orEmpty()) }
+        if (activity != null) shown = activity
+        Row(
+            Modifier
+                .padding(horizontal = 12.dp)
+                .fillMaxWidth()
+                .background(MaterialTheme.colorScheme.surfaceContainerHighest, MaterialTheme.shapes.small)
+                .padding(horizontal = 16.dp, vertical = 12.dp)
+                .semantics { liveRegion = LiveRegionMode.Polite },
+            horizontalArrangement = Arrangement.spacedBy(12.dp),
+            verticalAlignment = Alignment.CenterVertically,
+        ) {
+            CircularProgressIndicator(Modifier.size(18.dp), strokeWidth = 2.dp)
+            Text(shown, style = MaterialTheme.typography.bodyMedium, maxLines = 2, modifier = Modifier.weight(1f))
+            // A crawl of a large share can take minutes, and is the viewer's
+            // to call off; what it has read so far stays.
+            onStop?.let { QuietButton(onClick = it) { Text("Stop") } }
+        }
+    }
+}
@@ -33,6 +33,7 @@ import androidx.compose.ui.graphics.asImageBitmap
 import androidx.compose.ui.layout.ContentScale
 import androidx.compose.ui.platform.LocalContext
 import androidx.compose.ui.platform.LocalDensity
+import androidx.compose.ui.unit.Dp
 import androidx.compose.ui.text.font.FontWeight
 import io.narl.protonstream.native.NativeRuntime
 import kotlinx.coroutines.Dispatchers
@@ -87,16 +88,20 @@ internal fun RemoteArtwork(
    modifier: Modifier = Modifier,
    fallback: ThumbnailSource? = null,
    labelled: Boolean = true,
+    maxEdge: Dp? = null,
 ) {
    val context = LocalContext.current
    val enabled = LocalArtworkLoading.current
+    // Decoded at the size it is drawn: a grid tile is a few hundred pixels,
+    // and decoding its poster at 1024 holds four times the memory for nothing.
+    val edge = with(LocalDensity.current) { maxEdge?.roundToPx() }?.coerceIn(1, MAX_ART_EDGE) ?: MAX_ART_EDGE
    var image by remember(url, fallback) { mutableStateOf<ArtworkLoad>(ArtworkLoad.Pending) }
    LaunchedEffect(url, fallback, enabled) {
        if (!enabled) {
            image = ArtworkLoad.Missing
            return@LaunchedEffect
        }
-        image = (loadArtwork(context, url) ?: loadThumbnail(fallback))
+        image = (loadArtwork(context, url, edge) ?: loadThumbnail(fallback, edge))
            ?.let { ArtworkLoad.Loaded(it.asImageBitmap()) }
            ?: ArtworkLoad.Missing
    }
@@ -186,8 +191,8 @@ internal fun initials(name: String): String {
 * loader's protocol checks and exactly this disk cache, so the artwork the shade
 * shows costs no second download.
 */
-internal suspend fun loadArtwork(context: Context, url: String?): Bitmap? = url?.let { requested ->
-    decoded.get(requested) ?: withContext(Dispatchers.IO) {
+internal suspend fun loadArtwork(context: Context, url: String?, edge: Int = MAX_ART_EDGE): Bitmap? = url?.let { requested ->
+    decoded.get(sized(requested, edge)) ?: withContext(Dispatchers.IO) {
        runCatching {
            val uri = URI(requested)
            require(uri.scheme.equals("https", ignoreCase = true)) { "Artwork must use HTTPS" }
@@ -197,7 +202,7 @@ internal suspend fun loadArtwork(context: Context, url: String?): Bitmap? = url?
            val cached = directory.resolve("$digest.img")
            val fresh = !cached.isFile
            val bytes = if (fresh) download(uri) else cached.readBytes()
-            val bitmap = requireNotNull(decodeSampled(bytes)) { "Artwork is not a decodable image" }
+            val bitmap = requireNotNull(decodeSampled(bytes, edge)) { "Artwork is not a decodable image" }
            if (fresh) {
                // Written only once it has decoded. Caching the bytes first is
                // what turns one hostile poster into a crash on every launch
@@ -210,7 +215,7 @@ internal suspend fun loadArtwork(context: Context, url: String?): Bitmap? = url?
                cached.setLastModified(System.currentTimeMillis())
            }
            bitmap
-        }.getOrNull()?.also { decoded.put(requested, it) }
+        }.getOrNull()?.also { decoded.put(sized(requested, edge), it) }
    }
 }

@@ -224,21 +229,21 @@ internal suspend fun loadArtwork(context: Context, url: String?): Bitmap? = url?
 * share or a session that has to be reopened is transient, and the next
 * composition should try again.
 */
-internal suspend fun loadThumbnail(source: ThumbnailSource?): Bitmap? {
+internal suspend fun loadThumbnail(source: ThumbnailSource?, edge: Int = MAX_ART_EDGE): Bitmap? {
    val file = source ?: return null
    val key = file.key
-    decoded.get(key)?.let { return it }
+    decoded.get(sized(key, edge))?.let { return it }
    if (key in missing) return null
    val fetched = withContext(Dispatchers.IO) {
        runCatching { NativeRuntime.engine().thumbnail(file.shareId, file.volumeId, file.linkId) }
    }
    val bytes = fetched.getOrElse { return null }
-    val bitmap = bytes?.let { withContext(Dispatchers.Default) { decodeSampled(it) } }
+    val bitmap = bytes?.let { withContext(Dispatchers.Default) { decodeSampled(it, edge) } }
    if (bitmap == null) {
        missing.add(key)
        return null
    }
-    decoded.put(key, bitmap)
+    decoded.put(sized(key, edge), bitmap)
    return bitmap
 }

@@ -257,28 +262,43 @@ private fun download(uri: URI): ByteArray {
 }

 /**
- * Decode within a bound the display can actually use.
+ * Decode with its longest edge at most [edge] pixels.
 *
 * [MAX_ART_BYTES] bounds the *compressed* image, which says nothing about what
 * it costs decoded: a 12 MiB PNG can be 12000×12000, and that is a 576 MB
 * `ARGB_8888` allocation on a device that will not give it. The bounds pass
 * costs no allocation and settles a sample size before anything is committed.
+ *
+ * Sampling halves, so it stops while the image is still at least [edge]; the
+ * decoder scales the rest of the way, which a poster sampled straight to under
+ * its tile would show as blur.
 */
-private fun decodeSampled(bytes: ByteArray): Bitmap? {
+private fun decodeSampled(bytes: ByteArray, edge: Int): Bitmap? {
    val bounds = BitmapFactory.Options().apply { inJustDecodeBounds = true }
    BitmapFactory.decodeByteArray(bytes, 0, bytes.size, bounds)
    val longest = maxOf(bounds.outWidth, bounds.outHeight)
    if (longest <= 0) return null
    var sample = 1
-    while (longest / sample > MAX_ART_EDGE) sample *= 2
+    while (longest / (sample * 2) >= edge) sample *= 2
+    val sampled = longest / sample
    return BitmapFactory.decodeByteArray(
        bytes,
        0,
        bytes.size,
-        BitmapFactory.Options().apply { inSampleSize = sample },
+        BitmapFactory.Options().apply {
+            inSampleSize = sample
+            if (sampled > edge) {
+                inScaled = true
+                inDensity = sampled
+                inTargetDensity = edge
+            }
+        },
    )
 }

+/** The decoded cache's key for one image at one size. */
+private fun sized(key: String, edge: Int) = "$key#$edge"
+
 /**
 * Hold the cache directory under [MAX_ART_CACHE_BYTES], oldest first.
 *
@@ -315,7 +335,7 @@ private val missing: MutableSet<String> = Collections.synchronizedSet(mutableSet
 * is a full-resolution decode per item.
 */
 private val decoded = object : LruCache<String, Bitmap>(
-    (Runtime.getRuntime().maxMemory() / 8).coerceIn(4L * 1024 * 1024, 32L * 1024 * 1024).toInt(),
+    (Runtime.getRuntime().maxMemory() / 8).coerceIn(4L * 1024 * 1024, 64L * 1024 * 1024).toInt(),
 ) {
    override fun sizeOf(key: String, value: Bitmap): Int = value.byteCount
 }
@@ -59,12 +59,14 @@ import androidx.compose.ui.window.DialogProperties
 import androidx.compose.ui.window.SecureFlagPolicy
 import androidx.compose.ui.unit.dp
 import io.narl.protonstream.settings.SettingsStore
+import io.narl.protonstream.sync.NewEpisodesWorker
 import kotlinx.coroutines.Dispatchers
 import kotlinx.coroutines.launch
 import kotlinx.coroutines.withContext
 import io.narl.protonstream.download.DownloadCoordinator
 import io.narl.protonstream.native.NativeRuntime
 import io.narl.protonstream.ui.theme.AccentButton
+import io.narl.protonstream.ui.theme.DangerButton
 import io.narl.protonstream.ui.theme.AppearanceState
 import io.narl.protonstream.ui.theme.EdgedButton
 import io.narl.protonstream.ui.theme.TonalButton
@@ -86,7 +88,8 @@ import io.narl.protonstream.ui.theme.AccentProgress
@Composable
 internal fun SettingsScreen(
    state: AppUiState,
-    onSaveMetadata: (Boolean, MetadataProvider, String, String) -> Unit,
+    /** Resolves to why the settings were not stored, or null once they are. */
+    onSaveMetadata: suspend (Boolean, MetadataProvider, String, String) -> String?,
    onMatchAgain: () -> Unit,
    onClearCache: () -> Unit,
    onRemoveAllOffline: () -> Unit,
@@ -102,6 +105,7 @@ internal fun SettingsScreen(
    val settings = remember { SettingsStore(context) }
    var wifiOnly by remember { mutableStateOf(settings.wifiOnly) }
    var backgroundAudio by remember { mutableStateOf(settings.backgroundAudio) }
+    var newEpisodes by remember { mutableStateOf(settings.newEpisodeNotifications) }
    var hardwareDecoding by remember { mutableStateOf(settings.hardwareDecoding) }
    var cacheBudgetGib by remember { mutableStateOf(settings.cacheBudgetGib) }
    // Playback preferences are the shared store's, not this app's: they are the
@@ -205,6 +209,15 @@ internal fun SettingsScreen(
                backgroundAudio = it
                settings.backgroundAudio = it
            }
+            SettingSwitch(
+                "New episode notifications",
+                "Looks at your shares every few hours and says when a show gains episodes",
+                newEpisodes,
+            ) {
+                newEpisodes = it
+                settings.newEpisodeNotifications = it
+                NewEpisodesWorker.schedule(context)
+            }
        }
        SettingsPage.Storage -> SettingsSubPage(SettingsPage.Storage, padding, back) {
            SettingSwitch("Download on Wi-Fi only", "Mobile data is never used for downloads", wifiOnly) {
@@ -315,7 +328,7 @@ internal fun SettingsScreen(
                )
            },
            confirmButton = {
-                AccentButton(onClick = { confirmDelete = false; onRemoveAllOffline() }) { Text("Delete") }
+                DangerButton(onClick = { confirmDelete = false; onRemoveAllOffline() }) { Text("Delete") }
            },
            dismissButton = { TonalButton(onClick = { confirmDelete = false }) { Text("Cancel") } },
        )
@@ -327,10 +340,7 @@ internal fun SettingsScreen(
        MetadataSettingsDialog(
            current = state.metadataSettings,
            onDismiss = { showMetadata = false },
-            onSave = { enabled, provider, language, key ->
-                onSaveMetadata(enabled, provider, language, key)
-                showMetadata = false
-            },
+            onSave = onSaveMetadata,
        )
    }
 }
@@ -411,14 +421,19 @@ private fun SettingAction(
 private fun MetadataSettingsDialog(
    current: uniffi.pstr_android.MetadataSettingsRecord,
    onDismiss: () -> Unit,
-    onSave: (Boolean, MetadataProvider, String, String) -> Unit,
+    onSave: suspend (Boolean, MetadataProvider, String, String) -> String?,
 ) {
    var enabled by remember { mutableStateOf(current.enabled) }
    var provider by remember { mutableStateOf(current.provider) }
    var language by remember { mutableStateOf(current.language) }
    var apiKey by remember { mutableStateOf("") }
+    var saving by remember { mutableStateOf(false) }
+    var refusal by remember { mutableStateOf<String?>(null) }
+    val scope = rememberCoroutineScope()
+    val needsKey = enabled && provider == MetadataProvider.TMDB && !current.ready && apiKey.isBlank()
+    val forgets = current.enabled && (!enabled || provider != current.provider)
    AlertDialog(
-        onDismissRequest = onDismiss,
+        onDismissRequest = { if (!saving) onDismiss() },
        properties = DialogProperties(securePolicy = SecureFlagPolicy.SecureOn),
        title = { Text("Metadata enrichment") },
        text = {
@@ -447,15 +462,35 @@ private fun MetadataSettingsDialog(
                        singleLine = true,
                    )
                }
+                if (needsKey) Text("Enter a TMDB API key to save.", color = MaterialTheme.colorScheme.error)
+                // Said before Save rather than after: what is forgotten
+                // includes matches chosen by hand, which no look-up redoes.
+                if (forgets) {
+                    Text(
+                        "Saving forgets every poster, description and match stored now, " +
+                            "including ones you chose by hand.",
+                        color = MaterialTheme.colorScheme.error,
+                        style = MaterialTheme.typography.bodySmall,
+                    )
+                }
+                refusal?.let { Text(it, color = MaterialTheme.colorScheme.error) }
            }
        },
        confirmButton = {
            AccentButton(
-                enabled = !enabled || provider != MetadataProvider.TMDB || current.ready || apiKey.isNotBlank(),
-                onClick = { onSave(enabled, provider, language.ifBlank { "en" }, apiKey) },
-            ) { Text("Save") }
+                enabled = !needsKey && !saving,
+                onClick = {
+                    saving = true
+                    refusal = null
+                    scope.launch {
+                        refusal = onSave(enabled, provider, language.ifBlank { "en" }, apiKey)
+                        saving = false
+                        if (refusal == null) onDismiss()
+                    }
+                },
+            ) { Text(if (saving) "Saving…" else "Save") }
        },
-        dismissButton = { TonalButton(onClick = onDismiss) { Text("Cancel") } },
+        dismissButton = { TonalButton(onClick = onDismiss, enabled = !saving) { Text("Cancel") } },
    )
 }

@@ -1,5 +1,10 @@
 package io.narl.protonstream.ui

+import kotlinx.coroutines.launch
+import androidx.compose.runtime.rememberCoroutineScope
+import androidx.compose.material3.CircularProgressIndicator
+import androidx.compose.foundation.layout.size
+import androidx.compose.foundation.layout.Row
 import androidx.compose.foundation.layout.Arrangement
 import androidx.compose.foundation.layout.Column
 import androidx.compose.foundation.layout.PaddingValues
@@ -25,13 +30,18 @@ import androidx.compose.ui.Alignment
 import androidx.compose.ui.Modifier
 import androidx.compose.ui.text.font.FontWeight
 import androidx.compose.ui.text.input.PasswordVisualTransformation
+import androidx.compose.ui.text.input.VisualTransformation
+import androidx.compose.ui.text.style.TextOverflow
 import androidx.compose.foundation.text.KeyboardOptions
 import androidx.compose.ui.text.input.KeyboardType
 import androidx.compose.ui.window.DialogProperties
 import androidx.compose.ui.window.SecureFlagPolicy
 import androidx.compose.ui.unit.dp
 import io.narl.protonstream.ui.theme.AccentButton
+import io.narl.protonstream.ui.theme.DangerButton
 import io.narl.protonstream.ui.theme.TonalButton
+import androidx.compose.material.icons.filled.Edit
+import uniffi.pstr_android.AccountState
 import uniffi.pstr_android.ShareRecord
 import androidx.compose.foundation.layout.Box
 import androidx.compose.material3.ExtendedFloatingActionButton
@@ -44,34 +54,64 @@ import androidx.compose.material.icons.filled.MoreVert
 import androidx.compose.material.icons.filled.Key
 import androidx.compose.material.icons.filled.Delete
 import androidx.compose.material.icons.filled.FolderShared
+import androidx.compose.material.icons.filled.Visibility
+import androidx.compose.material.icons.filled.VisibilityOff
 import androidx.compose.ui.graphics.Color

@Composable
 internal fun SharesScreen(
    shares: List<ShareRecord>,
-    onAdd: (String, String, String?) -> Unit,
+    /** Resolves to why the link was refused, or null once it is added. */
+    onAdd: suspend (String, String, String?) -> String?,
    onRepair: (String, String, String?) -> Unit,
    onRefresh: (String) -> Unit,
    onRemove: (String) -> Unit,
    incomingLink: String?,
    onIncomingLinkTaken: () -> Unit,
    padding: PaddingValues,
+    account: AccountUiState = AccountUiState(),
+    accountActions: AccountActions? = null,
+    onRename: (String, String) -> Unit = { _, _ -> },
 ) {
    var showAdd by remember { mutableStateOf(false) }
+    var renaming by remember { mutableStateOf<ShareRecord?>(null) }
+    var signingIn by remember { mutableStateOf(false) }
+    var browsing by remember { mutableStateOf(false) }
    var repairing by remember { mutableStateOf<ShareRecord?>(null) }
    var removing by remember { mutableStateOf<ShareRecord?>(null) }
    TabPage("Shares", padding) { body ->
        Box(Modifier.fillMaxSize().padding(body)) {
-            if (shares.isEmpty()) {
+            if (shares.isEmpty() && account.state == null) {
                EmptyState("No shares yet", "Add a Proton Drive public link to build your library.")
            } else {
                LazyColumn(contentPadding = PaddingValues(top = 8.dp, bottom = 96.dp)) {
+                    if (accountActions != null) {
+                        item(key = "account") {
+                            AccountCard(
+                                account,
+                                accountActions,
+                                onSignIn = { signingIn = true },
+                                onBrowse = { browsing = true },
+                            )
+                        }
+                    }
+                    if (shares.isEmpty()) {
+                        item(key = "empty") {
+                            Text(
+                                "No shares yet. Add a public link, or a folder of your Drive once signed in.",
+                                style = MaterialTheme.typography.bodyMedium,
+                                color = MaterialTheme.colorScheme.onSurfaceVariant,
+                                modifier = Modifier.padding(16.dp),
+                            )
+                        }
+                    }
                    items(shares, key = { it.id }) { share ->
                        ShareRow(
                            share = share,
                            onRefresh = { onRefresh(share.id) },
                            onRepair = { repairing = share },
                            onRemove = { removing = share },
+                            onRename = { renaming = share },
                        )
                    }
                }
@@ -95,6 +135,14 @@ internal fun SharesScreen(
            onAdd = onAdd,
        )
    }
+    if (accountActions != null && (signingIn || account.state == AccountState.SecondFactor ||
+            account.state == AccountState.MailboxPassword)
+    ) {
+        SignInDialog(account, accountActions, onDismiss = { signingIn = false })
+    }
+    if (accountActions != null && browsing) {
+        DriveBrowserDialog(accountActions, onDismiss = { browsing = false })
+    }
    repairing?.let { share ->
        RepairShareDialog(
            share = share,
@@ -102,20 +150,35 @@ internal fun SharesScreen(
            onRepair = { url, password -> onRepair(share.id, url, password) },
        )
    }
+    renaming?.let { share ->
+        var name by remember(share.id) { mutableStateOf(share.name) }
+        AlertDialog(
+            onDismissRequest = { renaming = null },
+            title = { Text("Rename ${share.name}") },
+            text = { OutlinedTextField(name, { name = it }, label = { Text("Name") }, singleLine = true) },
+            confirmButton = {
+                AccentButton(enabled = name.isNotBlank(), onClick = {
+                    renaming = null
+                    onRename(share.id, name.trim())
+                }) { Text("Save") }
+            },
+            dismissButton = { TonalButton(onClick = { renaming = null }) { Text("Cancel") } },
+        )
+    }
    removing?.let { share ->
-        // Asked, because it cannot be undone: the link's secret, its offline
-        // files and its watch positions all go (`Catalog::remove_share`).
+        // Asked, because it cannot be undone: the link's secret and its
+        // offline files go. Watch positions stay (`Catalog::remove_share`).
        AlertDialog(
            onDismissRequest = { removing = null },
            title = { Text("Remove ${share.name}?") },
            text = {
                Text(
-                    "Its titles leave the library, and its offline episodes and watch " +
-                        "progress are deleted. Adding the link again starts it fresh.",
+                    "Its titles leave the library and its offline episodes are deleted. " +
+                        "Watch progress is kept, so adding the link again picks up where you left off.",
                )
            },
            confirmButton = {
-                AccentButton(onClick = { removing = null; onRemove(share.id) }) { Text("Remove") }
+                DangerButton(onClick = { removing = null; onRemove(share.id) }) { Text("Remove") }
            },
            dismissButton = { TonalButton(onClick = { removing = null }) { Text("Cancel") } },
        )
@@ -128,18 +191,58 @@ internal fun SharesScreen(
 * Three differently styled controls beside the name squeezed it into a column
 * a word wide; one icon leaves the row its width.
 */
+/** "120 files · crawled 2 h ago", or that it has not been yet. */
+internal fun crawlLine(share: ShareRecord, now: Long = System.currentTimeMillis() / 1_000): String {
+    val at = share.crawledAt ?: return "Not crawled yet"
+    val files = share.crawlFiles?.toLong()?.let { if (it == 1L) "1 file" else "$it files" }
+    return listOfNotNull(files, "crawled ${ago(at, now)}").joinToString(" · ")
+}
+
+/** "just now", "5 min ago", "3 h ago", "2 days ago" — the desktop's `ui::ago`. */
+internal fun ago(at: Long, now: Long): String {
+    val seconds = (now - at).coerceAtLeast(0)
+    return when {
+        seconds < 60 -> "just now"
+        seconds < 3_600 -> "${seconds / 60} min ago"
+        seconds < 86_400 -> "${seconds / 3_600} h ago"
+        seconds < 172_800 -> "1 day ago"
+        else -> "${seconds / 86_400} days ago"
+    }
+}
+
@Composable
 private fun ShareRow(
    share: ShareRecord,
    onRefresh: () -> Unit,
    onRepair: () -> Unit,
    onRemove: () -> Unit,
+    onRename: () -> Unit = {},
 ) {
    var menu by remember { mutableStateOf(false) }
    ListItem(
        headlineContent = { Text(share.name, fontWeight = FontWeight.SemiBold) },
        supportingContent = {
-            Text(if (share.hasCustomPassword) "Link and custom password, stored securely" else "Public link")
+            Column {
+                Text(
+                    when {
+                        share.fromAccount -> "Folder of your Drive"
+                        share.hasCustomPassword -> "Link and custom password"
+                        else -> "Public link"
+                    },
+                )
+                Text(crawlLine(share), style = MaterialTheme.typography.bodySmall)
+                // Until a crawl succeeds: a link revoked upstream otherwise
+                // just stops growing.
+                share.crawlError?.let {
+                    Text(
+                        "Last crawl failed: $it",
+                        color = MaterialTheme.colorScheme.error,
+                        style = MaterialTheme.typography.bodySmall,
+                        maxLines = 2,
+                        overflow = TextOverflow.Ellipsis,
+                    )
+                }
+            }
        },
        leadingContent = {
            Icon(
@@ -161,14 +264,21 @@ private fun ShareRow(
                        leadingIcon = { Icon(Icons.Default.Refresh, contentDescription = null) },
                        onClick = { menu = false; onRefresh() },
                    )
+                    DropdownMenuItem(
+                        text = { Text("Rename") },
+                        leadingIcon = { Icon(Icons.Default.Edit, contentDescription = null) },
+                        onClick = { menu = false; onRename() },
+                    )
                    // Not a remove: a share whose secret has become unreadable
                    // cannot be removed either, since removal deletes a secret
                    // the store can no longer touch.
-                    DropdownMenuItem(
-                        text = { Text("Re-enter link") },
-                        leadingIcon = { Icon(Icons.Default.Key, contentDescription = null) },
-                        onClick = { menu = false; onRepair() },
-                    )
+                    if (!share.fromAccount) {
+                        DropdownMenuItem(
+                            text = { Text("Re-enter link") },
+                            leadingIcon = { Icon(Icons.Default.Key, contentDescription = null) },
+                            onClick = { menu = false; onRepair() },
+                        )
+                    }
                    DropdownMenuItem(
                        text = { Text("Remove") },
                        leadingIcon = { Icon(Icons.Default.Delete, contentDescription = null) },
@@ -236,32 +346,55 @@ private fun RepairShareDialog(
    )
 }

+/**
+ * Add a link. The form stays up while the link is opened, and with the reason
+ * under it when the link is refused, so fixing a typo is a retry rather than
+ * starting over.
+ */
@Composable
 private fun AddShareDialog(
    initialUrl: String,
    onDismiss: () -> Unit,
-    onAdd: (String, String, String?) -> Unit,
+    onAdd: suspend (String, String, String?) -> String?,
 ) {
    var name by remember { mutableStateOf("") }
    var url by remember(initialUrl) { mutableStateOf(initialUrl) }
+    var showLink by remember { mutableStateOf(false) }
    var password by remember { mutableStateOf("") }
+    var adding by remember { mutableStateOf(false) }
+    var refusal by remember { mutableStateOf<String?>(null) }
+    val scope = rememberCoroutineScope()
    AlertDialog(
-        onDismissRequest = onDismiss,
+        onDismissRequest = { if (!adding) onDismiss() },
        properties = DialogProperties(securePolicy = SecureFlagPolicy.SecureOn),
        title = { Text("Add Proton Drive share") },
        text = {
            Column(verticalArrangement = Arrangement.spacedBy(8.dp)) {
-                OutlinedTextField(name, { name = it }, label = { Text("Library name") }, singleLine = true)
                OutlinedTextField(
                    url,
                    { url = it },
-                    label = { Text("Public share URL") },
+                    label = { Text("Share link") },
                    singleLine = true,
                    // The URL fragment is a secret. Password input disables
                    // IME learning/suggestions while normal long-press paste
-                    // remains available.
-                    visualTransformation = PasswordVisualTransformation(),
+                    // remains available; the eye shows what was pasted.
+                    visualTransformation = if (showLink) VisualTransformation.None else PasswordVisualTransformation(),
                    keyboardOptions = KeyboardOptions(keyboardType = KeyboardType.Password),
+                    trailingIcon = {
+                        IconButton(onClick = { showLink = !showLink }) {
+                            Icon(
+                                if (showLink) Icons.Default.VisibilityOff else Icons.Default.Visibility,
+                                contentDescription = if (showLink) "Hide link" else "Show link",
+                            )
+                        }
+                    },
+                )
+                OutlinedTextField(
+                    name,
+                    { name = it },
+                    label = { Text("Name (optional)") },
+                    supportingText = { Text("Defaults to the shared folder's name") },
+                    singleLine = true,
                )
                OutlinedTextField(
                    password,
@@ -271,14 +404,30 @@ private fun AddShareDialog(
                    visualTransformation = PasswordVisualTransformation(),
                    keyboardOptions = KeyboardOptions(keyboardType = KeyboardType.Password),
                )
+                if (adding) {
+                    Row(horizontalArrangement = Arrangement.spacedBy(12.dp), verticalAlignment = Alignment.CenterVertically) {
+                        CircularProgressIndicator(Modifier.size(18.dp), strokeWidth = 2.dp)
+                        Text("Opening the link…")
+                    }
+                } else {
+                    refusal?.let { Text(it, color = MaterialTheme.colorScheme.error) }
+                }
            }
        },
        confirmButton = {
            AccentButton(
-                onClick = { onAdd(name.trim(), url.trim(), password); onDismiss() },
-                enabled = name.isNotBlank() && url.isNotBlank(),
-            ) { Text("Add") }
+                onClick = {
+                    adding = true
+                    refusal = null
+                    scope.launch {
+                        refusal = onAdd(name.trim(), url.trim(), password)
+                        adding = false
+                        if (refusal == null) onDismiss()
+                    }
+                },
+                enabled = url.isNotBlank() && !adding,
+            ) { Text(if (adding) "Adding…" else "Add") }
        },
-        dismissButton = { TonalButton(onClick = onDismiss) { Text("Cancel") } },
+        dismissButton = { TonalButton(onClick = onDismiss, enabled = !adding) { Text("Cancel") } },
    )
 }
@@ -7,6 +7,7 @@ import androidx.compose.runtime.mutableFloatStateOf
 import androidx.compose.ui.graphics.graphicsLayer
 import kotlin.coroutines.cancellation.CancellationException
 import androidx.compose.foundation.clickable
+import androidx.compose.foundation.combinedClickable
 import androidx.compose.foundation.background
 import androidx.compose.foundation.layout.Arrangement
 import androidx.compose.foundation.layout.Box
@@ -30,6 +31,8 @@ import androidx.compose.foundation.lazy.items
 import androidx.compose.foundation.lazy.itemsIndexed
 import androidx.compose.foundation.lazy.grid.items
 import androidx.compose.material3.AlertDialog
+import androidx.compose.material3.DropdownMenu
+import androidx.compose.material3.DropdownMenuItem
 import androidx.compose.material3.MaterialTheme
 import androidx.compose.material3.OutlinedTextField
 import androidx.compose.material3.Text
@@ -38,14 +41,17 @@ import androidx.compose.material3.IconButton
 import androidx.compose.material.icons.Icons
 import androidx.compose.material.icons.filled.CheckCircle
 import androidx.compose.material.icons.outlined.CheckCircle
+import androidx.compose.material.icons.filled.DoneAll
 import androidx.compose.material.icons.filled.Download
 import androidx.compose.material.icons.filled.Edit
+import androidx.compose.material.icons.filled.RemoveDone
 import androidx.compose.material.icons.filled.Pause
 import androidx.compose.material.icons.filled.PlayArrow
 import androidx.compose.material.icons.automirrored.filled.ArrowBack
 import androidx.compose.runtime.Composable
 import androidx.compose.runtime.getValue
 import androidx.compose.runtime.mutableStateOf
+import androidx.compose.runtime.produceState
 import androidx.compose.runtime.remember
 import androidx.compose.runtime.rememberCoroutineScope
 import androidx.compose.runtime.setValue
@@ -68,6 +74,7 @@ import io.narl.protonstream.download.DownloadStateStore
 import io.narl.protonstream.download.RetainedDownload
 import io.narl.protonstream.native.NativeRuntime
 import io.narl.protonstream.ui.theme.AccentButton
+import io.narl.protonstream.ui.theme.DangerButton
 import io.narl.protonstream.ui.theme.AccentProgress
 import io.narl.protonstream.ui.theme.EdgedButton
 import io.narl.protonstream.ui.theme.QuietButton
@@ -97,11 +104,14 @@ internal fun TitleScreen(
    onMetadataChanged: () -> Unit,
    onSetWatched: (EpisodeRecord, Boolean) -> Unit,
    padding: PaddingValues,
+    /** Several episodes seen or unseen at once, named for the message. */
+    onMarkEpisodes: (List<EpisodeRecord>, Boolean, String) -> Unit = { _, _, _ -> },
    /** Every title of its franchise, in release order, this one included. */
    franchise: List<TitleRecord> = emptyList(),
    onOpenTitle: (TitleRecord) -> Unit = {},
 ) {
    val context = LocalContext.current
+    val download = rememberDownload()
    var showMatch by remember(title.key) { mutableStateOf(false) }
    var overviewOpen by remember(title.key) { mutableStateOf(false) }

@@ -122,7 +132,7 @@ internal fun TitleScreen(
    // Display order across seasons: what previous/next and autoplay walk, and
    // the same order the desktop client uses.
    val playlist = remember(title) { title.seasons.flatMap(SeasonRecord::episodes) }
-    val nextUp = remember(playlist) { nextUpIndex(playlist) }
+    val nextUp = remember(playlist) { nextUpIndex(playlist, title.continueIndex) }
    val upNext = playlist.getOrNull(nextUp)
    // One season on screen at a time, opened on the one Play would land in: a
    // forty-episode show as stacked sections is one long scroll to the part
@@ -138,7 +148,11 @@ internal fun TitleScreen(
    // without a trip to the Downloads tab.
    val work by WorkManager.getInstance(context)
        .getWorkInfosByTagLiveData(DownloadCoordinator.TAG).observeAsState(emptyList())
-    val downloads = remember(work) { DownloadStateStore(context).records() }
+    // Decoded off the main thread: WorkManager reports progress several times
+    // a second while a season downloads, and each report re-reads every record.
+    val downloads by produceState(emptyList<RetainedDownload>(), work) {
+        value = withContext(Dispatchers.IO) { DownloadStateStore(context).records() }
+    }

    // On a tablet the page keeps a phone's reading width, centred: a Play
    // button and synopsis lines two thousand pixels wide are read by turning
@@ -266,7 +280,7 @@ internal fun TitleScreen(
                            }
                        }
                        TitleAction(Icons.Default.Download, "Download", Modifier.weight(1f)) {
-                            DownloadCoordinator.enqueue(context, playlist)
+                            download(playlist, title.displayName)
                        }
                        TitleAction(Icons.Default.Edit, "Match", Modifier.weight(1f)) { showMatch = true }
                        // The provider's own page for this title: where a viewer goes
@@ -343,7 +357,9 @@ internal fun TitleScreen(
                    verticalAlignment = Alignment.CenterVertically,
                ) {
                    LazyRow(Modifier.weight(1f), horizontalArrangement = Arrangement.spacedBy(8.dp)) {
-                        itemsIndexed(title.seasons, key = { _, it -> it.label }) { index, entry ->
+                        // By position: two seasons can share a label, and a
+                        // repeated key is a crash in a lazy list.
+                        itemsIndexed(title.seasons, key = { index, _ -> index }) { index, entry ->
                            FilterChip(
                                selected = index == seasonIndex,
                                onClick = { seasonIndex = index },
@@ -352,7 +368,16 @@ internal fun TitleScreen(
                        }
                    }
                    season?.let {
-                        IconButton(onClick = { DownloadCoordinator.enqueue(context, it.episodes) }) {
+                        // For someone joining the show partway, who would
+                        // otherwise tick every earlier episode one by one.
+                        val seen = it.episodes.all(EpisodeRecord::watched)
+                        IconButton(onClick = { onMarkEpisodes(it.episodes, !seen, "${title.displayName} ${it.label}") }) {
+                            Icon(
+                                if (seen) Icons.Default.RemoveDone else Icons.Default.DoneAll,
+                                contentDescription = "Mark ${it.label} ${if (seen) "unwatched" else "watched"}",
+                            )
+                        }
+                        IconButton(onClick = { download(it.episodes, "${title.displayName} ${it.label}") }) {
                            Icon(Icons.Default.Download, contentDescription = "Download ${it.label}")
                        }
                    }
@@ -374,6 +399,14 @@ internal fun TitleScreen(
                            onPause = { DownloadCoordinator.pause(context, it) },
                            onResume = { DownloadCoordinator.resume(context, it) },
                            onSetWatched = { onSetWatched(episode, it) },
+                            onWatchedUpTo = {
+                                val upTo = playlist.indexOfFirst { it.linkId == episode.linkId }
+                                onMarkEpisodes(
+                                    playlist.take(upTo + 1),
+                                    true,
+                                    "${title.displayName} up to ${episode.label}",
+                                )
+                            },
                        )
                    }
                }
@@ -521,16 +554,35 @@ private fun EpisodeRow(
    onPause: (RetainedDownload) -> Unit,
    onResume: (RetainedDownload) -> Unit,
    onSetWatched: (Boolean) -> Unit,
+    onWatchedUpTo: () -> Unit = {},
 ) {
+    // A long press, for someone joining a show partway: everything before
+    // this one ticked at once rather than one by one.
+    var menu by remember { mutableStateOf(false) }
    val running = download?.status == RetainedDownload.STATUS_RUNNING ||
        download?.status == RetainedDownload.STATUS_QUEUED
    val heading = episode.heading(position)
    Column(
        Modifier
            .fillMaxWidth()
-            .clickable(enabled = playerReady, onClick = onPlay)
+            .combinedClickable(
+                enabled = playerReady,
+                onClick = onPlay,
+                onLongClick = { menu = true },
+                onLongClickLabel = "More for this episode",
+            )
            .padding(horizontal = 16.dp, vertical = 6.dp),
    ) {
+        DropdownMenu(expanded = menu, onDismissRequest = { menu = false }) {
+            DropdownMenuItem(
+                text = { Text("Mark watched up to here") },
+                leadingIcon = { Icon(Icons.Default.DoneAll, contentDescription = null) },
+                onClick = {
+                    menu = false
+                    onWatchedUpTo()
+                },
+            )
+        }
        Row(verticalAlignment = Alignment.CenterVertically) {
            // With metadata off the provider has no still, and Proton's own
            // thumbnail is a frame of this very episode. Where it was left sits
@@ -636,8 +688,7 @@ private fun EpisodeRow(
                fill = solid(MaterialTheme.colorScheme.tertiary),
            )
            Text(
-                "${active.status.replaceFirstChar { it.uppercase() }} · " +
-                    "${formatBytes(active.downloaded.toULong())} of ${formatBytes(active.total.toULong())}",
+                downloadStatusLine(active, rememberQueueReason(active)),
                style = MaterialTheme.typography.bodySmall,
                color = MaterialTheme.colorScheme.onSurfaceVariant,
            )
@@ -654,8 +705,36 @@ internal fun ChangeMatchDialog(
 ) {
    var term by remember(title.key) { mutableStateOf(title.canonicalName ?: title.name) }
    var searching by remember { mutableStateOf(false) }
+    // Choosing fetches the entry's episodes too, which is a few requests.
+    var choosing by remember { mutableStateOf(false) }
    var options by remember { mutableStateOf<List<MatchRecord>>(emptyList()) }
+    var confirmForget by remember { mutableStateOf(false) }
    val scope = rememberCoroutineScope()
+    if (confirmForget) {
+        // Asked, because a match chosen by hand is work the next look-up
+        // does not redo: it decides again on its own.
+        AlertDialog(
+            onDismissRequest = { confirmForget = false },
+            title = { Text("Forget this match?") },
+            text = {
+                Text(
+                    "Its poster, description and episode names go, and the next look-up " +
+                        "matches it again on its own. A match you chose by hand is lost.",
+                )
+            },
+            confirmButton = {
+                DangerButton(onClick = {
+                    confirmForget = false
+                    scope.launch {
+                        runCatching { withContext(Dispatchers.IO) { NativeRuntime.engine().forgetMatch(title.key) } }
+                            .onSuccess { onChanged() }.onFailure(onError)
+                    }
+                }) { Text("Forget") }
+            },
+            dismissButton = { TonalButton(onClick = { confirmForget = false }) { Text("Cancel") } },
+        )
+        return
+    }
    AlertDialog(
        onDismissRequest = onDismiss,
        title = { Text("Change match") },
@@ -672,16 +751,26 @@ internal fun ChangeMatchDialog(
                        searching = false
                    }
                }) { Text(if (searching) "Searching…" else "Search") }
+                if (choosing) {
+                    Text(
+                        "Fetching its episodes…",
+                        style = MaterialTheme.typography.bodySmall,
+                        modifier = Modifier.padding(top = 8.dp),
+                    )
+                }
                LazyColumn(Modifier.fillMaxWidth().heightIn(max = 300.dp)) {
                    items(options, key = { "${it.provider}:${it.remoteId}" }) { option ->
                        EdgedButton(
                            onClick = {
+                                choosing = true
                                scope.launch {
                                    runCatching {
                                        withContext(Dispatchers.IO) { NativeRuntime.engine().chooseMatch(title.key, option) }
                                    }.onSuccess { onChanged() }.onFailure(onError)
+                                    choosing = false
                                }
                            },
+                            enabled = !choosing,
                            modifier = Modifier.fillMaxWidth().padding(top = 6.dp),
                        ) {
                            Column(Modifier.fillMaxWidth()) {
@@ -694,12 +783,7 @@ internal fun ChangeMatchDialog(
            }
        },
        confirmButton = {
-            QuietButton(onClick = {
-                scope.launch {
-                    runCatching { withContext(Dispatchers.IO) { NativeRuntime.engine().forgetMatch(title.key) } }
-                        .onSuccess { onChanged() }.onFailure(onError)
-                }
-            }) { Text("Forget match") }
+            QuietButton(onClick = { confirmForget = true }) { Text("Forget match") }
        },
        dismissButton = { TonalButton(onClick = onDismiss) { Text("Close") } },
    )
@@ -142,6 +142,28 @@ internal fun QuietButton(
    content = content,
 )

+/**
+ * The yes of a confirmation that deletes or forgets something.
+ *
+ * Not [AccentButton]: the filled accent is this app's "go on", and a dialog
+ * whose most inviting button is the one that loses something reads as the
+ * safe choice. Error-toned text instead, as Material's own guidance has it.
+ */
+@Composable
+internal fun DangerButton(
+    onClick: () -> Unit,
+    modifier: Modifier = Modifier,
+    enabled: Boolean = true,
+    content: @Composable RowScope.() -> Unit,
+) = TextButton(
+    onClick = onClick,
+    modifier = modifier,
+    enabled = enabled,
+    shape = MaterialTheme.shapes.small,
+    colors = ButtonDefaults.textButtonColors(contentColor = MaterialTheme.colorScheme.error),
+    content = content,
+)
+
 /**
 * How far along something is, drawn in the accent.
 *
@@ -56,6 +56,12 @@ object AppearanceState {
            .onSuccess { current.value = it }
    }

+    /** Read the stored choice again, after sync rewrote it. */
+    suspend fun reload() {
+        runCatching { withContext(Dispatchers.IO) { NativeRuntime.engine().palette() } }
+            .onSuccess { current.value = it }
+    }
+
    /** Repaint immediately, before the write that stores the choice lands. */
    fun apply(palette: PaletteRecord) {
        current.value = palette
@@ -0,0 +1,37 @@
+package io.narl.protonstream.download
+
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertTrue
+import org.junit.Test
+
+class TransferRateTest {
+    @Test
+    fun `the first sample has no rate to report`() {
+        assertEquals(0L, TransferRate().sample(4L * 1024 * 1024, 1_000))
+    }
+
+    @Test
+    fun `a steady transfer reports its rate`() {
+        val rate = TransferRate()
+        rate.sample(0, 0)
+        assertEquals(1_000_000L, rate.sample(1_000_000, 1_000))
+        assertEquals(1_000_000L, rate.sample(2_000_000, 2_000))
+    }
+
+    @Test
+    fun `one slow block moves the rate without halving it`() {
+        val rate = TransferRate()
+        rate.sample(0, 0)
+        rate.sample(1_000_000, 1_000)
+        val after = rate.sample(2_000_000, 3_000)
+        assertTrue(after in 600_000L..999_999L)
+    }
+
+    @Test
+    fun `a resumed download starting below the last sample starts over`() {
+        val rate = TransferRate()
+        rate.sample(0, 0)
+        rate.sample(1_000_000, 1_000)
+        assertEquals(1_000_000L, rate.sample(0, 2_000))
+    }
+}
@@ -0,0 +1,38 @@
+package io.narl.protonstream.ui
+
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertFalse
+import org.junit.Assert.assertTrue
+import org.junit.Test
+
+class AccountUiTest {
+    @Test
+    fun `the sync line says how long ago and what came in`() {
+        val minute = 60_000L
+        assertEquals("Library, settings and watch history sync through your Drive", syncLine(AccountUiState(), 0))
+        assertEquals("Synced just now", syncLine(AccountUiState(syncedAt = 0), 30_000))
+        assertEquals("Synced 5 min ago", syncLine(AccountUiState(syncedAt = 0), 5 * minute))
+        assertEquals(
+            "Synced 2 h ago · 3 from other devices",
+            syncLine(AccountUiState(syncedAt = 0, applied = 3), 120 * minute),
+        )
+    }
+
+    @Test
+    fun `a failed sync is said in place of when it last worked`() {
+        assertEquals(
+            "Did not sync: offline",
+            syncLine(AccountUiState(syncedAt = 0, syncError = "offline"), 0),
+        )
+    }
+
+    @Test
+    fun `the verification page may only navigate within Proton over https`() {
+        assertTrue(isProtonPage("https", "verify.proton.me"))
+        assertTrue(isProtonPage("https", "proton.me"))
+        assertFalse(isProtonPage("http", "verify.proton.me"))
+        assertFalse(isProtonPage("https", "proton.me.example.com"))
+        assertFalse(isProtonPage("https", "notproton.me"))
+        assertFalse(isProtonPage("https", null))
+    }
+}
@@ -26,6 +26,7 @@ class HistoryTest {
        displayName = key, wideUrl = null, formatLabel = null, seasonLabel = null, studios = emptyList(),
        directors = emptyList(), tags = emptyList(), airing = false, nextEpisode = null, nextAiringAt = null,
        franchise = emptyList(),
+        continueIndex = null,
    )

    @Test
@@ -27,6 +27,8 @@ import org.robolectric.annotation.Config
 import org.robolectric.annotation.GraphicsMode
 import uniffi.pstr_android.ArrangementRecord
 import uniffi.pstr_android.EpisodeRecord
+import uniffi.pstr_android.MetadataProvider
+import uniffi.pstr_android.MetadataSettingsRecord
 import uniffi.pstr_android.OfflineRecord
 import uniffi.pstr_android.PaletteRecord
 import uniffi.pstr_android.SeasonRecord
@@ -79,18 +81,23 @@ class ScreenshotTest {

    @Test
    fun `the library on a phone`() = capture("library-phone") {
+        LibraryScreen(MATCHED, {}, { _, _ -> }, {}, {}, { _, _ -> }, { _, _ -> }, PaddingValues())
+    }
+
+    @Test
+    fun `the library offering posters while they are off`() = capture("library-phone-offer") {
        LibraryScreen(LIBRARY, {}, { _, _ -> }, {}, {}, { _, _ -> }, { _, _ -> }, PaddingValues())
    }

    @Test
    @Config(qualifiers = RobolectricDeviceQualifiers.MediumTablet)
    fun `the library on a tablet`() = capture("library-tablet") {
-        LibraryScreen(LIBRARY, {}, { _, _ -> }, {}, {}, { _, _ -> }, { _, _ -> }, PaddingValues())
+        LibraryScreen(MATCHED, {}, { _, _ -> }, {}, {}, { _, _ -> }, { _, _ -> }, PaddingValues())
    }

    @Test
    fun `the library in the light palette`() = captureLight("library-phone-light") {
-        LibraryScreen(LIBRARY, {}, { _, _ -> }, {}, {}, { _, _ -> }, { _, _ -> }, PaddingValues())
+        LibraryScreen(MATCHED, {}, { _, _ -> }, {}, {}, { _, _ -> }, { _, _ -> }, PaddingValues())
    }

    @Test
@@ -116,7 +123,7 @@ class ScreenshotTest {
        // reads it from, so the scale is set there.
        val density = LocalDensity.current
        CompositionLocalProvider(LocalDensity provides Density(density.density, fontScale = 1.5f)) {
-            LibraryScreen(LIBRARY, {}, { _, _ -> }, {}, {}, { _, _ -> }, { _, _ -> }, PaddingValues())
+            LibraryScreen(MATCHED, {}, { _, _ -> }, {}, {}, { _, _ -> }, { _, _ -> }, PaddingValues())
        }
    }

@@ -137,22 +144,22 @@ class ScreenshotTest {

    @Test
    fun `the shares page`() = capture("shares-phone") {
-        SharesScreen(LIBRARY.shares, { _, _, _ -> }, { _, _, _ -> }, {}, {}, null, {}, PaddingValues())
+        SharesScreen(LIBRARY.shares, { _, _, _ -> null }, { _, _, _ -> }, {}, {}, null, {}, PaddingValues())
    }

    @Test
    fun `the settings page`() = capture("settings-phone") {
-        SettingsScreen(LIBRARY, { _, _, _, _ -> }, {}, {}, {}, PaddingValues(), version = "1.0.0")
+        SettingsScreen(LIBRARY, { _, _, _, _ -> null }, {}, {}, {}, PaddingValues(), version = "1.0.0")
    }

    @Test
    fun `the playback settings`() = capture("settings-playback") {
-        SettingsScreen(LIBRARY, { _, _, _, _ -> }, {}, {}, {}, PaddingValues(), SettingsPage.Playback)
+        SettingsScreen(LIBRARY, { _, _, _, _ -> null }, {}, {}, {}, PaddingValues(), SettingsPage.Playback)
    }

    @Test
    fun `the storage settings`() = capture("settings-storage") {
-        SettingsScreen(LIBRARY, { _, _, _, _ -> }, {}, {}, {}, PaddingValues(), SettingsPage.Storage)
+        SettingsScreen(LIBRARY, { _, _, _, _ -> null }, {}, {}, {}, PaddingValues(), SettingsPage.Storage)
    }

    @Test
@@ -264,6 +271,9 @@ class ScreenshotTest {
            nextEpisode = null,
            nextAiringAt = null,
            franchise = emptyList(),
+            // What the engine would pick for these fixtures: the part-watched episode.
+            continueIndex = seasons.flatMap { it.episodes }.indexOfFirst { it.resumeAt != null }
+                .takeIf { it >= 0 }?.toUInt(),
        )

        val SERIES = title(
@@ -290,6 +300,16 @@ class ScreenshotTest {
        val FILM = title("akira", "Akira", listOf(SeasonRecord(null, "Film", listOf(episode(1u, 1u)))))
            .copy(kind = TitleType.FILM, year = 1988u)

+        /** [LIBRARY] with posters on, as the shelf above its grid implies. */
+        val MATCHED get() = LIBRARY.copy(
+            metadataSettings = MetadataSettingsRecord(
+                enabled = true,
+                provider = MetadataProvider.ANI_LIST,
+                language = "en",
+                ready = true,
+            ),
+        )
+
        val LIBRARY = AppUiState(
            loading = false,
            titles = listOf(
@@ -306,9 +326,17 @@ class ScreenshotTest {
                },
                shelves = listOf(ShelfRecord("From MAPPA", listOf("oshi-no-ko", "bleach", "akira"))),
            ),
+            // Crawled relative to the clock, so the row reads "2 h ago" on
+            // whatever day the test runs.
            shares = listOf(
-                ShareRecord("anime", "anime", true),
-                ShareRecord("films", "films", false),
+                ShareRecord(
+                    "anime",
+                    "anime",
+                    true,
+                    crawledAt = System.currentTimeMillis() / 1_000 - 2 * 3_600,
+                    crawlFiles = 120uL,
+                ),
+                ShareRecord("films", "films", false, crawlError = "the link was revoked or has expired"),
            ),
            storage = StorageUsageRecord(6_400_000_000uL, 3uL, 0uL, 1_100_000_000uL),
        )
@@ -24,6 +24,7 @@ pstr-core.workspace = true
 pstr-meta.workspace = true
 pstr-stream.workspace = true
 tokio.workspace = true
+futures.workspace = true
 parking_lot.workspace = true
 thiserror.workspace = true
 uniffi.workspace = true
@@ -25,6 +25,8 @@ tracing-subscriber.workspace = true
 eframe.workspace = true
 egui.workspace = true
 egui-phosphor.workspace = true
+# The parser egui reads fonts with, to check a system font before handing it over.
+skrifa.workspace = true
 image.workspace = true
 sha2.workspace = true
 parking_lot.workspace = true
@@ -33,12 +35,12 @@ serde_json.workspace = true
 directories.workspace = true
 chrono.workspace = true
 souvlaki.workspace = true
+wry.workspace = true
+tao.workspace = true

 [build-dependencies]
 embed-resource.workspace = true

-[dev-dependencies]
-skrifa.workspace = true

 [target.'cfg(target_os = "linux")'.dependencies]
 dbus.workspace = true
@@ -11,6 +11,9 @@ use serde::{Deserialize, Serialize};
 /// What the settings page offers for the streaming cache, in GiB.
 pub const CACHE_CHOICES: [u32; 5] = [1, 2, 4, 8, 16];

+/// What the settings page offers for the size of everything, in percent.
+pub const TEXT_SIZE_CHOICES: [u16; 5] = [90, 100, 115, 130, 150];
+
 #[derive(Debug, Clone, Copy, PartialEq, Serialize, Deserialize)]
 // A file from an older version, or edited by hand, missing a field: the rest
 // still counts, and the missing one takes its default.
@@ -21,6 +24,15 @@ pub struct DesktopPrefs {
    pub hardware_decoding: bool,
    /// How much decrypted video the disk cache may keep.
    pub cache_gib: u32,
+    /// How the library was last arranged, so it opens that way.
+    pub filter: crate::app::Filter,
+    pub sort: pstr_core::browse::Sort,
+    pub grouped: bool,
+    /// The library's offer of posters and synopses was turned down.
+    pub metadata_offer_dismissed: bool,
+    /// How large text and controls are drawn, in percent. Per computer, not
+    /// synced: what reads well depends on the screen and how far away it is.
+    pub text_size: u16,
 }

 impl Default for DesktopPrefs {
@@ -28,11 +40,23 @@ impl Default for DesktopPrefs {
        Self {
            hardware_decoding: true,
            cache_gib: 4,
+            filter: crate::app::Filter::default(),
+            sort: pstr_core::browse::Sort::default(),
+            // On: a share holding a series and its three films is four tiles
+            // of the same picture otherwise.
+            grouped: true,
+            metadata_offer_dismissed: false,
+            text_size: 100,
        }
    }
 }

 impl DesktopPrefs {
+    /// [`Self::text_size`] as egui's zoom factor, kept to what is offered.
+    pub fn zoom(&self) -> f32 {
+        f32::from(self.text_size.clamp(50, 200)) / 100.0
+    }
+
    pub fn cache_bytes(&self) -> u64 {
        u64::from(self.cache_gib.clamp(1, 64)) << 30
    }
@@ -93,6 +117,17 @@ mod tests {
        assert!(prefs.hardware_decoding);
    }

+    #[test]
+    fn a_text_size_from_an_older_file_is_full_size_and_a_wild_one_is_kept_in_range() {
+        let prefs: DesktopPrefs = serde_json::from_str(r#"{ "cache_gib": 8 }"#).unwrap();
+        assert_eq!(prefs.zoom(), 1.0);
+        let wild = DesktopPrefs {
+            text_size: 900,
+            ..DesktopPrefs::default()
+        };
+        assert_eq!(wild.zoom(), 2.0);
+    }
+
    #[test]
    fn an_unparseable_file_is_never_overwritten() {
        let path = std::env::temp_dir().join(format!("pstr-desktop-{}.json", std::process::id()));
@@ -30,5 +30,6 @@ pub mod pacing;
 pub mod playback;
 pub mod theme;
 pub mod ui;
+pub mod verify;
 pub mod video;
 pub mod window;
@@ -16,6 +16,12 @@ use anyhow::Context;
 use pstr_core::config::AppDirs;

 fn main() -> anyhow::Result<()> {
+    // Before anything else: a verification window is a child process of the
+    // app, and must not claim the single instance or open a library.
+    if let Some(code) = pstr_app::verify::run_if_requested() {
+        std::process::exit(code);
+    }
+
    tracing_subscriber::fmt()
        .with_env_filter(
            tracing_subscriber::EnvFilter::try_from_default_env()
@@ -35,8 +35,8 @@ use pstr_core::catalog::CatalogNode;
 use pstr_core::library::{Episode, Title};
 use pstr_core::prefs::PlaybackPrefs;
 use pstr_player::{
-    Chapter, ChapterRole, EndReason, Player, PlayerConfig, PlayerEvent, Track, TrackKind,
-    VideoOutput,
+    Chapter, ChapterRole, EndReason, Player, PlayerConfig, PlayerEvent, StreamHandle, Track,
+    TrackKind, VideoOutput,
 };
 use pstr_stream::VideoStream;

@@ -147,6 +147,10 @@ pub enum Command {
    /// Move subtitles, as a percentage of the window's height. See
    /// [`Playback::lift_subtitles`].
    SetSubtitlePosition(f64),
+    /// Restyle subtitles, the line already showing included.
+    SetSubtitleStyle(pstr_core::prefs::SubtitleStyle),
+    /// Shift subtitles this many seconds later; negative is earlier.
+    SetSubtitleDelay(f64),
    /// 1.0 is normal speed.
    SetSpeed(f64),
    /// Save the current frame to this file.
@@ -184,6 +188,14 @@ pub struct Playback {
    /// Where subtitles were last put, so they are only moved when that changes
    /// rather than once a frame.
    subtitle_position: f64,
+    /// How the viewer has subtitles drawn, as last handed to this player.
+    pub subtitle_style: pstr_core::prefs::SubtitleStyle,
+    /// Where the controls would lift subtitles to. The higher of this and the
+    /// style's own position wins.
+    lifted_position: f64,
+    /// How far subtitles are shifted, in seconds. Per file rather than a
+    /// preference: an offset belongs to one release, not to the viewer.
+    pub subtitle_delay: f64,
    /// What the file contains. Empty until mpv has demuxed it.
    pub tracks: Vec<Track>,
    /// The file's chapters, in order. Empty for a file muxed without them.
@@ -259,7 +271,10 @@ impl Playback {
            paused: false,
            volume: prefs.volume,
            muted: prefs.muted,
-            subtitle_position: 100.0,
+            subtitle_position: prefs.subtitle_style.position,
+            subtitle_style: prefs.subtitle_style.clone(),
+            lifted_position: 100.0,
+            subtitle_delay: 0.0,
            speed: prefs.speed,
            tracks: Vec::new(),
            chapters: Vec::new(),
@@ -282,17 +297,57 @@ impl Playback {
    /// the mouse is moving, which is exactly when someone is looking at the
    /// screen.
    pub fn lift_subtitles(&mut self, covered: f32, height: f32) {
-        let position = if covered > 0.0 && height > 0.0 {
+        self.lifted_position = if covered > 0.0 && height > 0.0 {
            (100.0 * (1.0 - f64::from(covered / height))).round()
        } else {
            100.0
        };
+        self.place_subtitles();
+    }
+
+    /// Move subtitles to [`Self::subtitle_position`], when that has changed.
+    fn place_subtitles(&mut self) {
+        let position = self.subtitle_position();
        if position != self.subtitle_position {
            self.subtitle_position = position;
            self.send(Command::SetSubtitlePosition(position));
        }
    }

+    /// Where subtitles go: where the style puts them, unless the controls
+    /// would cover that, in which case just above the controls.
+    ///
+    /// A styled track ignores the style's position unless it is restyled:
+    /// mpv applies `sub-pos` to it either way, and its signs were placed by
+    /// hand. The lift still applies, because a line under the seek bar cannot
+    /// be read however carefully it was placed.
+    fn subtitle_position(&self) -> f64 {
+        let styled = self
+            .selected_track(TrackKind::Subtitle)
+            .is_some_and(|track| is_styled(track.codec.as_deref()));
+        let position = if styled && !self.subtitle_style.restyle_styled {
+            100.0
+        } else {
+            self.subtitle_style.position
+        };
+        position.min(self.lifted_position)
+    }
+
+    /// Restyle the subtitles of this file, now.
+    pub fn restyle_subtitles(&mut self, style: &pstr_core::prefs::SubtitleStyle) {
+        self.subtitle_style = style.clone();
+        self.subtitle_position = self.subtitle_position();
+        let mut style = style.clone();
+        style.position = self.subtitle_position;
+        self.send(Command::SetSubtitleStyle(style));
+    }
+
+    /// Shift subtitles to `seconds`, rounded to the tenth a keypress moves.
+    pub fn set_subtitle_delay(&mut self, seconds: f64) {
+        self.subtitle_delay = (seconds * 10.0).round() / 10.0;
+        self.send(Command::SetSubtitleDelay(self.subtitle_delay));
+    }
+
    /// Whether the picture is drawn in this window rather than mpv's own.
    pub fn is_embedded(&self) -> bool {
        self.video.is_some()
@@ -338,6 +393,18 @@ impl Playback {
        (end > self.position + 0.5).then_some((label, end))
    }

+    /// Whether the chapters say where the credits start. Most files that are
+    /// not anime have no chapters at all.
+    pub fn knows_credits(&self) -> bool {
+        self.credits_at.is_some()
+    }
+
+    /// Seconds of the file left to play, once its length is known.
+    pub fn remaining(&self) -> Option<f64> {
+        self.duration
+            .map(|duration| (duration - self.position).max(0.0))
+    }
+
    /// Whether the playhead is inside the run of credits and preview that ends
    /// the file — what "the episode is over" means when a file states its
    /// chapters.
@@ -360,7 +427,11 @@ impl Playback {
            PlayerEvent::FileLoaded => self.loaded = true,
            PlayerEvent::Volume(volume) => self.volume = *volume,
            PlayerEvent::Muted(muted) => self.muted = *muted,
-            PlayerEvent::Tracks(tracks) => self.tracks = tracks.clone(),
+            PlayerEvent::Tracks(tracks) => {
+                self.tracks = tracks.clone();
+                // A switch between a plain and a styled track moves the line.
+                self.place_subtitles();
+            }
            PlayerEvent::Chapters(chapters) => {
                self.chapters = chapters.clone();
                self.reclassify();
@@ -467,6 +538,11 @@ fn build_player(
    Ok((Arc::new(player), None))
 }

+/// Whether a subtitle codec carries its own styling, as mpv names them.
+fn is_styled(codec: Option<&str>) -> bool {
+    matches!(codec, Some("ass" | "ssa"))
+}
+
 /// The player defaults with the viewer's preferences folded in.
 fn from_prefs(
    prefs: &PlaybackPrefs,
@@ -482,6 +558,7 @@ fn from_prefs(
            .and_then(|p| p.subtitle_language.clone())
            .or_else(|| prefs.subtitle_language.clone()),
        subtitles: show.map(|p| p.subtitles).unwrap_or(prefs.subtitles),
+        subtitle_style: prefs.subtitle_style.clone(),
        // Carried from file to file, like the volume: somebody who watches at
        // 1.25 watches the next episode at 1.25 too.
        options: vec![("speed".into(), format!("{:.2}", prefs.speed))],
@@ -504,7 +581,11 @@ fn run(
    orders: std::sync::mpsc::Receiver<Command>,
    finished: Arc<AtomicBool>,
 ) {
-    let handle = match player.play(stream) {
+    let opened = match target.resume_at {
+        Some(at) => player.play_from(stream, at),
+        None => player.play(stream),
+    };
+    let handle = match opened {
        Ok(handle) => handle,
        Err(error) => {
            engine.emit(Event::Error(format!("load {}: {error}", target.name)));
@@ -514,10 +595,18 @@ fn run(
        }
    };

+    // Opened while mpv opens the video, and added once it has: an external
+    // track belongs to the file loaded at the time.
+    let mut sidecars = Some(engine.runtime().spawn({
+        let engine = engine.clone();
+        let target = target.clone();
+        async move { engine.open_sidecars(&target).await }
+    }));
+    let mut subtitles: Vec<StreamHandle> = Vec::new();
+
    let mut position = target.resume_at.unwrap_or(0.0);
    let mut duration: Option<f64> = None;
    let mut watched = false;
-    let mut resumed = target.resume_at.is_none();
    let mut last_save = std::time::Instant::now();

    'playback: loop {
@@ -543,6 +632,10 @@ fn run(
        match &event {
            PlayerEvent::FileLoaded => {
                duration = player.duration();
+                if let Some(opening) = sidecars.take() {
+                    let opened = engine.runtime().block_on(opening).unwrap_or_default();
+                    subtitles = add_sidecars(&engine, &target, &player, opened);
+                }
                // The first moment there is a track list to read: mpv has
                // demuxed the file and made its own default selection. Put the
                // title's own choice over it before the menus are told, so they
@@ -550,14 +643,16 @@ fn run(
                if let Some(show) = target.track_prefs.as_deref() {
                    restore_tracks(&player, show);
                }
-                emit_tracks(&engine, id, &player);
-                // Only now is there a timeline to seek within.
-                if !resumed && let Some(at) = target.resume_at {
-                    resumed = true;
-                    if let Err(error) = player.seek_to(at) {
-                        tracing::warn!("resume at {at}: {error}");
-                    }
+                // A subtitle track picked by name stays; one mpv picked by
+                // language may be the signs and songs, not the dialogue.
+                let picked = target
+                    .track_prefs
+                    .as_deref()
+                    .is_some_and(|show| show.subtitle_title.is_some());
+                if !picked {
+                    prefer_full_subtitles(&player);
                }
+                emit_tracks(&engine, id, &player);
            }
            PlayerEvent::Duration(value) => duration = Some(*value),
            PlayerEvent::Position(value) => {
@@ -599,6 +694,7 @@ fn run(
    // the other `Arc`, and mpv must be destroyed there, on the thread whose
    // OpenGL context its render context was built against.
    drop(handle);
+    drop(subtitles);
    drop(player);

    engine.release(
@@ -627,6 +723,11 @@ fn apply_command(
        Command::SetVolume(volume) => player.set_volume(volume),
        Command::SetMuted(muted) => player.set_muted(muted),
        Command::SetSubtitlePosition(percent) => player.set_subtitle_position(percent),
+        Command::SetSubtitleStyle(style) => {
+            player.apply_subtitle_style(&style);
+            Ok(())
+        }
+        Command::SetSubtitleDelay(seconds) => player.set_subtitle_delay(seconds),
        Command::SetSpeed(speed) => player.set_speed(speed),
        Command::Screenshot(path) => player.screenshot(&path),
        Command::SelectTrack(kind, track) => select_track(engine, id, player, kind, track),
@@ -713,6 +814,57 @@ fn restore_tracks(player: &Player, show: &pstr_core::catalog::TitleTrackPrefs) {
    }
 }

+/// Play the dialogue rather than the signs and songs mpv picked by language.
+/// Not remembered: it is the choice mpv should have made, not the viewer's.
+fn prefer_full_subtitles(player: &Player) {
+    if let Some(track) = pstr_player::full_subtitles_instead(&player.tracks())
+        && let Err(error) = player.select_track(TrackKind::Subtitle, Some(track))
+    {
+        tracing::warn!("select dialogue subtitle {track}: {error}");
+    }
+}
+
+/// Hand mpv the subtitle files paired with the video it has just loaded.
+///
+/// One is turned on only when subtitles are on and the video has none of its
+/// own playing — a file's own track was chosen by name and language already,
+/// and an external one is the fallback, not an override.
+fn add_sidecars(
+    engine: &Engine,
+    target: &PlaybackTarget,
+    player: &Player,
+    opened: Vec<(pstr_core::catalog::Sidecar, VideoStream)>,
+) -> Vec<StreamHandle> {
+    let config = from_prefs(&engine.playback_prefs(), target.track_prefs.as_deref());
+    let playing = player
+        .tracks()
+        .iter()
+        .any(|track| track.kind == TrackKind::Subtitle && track.selected);
+    let (sidecars, streams): (Vec<_>, Vec<_>) = opened.into_iter().unzip();
+    let select = (config.subtitles && !playing)
+        .then(|| {
+            pstr_core::catalog::preferred_sidecar(&sidecars, config.subtitle_language.as_deref())
+        })
+        .flatten();
+    sidecars
+        .iter()
+        .zip(streams)
+        .enumerate()
+        .filter_map(|(index, (sidecar, stream))| {
+            let title = sidecar.title.as_deref().unwrap_or("External");
+            player
+                .add_subtitle(
+                    stream,
+                    title,
+                    sidecar.language.as_deref(),
+                    select == Some(index),
+                )
+                .inspect_err(|error| tracing::warn!(%error, "add subtitle {}", sidecar.name))
+                .ok()
+        })
+        .collect()
+}
+
 /// Tell the UI what the file contains and what of it is playing.
 fn emit_tracks(engine: &Engine, id: u64, player: &Player) {
    engine.emit(Event::Player {
@@ -738,3 +890,17 @@ fn save(
        watch_state(position, duration, watched),
    );
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn only_ass_and_ssa_tracks_count_as_styled() {
+        assert!(is_styled(Some("ass")));
+        assert!(is_styled(Some("ssa")));
+        assert!(!is_styled(Some("subrip")));
+        assert!(!is_styled(Some("hdmv_pgs_subtitle")));
+        assert!(!is_styled(None));
+    }
+}
@@ -186,9 +186,48 @@ pub fn semibold() -> egui::FontFamily {
    egui::FontFamily::Name("semibold".into())
 }

+/// The family the subtitle preview is drawn in: the face the chosen subtitle
+/// font resolves to, ahead of the app's own fonts, which stand in until it has
+/// loaded and for any glyph it lacks.
+pub fn subtitle_family() -> egui::FontFamily {
+    egui::FontFamily::Name("subtitle".into())
+}
+
+/// The system fonts loaded so far. Each install builds the definitions from
+/// all of them, so loading one does not drop the other.
+#[derive(Default)]
+struct SystemFonts {
+    cjk: Option<Arc<egui::FontData>>,
+    subtitle: Option<(SubtitleRequest, Arc<egui::FontData>, SubtitleFace)>,
+    /// The subtitle face last asked for, loading or loaded.
+    wanted: Option<SubtitleRequest>,
+}
+
+static SYSTEM_FONTS: parking_lot::Mutex<SystemFonts> = parking_lot::Mutex::new(SystemFonts {
+    cjk: None,
+    subtitle: None,
+    wanted: None,
+});
+
+#[derive(Debug, Clone, PartialEq, Eq)]
+struct SubtitleRequest {
+    family: String,
+    bold: bool,
+    italic: bool,
+}
+
+/// What the loaded subtitle face draws by itself. A style it lacks is one
+/// libass makes up, and so must the preview.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub struct SubtitleFace {
+    pub bold: bool,
+    pub italic: bool,
+}
+
 /// Inter, the icon font, and egui's own fonts behind them for the emoji and
-/// symbols Inter does not carry. `cjk` goes last, when there is one.
-fn font_definitions(cjk: Option<egui::FontData>) -> egui::FontDefinitions {
+/// symbols Inter does not carry. The CJK fallback goes last, when there is
+/// one.
+fn font_definitions(system: &SystemFonts) -> egui::FontDefinitions {
    use egui::FontFamily::{Monospace, Proportional};

    let mut fonts = egui::FontDefinitions::default();
@@ -207,21 +246,29 @@ fn font_definitions(cjk: Option<egui::FontData>) -> egui::FontDefinitions {
    // Right behind Inter. The icons are in the private use area, which the
    // bundled Inter no longer maps, so neither font shadows the other.
    egui_phosphor::add_to_fonts(&mut fonts, egui_phosphor::Variant::Regular);
-    if let Some(cjk) = cjk {
+    if let Some(cjk) = &system.cjk {
        let name = "system-cjk-fallback".to_owned();
-        fonts.font_data.insert(name.clone(), Arc::new(cjk));
+        fonts.font_data.insert(name.clone(), cjk.clone());
        for family in [Proportional, Monospace] {
            fonts.families.entry(family).or_default().push(name.clone());
        }
    }
-    let fallbacks = fonts.families[&Proportional]
+    let fallbacks: Vec<String> = fonts.families[&Proportional]
        .iter()
        .filter(|name| *name != "inter")
-        .cloned();
+        .cloned()
+        .collect();
    let semibold_chain = std::iter::once("inter-semibold".to_owned())
        .chain(fallbacks)
        .collect();
    fonts.families.insert(semibold(), semibold_chain);
+    let mut subtitle_chain = fonts.families[&Proportional].clone();
+    if let Some((_, face, _)) = &system.subtitle {
+        let name = "system-subtitle".to_owned();
+        fonts.font_data.insert(name.clone(), face.clone());
+        subtitle_chain.insert(0, name);
+    }
+    fonts.families.insert(subtitle_family(), subtitle_chain);
    fonts
 }

@@ -234,7 +281,7 @@ fn font_definitions(cjk: Option<egui::FontData>) -> egui::FontDefinitions {
 /// anyway. egui deliberately does not bundle the multi-megabyte CJK families,
 /// and native desktops already provide one.
 pub fn install_fonts(ctx: &egui::Context) {
-    ctx.set_fonts(font_definitions(None));
+    ctx.set_fonts(font_definitions(&SYSTEM_FONTS.lock()));
    let ctx = ctx.clone();
    let spawned = std::thread::Builder::new()
        .name("fonts".into())
@@ -248,13 +295,98 @@ fn install_cjk_fallback(ctx: &egui::Context) {
    let Some((path, index)) = system_cjk_font() else {
        return;
    };
-    let Ok(bytes) = std::fs::read(path) else {
+    let Ok(bytes) = std::fs::read(&path) else {
        return;
    };
+    let Some(data) = system_font_data(bytes, index) else {
+        tracing::debug!("CJK fallback {}#{index} does not parse", path.display());
+        return;
+    };
+    let mut system = SYSTEM_FONTS.lock();
+    system.cjk = Some(Arc::new(data));
+    ctx.set_fonts(font_definitions(&system));
+    ctx.request_repaint();
+}
+
+/// The face the subtitle preview should be drawn in for this font, bold and
+/// italic, once [`subtitle_family`] holds it.
+///
+/// `None` while it loads, and for good where the system cannot say which file
+/// a family is — everywhere but Linux. The first call for a font starts the
+/// load on a thread of its own, since `fc-match` and reading the file are too
+/// slow for a frame, and asks for a repaint when it is in.
+pub fn subtitle_face(
+    ctx: &egui::Context,
+    family: &str,
+    bold: bool,
+    italic: bool,
+) -> Option<SubtitleFace> {
+    let request = SubtitleRequest {
+        family: family.to_owned(),
+        bold,
+        italic,
+    };
+    let mut system = SYSTEM_FONTS.lock();
+    if let Some((loaded, _, face)) = &system.subtitle
+        && *loaded == request
+    {
+        return Some(*face);
+    }
+    if system.wanted.as_ref() != Some(&request) {
+        system.wanted = Some(request.clone());
+        let ctx = ctx.clone();
+        let spawned = std::thread::Builder::new()
+            .name("subtitle-font".into())
+            .spawn(move || install_subtitle_face(&ctx, request));
+        if let Err(error) = spawned {
+            tracing::debug!("subtitle font thread: {error}");
+        }
+    }
+    None
+}
+
+fn install_subtitle_face(ctx: &egui::Context, request: SubtitleRequest) {
+    let Some((path, index, face)) = system_subtitle_font(&request) else {
+        return;
+    };
+    let Ok(bytes) = std::fs::read(&path) else {
+        return;
+    };
+    let Some(data) = system_font_data(bytes, index) else {
+        tracing::debug!("subtitle font {}#{index} does not parse", path.display());
+        return;
+    };
+    let mut system = SYSTEM_FONTS.lock();
+    // Another font was picked while this one loaded.
+    if system.wanted.as_ref() != Some(&request) {
+        return;
+    }
+    system.subtitle = Some((request, Arc::new(data), face));
+    ctx.set_fonts(font_definitions(&system));
+    ctx.request_repaint();
+}
+
+/// A system font, if egui can read it.
+///
+/// egui panics on a font it cannot parse, and this one comes from whatever the
+/// system has installed. So it is parsed here first, the same way egui does,
+/// and a font that fails is left out rather than taking the app down.
+fn system_font_data(bytes: Vec<u8>, index: u32) -> Option<egui::FontData> {
+    skrifa::FontRef::from_index(&bytes, index).ok()?;
    let mut data = egui::FontData::from_owned(bytes);
    data.index = index;
-    ctx.set_fonts(font_definitions(Some(data)));
-    ctx.request_repaint();
+    Some(data)
+}
+
+/// The face within a font collection that fontconfig's `%{index}` names.
+///
+/// Fontconfig packs a variable font's named instance into the high 16 bits —
+/// Fedora's variable Noto Sans CJK answers 262144, instance 4 of face 0. The
+/// instance is not a face, and passing it to egui as one stopped the app at
+/// start.
+#[cfg(any(target_os = "linux", test))]
+fn fontconfig_face(index: u32) -> u32 {
+    index & 0xFFFF
 }

 #[cfg(target_os = "linux")]
@@ -269,10 +401,73 @@ fn system_cjk_font() -> Option<(std::path::PathBuf, u32)> {
    let index = lines
        .next()
        .and_then(|value| value.parse().ok())
+        .map(fontconfig_face)
        .unwrap_or(0);
    path.is_file().then_some((path, index))
 }

+/// The file fontconfig picks for a subtitle font, as libass asks for it: the
+/// family with the weight and slant wanted, falling back as libass would to
+/// whatever fontconfig likes best when the family is not installed.
+#[cfg(target_os = "linux")]
+fn system_subtitle_font(
+    request: &SubtitleRequest,
+) -> Option<(std::path::PathBuf, u32, SubtitleFace)> {
+    let output = std::process::Command::new("fc-match")
+        .args([
+            "-f",
+            "%{file}\\n%{index}\\n%{weight}\\n%{slant}",
+            &fontconfig_pattern(request),
+        ])
+        .output()
+        .ok()?;
+    let text = std::str::from_utf8(&output.stdout).ok()?;
+    let mut lines = text.lines();
+    let path = std::path::PathBuf::from(lines.next()?);
+    let mut number = || lines.next().and_then(|value| value.parse::<u32>().ok());
+    let index = number().unwrap_or(0);
+    let (weight, slant) = (number().unwrap_or(0), number().unwrap_or(0));
+    // A variable font's named instance is drawn by egui as the default one,
+    // which is upright and regular, whatever fontconfig says it matched.
+    let instance = index != fontconfig_face(index);
+    let face = SubtitleFace {
+        bold: !instance && weight >= FC_WEIGHT_BOLD,
+        italic: !instance && slant > 0,
+    };
+    path.is_file()
+        .then_some((path, fontconfig_face(index), face))
+}
+
+#[cfg(any(target_os = "linux", test))]
+const FC_WEIGHT_BOLD: u32 = 200;
+
+/// A fontconfig pattern for the request. A family name is free text, and `-`,
+/// `:`, `,` and `\\` mean something in a pattern, so those are escaped.
+#[cfg(any(target_os = "linux", test))]
+fn fontconfig_pattern(request: &SubtitleRequest) -> String {
+    let mut pattern = String::new();
+    for character in request.family.chars() {
+        if matches!(character, '-' | ':' | ',' | '\\') {
+            pattern.push('\\');
+        }
+        pattern.push(character);
+    }
+    if request.bold {
+        pattern.push_str(&format!(":weight={FC_WEIGHT_BOLD}"));
+    }
+    if request.italic {
+        pattern.push_str(":slant=100");
+    }
+    pattern
+}
+
+/// Elsewhere there is no asking which file a family is, and the preview
+/// stays in the app's own font.
+#[cfg(not(target_os = "linux"))]
+fn system_subtitle_font(_: &SubtitleRequest) -> Option<(std::path::PathBuf, u32, SubtitleFace)> {
+    None
+}
+
 #[cfg(target_os = "windows")]
 fn system_cjk_font() -> Option<(std::path::PathBuf, u32)> {
    let path = std::path::PathBuf::from(r"C:\Windows\Fonts\YuGothR.ttc");
@@ -290,6 +485,68 @@ fn system_cjk_font() -> Option<(std::path::PathBuf, u32)> {
    None
 }

+/// The font families installed here, by name, for the subtitle font picker.
+///
+/// `None` until they have been read. The first call starts that on a thread
+/// of its own and asks for a repaint when it is done: `fc-list` over a large
+/// font collection takes long enough to be seen as a stalled frame.
+pub fn font_families(ctx: &egui::Context) -> Option<&'static [String]> {
+    static FAMILIES: std::sync::OnceLock<Vec<String>> = std::sync::OnceLock::new();
+    static STARTED: std::sync::atomic::AtomicBool = std::sync::atomic::AtomicBool::new(false);
+    if let Some(families) = FAMILIES.get() {
+        return Some(families);
+    }
+    if !STARTED.swap(true, std::sync::atomic::Ordering::Relaxed) {
+        let ctx = ctx.clone();
+        let spawned = std::thread::Builder::new()
+            .name("font-families".into())
+            .spawn(move || {
+                let _ = FAMILIES.set(system_font_families());
+                ctx.request_repaint();
+            });
+        if let Err(error) = spawned {
+            tracing::debug!("font families thread: {error}");
+        }
+    }
+    None
+}
+
+#[cfg(target_os = "linux")]
+fn system_font_families() -> Vec<String> {
+    let Ok(output) = std::process::Command::new("fc-list")
+        .args([":", "family"])
+        .output()
+    else {
+        return Vec::new();
+    };
+    font_families_from_fc_list(&String::from_utf8_lossy(&output.stdout))
+}
+
+/// Elsewhere the picker takes a typed name only. mpv's font lookup there is
+/// the system's own, so any installed family's name works.
+#[cfg(not(target_os = "linux"))]
+fn system_font_families() -> Vec<String> {
+    Vec::new()
+}
+
+/// One family per line of `fc-list : family`, sorted and without repeats.
+///
+/// A line lists a family's names in every language it has, comma-separated,
+/// and one family appears once per style. The first name is the one libass
+/// matches on.
+#[cfg(any(target_os = "linux", test))]
+fn font_families_from_fc_list(listing: &str) -> Vec<String> {
+    let mut families: Vec<String> = listing
+        .lines()
+        .filter_map(|line| line.split(',').next())
+        .map(|family| family.trim().to_owned())
+        .filter(|family| !family.is_empty() && !family.starts_with('.'))
+        .collect();
+    families.sort_by_key(|family| family.to_lowercase());
+    families.dedup();
+    families
+}
+
 /// Every colour the app draws with, as egui wants them.
 ///
 /// The *choice* of colours is `pstr_core::appearance` — one resolution shared
@@ -855,6 +1112,59 @@ const RAMP_STOPS: usize = 64;
 mod tests {
    use super::*;

+    #[test]
+    fn each_font_family_is_listed_once_by_its_first_name() {
+        let listing = "Noto Sans,Noto Sans Regular\nDejaVu Sans\nnoto sans mono\nNoto Sans,Noto Sans Bold\n\n.LastResort\n";
+        assert_eq!(
+            font_families_from_fc_list(listing),
+            ["DejaVu Sans", "Noto Sans", "noto sans mono"]
+        );
+    }
+
+    #[test]
+    fn a_variable_fonts_named_instance_is_not_taken_for_a_face() {
+        assert_eq!(fontconfig_face(262_144), 0);
+        assert_eq!(fontconfig_face(0x0002_0001), 1);
+        assert_eq!(fontconfig_face(2), 2);
+    }
+
+    #[test]
+    fn a_system_font_egui_cannot_read_is_left_out() {
+        assert!(system_font_data(INTER.to_vec(), 0).is_some());
+        assert!(system_font_data(INTER.to_vec(), 4).is_none());
+        assert!(system_font_data(b"not a font".to_vec(), 0).is_none());
+    }
+
+    #[test]
+    fn a_subtitle_font_is_asked_of_fontconfig_with_its_style_and_escaped() {
+        let request = |family: &str, bold, italic| SubtitleRequest {
+            family: family.to_owned(),
+            bold,
+            italic,
+        };
+        assert_eq!(
+            fontconfig_pattern(&request("Noto Sans", false, false)),
+            "Noto Sans"
+        );
+        assert_eq!(
+            fontconfig_pattern(&request("Noto Sans", true, true)),
+            "Noto Sans:weight=200:slant=100"
+        );
+        assert_eq!(
+            fontconfig_pattern(&request("A-B:C,D\\E", false, true)),
+            "A\\-B\\:C\\,D\\\\E:slant=100"
+        );
+    }
+
+    #[test]
+    fn the_subtitle_preview_family_exists_before_any_font_has_loaded() {
+        let fonts = font_definitions(&SystemFonts::default());
+        assert_eq!(
+            fonts.families[&subtitle_family()],
+            fonts.families[&egui::FontFamily::Proportional]
+        );
+    }
+
    #[test]
    fn the_bundled_inter_leaves_the_icon_codepoints_to_phosphor() {
        use skrifa::MetadataProvider as _;
@@ -0,0 +1,600 @@
+//! The Proton account, on the shares page: signing in, watch-history sync, and
+//! picking folders of the viewer's own Drive as library shares.
+//!
+//! Optional and said so: public links need no account, and the page reads the
+//! same without one. What signing in adds is spelled out next to the form,
+//! because "sign in" alone does not say why an app that streams public links
+//! would want a password.
+
+use pstr_core::account::{DriveEntry, DrivePlace, PlaceKind};
+use pstr_core::proton_sdk::ids::NodeUid;
+use pstr_core::sync::SyncReport;
+
+use crate::app::Action;
+use crate::engine::AccountStatus;
+use crate::theme;
+use crate::ui;
+use crate::ui::widgets::Named;
+
+/// What the account section holds between frames.
+#[derive(Default)]
+pub struct AccountPanel {
+    pub status: AccountStatus,
+    pub username: String,
+    pub password: String,
+    pub code: String,
+    pub mailbox: String,
+    /// A request is out and not answered yet.
+    pub busy: bool,
+    /// Why the last sign-in step was refused.
+    pub error: Option<String>,
+    /// When watch history last synced, in Unix seconds, and what it did.
+    pub synced: Option<(i64, SyncReport)>,
+    /// Why the last sync failed, until one succeeds.
+    pub sync_error: Option<String>,
+    pub browser: DriveBrowser,
+}
+
+impl AccountPanel {
+    /// Apply where the account now stands. The typed secrets go as soon as
+    /// they are not needed: a password has no business sitting in a struct for
+    /// the rest of the session.
+    pub fn set_status(&mut self, status: AccountStatus) {
+        self.busy = false;
+        match &status {
+            AccountStatus::SignedIn(_) | AccountStatus::SignedOut => {
+                self.password.clear();
+                self.code.clear();
+                self.mailbox.clear();
+                if matches!(status, AccountStatus::SignedIn(_)) {
+                    self.error = None;
+                } else {
+                    self.browser = DriveBrowser::default();
+                    self.synced = None;
+                    self.sync_error = None;
+                }
+            }
+            AccountStatus::SecondFactor => self.error = None,
+            AccountStatus::MailboxPassword => {
+                self.code.clear();
+                self.error = None;
+            }
+            AccountStatus::Unknown => {}
+        }
+        self.status = status;
+    }
+
+    pub fn refused(&mut self, error: String) {
+        self.busy = false;
+        self.error = Some(error);
+    }
+}
+
+/// Where the Drive browser is.
+#[derive(Default)]
+pub struct DriveBrowser {
+    pub open: bool,
+    /// The folders descended through, each by name. Empty means the places.
+    pub trail: Vec<(String, NodeUid)>,
+    pub places: Option<Vec<DrivePlace>>,
+    /// The listing of the folder at the end of the trail, once it arrives.
+    pub entries: Option<(NodeUid, Vec<DriveEntry>)>,
+    pub loading: bool,
+    pub error: Option<String>,
+}
+
+impl DriveBrowser {
+    pub fn places_arrived(&mut self, places: Vec<DrivePlace>) {
+        self.loading = false;
+        self.error = None;
+        self.places = Some(places);
+    }
+
+    /// Take a listing, unless the viewer has already moved on from it.
+    pub fn folder_arrived(&mut self, uid: NodeUid, entries: Vec<DriveEntry>) {
+        if self
+            .trail
+            .last()
+            .is_some_and(|(_, current)| *current == uid)
+        {
+            self.loading = false;
+            self.error = None;
+            self.entries = Some((uid, entries));
+        }
+    }
+
+    pub fn failed(&mut self, error: String) {
+        self.loading = false;
+        self.error = Some(error);
+    }
+
+    fn enter(&mut self, name: String, uid: NodeUid, actions: &mut Vec<Action>) {
+        self.trail.push((name, uid.clone()));
+        self.entries = None;
+        self.loading = true;
+        self.error = None;
+        actions.push(Action::BrowseFolder(uid));
+    }
+
+    fn up(&mut self, actions: &mut Vec<Action>) {
+        self.trail.pop();
+        self.entries = None;
+        self.error = None;
+        match self.trail.last() {
+            Some((_, uid)) => {
+                self.loading = true;
+                actions.push(Action::BrowseFolder(uid.clone()));
+            }
+            None => self.loading = self.places.is_none(),
+        }
+    }
+}
+
+/// The account card: a sign-in form, or who is signed in and how sync is doing.
+pub fn section(ui: &mut egui::Ui, panel: &mut AccountPanel, actions: &mut Vec<Action>) {
+    ui::section(ui, "Proton account");
+    ui.label(ui::muted(
+        "Optional. Signed in, your shares, settings and watch history are kept in your own \
+         Drive, so every device shows the same library and resumes where another left off, \
+         and folders of your Drive — your files, other devices, what was shared with you — \
+         can be added to the library.",
+    ));
+    ui.add_space(theme::space::L);
+
+    card(ui, |ui| match panel.status.clone() {
+        AccountStatus::Unknown => {
+            ui.horizontal(|ui| {
+                ui.add(egui::Spinner::new().size(14.0));
+                ui.label(ui::muted("reading the stored session…"));
+            });
+        }
+        AccountStatus::SignedOut => sign_in_form(ui, panel, actions),
+        AccountStatus::SecondFactor => code_form(ui, panel, actions),
+        AccountStatus::MailboxPassword => mailbox_form(ui, panel, actions),
+        AccountStatus::SignedIn(username) => signed_in(ui, panel, &username, actions),
+    });
+}
+
+fn card(ui: &mut egui::Ui, add: impl FnOnce(&mut egui::Ui)) {
+    egui::Frame::new()
+        .fill(theme::card())
+        .corner_radius(egui::CornerRadius::same(theme::radius::MD))
+        .inner_margin(egui::Margin::same(14))
+        .show(ui, |ui| {
+            ui.set_width(ui.available_width().min(640.0));
+            add(ui);
+        });
+}
+
+fn sign_in_form(ui: &mut egui::Ui, panel: &mut AccountPanel, actions: &mut Vec<Action>) {
+    ui.label(ui::muted("Address"));
+    ui.add(
+        egui::TextEdit::singleline(&mut panel.username)
+            .hint_text("you@proton.me")
+            .desired_width(f32::INFINITY),
+    );
+    ui.add_space(theme::space::M);
+    ui.label(ui::muted("Password"));
+    let field = ui.add(
+        egui::TextEdit::singleline(&mut panel.password)
+            .password(true)
+            .desired_width(f32::INFINITY),
+    );
+    ui.add_space(theme::space::L);
+    error_line(ui, panel);
+    let ready = !panel.username.trim().is_empty() && !panel.password.is_empty() && !panel.busy;
+    let submitted = field.lost_focus() && ui.input(|input| input.key_pressed(egui::Key::Enter));
+    ui.horizontal(|ui| {
+        let clicked = ui
+            .add_enabled_ui(ready, |ui| ui::accent_button(ui, "Sign in"))
+            .inner
+            .clicked();
+        if ready && (clicked || submitted) {
+            panel.busy = true;
+            panel.error = None;
+            actions.push(Action::SignIn {
+                username: panel.username.trim().to_owned(),
+                password: panel.password.clone(),
+            });
+        }
+        busy_line(ui, panel, "signing in…");
+    });
+}
+
+fn code_form(ui: &mut egui::Ui, panel: &mut AccountPanel, actions: &mut Vec<Action>) {
+    ui.label(ui::muted("Two-factor code from your authenticator app"));
+    let field = ui.add(
+        egui::TextEdit::singleline(&mut panel.code)
+            .hint_text("123456")
+            .desired_width(160.0),
+    );
+    field.request_focus();
+    ui.add_space(theme::space::S);
+    // Security keys need WebAuthn, which the sign-in here does not speak. An
+    // account with nothing else is refused before this form (`AccountStore`).
+    ui.label(ui::muted(
+        "Security keys are not supported here — use the code from your authenticator app.",
+    ));
+    ui.add_space(theme::space::L);
+    error_line(ui, panel);
+    let ready = !panel.code.trim().is_empty() && !panel.busy;
+    let submitted = field.lost_focus() && ui.input(|input| input.key_pressed(egui::Key::Enter));
+    ui.horizontal(|ui| {
+        let clicked = ui
+            .add_enabled_ui(ready, |ui| ui::accent_button(ui, "Continue"))
+            .inner
+            .clicked();
+        if ready && (clicked || submitted) {
+            panel.busy = true;
+            actions.push(Action::SubmitSecondFactor(panel.code.trim().to_owned()));
+        }
+        if ui.button("Cancel").clicked() {
+            actions.push(Action::CancelSignIn);
+        }
+        busy_line(ui, panel, "checking…");
+    });
+}
+
+fn mailbox_form(ui: &mut egui::Ui, panel: &mut AccountPanel, actions: &mut Vec<Action>) {
+    ui.label(ui::muted(
+        "This account has a separate mailbox password. It unlocks your files, and is kept \
+         in your system keyring.",
+    ));
+    ui.add_space(theme::space::S);
+    let field = ui.add(
+        egui::TextEdit::singleline(&mut panel.mailbox)
+            .password(true)
+            .hint_text("Mailbox password")
+            .desired_width(f32::INFINITY),
+    );
+    ui.add_space(theme::space::L);
+    error_line(ui, panel);
+    let ready = !panel.mailbox.is_empty() && !panel.busy;
+    let submitted = field.lost_focus() && ui.input(|input| input.key_pressed(egui::Key::Enter));
+    ui.horizontal(|ui| {
+        let clicked = ui
+            .add_enabled_ui(ready, |ui| ui::accent_button(ui, "Unlock"))
+            .inner
+            .clicked();
+        if ready && (clicked || submitted) {
+            panel.busy = true;
+            actions.push(Action::SubmitMailboxPassword(panel.mailbox.clone()));
+        }
+        if ui.button("Cancel").clicked() {
+            actions.push(Action::CancelSignIn);
+        }
+        busy_line(ui, panel, "unlocking…");
+    });
+}
+
+fn signed_in(
+    ui: &mut egui::Ui,
+    panel: &mut AccountPanel,
+    username: &str,
+    actions: &mut Vec<Action>,
+) {
+    ui.horizontal(|ui| {
+        ui.vertical(|ui| {
+            ui.label(
+                egui::RichText::new(format!(
+                    "{}  {username}",
+                    egui_phosphor::regular::USER_CIRCLE
+                ))
+                .strong(),
+            );
+            let status = match (&panel.sync_error, &panel.synced) {
+                (Some(error), _) => format!("Did not sync: {error}"),
+                (None, Some((at, report))) => sync_line(*at, report, unix_now()),
+                (None, None) => {
+                    "Library, settings and watch history sync through your Drive".to_owned()
+                }
+            };
+            ui.label(ui::muted(status));
+        });
+        ui.with_layout(egui::Layout::right_to_left(egui::Align::Center), |ui| {
+            if ui
+                .add(
+                    egui::Button::new(format!("{}  Sign out", egui_phosphor::regular::SIGN_OUT))
+                        .fill(theme::card_hover()),
+                )
+                .clicked()
+            {
+                actions.push(Action::SignOut);
+            }
+            if ui
+                .button(format!(
+                    "{}  Sync now",
+                    egui_phosphor::regular::ARROWS_CLOCKWISE
+                ))
+                .clicked()
+            {
+                actions.push(Action::SyncNow);
+            }
+        });
+    });
+}
+
+/// "Synced 3 min ago · 2 positions from other devices".
+fn sync_line(at: i64, report: &SyncReport, now: i64) -> String {
+    let mut line = format!("Synced {}", ui::ago(at, now));
+    if report.applied > 0 {
+        line.push_str(&format!(
+            "  ·  {} from other devices",
+            ui::library::plural(report.applied, "position")
+        ));
+    }
+    line
+}
+
+fn error_line(ui: &mut egui::Ui, panel: &AccountPanel) {
+    if let Some(error) = &panel.error {
+        ui.label(theme::Role::Caption.rich(error).color(theme::danger()));
+        ui.add_space(theme::space::S);
+    }
+}
+
+fn busy_line(ui: &mut egui::Ui, panel: &AccountPanel, text: &str) {
+    if panel.busy {
+        ui.add(egui::Spinner::new().size(14.0));
+        ui.label(ui::muted(text));
+    }
+}
+
+/// Browse the account's Drive and add a folder of it to the library.
+pub fn browser(
+    ui: &mut egui::Ui,
+    panel: &mut AccountPanel,
+    shares: &[pstr_core::Share],
+    actions: &mut Vec<Action>,
+) {
+    if !matches!(panel.status, AccountStatus::SignedIn(_)) {
+        return;
+    }
+    ui.add_space(theme::space::XXL);
+    ui::section(ui, "Add from your Drive");
+    let browser = &mut panel.browser;
+    if !browser.open {
+        ui.label(ui::muted(
+            "A folder of your own Drive becomes a share like any link: crawled, browsable and \
+             streamed through your account.",
+        ));
+        ui.add_space(theme::space::L);
+        if ui
+            .button(format!(
+                "{}  Browse your Drive",
+                egui_phosphor::regular::FOLDER
+            ))
+            .clicked()
+        {
+            browser.open = true;
+            if browser.places.is_none() {
+                browser.loading = true;
+                actions.push(Action::BrowsePlaces);
+            }
+        }
+        return;
+    }
+
+    card(ui, |ui| {
+        ui.horizontal(|ui| {
+            if !browser.trail.is_empty()
+                && ui
+                    .button(egui_phosphor::regular::ARROW_LEFT)
+                    .hint("Up a folder")
+                    .clicked()
+            {
+                browser.up(actions);
+            }
+            let mut crumbs = vec!["Drive".to_owned()];
+            crumbs.extend(browser.trail.iter().map(|(name, _)| name.clone()));
+            ui.label(
+                egui::RichText::new(
+                    crumbs.join(&format!("  {}  ", egui_phosphor::regular::CARET_RIGHT)),
+                )
+                .strong(),
+            );
+            ui.with_layout(egui::Layout::right_to_left(egui::Align::Center), |ui| {
+                if ui.button("Close").clicked() {
+                    browser.open = false;
+                }
+            });
+        });
+        ui.add_space(theme::space::M);
+
+        if let Some(error) = &browser.error {
+            ui.label(theme::Role::Caption.rich(error).color(theme::danger()));
+            ui.add_space(theme::space::S);
+        }
+        if browser.loading {
+            ui.horizontal(|ui| {
+                ui.add(egui::Spinner::new().size(14.0));
+                ui.label(ui::muted("listing…"));
+            });
+            return;
+        }
+
+        let mut entered = None;
+        egui::ScrollArea::vertical()
+            .max_height(320.0)
+            .auto_shrink([false, true])
+            .show(ui, |ui| match browser.trail.last() {
+                None => {
+                    for place in browser.places.iter().flatten() {
+                        let icon = match place.kind {
+                            PlaceKind::MyFiles => egui_phosphor::regular::HARD_DRIVES,
+                            PlaceKind::Device => egui_phosphor::regular::DESKTOP,
+                            PlaceKind::SharedWithMe => egui_phosphor::regular::USERS,
+                        };
+                        if row(ui, icon, &place.name, None, true).clicked() {
+                            entered = Some((place.name.clone(), place.uid.clone()));
+                        }
+                    }
+                }
+                Some(_) => {
+                    let entries = browser
+                        .entries
+                        .as_ref()
+                        .map(|(_, entries)| entries.as_slice());
+                    if entries.is_some_and(<[DriveEntry]>::is_empty) {
+                        ui.label(ui::muted("This folder is empty."));
+                    }
+                    for entry in entries.unwrap_or_default() {
+                        let (icon, detail) = if entry.is_folder {
+                            (egui_phosphor::regular::FOLDER, None)
+                        } else if entry
+                            .media_type
+                            .as_deref()
+                            .is_some_and(|media| media.starts_with("video/"))
+                        {
+                            (
+                                egui_phosphor::regular::FILE_VIDEO,
+                                entry.size.map(format_size),
+                            )
+                        } else {
+                            (egui_phosphor::regular::FILE, entry.size.map(format_size))
+                        };
+                        if row(ui, icon, &entry.name, detail.as_deref(), entry.is_folder).clicked()
+                            && entry.is_folder
+                        {
+                            entered = Some((entry.name.clone(), entry.uid.clone()));
+                        }
+                    }
+                }
+            });
+        if let Some((name, uid)) = entered {
+            browser.enter(name, uid, actions);
+        }
+
+        if let Some((name, uid)) = browser.trail.last() {
+            ui.add_space(theme::space::L);
+            let added = shares.iter().any(|share| {
+                share
+                    .folder
+                    .as_ref()
+                    .is_some_and(|folder| folder.uid() == *uid)
+            });
+            ui.horizontal(|ui| {
+                if added {
+                    ui.label(ui::muted("This folder is already in the library."));
+                } else if ui::accent_button(ui, "Add this folder").clicked() {
+                    actions.push(Action::AddAccountFolder {
+                        name: name.clone(),
+                        uid: uid.clone(),
+                    });
+                    browser.open = false;
+                }
+            });
+        }
+    });
+}
+
+/// One line of the browser. Only folders and places are clickable.
+fn row(
+    ui: &mut egui::Ui,
+    icon: &str,
+    name: &str,
+    detail: Option<&str>,
+    clickable: bool,
+) -> egui::Response {
+    let mut text = egui::text::LayoutJob::default();
+    let body = ui.style().text_styles[&egui::TextStyle::Body].clone();
+    text.append(
+        &format!("{icon}  {name}"),
+        0.0,
+        egui::TextFormat::simple(
+            body.clone(),
+            if clickable {
+                theme::text()
+            } else {
+                theme::muted()
+            },
+        ),
+    );
+    if let Some(detail) = detail {
+        text.append(
+            &format!("   {detail}"),
+            0.0,
+            egui::TextFormat::simple(body, theme::muted()),
+        );
+    }
+    let sense = if clickable {
+        egui::Sense::click()
+    } else {
+        egui::Sense::hover()
+    };
+    let response = ui.add(egui::Label::new(text).sense(sense).truncate());
+    if clickable && response.hovered() {
+        ui.ctx().set_cursor_icon(egui::CursorIcon::PointingHand);
+    }
+    response
+}
+
+fn format_size(bytes: i64) -> String {
+    let bytes = bytes.max(0) as f64;
+    const GIB: f64 = 1024.0 * 1024.0 * 1024.0;
+    const MIB: f64 = 1024.0 * 1024.0;
+    if bytes >= GIB {
+        format!("{:.1} GiB", bytes / GIB)
+    } else {
+        format!("{:.0} MiB", bytes / MIB)
+    }
+}
+
+pub(crate) fn unix_now() -> i64 {
+    std::time::SystemTime::now()
+        .duration_since(std::time::UNIX_EPOCH)
+        .map(|since| since.as_secs() as i64)
+        .unwrap_or(0)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn the_sync_line_says_how_long_ago_and_what_came_in() {
+        let quiet = SyncReport::default();
+        assert_eq!(sync_line(100, &quiet, 130), "Synced just now");
+        assert_eq!(sync_line(100, &quiet, 400), "Synced 5 min ago");
+        let busy = SyncReport {
+            applied: 2,
+            ..SyncReport::default()
+        };
+        assert_eq!(
+            sync_line(0, &busy, 7200),
+            "Synced 2 h ago  ·  2 positions from other devices"
+        );
+    }
+
+    #[test]
+    fn signing_out_forgets_what_was_typed_and_browsed() {
+        let mut panel = AccountPanel {
+            password: "secret".into(),
+            mailbox: "also secret".into(),
+            ..AccountPanel::default()
+        };
+        panel.browser.open = true;
+        panel.set_status(AccountStatus::SignedOut);
+        assert!(panel.password.is_empty() && panel.mailbox.is_empty());
+        assert!(!panel.browser.open);
+    }
+
+    #[test]
+    fn a_listing_for_a_folder_already_left_is_dropped() {
+        let uid = |link: &str| {
+            NodeUid::new(
+                pstr_core::proton_sdk::ids::VolumeId::new("v".to_owned()),
+                pstr_core::proton_sdk::ids::LinkId::new(link.to_owned()),
+            )
+        };
+        let mut browser = DriveBrowser {
+            trail: vec![("b".into(), uid("b"))],
+            loading: true,
+            ..DriveBrowser::default()
+        };
+        browser.folder_arrived(uid("a"), Vec::new());
+        assert!(browser.loading && browser.entries.is_none());
+        browser.folder_arrived(uid("b"), Vec::new());
+        assert!(!browser.loading && browser.entries.is_some());
+    }
+}
@@ -1,6 +1,6 @@
 //! Inspectable desktop download queue.

-use crate::app::Action;
+use crate::app::{Action, Page};
 use crate::engine::{DownloadItem, DownloadState};
 use crate::{theme, ui};

@@ -222,12 +222,20 @@ fn buttons(ui: &mut egui::Ui, item: &DownloadItem, actions: &mut Vec<Action>) {
            }
        }
        DownloadState::Completed => {
+            // The point of a download is to watch it, and the library is a
+            // detour from here — offline most of all.
+            if ui::accent_button(ui, "Play").clicked() {
+                actions.push(Action::PlayResuming(item.target.clone()));
+            }
+            if ui.button("Open").on_hover_text("Go to its title").clicked() {
+                actions.push(Action::Goto(Page::Title(item.target.title_key.clone())));
+            }
            if ui
                .button("Delete")
                .on_hover_text("Delete the offline copy; keep the online source")
                .clicked()
            {
-                actions.push(Action::RemoveDownload(key(), false));
+                actions.push(Action::DeleteOffline(vec![key()], item.target.caption()));
            }
        }
    }
@@ -10,6 +10,7 @@ use pstr_core::library::{Episode, Library, Title, TitleKind};

 use crate::app::{Action, Page};
 use crate::theme;
+use crate::ui::widgets::Named;
 use crate::ui::{self, Art};

 const STILL: egui::Vec2 = egui::vec2(128.0, 72.0);
@@ -161,7 +162,7 @@ fn row(
                        )
                        .frame(false),
                    )
-                    .on_hover_text(if episode.is_watched() {
+                    .hint(if episode.is_watched() {
                        "Remove from history — marks it unwatched"
                    } else {
                        "Remove from history — forgets where you stopped"
@@ -19,6 +19,11 @@ pub struct Shelves<'a> {
    pub search: &'a str,
    /// The grid's shape.
    pub tiles: Tiles,
+    /// What a crawl in progress has found, if one is.
+    pub crawl: Option<&'a str>,
+    /// Whether to offer posters and synopses: they are off, and the offer has
+    /// not been turned down.
+    pub offer_metadata: bool,
 }

 pub fn show(ui: &mut egui::Ui, art: &mut Art<'_>, shelves: Shelves<'_>, actions: &mut Vec<Action>) {
@@ -28,12 +33,14 @@ pub fn show(ui: &mut egui::Ui, art: &mut Art<'_>, shelves: Shelves<'_>, actions:
        loaded,
        search,
        tiles,
+        crawl,
+        offer_metadata,
    } = shelves;
    if !loaded {
        return placeholder(ui);
    }
    if library.is_empty() {
-        return empty_state(ui, actions);
+        return empty_state(ui, crawl, actions);
    }

    let pick = |indices: &[usize]| -> Vec<&Title> {
@@ -48,6 +55,10 @@ pub fn show(ui: &mut egui::Ui, art: &mut Art<'_>, shelves: Shelves<'_>, actions:
    egui::ScrollArea::vertical()
        .auto_shrink([false, false])
        .show(ui, |ui| {
+            if !searching && offer_metadata {
+                metadata_offer(ui, actions);
+                ui.add_space(theme::space::XL);
+            }
            if !searching {
                if let Some(title) = featured(library, view, art.metadata, today()) {
                    hero(ui, art, title, actions);
@@ -304,8 +315,16 @@ fn shelf_controls(ui: &mut egui::Ui, view: &LibraryView, actions: &mut Vec<Actio
    }
    ui.add_space(theme::space::S);
    let mut grouped = view.grouped;
-    if ui
-        .toggle_value(&mut grouped, egui_phosphor::regular::STACK)
+    let toggle = ui.toggle_value(&mut grouped, egui_phosphor::regular::STACK);
+    toggle.widget_info(|| {
+        egui::WidgetInfo::selected(
+            egui::WidgetType::SelectableLabel,
+            true,
+            view.grouped,
+            "Group franchises",
+        )
+    });
+    if toggle
        .on_hover_text(if view.grouped {
            "One tile per franchise. Click to show every title"
        } else {
@@ -316,17 +335,8 @@ fn shelf_controls(ui: &mut egui::Ui, view: &LibraryView, actions: &mut Vec<Actio
        actions.push(Action::SetGrouped(grouped));
    }
    ui.add_space(theme::space::L);
-    if let Some(filter) = ui::widgets::segmented(
-        ui,
-        view.filter,
-        &[
-            (Filter::All, "All"),
-            (Filter::Series, "Series"),
-            (Filter::Films, "Films"),
-            (Filter::Watching, "Watching"),
-            (Filter::Unwatched, "Not started"),
-        ],
-    ) {
+    let filters = Filter::ALL.map(|filter| (filter, filter.label()));
+    if let Some(filter) = ui::widgets::segmented(ui, view.filter, &filters) {
        actions.push(Action::SetShelf(filter, view.sort));
    }
 }
@@ -382,7 +392,7 @@ fn tile_shape(tiles: Tiles) -> (f32, f32) {
    }
 }

-/// The top shelf: one card per part-watched title, scrolling sideways.
+/// The top shelf: one card per title in progress, scrolling sideways.
 fn continue_row(
    ui: &mut egui::Ui,
    art: &mut Art<'_>,
@@ -395,21 +405,17 @@ fn continue_row(
        .show(ui, |ui| {
            ui.horizontal(|ui| {
                for title in titles {
-                    let Some(episode) = title.resume() else {
+                    let Some(episode) = title.continue_with() else {
                        continue;
                    };
-                    let remaining = episode
-                        .watch
-                        .and_then(|watch| watch.duration_secs)
-                        .map(|duration| {
-                            format!(
-                                "{} left",
-                                ui::format_time(
-                                    duration - episode.watch.map_or(0.0, |w| w.position_secs)
-                                )
-                            )
-                        })
-                        .unwrap_or_else(|| episode.label());
+                    let remaining = match episode.resume_at() {
+                        Some(at) => episode
+                            .watch
+                            .and_then(|watch| watch.duration_secs)
+                            .map(|duration| format!("{} left", ui::format_time(duration - at)))
+                            .unwrap_or_else(|| episode.label()),
+                        None => format!("Next: {}", episode.label()),
+                    };

                    let picture = art.of(title);
                    let response = ui::card(
@@ -550,7 +556,7 @@ fn tile_menu(
            });
        }
        if continuing
-            && let Some(episode) = title.resume()
+            && let Some(episode) = title.continue_with()
            && ui
                .button("Remove from Continue watching")
                .on_hover_text("Forget where you stopped in it")
@@ -639,9 +645,54 @@ fn placeholder(ui: &mut egui::Ui) {
    }
 }

-fn empty_state(ui: &mut egui::Ui, actions: &mut Vec<Action>) {
+/// Posters and synopses, offered once there is a library to put them on and
+/// never turned on unasked: switching them on sends title names out.
+fn metadata_offer(ui: &mut egui::Ui, actions: &mut Vec<Action>) {
+    egui::Frame::new()
+        .fill(theme::card())
+        .corner_radius(egui::CornerRadius::same(theme::radius::MD))
+        .inner_margin(egui::Margin::symmetric(14, 12))
+        .show(ui, |ui| {
+            ui.set_width(ui.available_width());
+            ui.horizontal(|ui| {
+                ui.vertical(|ui| {
+                    ui.label(egui::RichText::new("Add posters and synopses?").strong());
+                    ui.label(ui::muted(
+                        "Turning it on in Settings sends the titles in your library — not your \
+                         files, and nothing about what you have watched — to AniList or TMDB.",
+                    ));
+                });
+                ui.with_layout(egui::Layout::right_to_left(egui::Align::Center), |ui| {
+                    if ui.button("Not now").clicked() {
+                        actions.push(Action::DismissMetadataOffer);
+                    }
+                    if ui::accent_button(ui, "Open settings").clicked() {
+                        actions.push(Action::Goto(Page::Settings));
+                    }
+                });
+            });
+        });
+}
+
+fn empty_state(ui: &mut egui::Ui, crawl: Option<&str>, actions: &mut Vec<Action>) {
    ui.vertical_centered(|ui| {
        ui.add_space(120.0);
+        // A share just added: say it is being looked through, rather than
+        // offer to add the one that is already filling the page.
+        if let Some(crawl) = crawl {
+            ui.add(egui::Spinner::new().size(28.0));
+            ui.add_space(theme::space::L);
+            ui.label(
+                theme::Role::Title
+                    .rich("Looking through the share")
+                    .strong(),
+            );
+            ui.add_space(theme::space::S);
+            ui.label(ui::muted(format!(
+                "Its titles appear here once it has been listed ({crawl})."
+            )));
+            return;
+        }
        ui.label(
            theme::Role::Title
                .rich("Nothing in the library yet")
@@ -653,7 +704,7 @@ fn empty_state(ui: &mut egui::Ui, actions: &mut Vec<Action>) {
        ));
        ui.add_space(theme::space::XL);
        if ui::accent_button(ui, "Add a share").clicked() {
-            actions.push(Action::Goto(Page::Shares));
+            actions.push(Action::OpenShareForm);
        }
    });
 }
@@ -130,12 +130,29 @@ fn current_row(
                )));
                // Only worth offering when there is something to undo: with no
                // row stored, "clear" would delete nothing.
-                if ui
+                //
+                // A match chosen by hand is asked about first: it is work the
+                // next match run does not redo.
+                let asking = ui.id().with(("forget", &matcher.title_key));
+                if ui.data(|data| data.get_temp::<bool>(asking).unwrap_or(false)) {
+                    ui.label(ui::muted("Forget the match you chose?"));
+                    if ui::danger_button(ui, "Forget").clicked() {
+                        ui.data_mut(|data| data.remove::<bool>(asking));
+                        actions.push(Action::ForgetMatch(matcher.title_key.clone()));
+                    }
+                    if ui.button("Keep").clicked() {
+                        ui.data_mut(|data| data.remove::<bool>(asking));
+                    }
+                } else if ui
                    .button("Clear")
                    .on_hover_text("Forget this match and let the next match run decide again")
                    .clicked()
                {
-                    actions.push(Action::ForgetMatch(matcher.title_key.clone()));
+                    if *manual {
+                        ui.data_mut(|data| data.insert_temp(asking, true));
+                    } else {
+                        actions.push(Action::ForgetMatch(matcher.title_key.clone()));
+                    }
                }
            }
            Some((None, _)) => {
@@ -3,6 +3,7 @@
 //! mutating the library it is iterating: pages collect [`Action`]s and the app
 //! applies them after the frame is drawn.

+pub mod account;
 pub mod downloads;
 pub mod history;
 pub mod library;
@@ -24,6 +25,7 @@ use pstr_core::metadata::{ArtShape, EpisodeGuide, EpisodeMetadata, MetadataRecor

 use crate::engine::{Engine, ImageCache, WIDE_MAX_EDGE, thumbnail_key};
 use crate::theme;
+use widgets::Named;

 /// Everything the pages need to draw one title's picture.
 ///
@@ -171,6 +173,19 @@ pub fn wide_key(title_key: &str) -> String {
    format!("wide:{title_key}")
 }

+/// "just now", "5 min ago", "3 h ago", "2 days ago": how long before `now`
+/// the Unix time `at` was.
+pub fn ago(at: i64, now: i64) -> String {
+    let ago = (now - at).max(0);
+    match ago {
+        0..60 => "just now".to_owned(),
+        60..3600 => format!("{} min ago", ago / 60),
+        3600..86_400 => format!("{} h ago", ago / 3600),
+        86_400..172_800 => "1 day ago".to_owned(),
+        _ => format!("{} days ago", ago / 86_400),
+    }
+}
+
 /// `1:03:47`, or `4:12` for anything under an hour.
 pub fn format_time(seconds: f64) -> String {
    if !seconds.is_finite() || seconds < 0.0 {
@@ -191,6 +206,18 @@ pub fn format_speed(speed: f64) -> String {
    format!("{}×", text.trim_end_matches('0').trim_end_matches('.'))
 }

+/// `+0.3 s`, `−1.2 s` or `0 s`: a subtitle delay, signed so the direction
+/// reads without knowing which way mpv counts.
+pub fn format_delay(seconds: f64) -> String {
+    if seconds.abs() < 0.05 {
+        "0 s".to_owned()
+    } else if seconds > 0.0 {
+        format!("+{seconds:.1} s")
+    } else {
+        format!("−{:.1} s", -seconds)
+    }
+}
+
 /// `1.4 GiB`, for what a file costs to watch.
 pub fn format_size(bytes: i64) -> String {
    const UNITS: [&str; 4] = ["B", "KiB", "MiB", "GiB"];
@@ -310,7 +337,7 @@ pub fn search_field(ui: &mut egui::Ui, search: &mut String, focus: bool) {
        );
        if response
            .on_hover_cursor(egui::CursorIcon::PointingHand)
-            .on_hover_text("Clear (Esc)")
+            .hint("Clear (Esc)")
            .clicked()
        {
            search.clear();
@@ -373,6 +400,19 @@ pub enum Answer {
 /// inside the app — stored secrets, downloaded bytes. Everything else acts on
 /// the click.
 pub fn confirm(ctx: &egui::Context, id: &str, heading: &str, body: &str, verb: &str) -> Answer {
+    confirm_with(ctx, id, heading, body, verb, true)
+}
+
+/// [`confirm`], for a question whose yes loses nothing — a large download —
+/// and so is the accent rather than the danger colour.
+pub fn confirm_with(
+    ctx: &egui::Context,
+    id: &str,
+    heading: &str,
+    body: &str,
+    verb: &str,
+    destroys: bool,
+) -> Answer {
    let mut answer = Answer::Pending;
    let modal = egui::Modal::new(egui::Id::new(("confirm", id)))
        .frame(
@@ -393,7 +433,12 @@ pub fn confirm(ctx: &egui::Context, id: &str, heading: &str, body: &str, verb: &
            ui.label(theme::Role::Body.rich(body).color(theme::muted()));
            ui.add_space(theme::space::XL);
            ui.with_layout(egui::Layout::right_to_left(egui::Align::Center), |ui| {
-                if danger_button(ui, verb).clicked() {
+                let yes = if destroys {
+                    danger_button(ui, verb)
+                } else {
+                    accent_button(ui, verb)
+                };
+                if yes.clicked() {
                    answer = Answer::Confirmed;
                }
                if ui.button("Cancel").clicked() {
@@ -497,6 +542,7 @@ fn filled(ui: &mut egui::Ui, text: &str, fill: Fill, extra: Vec2) -> egui::Respo
    );

    let (rect, response) = ui.allocate_exact_size(size, Sense::click());
+    let response = response.named(text);
    if !ui.is_rect_visible(rect) {
        return response;
    }
@@ -594,6 +640,11 @@ pub fn card(ui: &mut egui::Ui, card: Card<'_>) -> egui::Response {

    let (rect, response) =
        ui.allocate_exact_size(Vec2::new(width, image_height + text_height), Sense::click());
+    let response = if card.subtitle.is_empty() {
+        response.named(card.name)
+    } else {
+        response.named(format!("{}, {}", card.name, card.subtitle))
+    };
    // Reached with the arrow keys or Tab: bring it into view, before the
    // early return below would skip a tile that is just off screen.
    if response.gained_focus() {
@@ -878,6 +929,13 @@ pub fn columns_of(available: f32, minimum: f32) -> Grid {

 #[cfg(test)]
 mod tests {
+    #[test]
+    fn a_subtitle_delay_reads_with_its_direction() {
+        assert_eq!(super::format_delay(0.3), "+0.3 s");
+        assert_eq!(super::format_delay(-1.2), "−1.2 s");
+        assert_eq!(super::format_delay(0.0000001), "0 s");
+    }
+
    use super::*;

    #[test]
@@ -20,6 +20,7 @@ use egui::{Align2, Color32, CornerRadius, Rect, Sense, Vec2};
 use crate::app::{Action, Adjacent};
 use crate::playback::{Command, Playback};
 use crate::theme;
+use crate::ui::widgets::Named;
 use crate::ui::{self, transport::Neighbours};

 /// How long the controls stay up after the pointer stops moving.
@@ -139,6 +140,9 @@ pub struct UpNextCard {
    pub caption: String,
    /// Its still, once there is one.
    pub still: Option<egui::TextureHandle>,
+    /// Counting down the end of a file with no credits chapter, where the
+    /// second button cancels the next episode rather than deferring it.
+    pub tail: bool,
 }

 impl Overlay {
@@ -185,16 +189,28 @@ impl Overlay {
    }
 }

+/// What the player page shows while a file opens and there is no picture yet.
+pub struct Waiting<'a> {
+    /// The episode being opened.
+    pub name: &'a str,
+    /// The title it belongs to, as the library names it.
+    pub title: Option<String>,
+    /// The title's widest art, dimmed behind the words.
+    pub art: Option<egui::TextureHandle>,
+    /// Whether one episode is following another, rather than a first click.
+    pub next: bool,
+}
+
 /// Draw the picture and its controls.
 ///
-/// `playback` is `None` in the gap between one episode ending and the next
-/// having opened — the page stays, because that is where the viewer means to
-/// be, and `opening` is what it says while they wait.
+/// `playback` is `None` until the file has opened — on a first click, and in
+/// the gap between one episode ending and the next — and `opening` is what the
+/// page says meanwhile.
 pub fn show(
    ui: &mut egui::Ui,
    frame: &mut eframe::Frame,
    playback: Option<&mut Playback>,
-    opening: Option<&str>,
+    opening: Option<Waiting<'_>>,
    chrome_state: Chrome<'_>,
    actions: &mut Vec<Action>,
 ) {
@@ -372,26 +388,60 @@ fn stalled(ui: &mut egui::Ui, rect: Rect) {
    );
 }

-/// The screen between two episodes: one has ended and the next is opening.
+/// The screen while a file opens: after a click, or between one episode and
+/// the next.
 ///
 /// It keeps a way out, because opening a file over a public link can take
 /// seconds and a black screen with no controls is indistinguishable from a
 /// hang.
-fn between(ui: &mut egui::Ui, opening: Option<&str>, rect: Rect, actions: &mut Vec<Action>) {
+fn between(ui: &mut egui::Ui, waiting: Option<Waiting<'_>>, rect: Rect, actions: &mut Vec<Action>) {
+    let Waiting {
+        name,
+        title,
+        art,
+        next,
+    } = waiting.unwrap_or(Waiting {
+        name: "opening…",
+        title: None,
+        art: None,
+        next: true,
+    });
+    if let Some(art) = &art {
+        // Cover rather than fit: bars around a dimmed backdrop look like a
+        // mistake, and its edges are not what anyone is looking at.
+        let size = art.size_vec2();
+        let scale = (rect.width() / size.x).max(rect.height() / size.y);
+        let shown = size * scale;
+        let uv = Rect::from_center_size(
+            egui::pos2(0.5, 0.5),
+            Vec2::new(rect.width() / shown.x, rect.height() / shown.y),
+        );
+        ui.painter()
+            .image(art.id(), rect, uv, Color32::from_white_alpha(70));
+    }
    ui.painter().text(
        rect.center() - Vec2::new(0.0, 16.0),
        Align2::CENTER_CENTER,
-        "Up next",
+        match (&title, next) {
+            (_, true) => "Up next",
+            (Some(title), false) => title.as_str(),
+            (None, false) => "Opening",
+        },
        theme::Role::Body.font(),
        theme::muted(),
    );
    ui.painter().text(
        rect.center() + Vec2::new(0.0, 12.0),
        Align2::CENTER_CENTER,
-        opening.unwrap_or("opening…"),
+        name,
        theme::Role::Title.font(),
        theme::text(),
    );
+    let spinner = Rect::from_center_size(rect.center() + Vec2::new(0.0, 56.0), Vec2::splat(24.0));
+    ui.put(
+        spinner,
+        egui::Spinner::new().size(24.0).color(Color32::WHITE),
+    );

    ui.scope_builder(
        egui::UiBuilder::new()
@@ -404,8 +454,6 @@ fn between(ui: &mut egui::Ui, opening: Option<&str>, rect: Rect, actions: &mut V
            if ui.button("Back").clicked() {
                actions.push(Action::LeavePlayer);
            }
-            ui.add_space(theme::space::M);
-            ui.add(egui::Spinner::new().size(14.0));
        },
    );
 }
@@ -539,7 +587,7 @@ fn up_next_card(
                        theme::Role::Body.font(),
                        Color32::WHITE,
                    );
-                    if response.on_hover_text("Play now").clicked() {
+                    if response.hint("Play now").clicked() {
                        actions.push(Action::PlayAdjacent(Adjacent::Next));
                    }

@@ -566,11 +614,15 @@ fn up_next_card(
                                actions.push(Action::PlayAdjacent(Adjacent::Next));
                            }
                            ui.add_space(theme::space::S);
-                            if ui
-                                .button("Watch till the end")
-                                .on_hover_text("Play this one out — nothing will be skipped")
-                                .clicked()
-                            {
+                            let (label, hint) = if card.tail {
+                                ("Cancel", "Stay here — the next episode will not start")
+                            } else {
+                                (
+                                    "Watch till the end",
+                                    "Play this one out — nothing will be skipped",
+                                )
+                            };
+                            if ui.button(label).on_hover_text(hint).clicked() {
                                actions.push(Action::WatchToEnd);
                            }
                        });
@@ -695,7 +747,7 @@ fn chrome(
                        .corner_radius(CornerRadius::same(theme::radius::MD))
                        .min_size(Vec2::new(38.0, 32.0)),
                    )
-                    .on_hover_text(if fullscreen {
+                    .hint(if fullscreen {
                        "Leave fullscreen (F)"
                    } else {
                        "Fullscreen (F)"
@@ -727,12 +779,31 @@ fn chrome(
                            .corner_radius(CornerRadius::same(theme::radius::MD))
                            .min_size(Vec2::new(38.0, 32.0)),
                        )
-                        .on_hover_text("Episodes (E)")
+                        .hint("Episodes (E)")
                        .clicked()
                    {
                        actions.push(Action::ToggleEpisodes);
                    }
                }
+                // Esc leaves the page and keeps playing; this is the one-step
+                // way to be done with the episode.
+                ui.add_space(theme::space::S);
+                if ui
+                    .add(
+                        egui::Button::new(
+                            theme::Role::Subhead
+                                .rich(egui_phosphor::regular::STOP)
+                                .color(Color32::WHITE),
+                        )
+                        .fill(Color32::from_black_alpha(160))
+                        .corner_radius(CornerRadius::same(theme::radius::MD))
+                        .min_size(Vec2::new(38.0, 32.0)),
+                    )
+                    .hint("Stop")
+                    .clicked()
+                {
+                    actions.push(Action::Player(Command::Stop));
+                }
            });
        },
    );
@@ -834,7 +905,7 @@ fn episode_drawer(
                                    )
                                    .frame(false),
                                )
-                                .on_hover_text("Close (E)")
+                                .hint("Close (E)")
                                .clicked()
                            {
                                actions.push(Action::ToggleEpisodes);
@@ -7,11 +7,14 @@

 use pstr_core::appearance::{Accent, Appearance, Flavor, Tiles};
 use pstr_core::metadata::{MetadataConfig, ProviderId, TitleNames};
+use pstr_core::prefs::{Colour, PlaybackPrefs, SubtitleBackdrop, SubtitleStyle};
+use pstr_player::LANGUAGES;

 use crate::app::Action;
-use crate::desktop_prefs::{CACHE_CHOICES, DesktopPrefs};
+use crate::desktop_prefs::{CACHE_CHOICES, DesktopPrefs, TEXT_SIZE_CHOICES};
 use crate::theme;
 use crate::ui;
+use crate::ui::widgets::Named;

 /// The settings that are a single value rather than a form.
 ///
@@ -19,9 +22,11 @@ use crate::ui;
 /// they are read-only, and passing them one by one is what pushed this
 /// function past the argument count anybody can read.
 #[derive(Debug, Clone, Copy)]
-pub struct Prefs {
+pub struct Prefs<'a> {
    pub autoplay: bool,
    pub auto_skip: bool,
+    /// The languages, read from here.
+    pub playback: &'a PlaybackPrefs,
    pub appearance: Appearance,
    pub desktop: DesktopPrefs,
    /// What the streaming cache holds, once the shares are open.
@@ -35,7 +40,7 @@ const COLUMN: f32 = 760.0;
 pub fn show(
    ui: &mut egui::Ui,
    settings: &mut MetadataConfig,
-    prefs: Prefs,
+    prefs: Prefs<'_>,
    api_key: &mut String,
    actions: &mut Vec<Action>,
 ) {
@@ -51,8 +56,9 @@ pub fn show(
                ui.vertical(|ui| {
                    ui.set_width(width);
                    ui.add_space(theme::space::M);
-                    appearance_form(ui, prefs.appearance, actions);
+                    appearance_form(ui, prefs.appearance, prefs.desktop, actions);
                    playback_form(ui, prefs, actions);
+                    subtitle_form(ui, &prefs.playback.subtitle_style, actions);
                    storage_form(ui, prefs, actions);
                    metadata_form(ui, settings, api_key, actions);
                    about(ui);
@@ -66,7 +72,12 @@ pub fn show(
 /// Every control here repaints the whole window the moment it is clicked —
 /// there is no "apply" — because the preview *is* the app. A swatch row that
 /// only changed a small square would be asking someone to imagine the result.
-fn appearance_form(ui: &mut egui::Ui, appearance: Appearance, actions: &mut Vec<Action>) {
+fn appearance_form(
+    ui: &mut egui::Ui,
+    appearance: Appearance,
+    desktop: DesktopPrefs,
+    actions: &mut Vec<Action>,
+) {
    ui::widgets::settings_group(ui, "Appearance", None, |ui| {
        ui.add_space(theme::space::L);
        ui.label(theme::Role::Body.rich("Palette").color(theme::text()));
@@ -75,6 +86,7 @@ fn appearance_form(ui: &mut egui::Ui, appearance: Appearance, actions: &mut Vec<
        ui.horizontal_wrapped(|ui| {
            for flavor in Flavor::ALL {
                if palette_card(ui, appearance, flavor)
+                    .named(flavor.label())
                    .on_hover_text(flavor.description())
                    .clicked()
                    && appearance.flavor != flavor
@@ -102,6 +114,27 @@ fn appearance_form(ui: &mut egui::Ui, appearance: Appearance, actions: &mut Vec<
            }
        });

+        ui::widgets::settings_row(
+            ui,
+            "Text size",
+            Some("Everything grows with it. Kept on this computer only."),
+            |ui| {
+                let choices: Vec<(u16, String)> = TEXT_SIZE_CHOICES
+                    .iter()
+                    .map(|&percent| (percent, format!("{percent}%")))
+                    .collect();
+                let labels: Vec<(u16, &str)> = choices
+                    .iter()
+                    .map(|(percent, label)| (*percent, label.as_str()))
+                    .collect();
+                if let Some(text_size) = ui::widgets::segmented(ui, desktop.text_size, &labels) {
+                    actions.push(Action::SetDesktopPrefs(DesktopPrefs {
+                        text_size,
+                        ..desktop
+                    }));
+                }
+            },
+        );
        ui::widgets::settings_row(
            ui,
            "Library tiles",
@@ -265,22 +298,24 @@ fn swatch(ui: &mut egui::Ui, appearance: Appearance, accent: Accent) -> egui::Re
        }
    }
    response
-        .on_hover_text(accent.label())
+        .hint(accent.label())
        .on_hover_cursor(egui::CursorIcon::PointingHand)
 }

 /// The playback settings that are not per-file.
 ///
-/// Volume, audio language, subtitle language and speed are all set from the
-/// player itself, where a viewer can hear the result.
-fn playback_form(ui: &mut egui::Ui, prefs: Prefs, actions: &mut Vec<Action>) {
+/// Volume and speed are set from the player itself, where a viewer can hear
+/// the result. The languages are here as well as there: what a first episode
+/// opens with is decided before there is a player to choose from.
+fn playback_form(ui: &mut egui::Ui, prefs: Prefs<'_>, actions: &mut Vec<Action>) {
    ui::widgets::settings_group(
        ui,
        "Playback",
        Some(
-            "Volume, audio, subtitles and speed are set from the player, and remembered from there.",
+            "Volume and speed are set from the player. A language chosen in the player for one show is kept for that show.",
        ),
        |ui| {
+            languages(ui, prefs.playback, actions);
            let mut autoplay = prefs.autoplay;
            ui::widgets::settings_row(
                ui,
@@ -322,8 +357,442 @@ fn playback_form(ui: &mut egui::Ui, prefs: Prefs, actions: &mut Vec<Action>) {
    );
 }

+/// The audio and subtitle languages every file opens with, until a show has a
+/// choice of its own.
+fn languages(ui: &mut egui::Ui, playback: &PlaybackPrefs, actions: &mut Vec<Action>) {
+    let name = |tag: &Option<String>| match tag {
+        Some(tag) => pstr_player::language_name(tag),
+        None => "The file's default".to_owned(),
+    };
+    let audio = playback.audio_language.clone();
+    ui::widgets::settings_row(
+        ui,
+        "Audio language",
+        Some("Played when a file has it."),
+        |ui| {
+            egui::ComboBox::from_id_salt("audio-language")
+                .selected_text(name(&audio))
+                .show_ui(ui, |ui| {
+                    for choice in
+                        std::iter::once(None).chain(LANGUAGES.map(|tag| Some(tag.to_owned())))
+                    {
+                        if ui
+                            .selectable_label(audio == choice, name(&choice))
+                            .clicked()
+                            && audio != choice
+                        {
+                            actions.push(Action::SetLanguages {
+                                audio: choice,
+                                subtitles: playback.subtitles,
+                                subtitle: playback.subtitle_language.clone(),
+                            });
+                        }
+                    }
+                });
+        },
+    );
+    // Off, the file's default, or a language: "off" is a decision of its
+    // own, which no language expresses.
+    let subtitle = playback
+        .subtitles
+        .then(|| playback.subtitle_language.clone());
+    let subtitle_name = |choice: &Option<Option<String>>| match choice {
+        None => "Off".to_owned(),
+        Some(tag) => name(tag),
+    };
+    ui::widgets::settings_row(
+        ui,
+        "Subtitles",
+        Some("Shown when a file has them in this language."),
+        |ui| {
+            egui::ComboBox::from_id_salt("subtitle-language")
+                .selected_text(subtitle_name(&subtitle))
+                .show_ui(ui, |ui| {
+                    let choices = [None, Some(None)]
+                        .into_iter()
+                        .chain(LANGUAGES.map(|tag| Some(Some(tag.to_owned()))));
+                    for choice in choices {
+                        if ui
+                            .selectable_label(subtitle == choice, subtitle_name(&choice))
+                            .clicked()
+                            && subtitle != choice
+                        {
+                            actions.push(Action::SetLanguages {
+                                audio: playback.audio_language.clone(),
+                                subtitles: choice.is_some(),
+                                subtitle: choice.flatten(),
+                            });
+                        }
+                    }
+                });
+        },
+    );
+}
+
+/// How subtitles look, with a sample line to judge it by.
+///
+/// Every change reaches a playing file as it is made, so the film itself is
+/// the other preview. A styled track takes none of it unless it is asked to;
+/// see [`SubtitleStyle`].
+fn subtitle_form(ui: &mut egui::Ui, style: &SubtitleStyle, actions: &mut Vec<Action>) {
+    ui::widgets::settings_group(
+        ui,
+        "Subtitles",
+        Some(
+            "Changes show on the playing video straight away. Plain subtitles (SRT) take all of this; styled ones (ASS) keep their own look unless you restyle them below.",
+        ),
+        |ui| {
+            let mut chosen = style.clone();
+            ui.add_space(theme::space::L);
+            subtitle_preview(ui, &chosen);
+            ui.add_space(theme::space::L);
+
+            ui::widgets::settings_row(ui, "Size", None, |ui| {
+                percent_slider(
+                    ui,
+                    &mut chosen.scale,
+                    SubtitleStyle::MIN_SCALE..=SubtitleStyle::MAX_SCALE,
+                );
+            });
+            ui::widgets::settings_row(
+                ui,
+                "Position",
+                Some("How far up the picture the line sits."),
+                |ui| subtitle_position_slider(ui, &mut chosen.position),
+            );
+            ui::widgets::settings_row(
+                ui,
+                "Font",
+                Some(if cfg!(target_os = "linux") {
+                    "Any font installed here."
+                } else {
+                    "Any font installed here. The sample above is drawn in the app's own font."
+                }),
+                |ui| {
+                    ui::widgets::toggle(ui, &mut chosen.italic, "Italic");
+                    ui::widgets::toggle(ui, &mut chosen.bold, "Bold");
+                    font_picker(ui, &mut chosen.font);
+                },
+            );
+            ui::widgets::settings_row(ui, "Text colour", None, |ui| {
+                colour_button(ui, &mut chosen.colour);
+            });
+            ui::widgets::settings_row(
+                ui,
+                "Background",
+                Some("A box reads on bright scenes; an outline hides less of the picture."),
+                |ui| {
+                    let choices =
+                        SubtitleBackdrop::ALL.map(|backdrop| (backdrop, backdrop.label()));
+                    if let Some(backdrop) = ui::widgets::segmented(ui, chosen.backdrop, &choices) {
+                        chosen.backdrop = backdrop;
+                    }
+                },
+            );
+            match chosen.backdrop {
+                SubtitleBackdrop::Outline => {
+                    ui::widgets::settings_row(ui, "Outline", None, |ui| {
+                        colour_button(ui, &mut chosen.outline_colour);
+                        ui.add(
+                            egui::Slider::new(
+                                &mut chosen.outline_size,
+                                0.0..=SubtitleStyle::MAX_OUTLINE,
+                            )
+                            .step_by(0.05)
+                            .fixed_decimals(1),
+                        );
+                    });
+                }
+                SubtitleBackdrop::Box => {
+                    ui::widgets::settings_row(
+                        ui,
+                        "Box colour",
+                        Some("Its opacity is how much of the picture shows through."),
+                        |ui| colour_button(ui, &mut chosen.box_colour),
+                    );
+                }
+            }
+            ui::widgets::settings_row(ui, "Shadow", Some("How far it falls. 0 is none."), |ui| {
+                colour_button(ui, &mut chosen.shadow_colour);
+                ui.add(
+                    egui::Slider::new(&mut chosen.shadow_offset, 0.0..=SubtitleStyle::MAX_SHADOW)
+                        .step_by(0.1)
+                        .fixed_decimals(1),
+                );
+            });
+            ui::widgets::settings_row(
+                ui,
+                "Blur",
+                Some("Softens the edges. Not shown in the sample."),
+                |ui| {
+                    ui.add(
+                        egui::Slider::new(&mut chosen.blur, 0.0..=SubtitleStyle::MAX_BLUR)
+                            .step_by(0.1)
+                            .fixed_decimals(1),
+                    );
+                },
+            );
+            ui::widgets::settings_row(
+                ui,
+                "Restyle styled subtitles",
+                Some(
+                    "Draw styled (ASS) dialogue in this style too, size and position included. Signs, songs and karaoke can come out wrong.",
+                ),
+                |ui| {
+                    ui::widgets::toggle(ui, &mut chosen.restyle_styled, "");
+                },
+            );
+            ui::widgets::settings_row(ui, "Reset", Some("Back to mpv's own look."), |ui| {
+                if ui
+                    .add_enabled(
+                        *style != SubtitleStyle::default(),
+                        egui::Button::new("Reset"),
+                    )
+                    .clicked()
+                {
+                    chosen = SubtitleStyle::default();
+                }
+            });
+
+            if chosen != *style {
+                actions.push(Action::SetSubtitleStyle(chosen.sanitized()));
+            }
+        },
+    );
+}
+
+/// A scale as a percentage slider, 100% being mpv's own size.
+pub(crate) fn percent_slider(
+    ui: &mut egui::Ui,
+    scale: &mut f64,
+    range: std::ops::RangeInclusive<f64>,
+) -> egui::Response {
+    let mut percent = *scale * 100.0;
+    let response = ui.add(
+        egui::Slider::new(&mut percent, range.start() * 100.0..=range.end() * 100.0)
+            .step_by(5.0)
+            .suffix("%")
+            .fixed_decimals(0),
+    );
+    *scale = percent / 100.0;
+    response
+}
+
+/// Where the line sits, 0 at the top of the picture and 100 at the bottom —
+/// shown the other way up, as height above the bottom edge, which is how
+/// anyone would describe moving subtitles up.
+pub(crate) fn subtitle_position_slider(ui: &mut egui::Ui, position: &mut f64) -> egui::Response {
+    let mut height = 100.0 - *position;
+    let response = ui.add(
+        egui::Slider::new(&mut height, 0.0..=90.0)
+            .step_by(1.0)
+            .suffix("% up")
+            .fixed_decimals(0),
+    );
+    *position = 100.0 - height;
+    response
+}
+
+/// A swatch that opens a colour wheel with an opacity slider.
+fn colour_button(ui: &mut egui::Ui, colour: &mut Colour) {
+    let [r, g, b, a] = colour.to_array();
+    let mut picked = egui::Color32::from_rgba_unmultiplied(r, g, b, a);
+    // The `Color32` form rather than `Hsva`, because egui remembers the hue
+    // behind it: rebuilt from RGB each frame, black and grey have none, and
+    // the wheel would snap back to red under the mouse.
+    let response = egui::color_picker::color_edit_button_srgba(
+        ui,
+        &mut picked,
+        egui::color_picker::Alpha::OnlyBlend,
+    );
+    // Only on a change: a round trip through premultiplied alpha can nudge
+    // an untouched colour by a step.
+    if response.changed() {
+        *colour = Colour::from(picked.to_srgba_unmultiplied());
+    }
+}
+
+/// The font: the installed families to pick from, and a box to type any name
+/// into — the only way on a system whose families the app cannot list.
+fn font_picker(ui: &mut egui::Ui, font: &mut Option<String>) {
+    let filter_id = egui::Id::new("subtitle-font-filter");
+    let mut filter: String = ui.data(|data| data.get_temp(filter_id)).unwrap_or_default();
+    let families = theme::font_families(ui.ctx());
+    egui::ComboBox::from_id_salt("subtitle-font")
+        .selected_text(font.as_deref().unwrap_or("Default"))
+        .width(200.0)
+        .height(320.0)
+        // Not on any click: the search box is clicked into.
+        .close_behavior(egui::PopupCloseBehavior::CloseOnClickOutside)
+        .show_ui(ui, |ui| {
+            ui.add(
+                egui::TextEdit::singleline(&mut filter)
+                    .hint_text("Search or type a font name")
+                    .desired_width(f32::INFINITY),
+            )
+            .request_focus();
+            let typed = filter.trim();
+            if ui.selectable_label(font.is_none(), "Default").clicked() {
+                *font = None;
+                ui.close();
+            }
+            let wanted = typed.to_lowercase();
+            let mut exact = false;
+            for family in families.unwrap_or_default() {
+                if !family.to_lowercase().contains(&wanted) {
+                    continue;
+                }
+                exact |= family.eq_ignore_ascii_case(typed);
+                let label = egui::RichText::new(family.as_str());
+                if ui
+                    .selectable_label(font.as_deref() == Some(family.as_str()), label)
+                    .clicked()
+                {
+                    *font = Some(family.clone());
+                    ui.close();
+                }
+            }
+            if families.is_none() {
+                ui.label(ui::muted("Reading the installed fonts…"));
+            }
+            if !typed.is_empty() && !exact && ui.button(format!("Use “{typed}”")).clicked() {
+                *font = Some(typed.to_owned());
+                ui.close();
+            }
+        });
+    ui.data_mut(|data| data.insert_temp(filter_id, filter));
+}
+
+/// A sample line, half on a bright sky and half on night, drawn in the
+/// chosen style — so whether it reads on both is visible before a film is.
+///
+/// An approximation. The font is the face fontconfig picks for the chosen one,
+/// as libass's is, but only on Linux; elsewhere, and while it loads, it is the
+/// app's own. A bold or italic the face lacks is made up, as libass does, and
+/// there is no blur. Proportions follow mpv's, where sizes are in pixels of a
+/// 38-pixel font.
+fn subtitle_preview(ui: &mut egui::Ui, style: &SubtitleStyle) {
+    const HEIGHT: f32 = 132.0;
+    /// mpv's `sub-font-size`, the unit every other size is relative to.
+    const MPV_FONT: f32 = 38.0;
+    let width = ui.available_width();
+    let (rect, _) = ui.allocate_exact_size(egui::vec2(width, HEIGHT), egui::Sense::hover());
+    let painter = ui.painter_at(rect);
+    let radius = egui::CornerRadius::same(theme::radius::MD);
+
+    // Sky above haze on the left, a night street on the right.
+    let half = egui::Rect::from_min_max(rect.min, egui::pos2(rect.center().x, rect.max.y));
+    let mut sky = egui::Mesh::default();
+    sky.colored_vertex(half.left_top(), egui::Color32::from_rgb(0x8E, 0xC5, 0xF0));
+    sky.colored_vertex(half.right_top(), egui::Color32::from_rgb(0xB8, 0xDC, 0xF8));
+    sky.colored_vertex(
+        half.right_bottom(),
+        egui::Color32::from_rgb(0xFA, 0xF7, 0xEE),
+    );
+    sky.colored_vertex(
+        half.left_bottom(),
+        egui::Color32::from_rgb(0xF2, 0xF0, 0xE8),
+    );
+    sky.add_triangle(0, 1, 2);
+    sky.add_triangle(0, 2, 3);
+    painter.rect_filled(rect, radius, egui::Color32::from_rgb(0x14, 0x16, 0x22));
+    painter.add(sky);
+
+    let font_px = 22.0 * style.scale as f32;
+    let unit = font_px / MPV_FONT;
+    let face = theme::subtitle_face(
+        ui.ctx(),
+        style.font.as_deref().unwrap_or(SubtitleStyle::DEFAULT_FONT),
+        style.bold,
+        style.italic,
+    );
+    let (family, made_up_bold, made_up_italic) = match face {
+        Some(face) => (
+            theme::subtitle_family(),
+            style.bold && !face.bold,
+            style.italic && !face.italic,
+        ),
+        None if style.bold => (theme::semibold(), false, style.italic),
+        None => (egui::FontFamily::Proportional, false, style.italic),
+    };
+    let job = egui::text::LayoutJob::single_section(
+        "Can you read this on both sides?".to_owned(),
+        egui::TextFormat {
+            font_id: egui::FontId::new(font_px, family),
+            color: egui::Color32::PLACEHOLDER,
+            italics: made_up_italic,
+            ..Default::default()
+        },
+    );
+    let galley = painter.layout_job(job);
+    let size = galley.size();
+    // Bottom of the line at `position` percent down, as mpv places it, kept
+    // inside the strip.
+    let margin = 8.0;
+    let bottom = rect.top() + HEIGHT * style.position as f32 / 100.0 - margin;
+    let top = bottom
+        .min(rect.bottom() - margin)
+        .max(rect.top() + margin + size.y)
+        - size.y;
+    let at = egui::pos2(rect.center().x - size.x / 2.0, top);
+    let colour = |colour: Colour| {
+        let [r, g, b, a] = colour.to_array();
+        egui::Color32::from_rgba_unmultiplied(r, g, b, a)
+    };
+
+    let shadow = style.shadow_offset as f32 * unit;
+    match style.backdrop {
+        SubtitleBackdrop::Box => {
+            let padding = 6.0 * unit;
+            let line = egui::Rect::from_min_size(at, size).expand(padding);
+            if shadow > 0.0 {
+                painter.rect_filled(
+                    line.translate(egui::vec2(shadow, shadow)),
+                    0.0,
+                    colour(style.shadow_colour),
+                );
+            }
+            painter.rect_filled(line, 0.0, colour(style.box_colour));
+        }
+        SubtitleBackdrop::Outline => {
+            let outline = style.outline_size as f32 * unit;
+            let rings = |offset: egui::Vec2, ink: egui::Color32| {
+                if outline <= 0.0 {
+                    painter.galley_with_override_text_color(at + offset, galley.clone(), ink);
+                    return;
+                }
+                for step in 0..8 {
+                    let angle = step as f32 * std::f32::consts::TAU / 8.0;
+                    let ring = egui::vec2(angle.cos(), angle.sin()) * outline;
+                    painter.galley_with_override_text_color(
+                        at + offset + ring,
+                        galley.clone(),
+                        ink,
+                    );
+                }
+            };
+            if shadow > 0.0 {
+                rings(egui::vec2(shadow, shadow), colour(style.shadow_colour));
+            }
+            if outline > 0.0 {
+                rings(egui::Vec2::ZERO, colour(style.outline_colour));
+            }
+        }
+    }
+    if made_up_bold {
+        // libass thickens a face with no bold by a stroke of its own colour.
+        let thicken = (font_px / 40.0).max(0.5);
+        painter.galley_with_override_text_color(
+            at + egui::vec2(thicken, 0.0),
+            galley.clone(),
+            colour(style.colour),
+        );
+    }
+    painter.galley_with_override_text_color(at, galley, colour(style.colour));
+}
+
 /// The streaming cache: how big it may get, and a way to empty it.
-fn storage_form(ui: &mut egui::Ui, prefs: Prefs, actions: &mut Vec<Action>) {
+fn storage_form(ui: &mut egui::Ui, prefs: Prefs<'_>, actions: &mut Vec<Action>) {
    ui::widgets::settings_group(
        ui,
        "Storage",
@@ -6,7 +6,10 @@
 //! below is the only place a link is ever visible, and only while it is being
 //! typed.

+use std::collections::HashMap;
+
 use pstr_core::Share;
+use pstr_core::catalog::CrawlRecord;
 use pstr_core::library::Library;

 use crate::app::{Action, ShareForm};
@@ -16,8 +19,10 @@ use crate::ui;
 pub fn show(
    ui: &mut egui::Ui,
    shares: &[Share],
+    crawls: &HashMap<String, CrawlRecord>,
    library: &Library,
    form: &mut ShareForm,
+    account: &mut ui::account::AccountPanel,
    actions: &mut Vec<Action>,
 ) {
    egui::ScrollArea::vertical()
@@ -35,15 +40,26 @@ pub fn show(
                    .iter()
                    .filter(|title| title.share_ids.contains(&share.id))
                    .count();
-                share_row(ui, share, titles, actions);
+                share_row(ui, share, titles, crawls.get(&share.id), form, actions);
            }

            ui.add_space(theme::space::XXL);
            add_form(ui, shares, form, actions);
+
+            ui.add_space(theme::space::XXL);
+            ui::account::section(ui, account, actions);
+            ui::account::browser(ui, account, shares, actions);
        });
 }

-fn share_row(ui: &mut egui::Ui, share: &Share, titles: usize, actions: &mut Vec<Action>) {
+fn share_row(
+    ui: &mut egui::Ui,
+    share: &Share,
+    titles: usize,
+    crawl: Option<&CrawlRecord>,
+    form: &mut ShareForm,
+    actions: &mut Vec<Action>,
+) {
    egui::Frame::new()
        .fill(theme::card())
        .corner_radius(egui::CornerRadius::same(theme::radius::MD))
@@ -56,10 +72,29 @@ fn share_row(ui: &mut egui::Ui, share: &Share, titles: usize, actions: &mut Vec<
                    // What is in it, rather than what it is called inside the
                    // app. The id is still a hover away for a bug report.
                    let mut detail = ui::library::plural(titles, "title");
+                    if share.folder.is_some() {
+                        detail.push_str("  ·  from your Drive");
+                    }
                    if share.has_custom_password {
                        detail.push_str("  ·  password protected");
                    }
+                    match crawl {
+                        Some(crawl) if crawl.crawled_at > 0 => {
+                            detail.push_str("  ·  crawled ");
+                            detail.push_str(&ui::ago(crawl.crawled_at, crate::engine::unix_now()));
+                        }
+                        _ => detail.push_str("  ·  not crawled yet"),
+                    }
                    ui.label(ui::muted(detail)).on_hover_text(&share.id);
+                    // Why the last look failed, until one succeeds: a link
+                    // revoked upstream otherwise just stops growing.
+                    if let Some(error) = crawl.and_then(|crawl| crawl.error.as_deref()) {
+                        ui.label(
+                            theme::Role::Caption
+                                .rich(format!("Last crawl failed: {error}"))
+                                .color(theme::danger()),
+                        );
+                    }
                });

                ui.with_layout(egui::Layout::right_to_left(egui::Align::Center), |ui| {
@@ -73,12 +108,121 @@ fn share_row(ui: &mut egui::Ui, share: &Share, titles: usize, actions: &mut Vec<
                    if ui.button("Crawl").clicked() {
                        actions.push(Action::Crawl(Some(share.id.clone())));
                    }
+                    if ui.button("Rename").clicked() {
+                        form.renaming = Some(share.id.clone());
+                        form.rename_to = share.name.clone();
+                    }
+                    // Not for a folder of the account, which has no link.
+                    if share.folder.is_none()
+                        && ui
+                            .button("Re-enter link")
+                            .on_hover_text(
+                                "For a keyring that lost the link, or a password that changed. \
+                                 The library, history and downloads stay.",
+                            )
+                            .clicked()
+                    {
+                        form.repairing = Some(share.id.clone());
+                        form.repair_url.clear();
+                        form.repair_password.clear();
+                    }
                });
            });
+            if form.repairing.as_deref() == Some(share.id.as_str()) {
+                repair_form(ui, share, form, actions);
+            }
+            if form.renaming.as_deref() == Some(share.id.as_str()) {
+                rename_form(ui, share, form, actions);
+            }
        });
    ui.add_space(theme::space::S);
 }

+/// A new name for a share, in its own row. Enter saves, as everywhere else.
+fn rename_form(ui: &mut egui::Ui, share: &Share, form: &mut ShareForm, actions: &mut Vec<Action>) {
+    ui.add_space(theme::space::M);
+    ui.horizontal(|ui| {
+        let field = ui.add(
+            egui::TextEdit::singleline(&mut form.rename_to)
+                .hint_text("Name")
+                .desired_width(320.0),
+        );
+        let ready = !form.rename_to.trim().is_empty();
+        let entered = field.lost_focus() && ui_enter_pressed(ui.ctx());
+        if ui
+            .add_enabled_ui(ready, |ui| ui::accent_button(ui, "Save"))
+            .inner
+            .clicked()
+            || (ready && entered)
+        {
+            actions.push(Action::RenameShare {
+                id: share.id.clone(),
+                name: form.rename_to.trim().to_owned(),
+            });
+        }
+        if ui.button("Cancel").clicked() {
+            form.renaming = None;
+        }
+    });
+}
+
+/// The same link again, and a password if it has one, for a share already in
+/// the library.
+fn repair_form(ui: &mut egui::Ui, share: &Share, form: &mut ShareForm, actions: &mut Vec<Action>) {
+    ui.add_space(theme::space::M);
+    ui.add(
+        egui::TextEdit::singleline(&mut form.repair_url)
+            .password(true)
+            .hint_text("The share link, including everything after the #")
+            .desired_width(f32::INFINITY),
+    );
+    ui.add_space(theme::space::S);
+    ui.add(
+        egui::TextEdit::singleline(&mut form.repair_password)
+            .password(true)
+            .hint_text("Link password, if it has one")
+            .desired_width(f32::INFINITY),
+    );
+    ui.add_space(theme::space::S);
+    let problem = (!form.repair_url.trim().is_empty())
+        .then(|| pstr_core::shares::share_token(form.repair_url.trim()).err())
+        .flatten();
+    if let Some(problem) = &problem {
+        ui.label(
+            theme::Role::Caption
+                .rich(problem.to_string())
+                .color(theme::danger()),
+        );
+    }
+    ui.horizontal(|ui| {
+        let ready = !form.repair_url.trim().is_empty() && problem.is_none();
+        if ui
+            .add_enabled_ui(ready, |ui| ui::accent_button(ui, "Save"))
+            .inner
+            .clicked()
+        {
+            actions.push(Action::RepairShare {
+                id: share.id.clone(),
+                url: form.repair_url.trim().to_owned(),
+                password: Some(form.repair_password.clone())
+                    .filter(|password| !password.is_empty()),
+            });
+        }
+        if ui.button("Cancel").clicked() {
+            form.repairing = None;
+        }
+    });
+}
+
+/// The add form's link field, which the library's empty state focuses.
+pub fn link_field_id() -> egui::Id {
+    egui::Id::new("share-link")
+}
+
+fn ui_enter_pressed(ctx: &egui::Context) -> bool {
+    ctx.input(|input| input.key_pressed(egui::Key::Enter))
+}
+
 fn add_form(ui: &mut egui::Ui, shares: &[Share], form: &mut ShareForm, actions: &mut Vec<Action>) {
    ui::section(ui, "Add a share");
    ui.label(ui::muted(
@@ -94,24 +238,28 @@ fn add_form(ui: &mut egui::Ui, shares: &[Share], form: &mut ShareForm, actions:
        .show(ui, |ui| {
            ui.set_width(ui.available_width().min(640.0));

-            ui.label(ui::muted("Name"));
-            ui.add(
-                egui::TextEdit::singleline(&mut form.name)
-                    .hint_text("Anime")
-                    .desired_width(f32::INFINITY),
-            );
-            ui.add_space(theme::space::M);
+            // Enter in any field of the form submits it, as the sign-in
+            // form's do.
+            let mut entered = false;
+            let mut submitted_from = |response: egui::Response| {
+                entered |= response.lost_focus() && ui_enter_pressed(&response.ctx);
+            };

            ui.label(ui::muted("Link"));
            ui.horizontal(|ui| {
                let paste = 60.0;
-                let field = egui::Id::new("share-link");
-                ui.add(
-                    egui::TextEdit::singleline(&mut form.url)
-                        .id(field)
-                        .password(true)
-                        .hint_text("https://drive.proton.me/urls/…#…")
-                        .desired_width(ui.available_width() - paste),
+                let field = link_field_id();
+                if std::mem::take(&mut form.focus) {
+                    ui.memory_mut(|memory| memory.request_focus(field));
+                }
+                submitted_from(
+                    ui.add(
+                        egui::TextEdit::singleline(&mut form.url)
+                            .id(field)
+                            .password(true)
+                            .hint_text("https://drive.proton.me/urls/…#…")
+                            .desired_width(ui.available_width() - paste),
+                    ),
                );
                // The link is masked, so pasting is the only sensible way in —
                // and a button says that more plainly than the field does.
@@ -136,20 +284,31 @@ fn add_form(ui: &mut egui::Ui, shares: &[Share], form: &mut ShareForm, actions:
            }
            ui.add_space(theme::space::M);

+            ui.label(ui::muted("Name (optional)"));
+            submitted_from(
+                ui.add(
+                    egui::TextEdit::singleline(&mut form.name)
+                        .hint_text("The shared folder's own name")
+                        .desired_width(f32::INFINITY),
+                ),
+            );
+            ui.add_space(theme::space::M);
+
            ui::widgets::toggle(ui, &mut form.has_password, "The link asks for a password");
            if form.has_password {
                ui.add_space(theme::space::S);
-                ui.add(
-                    egui::TextEdit::singleline(&mut form.password)
-                        .password(true)
-                        .hint_text("Link password")
-                        .desired_width(f32::INFINITY),
+                submitted_from(
+                    ui.add(
+                        egui::TextEdit::singleline(&mut form.password)
+                            .password(true)
+                            .hint_text("Link password")
+                            .desired_width(f32::INFINITY),
+                    ),
                );
            }

            ui.add_space(theme::space::L);
-            let ready = !form.name.trim().is_empty()
-                && !form.url.trim().is_empty()
+            let ready = !form.url.trim().is_empty()
                && problem.is_none()
                && (!form.has_password || !form.password.is_empty())
                && !form.sending;
@@ -159,11 +318,11 @@ fn add_form(ui: &mut egui::Ui, shares: &[Share], form: &mut ShareForm, actions:
                ui.add_space(theme::space::S);
            }
            ui.horizontal(|ui| {
-                if ui
-                    .add_enabled_ui(ready, |ui| ui::accent_button(ui, "Add and crawl"))
+                let clicked = ui
+                    .add_enabled_ui(ready, |ui| ui::accent_button(ui, "Add share"))
                    .inner
-                    .clicked()
-                {
+                    .clicked();
+                if clicked || (ready && entered) {
                    actions.push(Action::AddShare {
                        name: form.name.trim().to_string(),
                        url: form.url.trim().to_string(),
@@ -176,8 +335,8 @@ fn add_form(ui: &mut egui::Ui, shares: &[Share], form: &mut ShareForm, actions:
                if form.sending {
                    ui.add(egui::Spinner::new().size(14.0));
                    ui.label(ui::muted("adding…"));
-                } else if form.name.trim().is_empty() || form.url.trim().is_empty() {
-                    ui.label(ui::muted("A name and a link are needed."));
+                } else if form.url.trim().is_empty() {
+                    ui.label(ui::muted("Paste a share link to add it."));
                }
            });
        });
@@ -211,6 +370,7 @@ mod tests {
            name: "anime".into(),
            token: token.into(),
            has_custom_password: false,
+            folder: None,
        }
    }

@@ -36,6 +36,7 @@ const GROUPS: &[(&str, &[(&str, &str)])] = &[
            ("N  /  P", "Next and previous episode"),
            ("[  /  ]", "Slower and faster"),
            ("S", "Skip the opening or the credits"),
+            ("Z  /  X", "Subtitles 0.1 s earlier and later"),
            ("E", "The list of episodes"),
            ("F  or  double-click", "Fullscreen"),
            ("Esc", "Leave fullscreen, then the player"),
@@ -8,6 +8,7 @@ use crate::app::{Action, Page};
 use crate::engine::{DownloadItem, DownloadKey, DownloadState};
 use crate::playback::PlaybackTarget;
 use crate::theme;
+use crate::ui::widgets::Named;
 use crate::ui::{self, Art, Card};

 pub struct OfflineView<'a> {
@@ -96,6 +97,7 @@ pub fn show(
                )));
                ui.with_layout(egui::Layout::right_to_left(egui::Align::Center), |ui| {
                    season_download(ui, title, season, &offline, actions);
+                    season_watched(ui, title, season, actions);
                });
            });
            ui.add_space(theme::space::L);
@@ -207,6 +209,29 @@ fn back_link(ui: &mut egui::Ui) -> egui::Response {
 }

 /// Download, or delete, a whole season.
+/// Mark a whole season seen, or unseen once it all is — for someone who
+/// watched it elsewhere and joins the show here.
+fn season_watched(ui: &mut egui::Ui, title: &Title, season: &Season, actions: &mut Vec<Action>) {
+    let all = season.episodes.iter().all(|episode| episode.is_watched());
+    let label = if all {
+        "Mark season unwatched"
+    } else {
+        "Mark season watched"
+    };
+    if ui.button(label).clicked() {
+        actions.push(Action::MarkEpisodes {
+            key: title.key.clone(),
+            links: season
+                .episodes
+                .iter()
+                .map(|e| (e.node.share_id.clone(), e.node.link_id.clone()))
+                .collect(),
+            watched: !all,
+            what: format!("{} {}", title.name, season.label()),
+        });
+    }
+}
+
 fn season_download(
    ui: &mut egui::Ui,
    title: &Title,
@@ -222,9 +247,10 @@ fn season_download(
            .on_hover_text("Delete the offline copies; keep the online source")
            .clicked()
        {
-            for key in season_keys {
-                actions.push(Action::RemoveDownload(key, false));
-            }
+            actions.push(Action::DeleteOffline(
+                season_keys,
+                format!("{} {}", title.name, season.label()),
+            ));
        }
    } else if ui
        .button("Download season")
@@ -365,9 +391,7 @@ fn header(
                            .on_hover_text("Delete the offline copies; keep the online source")
                            .clicked()
                        {
-                            for key in title_keys {
-                                actions.push(Action::RemoveDownload(key, false));
-                            }
+                            actions.push(Action::DeleteOffline(title_keys, title.name.clone()));
                        }
                    } else if ui
                        .button("Download show")
@@ -760,14 +784,33 @@ fn episode_row(
            let cluster = egui::vec2(ui.available_width(), STILL.y);
            let layout = egui::Layout::right_to_left(egui::Align::Center);
            ui.allocate_ui_with_layout(cluster, layout, |ui| {
-                if ui::widgets::watched_mark(ui, watched)
-                    .on_hover_text(if watched {
-                        "Mark unwatched"
-                    } else {
-                        "Mark watched"
-                    })
-                    .clicked()
-                {
+                let mark = ui::widgets::watched_mark(ui, watched).on_hover_text(if watched {
+                    "Mark unwatched. Right-click for more."
+                } else {
+                    "Mark watched. Right-click for more."
+                });
+                // Joining a show partway is the usual reason to mark
+                // anything, and one tick per earlier episode is a chore.
+                mark.context_menu(|ui| {
+                    if ui.button("Mark watched up to here").clicked() {
+                        let links = title
+                            .episodes()
+                            .take(
+                                title
+                                    .position_of(&episode.node.share_id, &episode.node.link_id)
+                                    .map_or(0, |at| at + 1),
+                            )
+                            .map(|e| (e.node.share_id.clone(), e.node.link_id.clone()))
+                            .collect();
+                        actions.push(Action::MarkEpisodes {
+                            key: title.key.clone(),
+                            links,
+                            watched: true,
+                            what: format!("{} up to {}", title.name, episode.label()),
+                        });
+                    }
+                });
+                if mark.clicked() {
                    actions.push(Action::SetWatched {
                        share_id: episode.node.share_id.clone(),
                        link_id: episode.node.link_id.clone(),
@@ -836,6 +879,7 @@ pub(crate) fn still(
    actions: &mut Vec<Action>,
 ) {
    let (rect, response) = ui.allocate_exact_size(size, egui::Sense::click());
+    let response = response.named(format!("Play {}", episode.label()));
    if !ui.is_rect_visible(rect) {
        return;
    }
@@ -941,7 +985,7 @@ fn download(
            .on_hover_text("Available offline. Click to delete the copy; the share keeps the file.")
            .clicked()
        {
-            actions.push(Action::RemoveDownload(key, false));
+            actions.push(Action::DeleteOffline(vec![key], episode.label()));
        }
        return;
    }
@@ -9,6 +9,7 @@ use egui::{Align2, Color32, CornerRadius, Sense, Stroke, Vec2};

 use crate::app::Action;
 use crate::theme;
+use crate::ui::widgets::Named;

 /// How long a message stays up.
 const SECONDS: f64 = 5.0;
@@ -52,6 +53,17 @@ impl Toasts {
        self.push_inner(now, text.into(), false, Some((label, action)));
    }

+    /// An error with a button on it — "Retry".
+    pub fn push_error_with(
+        &mut self,
+        now: f64,
+        text: impl Into<String>,
+        label: &'static str,
+        action: Action,
+    ) {
+        self.push_inner(now, text.into(), true, Some((label, action)));
+    }
+
    fn push_inner(
        &mut self,
        now: f64,
@@ -203,7 +215,7 @@ fn card(ui: &mut egui::Ui, toast: &Toast) -> Pressed {
                    [c + Vec2::new(-d, d), c + Vec2::new(d, -d)],
                    Stroke::new(1.5, ink),
                );
-                if response.on_hover_text("Dismiss").clicked() {
+                if response.hint("Dismiss").clicked() {
                    pressed = Pressed::Close;
                }
                if let Some((label, _)) = &toast.action {
@@ -11,12 +11,14 @@
 //! and neither mutates: this module draws.

 use egui::{Color32, CornerRadius, Rect, Sense, Stroke, Vec2, pos2};
+use pstr_core::prefs::SubtitleStyle;
 use pstr_player::{MAX_VOLUME, Track, TrackKind};

 use crate::app::{Action, Adjacent, Page};
 use crate::playback::{Command, Playback};
 use crate::theme;
 use crate::ui;
+use crate::ui::widgets::Named;

 /// Height of the clickable seek bar. Comfortably larger than the few pixels it
 /// draws, because a seek bar you have to aim at is a seek bar nobody uses.
@@ -163,7 +165,7 @@ pub fn mini(
                        egui::StrokeKind::Inside,
                    );
                }
-                if response.on_hover_text("Show the picture again").clicked() {
+                if response.hint("Show the picture again").clicked() {
                    actions.push(Action::Goto(Page::Player));
                }
            }
@@ -313,7 +315,7 @@ fn play_pause(ui: &mut egui::Ui, playback: &Playback, actions: &mut Vec<Action>,
    }

    if response
-        .on_hover_text(if playback.paused {
+        .hint(if playback.paused {
            "Play (Space)"
        } else {
            "Pause (Space)"
@@ -354,7 +356,7 @@ fn step_button(
        enabled,
        egui::Button::new(theme::Role::Subhead.rich(label)).min_size(Vec2::new(38.0, 30.0)),
    );
-    if response.on_hover_text(hover).clicked() {
+    if response.hint(hover).clicked() {
        push(actions);
    }
 }
@@ -436,7 +438,7 @@ fn volume(ui: &mut egui::Ui, playback: &Playback, actions: &mut Vec<Action>) {
    };
    if ui
        .button(theme::Role::Subhead.rich(icon))
-        .on_hover_text(format!("Mute (M) — {:.0}%", playback.volume))
+        .hint(format!("Mute (M) — {:.0}%", playback.volume))
        .clicked()
    {
        actions.push(Action::ToggleMute);
@@ -469,6 +471,8 @@ fn track_menus(ui: &mut egui::Ui, playback: &Playback, actions: &mut Vec<Action>
            }
            ui.separator();
            track_options(ui, &subtitles, TrackKind::Subtitle, actions);
+            ui.separator();
+            subtitle_adjustments(ui, playback, actions);
        })
        .response
        .on_hover_text("Subtitle track");
@@ -488,6 +492,49 @@ fn track_menus(ui: &mut egui::Ui, playback: &Playback, actions: &mut Vec<Action>
    }
 }

+/// What is worth changing mid-episode without a trip to Settings: the size and
+/// place of the line, and its timing for a release that is out of step.
+fn subtitle_adjustments(ui: &mut egui::Ui, playback: &Playback, actions: &mut Vec<Action>) {
+    let mut style = playback.subtitle_style.clone();
+    egui::Grid::new("subtitle-adjustments")
+        .num_columns(2)
+        .spacing([theme::space::M, theme::space::S])
+        .show(ui, |ui| {
+            ui.label("Size");
+            ui::settings::percent_slider(
+                ui,
+                &mut style.scale,
+                SubtitleStyle::MIN_SCALE..=SubtitleStyle::MAX_SCALE,
+            );
+            ui.end_row();
+
+            ui.label("Position");
+            ui::settings::subtitle_position_slider(ui, &mut style.position);
+            ui.end_row();
+
+            ui.label("Delay");
+            ui.horizontal(|ui| {
+                if ui.button("−").on_hover_text("Earlier (Z)").clicked() {
+                    actions.push(Action::NudgeSubtitleDelay(-0.1));
+                }
+                ui.label(ui::format_delay(playback.subtitle_delay));
+                if ui.button("+").on_hover_text("Later (X)").clicked() {
+                    actions.push(Action::NudgeSubtitleDelay(0.1));
+                }
+                if ui
+                    .add_enabled(playback.subtitle_delay != 0.0, egui::Button::new("Reset"))
+                    .clicked()
+                {
+                    actions.push(Action::ResetSubtitleDelay);
+                }
+            });
+            ui.end_row();
+        });
+    if style != playback.subtitle_style {
+        actions.push(Action::SetSubtitleStyle(style.sanitized()));
+    }
+}
+
 fn track_options(ui: &mut egui::Ui, tracks: &[&Track], kind: TrackKind, actions: &mut Vec<Action>) {
    for track in tracks {
        if ui.selectable_label(track.selected, track.label()).clicked() {
@@ -509,7 +556,8 @@ fn speed_menu(ui: &mut egui::Ui, playback: &Playback, actions: &mut Vec<Action>)
        format!("Speed · {}", ui::format_speed(playback.speed))
    };
    ui.menu_button(label, |ui| {
-        for speed in [0.5, 0.75, 1.0, 1.25, 1.5, 1.75, 2.0] {
+        // The same steps `[` and `]` walk.
+        for speed in [0.5, 0.75, 1.0, 1.25, 1.5, 1.75, 2.0, 3.0] {
            if ui
                .selectable_label(
                    (playback.speed - speed).abs() < 1e-6,
@@ -566,6 +614,13 @@ fn seek_bar(ui: &mut egui::Ui, playback: &Playback, actions: &mut Vec<Action>, t
    let width = ui.available_width();
    let (rect, response) =
        ui.allocate_exact_size(Vec2::new(width, SEEK_HIT_HEIGHT), Sense::click_and_drag());
+    response.widget_info(|| {
+        egui::WidgetInfo::slider(
+            playback.duration.is_some(),
+            playback.position,
+            format!("Position, {}", ui::format_time(playback.position)),
+        )
+    });

    let active = response.hovered() || response.dragged();
    // Grows rather than jumps when the pointer arrives.
@@ -8,6 +8,31 @@ use egui::{Color32, CornerRadius, Sense, Stroke, Vec2};

 use crate::theme;

+/// A name for a screen reader, on a control whose face does not say it.
+///
+/// A button drawn as an icon glyph is announced as the icon font's private
+/// code point, and one painted by hand as nothing at all.
+pub trait Named {
+    /// The control's name to a screen reader.
+    fn named(self, name: impl Into<String>) -> Self;
+    /// Hover text that is also the control's name.
+    fn hint(self, text: impl Into<String>) -> Self;
+}
+
+impl Named for egui::Response {
+    fn named(self, name: impl Into<String>) -> Self {
+        let name = name.into();
+        let enabled = self.enabled();
+        self.widget_info(|| egui::WidgetInfo::labeled(egui::WidgetType::Button, enabled, &name));
+        self
+    }
+
+    fn hint(self, text: impl Into<String>) -> Self {
+        let text = text.into();
+        self.named(text.clone()).on_hover_text(text)
+    }
+}
+
 /// An on/off switch with its label beside it, for settings.
 ///
 /// Replaces egui's checkbox, whose unchecked box is drawn in the card colour —
@@ -98,6 +123,9 @@ pub fn toggle(ui: &mut egui::Ui, on: &mut bool, text: &str) -> egui::Response {
 pub fn watched_mark(ui: &mut egui::Ui, watched: bool) -> egui::Response {
    const SIZE: f32 = 20.0;
    let (rect, response) = ui.allocate_exact_size(Vec2::splat(SIZE), Sense::click());
+    response.widget_info(|| {
+        egui::WidgetInfo::selected(egui::WidgetType::Checkbox, true, watched, "Watched")
+    });
    if ui.is_rect_visible(rect) {
        let ctx = ui.ctx();
        let t = ctx.animate_bool_with_time(response.id, watched, theme::motion::STATE);
@@ -278,6 +306,12 @@ pub enum DownloadGlyph {
 pub fn download_button(ui: &mut egui::Ui, glyph: DownloadGlyph) -> egui::Response {
    const SIZE: f32 = 30.0;
    let (rect, response) = ui.allocate_exact_size(Vec2::splat(SIZE), Sense::click());
+    let response = response.named(match glyph {
+        DownloadGlyph::Download => "Download".to_owned(),
+        DownloadGlyph::Progress(done) => format!("Downloading, {:.0}%", done * 100.0),
+        DownloadGlyph::Paused(done) => format!("Download paused, {:.0}%", done * 100.0),
+        DownloadGlyph::Done => "Downloaded".to_owned(),
+    });
    if !ui.is_rect_visible(rect) {
        return response;
    }
@@ -0,0 +1,190 @@
+//! Proton's CAPTCHA, in a window of its own.
+//!
+//! Proton puts a CAPTCHA in front of a sign-in it does not recognise — a new
+//! network, a VPN exit. The page reports success by posting a message to its
+//! host rather than by redirecting, so the system browser has nowhere to send
+//! it back to: it needs a webview this app controls, as on Android and in
+//! `proton-drive-linux`.
+//!
+//! The webview runs in a child process — this same executable, started with
+//! [`ARG`] — because its windowing library and eframe's cannot both own the
+//! event loop of one process. The child prints the solved token on stdout and
+//! exits; closing its window exits with nothing printed, which is a cancel.
+
+use std::io::{Read as _, Write as _};
+
+/// The argument that starts this executable as the verification window,
+/// followed by the page's URL.
+pub const ARG: &str = "--human-verification";
+
+/// Forwards every message the page posts to this process. The page targets
+/// `window.parent`, which for a top-level page is the page itself, so a
+/// listener on its own window hears it.
+const BRIDGE: &str = r#"
+window.addEventListener('message', function (event) {
+    try {
+        window.ipc.postMessage(typeof event.data === 'string' ? event.data : JSON.stringify(event.data));
+    } catch (e) {}
+});
+"#;
+
+/// Run the verification window if this process was started for it, returning
+/// the process's exit code; `None` when it was started as the app.
+pub fn run_if_requested() -> Option<i32> {
+    let mut args = std::env::args().skip(1);
+    if args.next().as_deref() != Some(ARG) {
+        return None;
+    }
+    let Some(url) = args.next().filter(|url| is_proton_page(url)) else {
+        eprintln!("{ARG} needs a verification page on proton.me");
+        return Some(2);
+    };
+    Some(match window(&url) {
+        Ok(()) => 0,
+        Err(error) => {
+            eprintln!("the verification window failed: {error}");
+            1
+        }
+    })
+}
+
+/// Present `url` in the verification window and wait for the token it yields.
+///
+/// `None` when the viewer closed the window, or it could not be shown.
+/// Blocking: call it off the UI thread and outside the async runtime.
+pub fn solve(url: &str) -> Option<String> {
+    let exe = std::env::current_exe()
+        .inspect_err(|error| tracing::warn!("locate this executable: {error}"))
+        .ok()?;
+    let mut child = std::process::Command::new(exe)
+        .arg(ARG)
+        .arg(url)
+        .stdin(std::process::Stdio::null())
+        .stdout(std::process::Stdio::piped())
+        .spawn()
+        .inspect_err(|error| tracing::warn!("open the verification window: {error}"))
+        .ok()?;
+    let mut out = String::new();
+    if let Some(mut stdout) = child.stdout.take() {
+        let _ = stdout.read_to_string(&mut out);
+    }
+    let status = child.wait().ok()?;
+    if !status.success() {
+        tracing::warn!("the verification window exited with {status}");
+        return None;
+    }
+    out.lines()
+        .map(str::trim)
+        .rfind(|line| !line.is_empty())
+        .map(str::to_owned)
+}
+
+fn window(url: &str) -> anyhow::Result<()> {
+    use tao::event::{Event, WindowEvent};
+    use tao::event_loop::{ControlFlow, EventLoopBuilder};
+    use tao::window::WindowBuilder;
+    use wry::{NewWindowResponse, WebViewBuilder};
+
+    let event_loop = EventLoopBuilder::<String>::with_user_event().build();
+    let window = WindowBuilder::new()
+        .with_title("Confirm you are human — Proton Stream")
+        .with_inner_size(tao::dpi::LogicalSize::new(440.0, 680.0))
+        .build(&event_loop)?;
+
+    let proxy = event_loop.create_proxy();
+    let builder = WebViewBuilder::new()
+        .with_url(url)
+        .with_initialization_script(BRIDGE)
+        .with_ipc_handler(move |request| {
+            // Every message the page posts lands here, most of them its own
+            // chatter; only a completion carries a token.
+            if let Some(token) = pstr_core::account::verification_token(request.body()) {
+                let _ = proxy.send_event(token);
+            }
+        })
+        // The bridge above is reachable by whatever the page shows, so the
+        // page stays on Proton.
+        .with_navigation_handler(|url| is_allowed_navigation(&url))
+        .with_new_window_req_handler(|_, _| NewWindowResponse::Deny);
+
+    #[cfg(not(any(target_os = "windows", target_os = "macos")))]
+    let _webview = {
+        use tao::platform::unix::WindowExtUnix as _;
+        use wry::WebViewBuilderExtUnix as _;
+        let vbox = window
+            .default_vbox()
+            .ok_or_else(|| anyhow::anyhow!("the window has no GTK container"))?;
+        builder.build_gtk(vbox)?
+    };
+    #[cfg(any(target_os = "windows", target_os = "macos"))]
+    let _webview = builder.build(&window)?;
+
+    let mut answered = false;
+    event_loop.run(move |event, _, control_flow| {
+        *control_flow = ControlFlow::Wait;
+        match event {
+            Event::UserEvent(token) if !answered => {
+                answered = true;
+                let mut stdout = std::io::stdout().lock();
+                let _ = writeln!(stdout, "{token}");
+                let _ = stdout.flush();
+                *control_flow = ControlFlow::Exit;
+            }
+            Event::WindowEvent {
+                event: WindowEvent::CloseRequested,
+                ..
+            } => *control_flow = ControlFlow::Exit,
+            _ => {}
+        }
+    })
+}
+
+/// Whether `url` is a page of Proton's own, over HTTPS.
+fn is_proton_page(url: &str) -> bool {
+    let Some(rest) = url.strip_prefix("https://") else {
+        return false;
+    };
+    let authority = rest.split(['/', '?', '#']).next().unwrap_or_default();
+    // A user-info part would let `proton.me@evil.example` pass.
+    if authority.contains('@') {
+        return false;
+    }
+    let host = authority.split(':').next().unwrap_or_default();
+    host == "proton.me" || host.ends_with(".proton.me")
+}
+
+/// Whether the webview may go to `url`: Proton's pages, and the documents a
+/// page makes for itself, which have no origin of their own to leave to.
+fn is_allowed_navigation(url: &str) -> bool {
+    is_proton_page(url) || url == "about:blank" || url.starts_with("about:srcdoc")
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn only_proton_pages_over_https_are_proton_pages() {
+        assert!(is_proton_page(
+            "https://verify.proton.me/?embed=1&methods=captcha&token=x"
+        ));
+        assert!(is_proton_page("https://proton.me"));
+        assert!(!is_proton_page("http://verify.proton.me/"));
+        assert!(!is_proton_page("https://proton.me.evil.example/"));
+        assert!(!is_proton_page("https://evilproton.me/"));
+        assert!(!is_proton_page("https://proton.me@evil.example/"));
+        assert!(!is_proton_page(
+            "https://evil.example/?next=https://proton.me"
+        ));
+    }
+
+    #[test]
+    fn the_window_stays_on_proton() {
+        assert!(is_allowed_navigation(
+            "https://verify-api.proton.me/core/v4/captcha"
+        ));
+        assert!(is_allowed_navigation("about:blank"));
+        assert!(!is_allowed_navigation("https://example.com/"));
+        assert!(!is_allowed_navigation("file:///etc/passwd"));
+    }
+}
@@ -23,5 +23,6 @@ tokio.workspace = true
 anyhow.workspace = true
 clap.workspace = true
 rpassword.workspace = true
+parking_lot.workspace = true
 tracing.workspace = true
 tracing-subscriber.workspace = true
@@ -8,9 +8,12 @@
 use anyhow::{Context, Result};
 use clap::{Parser, Subcommand};
 use proton_sdk::ids::{LinkId, NodeUid, VolumeId};
-use pstr_core::catalog::{Catalog, build_rows};
+use pstr_core::account::{PlaceKind, SignIn};
+use pstr_core::catalog::{Catalog, build_rows, build_sidecars};
 use pstr_core::config::AppDirs;
-use pstr_core::{ShareStore, SharedLibrary};
+use pstr_core::shares::AccountFolder;
+use pstr_core::sync::WatchSync;
+use pstr_core::{Account, AccountStore, KeyringSecretStore, ShareStore, SharedLibrary};
 use pstr_player::{EndReason, Player, PlayerConfig, PlayerEvent};
 use pstr_stream::{DiskCacheConfig, LibraryOpener, StreamConfig, StreamSource};

@@ -69,8 +72,38 @@ enum Command {
        #[arg(long)]
        custom_password: bool,
    },
+    /// Add a folder of the signed-in account as a share.
+    ///
+    /// The folder is named by the `VOLUME:LINK` id `browse` prints.
+    AddFolder {
+        /// What to call it in the UI.
+        #[arg(long)]
+        name: String,
+        /// The folder, as `VOLUME:LINK`.
+        folder: String,
+    },
    /// List configured shares.
    Shares,
+    /// Sign in to a Proton account, for watch history across devices and for
+    /// folders of your own Drive.
+    ///
+    /// The password, a second-factor code and a mailbox password are prompted
+    /// for as the account needs them.
+    Login {
+        /// The account's address.
+        username: String,
+    },
+    /// Sign out and forget the stored session.
+    Logout,
+    /// Show which account is signed in.
+    Account,
+    /// List the account's Drive: its top-level places, or one folder.
+    Browse {
+        /// The folder to list, as `VOLUME:LINK`; the places when omitted.
+        folder: Option<String>,
+    },
+    /// Sync watch history with the signed-in account's Drive.
+    Sync,
    /// Forget a share and its stored credentials.
    Remove {
        /// The share id, as printed by `shares`.
@@ -210,6 +243,7 @@ async fn run(runtime: std::sync::Arc<tokio::runtime::Runtime>) -> Result<()> {
    let cli = Cli::parse();
    let dirs = AppDirs::ensure().context("resolve app directories")?;
    let store = ShareStore::new(dirs.clone());
+    let accounts = AccountStore::new(std::sync::Arc::new(KeyringSecretStore));

    match cli.command {
        Command::Add {
@@ -222,12 +256,105 @@ async fn run(runtime: std::sync::Arc<tokio::runtime::Runtime>) -> Result<()> {
            } else {
                None
            };
-            let share = store
-                .add(&name, &url, password.as_deref())
+            let (share, _) = store
+                .add_verified(&name, &url, password.as_deref())
+                .await
                .context("add share")?;
            println!("added {} ({})", share.name, share.id);
        }

+        Command::AddFolder { name, folder } => {
+            let uid = parse_uid(&folder)?;
+            let share = store
+                .add_folder(
+                    &name,
+                    AccountFolder {
+                        volume_id: uid.volume_id.as_str().to_owned(),
+                        link_id: uid.link_id.as_str().to_owned(),
+                    },
+                )
+                .context("add folder")?;
+            println!("added {} ({})", share.name, share.id);
+        }
+
+        Command::Login { username } => login(&accounts, &username).await?,
+
+        Command::Logout => {
+            let account = accounts.resume().ok().flatten();
+            accounts
+                .sign_out(account.as_ref())
+                .await
+                .context("sign out")?;
+            println!("signed out");
+        }
+
+        Command::Account => match accounts.username().context("read the account")? {
+            Some(username) => println!("signed in as {username}"),
+            None => println!("not signed in — sign in with `pstr login <address>`"),
+        },
+
+        Command::Browse { folder } => {
+            let account = signed_in(&accounts)?;
+            match folder {
+                None => {
+                    for place in account.places().await.context("list places")? {
+                        let kind = match place.kind {
+                            PlaceKind::MyFiles => "files",
+                            PlaceKind::Device => "device",
+                            PlaceKind::SharedWithMe => "shared",
+                        };
+                        println!("{}\t{kind}\t{}", format_uid(&place.uid), place.name);
+                    }
+                }
+                Some(folder) => {
+                    let entries = account
+                        .folder_children(&parse_uid(&folder)?)
+                        .await
+                        .context("list folder")?;
+                    for entry in entries {
+                        let kind = if entry.is_folder { "dir" } else { "file" };
+                        println!("{}\t{kind}\t{}", format_uid(&entry.uid), entry.name);
+                    }
+                }
+            }
+        }
+
+        Command::Sync => {
+            let account = signed_in(&accounts)?;
+            let sync = WatchSync::open(&dirs).context("open sync state")?;
+            let catalog =
+                parking_lot::Mutex::new(Catalog::open(&dirs.catalog_db()).context("open catalog")?);
+            let report = sync
+                .sync(&account, &catalog, &store)
+                .await
+                .context("sync")?;
+            let profile = &report.profile;
+            for id in &profile.shares_removed {
+                catalog
+                    .lock()
+                    .remove_share(id)
+                    .context("drop a removed share")?;
+            }
+            println!(
+                "read {} other device(s), took {} newer position(s), \
+                 {} share(s) added, {} removed, settings {}, {}",
+                report.devices,
+                report.applied,
+                profile.shares_added.len() + profile.shares_changed.len(),
+                profile.shares_removed.len(),
+                if profile.settings {
+                    "updated"
+                } else {
+                    "unchanged"
+                },
+                if report.uploaded {
+                    "uploaded this device's history"
+                } else {
+                    "this device's history was already up to date"
+                }
+            );
+        }
+
        Command::Shares => {
            let shares = store.list().context("list shares")?;
            if shares.is_empty() {
@@ -239,17 +366,41 @@ async fn run(runtime: std::sync::Arc<tokio::runtime::Runtime>) -> Result<()> {
                } else {
                    ""
                };
-                println!("{}\t{}{}", share.id, share.name, custom);
+                let kind = if share.folder.is_some() {
+                    " [account folder]"
+                } else {
+                    ""
+                };
+                println!("{}\t{}{}{}", share.id, share.name, custom, kind);
            }
        }

        Command::Remove { id } => {
            store.remove(&id).context("remove share")?;
+            // Its catalog rows go too, or the library keeps listing its files —
+            // beside the new share's, when the same folder was added back
+            // another way.
+            let mut catalog = Catalog::open(&dirs.catalog_db()).context("open catalog")?;
+            let offline = catalog
+                .offline_files_for_share(&id)
+                .context("read the share's downloads")?;
+            for (link_id, file) in &offline {
+                match std::fs::remove_file(dirs.offline_file(&id, link_id, &file.revision_id)) {
+                    Err(error) if error.kind() != std::io::ErrorKind::NotFound => {
+                        return Err(error).context("delete a downloaded file");
+                    }
+                    _ => {}
+                }
+            }
+            catalog
+                .remove_share(&id)
+                .context("drop the share's catalog rows")?;
            println!("removed {id}");
        }

        Command::Crawl { share } => {
-            let (library, failures) = SharedLibrary::open_all(&store)
+            let account = accounts.resume().context("resume the account")?;
+            let (library, failures) = SharedLibrary::open_all(&store, account.as_ref())
                .await
                .context("open shares")?;
            for (share, error) in &failures {
@@ -274,6 +425,9 @@ async fn run(runtime: std::sync::Arc<tokio::runtime::Runtime>) -> Result<()> {

                catalog
                    .replace_share(&share_id, &rows)
+                    .and_then(|()| {
+                        catalog.replace_sidecars(&share_id, &build_sidecars(&share_id, &nodes))
+                    })
                    .with_context(|| format!("store {share_id}"))?;

                println!(
@@ -643,7 +797,10 @@ async fn open_target(

    println!("file:   {} ({})", target.name, target.share_id);

-    let (library, failures) = SharedLibrary::open_all(store)
+    let account = AccountStore::new(std::sync::Arc::new(KeyringSecretStore))
+        .resume()
+        .context("resume the account")?;
+    let (library, failures) = SharedLibrary::open_all(store, account.as_ref())
        .await
        .context("open shares")?;
    for (share, error) in &failures {
@@ -967,7 +1124,74 @@ async fn play(
    Ok(())
 }

-/// Unix seconds, for the "when was this asked" columns.
+/// Walk an interactive sign-in through whatever the account asks for.
+async fn login(accounts: &AccountStore, username: &str) -> Result<()> {
+    let password = read_password("Password: ")?;
+    let mut step = match accounts.sign_in(username, &password, None).await {
+        Ok(step) => step,
+        Err(pstr_core::Error::HumanVerification(challenge)) => {
+            // Solving a CAPTCHA needs a browser engine that can hand the
+            // token back, which a terminal does not have. The desktop app has
+            // one, and keeps its session in the same keyring entry.
+            anyhow::bail!(
+                "Proton wants a CAPTCHA before it accepts this sign-in. Sign in once in the \
+                 desktop app on this computer, which shows it and shares its session with \
+                 pstr, or try again later. ({})",
+                challenge.verification_url()
+            );
+        }
+        Err(error) => return Err(error).context("sign in"),
+    };
+    loop {
+        step = match step {
+            SignIn::Done(account) => {
+                println!("signed in as {}", account.username());
+                return Ok(());
+            }
+            SignIn::SecondFactor(pending) => {
+                // Security keys need WebAuthn, which this sign-in does not speak.
+                let code = read_password("Code from your authenticator app: ")?;
+                pending
+                    .second_factor(&code)
+                    .await
+                    .context("second factor")?
+            }
+            SignIn::MailboxPassword(pending) => {
+                let mailbox = read_password("Mailbox password: ")?;
+                SignIn::Done(
+                    pending
+                        .mailbox_password(&mailbox)
+                        .await
+                        .context("mailbox password")?,
+                )
+            }
+        };
+    }
+}
+
+fn signed_in(accounts: &AccountStore) -> Result<Account> {
+    accounts
+        .resume()
+        .context("resume the account")?
+        .ok_or_else(|| anyhow::anyhow!("not signed in — sign in with `pstr login <address>`"))
+}
+
+/// A node as `browse` prints it and `add-folder` takes it.
+fn format_uid(uid: &NodeUid) -> String {
+    format!("{}:{}", uid.volume_id.as_str(), uid.link_id.as_str())
+}
+
+fn parse_uid(text: &str) -> Result<NodeUid> {
+    let (volume, link) = text
+        .split_once(':')
+        .filter(|(volume, link)| !volume.is_empty() && !link.is_empty())
+        .ok_or_else(|| anyhow::anyhow!("expected VOLUME:LINK, as `pstr browse` prints"))?;
+    Ok(NodeUid::new(
+        VolumeId::new(volume.to_owned()),
+        LinkId::new(link.to_owned()),
+    ))
+}
+
 fn unix_now() -> i64 {
    std::time::SystemTime::now()
        .duration_since(std::time::UNIX_EPOCH)
@@ -20,6 +20,8 @@ tracing.workspace = true
 directories.workspace = true
 rusqlite.workspace = true
 sha2.workspace = true
+parking_lot.workspace = true
+getrandom.workspace = true

 # The credential store, per platform. Without the target's feature `keyring`
 # compiles fine and silently resolves to its in-memory `mock` store, which
@@ -0,0 +1,705 @@
+//! Signing in to a Proton account, and keeping the session.
+//!
+//! The rest of the app works without one — public links need no account. A
+//! signed-in account adds two things: folders of the viewer's own Drive (My
+//! Files, other devices, what was shared with them) as library shares, and
+//! watch history kept in their Drive so every device resumes where another
+//! left off ([`crate::sync`]).
+//!
+//! ## What is kept, and where
+//!
+//! One JSON blob in the [`SecretStore`] holding the session tokens and, per
+//! account key, the passphrase that unlocks it. Those passphrases are derived
+//! at sign-in from the mailbox password and the key salts, and kept *instead*
+//! of the password: they unlock the key chain just the same, but a store that
+//! leaks gives away this app's access to the account rather than the password
+//! — which, on a single-password account, is the login password itself.
+//! Deriving them later is not an option either way: `core/v4/keys/salts`
+//! needs a scope only a password sign-in grants, and answers 403 after the
+//! first token refresh.
+//!
+//! Proton refresh tokens are single-use, so every refresh is written back
+//! (see [`persist_refreshed_tokens`]). A refresh that is not leaves the store
+//! holding a dead token and the next launch signed out.
+//!
+//! ## Signing in is several steps
+//!
+//! Password, then maybe a second-factor code, then — on an account with a
+//! separate mailbox password — that. Each front end asks for them in its own
+//! way, so [`AccountStore::sign_in`] returns a [`SignIn`] saying what it needs
+//! next and holding the half-made session until it is given.
+
+use std::collections::HashMap;
+use std::sync::Arc;
+
+use proton_drive_rs::{NodeKind, ProtonDriveClient};
+use proton_sdk::account::KeyPassphrases;
+use proton_sdk::api::{HumanVerificationCredential, ResponseCode};
+use proton_sdk::error::ProtonError;
+use proton_sdk::ids::NodeUid;
+use proton_sdk::session::{PasswordMode, ProtonApiSession, ResumeParameters};
+use serde::{Deserialize, Serialize};
+
+use crate::error::{Error, Result};
+use crate::shares::{SecretStore, client_configuration};
+
+/// The secret-store key the session is kept under. Share secrets are keyed
+/// `share-…`, so the two cannot collide.
+const SESSION_KEY: &str = "proton-account";
+
+/// Why an account whose only second factor is a security key cannot sign in.
+const SECURITY_KEY_ONLY: &str = "This account's only second factor is a security key, which this \
+     app cannot use yet. Add an authenticator app in your Proton account settings, then sign in \
+     with its code.";
+
+/// Why a sign-in Proton answered with [`ResponseCode::Blocked`] failed. The
+/// server's own text says the app version is no longer supported, which is
+/// not true and sends the viewer looking for an update that does not exist.
+const SIGN_IN_BLOCKED: &str = "Proton has blocked sign-ins from this app for now. Wait a while \
+     and try again, or sign in once on proton.me first.";
+
+/// Blocks in flight for streaming from the account, as for a public link —
+/// see `ShareStore::open`.
+const MAX_INFLIGHT_BLOCKS: usize = 48;
+
+/// Everything needed to resume the session unattended.
+#[derive(Serialize, Deserialize, Clone)]
+struct StoredSession {
+    session_id: String,
+    username: String,
+    user_id: String,
+    access_token: String,
+    refresh_token: String,
+    scopes: Vec<String>,
+    /// `1` single password, `2` separate mailbox password — Proton's values.
+    password_mode: u8,
+    /// Key id → the passphrase that unlocks it. ASCII: they are bcrypt output.
+    key_passphrases: HashMap<String, String>,
+}
+
+impl StoredSession {
+    fn capture(
+        session: &ProtonApiSession,
+        tokens: proton_sdk::http::Tokens,
+        key_passphrases: HashMap<String, String>,
+    ) -> Self {
+        Self {
+            session_id: session.session_id().as_str().to_owned(),
+            username: session.username().to_owned(),
+            user_id: session.user_id().as_str().to_owned(),
+            access_token: tokens.access_token,
+            refresh_token: tokens.refresh_token,
+            scopes: session.scopes().to_vec(),
+            password_mode: match session.password_mode() {
+                PasswordMode::Single => 1,
+                PasswordMode::Dual => 2,
+            },
+            key_passphrases,
+        }
+    }
+
+    fn unlock(&self) -> KeyPassphrases {
+        self.key_passphrases
+            .iter()
+            .map(|(id, passphrase)| (id.as_str(), passphrase.as_bytes()))
+            .collect()
+    }
+
+    fn resume_parameters(&self) -> ResumeParameters {
+        ResumeParameters {
+            session_id: self.session_id.clone().into(),
+            username: self.username.clone(),
+            user_id: self.user_id.clone().into(),
+            access_token: self.access_token.clone(),
+            refresh_token: self.refresh_token.clone(),
+            scopes: self.scopes.clone(),
+            is_waiting_for_second_factor_code: false,
+            password_mode: match self.password_mode {
+                1 => PasswordMode::Single,
+                _ => PasswordMode::Dual,
+            },
+        }
+    }
+}
+
+/// A signed-in account, ready for Drive work.
+///
+/// Cheap to clone; clones share one session and one set of caches.
+#[derive(Clone)]
+pub struct Account {
+    session: ProtonApiSession,
+    drive: ProtonDriveClient,
+}
+
+impl Account {
+    /// The address the viewer signed in with.
+    pub fn username(&self) -> &str {
+        self.session.username()
+    }
+
+    /// The Drive client the account's folders and watch history go through.
+    pub fn drive(&self) -> &ProtonDriveClient {
+        &self.drive
+    }
+
+    /// Where a library folder can come from: My Files, each device, and each
+    /// folder someone shared with the viewer.
+    ///
+    /// The device this app keeps watch history in is left out — it holds
+    /// nothing to watch. A device or share whose name will not decrypt is
+    /// still listed, under a placeholder, rather than hidden: it is the
+    /// viewer's, and they can still open it.
+    pub async fn places(&self) -> Result<Vec<DrivePlace>> {
+        let mut places = Vec::new();
+        let my_files = self.drive.get_my_files_folder().await?;
+        places.push(DrivePlace {
+            kind: PlaceKind::MyFiles,
+            name: "My files".to_owned(),
+            uid: my_files.uid,
+        });
+
+        let mut devices = self.drive.enumerate_devices().await?;
+        devices.sort_by_key(|device| device.creation_time);
+        for device in devices {
+            let name = device.name.unwrap_or_else(|_| "Unnamed device".to_owned());
+            if name == crate::sync::DEVICE_NAME {
+                continue;
+            }
+            places.push(DrivePlace {
+                kind: PlaceKind::Device,
+                name,
+                uid: device.root_folder_uid,
+            });
+        }
+
+        let shared: Vec<NodeUid> = self
+            .drive
+            .enumerate_shared_with_me()
+            .await?
+            .into_iter()
+            .map(|item| item.uid)
+            .collect();
+        if !shared.is_empty() {
+            let mut nodes = self.drive.enumerate_nodes(&shared).await?;
+            nodes.retain(|node| node.is_folder() && !node.trashed);
+            nodes.sort_by_key(|node| node.name.to_lowercase());
+            places.extend(nodes.into_iter().map(|node| DrivePlace {
+                kind: PlaceKind::SharedWithMe,
+                name: node.name,
+                uid: node.uid,
+            }));
+        }
+        Ok(places)
+    }
+
+    /// What one folder of the account holds: folders first, then files, each
+    /// by name. Trashed nodes are left out.
+    pub async fn folder_children(&self, folder: &NodeUid) -> Result<Vec<DriveEntry>> {
+        let uids = self
+            .drive
+            .enumerate_folder_children_node_uids(folder)
+            .await?;
+        if uids.is_empty() {
+            return Ok(Vec::new());
+        }
+        let mut entries: Vec<DriveEntry> = self
+            .drive
+            .enumerate_nodes(&uids)
+            .await?
+            .into_iter()
+            .filter(|node| !node.trashed)
+            .map(|node| {
+                let (size, media_type) = match &node.kind {
+                    NodeKind::File {
+                        media_type,
+                        claimed_size,
+                        ..
+                    } => (*claimed_size, Some(media_type.clone())),
+                    _ => (None, None),
+                };
+                DriveEntry {
+                    is_folder: node.is_folder(),
+                    uid: node.uid,
+                    name: node.name,
+                    size,
+                    media_type,
+                }
+            })
+            .collect();
+        entries.sort_by(|a, b| {
+            b.is_folder
+                .cmp(&a.is_folder)
+                .then_with(|| a.name.to_lowercase().cmp(&b.name.to_lowercase()))
+        });
+        Ok(entries)
+    }
+
+    /// End the session on Proton's side. Best-effort: a session that is
+    /// already dead has nothing to end.
+    async fn end(&self) {
+        if let Err(error) = self.session.end().await {
+            tracing::debug!(%error, "ending the Proton session failed");
+        }
+    }
+}
+
+/// Which kind of place a [`DrivePlace`] is.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum PlaceKind {
+    MyFiles,
+    Device,
+    SharedWithMe,
+}
+
+/// A top-level place in the account's Drive.
+#[derive(Debug, Clone)]
+pub struct DrivePlace {
+    pub kind: PlaceKind,
+    pub name: String,
+    pub uid: NodeUid,
+}
+
+/// One node of a folder listing.
+#[derive(Debug, Clone)]
+pub struct DriveEntry {
+    pub uid: NodeUid,
+    pub name: String,
+    pub is_folder: bool,
+    /// Plaintext size, when the uploader recorded one.
+    pub size: Option<i64>,
+    pub media_type: Option<String>,
+}
+
+/// Where a sign-in stands.
+pub enum SignIn {
+    /// Signed in; the session is stored.
+    Done(Account),
+    /// The account has two-factor authentication: ask for a code and pass it to
+    /// [`PendingSignIn::second_factor`].
+    SecondFactor(PendingSignIn),
+    /// The account has a separate mailbox password: ask for it and pass it to
+    /// [`PendingSignIn::mailbox_password`].
+    MailboxPassword(PendingSignIn),
+}
+
+/// A sign-in waiting on the viewer.
+pub struct PendingSignIn {
+    secrets: Arc<dyn SecretStore>,
+    session: ProtonApiSession,
+    password: String,
+}
+
+impl PendingSignIn {
+    /// Submit a second-factor code.
+    ///
+    /// A wrong code fails here and leaves nothing behind; the front end starts
+    /// the sign-in over, because Proton does not accept a second try on the
+    /// same half-made session.
+    pub async fn second_factor(mut self, code: &str) -> Result<SignIn> {
+        self.session
+            .apply_second_factor_code(code.trim())
+            .await
+            .map_err(|error| match error {
+                ProtonError::Api(api) if (400..500).contains(&api.http_status) => {
+                    Error::SignIn("that code was not accepted".to_owned())
+                }
+                other => other.into(),
+            })?;
+        self.after_second_factor().await
+    }
+
+    /// Submit the mailbox password, on an account that has one.
+    ///
+    /// By reference, unlike the code: a mistyped mailbox password is checked
+    /// on this side, the session survives it, and the viewer can try again
+    /// without starting over.
+    pub async fn mailbox_password(&self, mailbox_password: &str) -> Result<Account> {
+        finish(
+            Arc::clone(&self.secrets),
+            self.session.clone(),
+            mailbox_password,
+        )
+        .await
+    }
+
+    async fn after_second_factor(self) -> Result<SignIn> {
+        if self.session.password_mode() == PasswordMode::Dual {
+            return Ok(SignIn::MailboxPassword(self));
+        }
+        let password = self.password.clone();
+        finish(self.secrets, self.session, &password)
+            .await
+            .map(SignIn::Done)
+    }
+}
+
+/// The signed-in account, if any, and signing in and out.
+#[derive(Clone)]
+pub struct AccountStore {
+    secrets: Arc<dyn SecretStore>,
+}
+
+impl AccountStore {
+    pub fn new(secrets: Arc<dyn SecretStore>) -> Self {
+        Self { secrets }
+    }
+
+    /// The address of the stored account, without touching the network.
+    pub fn username(&self) -> Result<Option<String>> {
+        Ok(self.load()?.map(|stored| stored.username))
+    }
+
+    /// Start signing in.
+    ///
+    /// `verification` is the token from a solved CAPTCHA, after a first try
+    /// failed with [`Error::HumanVerification`]; the sign-in starts over with
+    /// it, because the gated attempt's SRP handshake is spent.
+    pub async fn sign_in(
+        &self,
+        username: &str,
+        password: &str,
+        verification: Option<HumanVerificationCredential>,
+    ) -> Result<SignIn> {
+        let session = ProtonApiSession::begin_verified(
+            client_configuration(),
+            username.trim(),
+            password.as_bytes(),
+            verification.as_ref(),
+        )
+        .await
+        .map_err(classify_sign_in_failure)?;
+        let pending = PendingSignIn {
+            secrets: Arc::clone(&self.secrets),
+            session,
+            password: password.to_owned(),
+        };
+        if pending.session.is_waiting_for_second_factor() {
+            let methods = pending.session.second_factor_methods();
+            if methods.fido2 && !methods.totp {
+                // A security key needs WebAuthn, which this sign-in does not
+                // speak; asking for a code would only fail as a wrong one.
+                pending.session.end().await.ok();
+                return Err(Error::SignIn(SECURITY_KEY_ONLY.to_owned()));
+            }
+            return Ok(SignIn::SecondFactor(pending));
+        }
+        pending.after_second_factor().await
+    }
+
+    /// The stored account, resumed, or `None` when nobody is signed in.
+    ///
+    /// Makes no request: a session whose refresh token has died is found out
+    /// by the first call that uses it, as [`Error::is_signed_out`].
+    pub fn resume(&self) -> Result<Option<Account>> {
+        let Some(stored) = self.load()? else {
+            return Ok(None);
+        };
+        let session = ProtonApiSession::resume(client_configuration(), stored.resume_parameters())?;
+        persist_refreshed_tokens(&self.secrets, &session, stored.key_passphrases.clone());
+        let drive = ProtonDriveClient::with_key_passphrases(&session, stored.unlock());
+        Ok(Some(account(session, drive)))
+    }
+
+    /// Forget the account: end its session and delete what was stored.
+    ///
+    /// The stored session goes even when ending it fails — signing out on a
+    /// plane must still sign out.
+    pub async fn sign_out(&self, account: Option<&Account>) -> Result<()> {
+        if let Some(account) = account {
+            account.end().await;
+        }
+        self.secrets.delete(SESSION_KEY)
+    }
+
+    /// The stored session, or `None` for none — or for one this build cannot
+    /// read, such as the shape development builds before 1.2.0 stored, which
+    /// kept the mailbox password. Signing in again is the only fix for either,
+    /// and it replaces what is there.
+    fn load(&self) -> Result<Option<StoredSession>> {
+        let Some(encoded) = self.secrets.get(SESSION_KEY)? else {
+            return Ok(None);
+        };
+        Ok(serde_json::from_str(&encoded)
+            .inspect_err(|error| {
+                tracing::warn!(%error, "the stored Proton session is unreadable; sign in again");
+            })
+            .ok())
+    }
+}
+
+/// Unlock the key chain with `mailbox_password`, store the session, and hand
+/// back the account.
+///
+/// The key passphrases are derived here, while the token still has the scope
+/// the key salts need. Unlocking the user keys is what proves the mailbox
+/// password: a wrong one unlocks none of them. Only the passphrases are
+/// stored; the password goes no further.
+async fn finish(
+    secrets: Arc<dyn SecretStore>,
+    session: ProtonApiSession,
+    mailbox_password: &str,
+) -> Result<Account> {
+    let probe = ProtonDriveClient::new(&session, mailbox_password.as_bytes().to_vec());
+    probe
+        .account()
+        .unlock()
+        .await
+        .map_err(|error| match error {
+            ProtonError::KeysLocked => {
+                Error::SignIn("that mailbox password did not unlock the account".to_owned())
+            }
+            other => other.into(),
+        })?;
+    let key_passphrases = probe
+        .account()
+        .key_passphrases()
+        .await?
+        .iter()
+        .map(|(id, passphrase)| {
+            std::str::from_utf8(passphrase)
+                .map(|passphrase| (id.to_owned(), passphrase.to_owned()))
+                .map_err(|_| Error::Config("a derived key passphrase is not text".to_owned()))
+        })
+        .collect::<Result<HashMap<_, _>>>()?;
+
+    let stored = StoredSession::capture(
+        &session,
+        session.current_tokens().await,
+        key_passphrases.clone(),
+    );
+    let encoded = serde_json::to_string(&stored)
+        .map_err(|e| Error::Config(format!("serialize the Proton session: {e}")))?;
+    secrets.set(SESSION_KEY, &encoded)?;
+    persist_refreshed_tokens(&secrets, &session, key_passphrases);
+
+    let drive = ProtonDriveClient::with_key_passphrases(&session, stored.unlock());
+    Ok(account(session, drive))
+}
+
+fn account(session: ProtonApiSession, drive: ProtonDriveClient) -> Account {
+    let drive = drive
+        .with_max_inflight_blocks(MAX_INFLIGHT_BLOCKS)
+        // A watch-history file is one small block; the single-request upload
+        // is one failure point where the draft dance is three.
+        .with_small_file_upload(true);
+    Account { session, drive }
+}
+
+/// Write every refreshed token pair back to the secret store.
+///
+/// Refresh tokens are single-use: once the HTTP client has spent the stored
+/// one, only the pair it got back can resume the session.
+fn persist_refreshed_tokens(
+    secrets: &Arc<dyn SecretStore>,
+    session: &ProtonApiSession,
+    key_passphrases: HashMap<String, String>,
+) {
+    let secrets = Arc::clone(secrets);
+    let template = session.clone();
+    session.http().set_on_tokens_refreshed(move |tokens| {
+        let stored = StoredSession::capture(&template, tokens, key_passphrases.clone());
+        let written = serde_json::to_string(&stored)
+            .map_err(|e| Error::Config(e.to_string()))
+            .and_then(|encoded| secrets.set(SESSION_KEY, &encoded));
+        if let Err(error) = written {
+            tracing::warn!(%error, "the refreshed Proton session could not be stored");
+        }
+    });
+}
+
+/// Lift a CAPTCHA gate, a blocked sign-in and a wrong password out of the
+/// generic API error.
+///
+/// Only a gate that can be solved in an app becomes
+/// [`Error::HumanVerification`]; one that wants an e-mail or SMS code is a plain
+/// failure, which reads better than an empty verification page.
+fn classify_sign_in_failure(error: ProtonError) -> Error {
+    if let ProtonError::Api(api) = &error {
+        if let Some(challenge) = api.human_verification()
+            && challenge.supports_captcha()
+        {
+            return Error::HumanVerification(Box::new(challenge));
+        }
+        if api.code == ResponseCode::Blocked {
+            return Error::SignIn(SIGN_IN_BLOCKED.to_owned());
+        }
+        if api.http_status == 422 && !api.is_human_verification_required() {
+            return Error::SignIn(if api.message.is_empty() {
+                "Proton did not accept that address and password".to_owned()
+            } else {
+                api.message.clone()
+            });
+        }
+    }
+    error.into()
+}
+
+/// The token out of a message posted by Proton's verification page, or `None`
+/// for anything that is not a completion.
+///
+/// The page posts plenty besides — resize requests, readiness pings — and
+/// taking an unrecognised message for success would retry the sign-in with a
+/// garbage token. Both spellings of the success type have shipped, and some
+/// hosts hand the message over stringified twice.
+pub fn verification_token(raw: &str) -> Option<String> {
+    let mut value: serde_json::Value = serde_json::from_str(raw).ok()?;
+    if let Some(inner) = value.as_str()
+        && let Ok(parsed) = serde_json::from_str(inner)
+    {
+        value = parsed;
+    }
+    let kind = value.get("type")?.as_str()?;
+    if !matches!(
+        kind,
+        "HUMAN_VERIFICATION_SUCCESS" | "human_verification_success"
+    ) {
+        return None;
+    }
+    let token = value.get("payload")?.get("token")?.as_str()?;
+    (!token.is_empty()).then(|| token.to_owned())
+}
+
+#[cfg(test)]
+mod tests {
+    use std::collections::HashMap;
+
+    use parking_lot::Mutex;
+
+    use super::*;
+
+    #[derive(Default)]
+    struct MemorySecrets(Mutex<HashMap<String, String>>);
+
+    impl SecretStore for MemorySecrets {
+        fn set(&self, key: &str, value: &str) -> Result<()> {
+            self.0.lock().insert(key.to_owned(), value.to_owned());
+            Ok(())
+        }
+        fn get(&self, key: &str) -> Result<Option<String>> {
+            Ok(self.0.lock().get(key).cloned())
+        }
+        fn delete(&self, key: &str) -> Result<()> {
+            self.0.lock().remove(key);
+            Ok(())
+        }
+    }
+
+    fn stored() -> StoredSession {
+        StoredSession {
+            session_id: "session".to_owned(),
+            username: "viewer@proton.me".to_owned(),
+            user_id: "user".to_owned(),
+            access_token: "access".to_owned(),
+            refresh_token: "refresh".to_owned(),
+            scopes: vec!["drive".to_owned()],
+            password_mode: 2,
+            key_passphrases: HashMap::from([("key-1".to_owned(), "derived".to_owned())]),
+        }
+    }
+
+    #[test]
+    fn nobody_is_signed_in_until_a_session_is_stored() {
+        let store = AccountStore::new(Arc::new(MemorySecrets::default()));
+        assert_eq!(store.username().expect("read"), None);
+        assert!(store.resume().expect("resume").is_none());
+    }
+
+    #[test]
+    fn a_stored_session_resumes_as_its_account_without_a_request() {
+        let secrets = Arc::new(MemorySecrets::default());
+        secrets
+            .set(SESSION_KEY, &serde_json::to_string(&stored()).unwrap())
+            .unwrap();
+        let store = AccountStore::new(secrets);
+        assert_eq!(
+            store.username().expect("read").as_deref(),
+            Some("viewer@proton.me")
+        );
+        let account = store.resume().expect("resume").expect("signed in");
+        assert_eq!(account.username(), "viewer@proton.me");
+    }
+
+    #[tokio::test]
+    async fn signing_out_forgets_the_stored_session() {
+        let secrets = Arc::new(MemorySecrets::default());
+        secrets
+            .set(SESSION_KEY, &serde_json::to_string(&stored()).unwrap())
+            .unwrap();
+        let store = AccountStore::new(secrets);
+        store.sign_out(None).await.expect("sign out");
+        assert_eq!(store.username().expect("read"), None);
+    }
+
+    #[test]
+    fn the_stored_session_holds_no_password() {
+        let encoded = serde_json::to_string(&stored()).unwrap();
+        assert!(!encoded.contains("password\""), "{encoded}");
+        assert!(!encoded.contains("key_salts"), "{encoded}");
+    }
+
+    #[test]
+    fn a_session_stored_by_an_older_build_reads_as_signed_out() {
+        let secrets = Arc::new(MemorySecrets::default());
+        secrets
+            .set(
+                SESSION_KEY,
+                r#"{"session_id":"s","username":"u","user_id":"i","access_token":"a",
+                    "refresh_token":"r","scopes":[],"password_mode":1,
+                    "mailbox_password":"hunter2","key_salts":[]}"#,
+            )
+            .unwrap();
+        let store = AccountStore::new(secrets);
+        assert_eq!(store.username().expect("read"), None);
+        assert!(store.resume().expect("resume").is_none());
+    }
+
+    #[test]
+    fn a_stored_session_unlocks_with_its_passphrases() {
+        let unlock = stored().unlock();
+        assert_eq!(unlock.len(), 1);
+        assert_eq!(unlock.get("key-1"), Some(b"derived".as_slice()));
+    }
+
+    #[test]
+    fn a_blocked_sign_in_does_not_claim_the_app_is_outdated() {
+        let error = classify_sign_in_failure(ProtonError::Api(proton_sdk::error::ProtonApiError {
+            code: ResponseCode::Blocked,
+            http_status: 422,
+            message: "This version of the app is no longer supported".to_owned(),
+            details: None,
+        }));
+        assert!(
+            matches!(&error, Error::SignIn(text) if text == SIGN_IN_BLOCKED),
+            "{error}"
+        );
+    }
+
+    #[test]
+    fn a_stored_session_keeps_its_password_mode() {
+        let params = stored().resume_parameters();
+        assert_eq!(params.password_mode, PasswordMode::Dual);
+        assert!(!params.is_waiting_for_second_factor_code);
+    }
+
+    #[test]
+    fn a_verification_completion_yields_its_token() {
+        let raw =
+            r#"{"type":"HUMAN_VERIFICATION_SUCCESS","payload":{"token":"tok-1","type":"captcha"}}"#;
+        assert_eq!(verification_token(raw).as_deref(), Some("tok-1"));
+        let twice = r#""{\"type\":\"HUMAN_VERIFICATION_SUCCESS\",\"payload\":{\"token\":\"tok-1\",\"type\":\"captcha\"}}""#;
+        assert_eq!(verification_token(twice).as_deref(), Some("tok-1"));
+    }
+
+    #[test]
+    fn messages_that_are_not_a_verification_completion_are_ignored() {
+        for raw in [
+            r#"{"type":"resize","payload":{"height":400}}"#,
+            r#"{"type":"HUMAN_VERIFICATION_SUCCESS"}"#,
+            r#"{"type":"HUMAN_VERIFICATION_SUCCESS","payload":{"token":""}}"#,
+            "not json",
+            "",
+        ] {
+            assert!(verification_token(raw).is_none(), "accepted: {raw}");
+        }
+    }
+}
@@ -7,11 +7,13 @@

 use std::collections::{HashMap, HashSet};

-use crate::library::{Library, Title, sort_name};
+use crate::catalog::CatalogNode;
+use crate::library::{Library, Title, TitleKind, sort_name};
 use crate::metadata::{MetadataRecord, TitleNames};

 /// What order a grid is in.
-#[derive(Debug, Clone, Copy, PartialEq, Eq, Default)]
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Default, serde::Serialize, serde::Deserialize)]
+#[serde(rename_all = "snake_case")]
 pub enum Sort {
    /// By the name shown, ignoring a leading article.
    #[default]
@@ -50,6 +52,60 @@ impl Sort {
    }
 }

+/// Which titles a grid shows.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Default, serde::Serialize, serde::Deserialize)]
+#[serde(rename_all = "snake_case")]
+pub enum Filter {
+    #[default]
+    All,
+    Series,
+    Films,
+    /// Started and not finished.
+    Watching,
+    /// Not started.
+    Unwatched,
+    /// With at least one episode kept on this device.
+    Downloaded,
+}
+
+impl Filter {
+    pub const ALL: [Self; 6] = [
+        Self::All,
+        Self::Series,
+        Self::Films,
+        Self::Watching,
+        Self::Unwatched,
+        Self::Downloaded,
+    ];
+
+    pub fn label(self) -> &'static str {
+        match self {
+            Self::All => "All",
+            Self::Series => "Series",
+            Self::Films => "Films",
+            Self::Watching => "Watching",
+            Self::Unwatched => "Not started",
+            Self::Downloaded => "Downloaded",
+        }
+    }
+
+    /// Whether the grid shows `title`. `offline` says whether a file is kept
+    /// on this device, which only the front end knows.
+    pub fn admits(self, title: &Title, offline: impl Fn(&CatalogNode) -> bool) -> bool {
+        let watched = title.watched_count();
+        match self {
+            Self::All => true,
+            Self::Series => title.kind == TitleKind::Series,
+            Self::Films => title.kind == TitleKind::Film,
+            Self::Watching => {
+                title.resume().is_some() || (watched > 0 && watched < title.episode_count())
+            }
+            Self::Unwatched => watched == 0 && title.resume().is_none(),
+            Self::Downloaded => title.episodes().any(|episode| offline(&episode.node)),
+        }
+    }
+}
+
 /// The name to show for `title`: the provider's, in the form the viewer
 /// picked, else the share's.
 pub fn display_name<'a>(
@@ -392,4 +448,44 @@ mod tests {
        assert_eq!(found[0].key, "sousou no frieren");
        assert_eq!(search(&library, &metadata, "").len(), 3);
    }
+
+    #[test]
+    fn the_filters_split_the_library_by_kind_and_progress() {
+        let film = title("f", "Film", TitleKind::Film);
+        let series = title("s", "Series", TitleKind::Series);
+        let none = |_: &CatalogNode| false;
+        assert!(Filter::All.admits(&film, none) && Filter::All.admits(&series, none));
+        assert!(Filter::Films.admits(&film, none) && !Filter::Films.admits(&series, none));
+        assert!(Filter::Series.admits(&series, none) && !Filter::Series.admits(&film, none));
+        // Nothing watched of either: not started, and not being watched.
+        assert!(Filter::Unwatched.admits(&film, none));
+        assert!(!Filter::Watching.admits(&film, none));
+    }
+
+    #[test]
+    fn the_downloaded_filter_admits_a_title_with_any_episode_kept_offline() {
+        let node = |link: &str, episode| CatalogNode {
+            share_id: "s".into(),
+            link_id: link.into(),
+            volume_id: "v".into(),
+            parent_link_id: None,
+            name: format!("Show - S01E0{episode}.mkv"),
+            is_folder: false,
+            media_type: Some("video/x-matroska".into()),
+            size: Some(1),
+            active_revision_id: Some("r".into()),
+            parsed: crate::naming::ParsedName {
+                title: "Show".into(),
+                season: Some(1),
+                episode: Some(episode),
+                year: None,
+                episode_title: None,
+            },
+        };
+        let library = Library::build(vec![node("a", 1), node("b", 2)], &HashMap::new());
+        let show = &library.titles[0];
+
+        assert!(Filter::Downloaded.admits(show, |node| node.link_id == "b"));
+        assert!(!Filter::Downloaded.admits(show, |_| false));
+    }
 }
@@ -88,6 +88,12 @@ impl AppDirs {
        self.config.join("shares.json")
    }

+    /// This installation's identity for watch-history sync. See
+    /// [`crate::sync`].
+    pub fn sync_file(&self) -> PathBuf {
+        self.config.join("sync.json")
+    }
+
    /// The catalog database.
    pub fn catalog_db(&self) -> PathBuf {
        self.data.join("catalog.db")
@@ -30,6 +30,75 @@ pub enum Error {
    /// The caller asked for something that does not exist or does not apply.
    #[error("{0}")]
    NotFound(String),
+
+    /// Proton gated a sign-in behind a CAPTCHA. The front end presents
+    /// [`HumanVerification::verification_url`](proton_sdk::api::HumanVerification::verification_url)
+    /// and signs in again with the token it yields.
+    #[error("Proton wants to confirm you are human before signing in")]
+    HumanVerification(Box<proton_sdk::api::HumanVerification>),
+
+    /// No account is signed in, or its session can no longer be refreshed and
+    /// the viewer has to sign in again.
+    #[error("{0}")]
+    SignedOut(String),
+
+    /// Signing in failed for a reason the viewer can act on, such as a wrong
+    /// mailbox password.
+    #[error("{0}")]
+    SignIn(String),
+
+    /// A public link with a password of its own was opened without one. The
+    /// handshake refusal says nothing a viewer can act on; this does.
+    #[error("This link has a password of its own. Enter it to add the link.")]
+    PasswordNeeded,
+}
+
+impl Error {
+    /// The message, followed by every cause its own text leaves out.
+    ///
+    /// A dropped connection reads as reqwest's "error sending request for url
+    /// (…)" and nothing else: why — a reset, a DNS failure, a certificate — is
+    /// further down the source chain. That is the part a viewer reporting a
+    /// failed crawl needs, so the URL, which only says which folder, is left
+    /// out to keep it on screen.
+    pub fn describe(&self) -> String {
+        let mut text = match self {
+            Self::Drive(proton_sdk::error::ProtonError::Transport(error)) => {
+                let url = error.url().map(|url| format!(" for url ({url})"));
+                let own = self.to_string();
+                url.map_or_else(|| own.clone(), |url| own.replace(&url, ""))
+            }
+            _ => self.to_string(),
+        };
+        let mut seen = self.to_string();
+        let mut source = std::error::Error::source(self);
+        while let Some(cause) = source {
+            let line = cause.to_string();
+            if !seen.contains(&line) {
+                text.push_str(": ");
+                text.push_str(&line);
+                seen.push_str(&line);
+            }
+            source = cause.source();
+        }
+        text
+    }
+
+    /// Whether this is the account's session having ended: the refresh token
+    /// was revoked or expired, the token lacks a scope only a password
+    /// sign-in grants, or the stored key passphrases no longer unlock the
+    /// account because its mailbox password changed. Nothing but signing in
+    /// again fixes it.
+    pub fn is_signed_out(&self) -> bool {
+        match self {
+            Self::SignedOut(_) => true,
+            Self::Drive(proton_sdk::error::ProtonError::KeysLocked) => true,
+            Self::Drive(proton_sdk::error::ProtonError::Api(api)) => {
+                api.is_invalid_refresh_token() || api.is_insufficient_scope()
+            }
+            _ => false,
+        }
+    }
 }

 #[cfg(not(target_os = "android"))]
@@ -40,3 +109,31 @@ impl From<keyring::Error> for Error {
 }

 pub type Result<T> = std::result::Result<T, Error>;
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[derive(Debug, thiserror::Error)]
+    #[error("connection closed before message completed")]
+    struct Closed;
+
+    #[derive(Debug, thiserror::Error)]
+    #[error("client error (SendRequest)")]
+    struct SendRequest(#[source] Closed);
+
+    #[test]
+    fn a_failure_is_described_with_the_causes_its_own_text_leaves_out() {
+        let error = Error::Io(std::io::Error::other(SendRequest(Closed)));
+        assert_eq!(
+            error.describe(),
+            "io: client error (SendRequest): connection closed before message completed"
+        );
+    }
+
+    #[test]
+    fn stored_passphrases_that_no_longer_unlock_mean_signed_out() {
+        let error = Error::Drive(proton_sdk::error::ProtonError::KeysLocked);
+        assert!(error.is_signed_out());
+    }
+}
@@ -0,0 +1,126 @@
+//! Language tags: what a container or a file name calls a language, and what a
+//! viewer calls it.
+
+/// The languages offered by name where a preference is chosen ahead of any
+/// file, as the three-letter tag a Matroska file carries. The same list
+/// [`language_name`] knows, and the phones' `LANGUAGES`; mpv treats the two-
+/// and three-letter forms as one.
+pub const LANGUAGES: [&str; 29] = [
+    "jpn", "eng", "ger", "fre", "spa", "ita", "por", "dut", "rus", "pol", "swe", "dan", "nor",
+    "fin", "cze", "hun", "tur", "ara", "heb", "hin", "kor", "chi", "tha", "vie", "ukr", "rum",
+    "gre", "ind", "may",
+];
+
+/// Each language's name and the tags it goes by, the [`LANGUAGES`] form first.
+///
+/// Deliberately a short list rather than a full ISO 639 table: it covers what
+/// the shares this app is pointed at actually contain, and an unrecognised tag
+/// still shows as something a viewer can pick between — `"por-BR"` reads fine
+/// on its own.
+const TABLE: [(&str, &[&str]); 29] = [
+    ("English", &["eng", "en"]),
+    ("Japanese", &["jpn", "ja"]),
+    ("German", &["ger", "de", "deu"]),
+    ("French", &["fre", "fr", "fra"]),
+    ("Spanish", &["spa", "es"]),
+    ("Italian", &["ita", "it"]),
+    ("Portuguese", &["por", "pt"]),
+    ("Dutch", &["dut", "nl", "nld"]),
+    ("Russian", &["rus", "ru"]),
+    ("Polish", &["pol", "pl"]),
+    ("Swedish", &["swe", "sv"]),
+    ("Danish", &["dan", "da"]),
+    ("Norwegian", &["nor", "no"]),
+    ("Finnish", &["fin", "fi"]),
+    ("Czech", &["cze", "cs", "ces"]),
+    ("Hungarian", &["hun", "hu"]),
+    ("Turkish", &["tur", "tr"]),
+    ("Arabic", &["ara", "ar"]),
+    ("Hebrew", &["heb", "he"]),
+    ("Hindi", &["hin", "hi"]),
+    ("Korean", &["kor", "ko"]),
+    ("Chinese", &["chi", "zh", "zho"]),
+    ("Thai", &["tha", "th"]),
+    ("Vietnamese", &["vie", "vi"]),
+    ("Ukrainian", &["ukr", "uk"]),
+    ("Romanian", &["rum", "ro", "ron"]),
+    ("Greek", &["gre", "el", "ell"]),
+    ("Indonesian", &["ind", "id"]),
+    ("Malay", &["may", "ms", "msa"]),
+];
+
+/// A readable name for a language tag, falling back to the tag itself.
+pub fn language_name(tag: &str) -> String {
+    // Container tags come in both the two- and three-letter forms, and often
+    // with a region suffix: "en", "eng", "en-US", "pt-BR".
+    let base = tag.split(['-', '_']).next().unwrap_or(tag);
+    let Some((name, _)) = TABLE
+        .iter()
+        .find(|(_, tags)| tags.iter().any(|known| known.eq_ignore_ascii_case(base)))
+    else {
+        return tag.to_string();
+    };
+
+    // The region matters when there is one — Brazilian Portuguese is not
+    // Portuguese to anyone choosing between the two.
+    match tag.split_once(['-', '_']) {
+        Some((_, region)) if !region.is_empty() => {
+            format!("{name} ({})", region.to_ascii_uppercase())
+        }
+        _ => (*name).to_string(),
+    }
+}
+
+/// Whether two container tags name the same language: "en" and "eng" do.
+pub fn same_language(a: &str, b: &str) -> bool {
+    a.eq_ignore_ascii_case(b) || language_name(a) == language_name(b)
+}
+
+/// The [`LANGUAGES`] tag for one word of a file name, if it names a language:
+/// "en", "eng" and "English" are all `"eng"`.
+///
+/// For the words around a subtitle file's name — `Episode 01.en.srt`,
+/// `2_English.srt` — where a two-letter word is far more often a language than
+/// anything else.
+pub fn language_tag(word: &str) -> Option<&'static str> {
+    TABLE
+        .iter()
+        .find(|(name, tags)| {
+            name.eq_ignore_ascii_case(word) || tags.iter().any(|tag| tag.eq_ignore_ascii_case(word))
+        })
+        .map(|(_, tags)| tags[0])
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn language_tags_resolve_in_both_iso_forms_and_keep_their_region() {
+        assert_eq!(language_name("jpn"), "Japanese");
+        assert_eq!(language_name("ja"), "Japanese");
+        assert_eq!(language_name("pt-BR"), "Portuguese (BR)");
+        // An unknown tag is shown as it stands rather than as "Unknown", which
+        // would make two of them indistinguishable.
+        assert_eq!(language_name("mis"), "mis");
+    }
+
+    #[test]
+    fn a_language_named_by_either_tag_or_by_its_name_has_the_tag_a_preference_uses() {
+        assert_eq!(language_tag("en"), Some("eng"));
+        assert_eq!(language_tag("ENG"), Some("eng"));
+        assert_eq!(language_tag("German"), Some("ger"));
+        assert_eq!(language_tag("deu"), Some("ger"));
+        assert_eq!(language_tag("forced"), None);
+    }
+
+    #[test]
+    fn every_language_offered_by_name_is_one_the_table_knows() {
+        let firsts: Vec<&str> = TABLE.iter().map(|(_, tags)| tags[0]).collect();
+        let mut offered = LANGUAGES.to_vec();
+        let mut known = firsts.clone();
+        offered.sort_unstable();
+        known.sort_unstable();
+        assert_eq!(offered, known);
+    }
+}
@@ -5,6 +5,7 @@
 //! how a share is opened and how its contents are modelled.
 #![forbid(unsafe_code)]

+pub mod account;
 pub mod appearance;
 pub mod browse;
 pub mod catalog;
@@ -12,17 +13,22 @@ pub mod chapters;
 pub mod config;
 pub mod error;
 pub mod franchise;
+pub mod language;
 pub mod library;
 pub mod metadata;
 pub mod naming;
 pub mod prefs;
+pub mod profile;
 pub mod shares;
 pub mod shelves;
+pub mod subtitles;
+pub mod sync;

+pub use account::{Account, AccountStore};
 pub use error::{Error, Result};
 #[cfg(not(target_os = "android"))]
 pub use shares::KeyringSecretStore;
-pub use shares::{SecretStore, Share, ShareStore, SharedLibrary};
+pub use shares::{SecretStore, Share, ShareClient, ShareStore, SharedLibrary};

 pub use proton_drive_rs;
 pub use proton_sdk;
@@ -189,10 +189,44 @@ impl Title {
            .max_by_key(|episode| episode.last_played())
    }

-    /// What a click on the poster should play: whatever is part-watched, else
-    /// the first unwatched episode, else the first episode.
+    /// What Continue watching offers for this title: the part-watched episode,
+    /// or the one after the episode finished last.
+    ///
+    /// Read off whichever episode was touched last. Finishing an episode is
+    /// the most ordinary moment to want the next, and a shelf that dropped the
+    /// show right then was missing its point. An episode reset to the start —
+    /// which is what leaving Continue watching does — says the viewer is done
+    /// with it, so the title is left out. One opened for a few seconds says
+    /// nothing either way and is passed over.
+    pub fn continue_with(&self) -> Option<&Episode> {
+        let latest = self
+            .episodes()
+            .filter(|episode| {
+                episode.watch.is_some_and(|watch| {
+                    watch.position_secs == 0.0
+                        || watch.position_secs >= RESUME_FLOOR_SECS
+                        || episode.is_watched()
+                })
+            })
+            .max_by_key(|episode| episode.last_played())?;
+        if latest.resume_at().is_some() {
+            return Some(latest);
+        }
+        if !latest.is_watched() {
+            return None;
+        }
+        let at = self.position_of(&latest.node.share_id, &latest.node.link_id)?;
+        self.episodes()
+            .skip(at + 1)
+            .find(|episode| !episode.is_watched())
+    }
+
+    /// What a click on the poster should play: what Continue watching offers,
+    /// else whatever is part-watched, else the first unwatched episode, else
+    /// the first episode.
    pub fn next_up(&self) -> Option<&Episode> {
-        self.resume()
+        self.continue_with()
+            .or_else(|| self.resume())
            .or_else(|| self.episodes().find(|episode| !episode.is_watched()))
            .or_else(|| self.episodes().next())
    }
@@ -357,13 +391,13 @@ impl Library {
        self.titles.iter().find(|title| title.key == key)
    }

-    /// Titles with something part-watched, most recent first. The top row of
-    /// the library.
+    /// Titles with something to go on with — see [`Title::continue_with`] —
+    /// most recent first. The top row of the library.
    pub fn continue_watching(&self) -> Vec<&Title> {
        let mut titles: Vec<&Title> = self
            .titles
            .iter()
-            .filter(|title| title.resume().is_some())
+            .filter(|title| title.continue_with().is_some())
            .collect();
        titles.sort_by_key(|title| std::cmp::Reverse(title.last_played()));
        titles
@@ -688,6 +722,64 @@ mod tests {
        assert_eq!(library.continue_watching().len(), 1);
    }

+    fn three_episodes() -> Vec<CatalogNode> {
+        vec![
+            node("s", "1", "Show - S01E01", Some(1), Some(1)),
+            node("s", "2", "Show - S01E02", Some(1), Some(2)),
+            node("s", "3", "Show - S01E03", Some(1), Some(3)),
+        ]
+    }
+
+    #[test]
+    fn a_finished_episode_puts_the_next_one_in_continue_watching() {
+        let mut states = HashMap::new();
+        states.insert(("s".into(), "1".into()), watch(1440.0, 1440.0, true, 10));
+        let library = Library::build(three_episodes(), &states);
+        let next = library.titles[0].continue_with().unwrap();
+        assert_eq!(next.node.link_id, "2");
+        assert_eq!(next.resume_at(), None);
+        assert_eq!(library.continue_watching().len(), 1);
+    }
+
+    #[test]
+    fn a_finished_last_episode_leaves_continue_watching() {
+        let mut states = HashMap::new();
+        for link in ["1", "2", "3"] {
+            states.insert(("s".into(), link.into()), watch(1440.0, 1440.0, true, 10));
+        }
+        let library = Library::build(three_episodes(), &states);
+        assert!(library.continue_watching().is_empty());
+    }
+
+    /// Leaving Continue watching resets the episode to the start. Offering the
+    /// one after the last finished episode instead would bring the title
+    /// straight back.
+    #[test]
+    fn an_episode_reset_to_the_start_keeps_its_title_out_of_continue_watching() {
+        let mut states = HashMap::new();
+        states.insert(("s".into(), "1".into()), watch(1440.0, 1440.0, true, 10));
+        states.insert(("s".into(), "2".into()), watch(0.0, 1440.0, false, 20));
+        let library = Library::build(three_episodes(), &states);
+        assert!(library.continue_watching().is_empty());
+    }
+
+    #[test]
+    fn a_few_seconds_of_the_next_episode_do_not_hide_the_one_part_watched() {
+        let mut states = HashMap::new();
+        states.insert(("s".into(), "1".into()), watch(700.0, 1440.0, false, 10));
+        states.insert(("s".into(), "2".into()), watch(4.0, 1440.0, false, 20));
+        let library = Library::build(three_episodes(), &states);
+        assert_eq!(library.titles[0].continue_with().unwrap().node.link_id, "1");
+    }
+
+    #[test]
+    fn the_episode_after_the_finished_one_is_offered_past_an_older_unwatched_one() {
+        let mut states = HashMap::new();
+        states.insert(("s".into(), "2".into()), watch(1440.0, 1440.0, true, 10));
+        let library = Library::build(three_episodes(), &states);
+        assert_eq!(library.titles[0].continue_with().unwrap().node.link_id, "3");
+    }
+
    #[test]
    fn a_watch_state_set_in_place_matches_a_rebuild() {
        let nodes = vec![
@@ -539,6 +539,9 @@ fn find_dash_numbering(text: &str) -> Option<NumberingMatch> {
        if is_token_char(tail) && tail != Some(b'v') {
            continue;
        }
+        if is_decimal_tail(text, after) {
+            continue;
+        }
        found = Some(NumberingMatch {
            numbering: Numbering {
                season: None,
@@ -551,6 +554,24 @@ fn find_dash_numbering(text: &str) -> Option<NumberingMatch> {
    found
 }

+/// Whether the number that ended at `at` goes on as a decimal: `.11` in
+/// `Evangelion - 1.11 You Are (Not) Alone`, `.0` in `3.0+1.01`.
+///
+/// That is a version of a film, not episode 1 of anything, and reading it as
+/// one turns a folder of four films into a series of episodes 1, 2, 3 and 3.
+/// One or two digits only: `- 05.1080p` is episode 5 and a resolution.
+fn is_decimal_tail(text: &str, at: usize) -> bool {
+    let bytes = text.as_bytes();
+    if bytes.get(at) != Some(&b'.') {
+        return false;
+    }
+    let digits = bytes[at + 1..]
+        .iter()
+        .take_while(|byte| byte.is_ascii_digit())
+        .count();
+    (1..=2).contains(&digits) && !is_token_char(bytes.get(at + 1 + digits).copied())
+}
+
 /// Step over an `E` / `EP` episode marker and any separator after it.
 ///
 /// Returns `at` unchanged when there is none, so a bare number and a marked one
@@ -630,9 +651,18 @@ fn is_token_start(text: &str, at: usize) -> bool {
 /// Normalize the title span: separators to spaces, then trim the debris that
 /// sits between the title and whatever followed it.
 fn clean_title(raw: &str, year: Option<u32>) -> String {
+    // A dot between two digits is a decimal point, not a separator: `1.11`
+    // is the film's name, `1 11` is two numbers.
+    let bytes = raw.as_bytes();
    let mut text: String = raw
-        .chars()
-        .map(|c| match c {
+        .char_indices()
+        .map(|(at, c)| match c {
+            '.' if at > 0
+                && bytes[at - 1].is_ascii_digit()
+                && bytes.get(at + 1).is_some_and(u8::is_ascii_digit) =>
+            {
+                '.'
+            }
            '.' | '_' => ' ',
            other => other,
        })
@@ -813,6 +843,15 @@ pub fn is_video_file(name: &str) -> bool {
        .is_some_and(|(_, ext)| VIDEO_EXTENSIONS.contains(&ext.to_ascii_lowercase().as_str()))
 }

+/// Subtitle formats mpv reads from a file of their own.
+const SUBTITLE_EXTENSIONS: &[&str] = &["srt", "ass", "ssa", "vtt"];
+
+/// Whether a filename names a subtitle file a video can be paired with.
+pub fn is_subtitle_file(name: &str) -> bool {
+    name.rsplit_once('.')
+        .is_some_and(|(_, ext)| SUBTITLE_EXTENSIONS.contains(&ext.to_ascii_lowercase().as_str()))
+}
+
 #[cfg(test)]
 mod tests {
    use super::*;
@@ -847,6 +886,46 @@ mod tests {
        );
    }

+    /// **What the four Rebuild of Evangelion films parsed as.** ` - 1.11` read
+    /// as episode 1, so the folder became a series of episodes 1, 2, 3 and 3.
+    /// A decimal is a version of the film, and the name keeps it.
+    #[test]
+    fn a_decimal_after_the_dash_is_part_of_a_films_name_not_an_episode() {
+        assert_eq!(
+            parsed("Evangelion - 1.11 You Are (Not) Alone.mkv"),
+            ("Evangelion - 1.11 You Are Alone".into(), None, None, None)
+        );
+        assert_eq!(
+            parsed("Evangelion - 3.0+1.01 Thrice Upon a Time.mkv"),
+            (
+                "Evangelion - 3.0+1.01 Thrice Upon a Time".into(),
+                None,
+                None,
+                None
+            )
+        );
+    }
+
+    /// A recap numbered between two episodes is not a second copy of the one
+    /// before it.
+    #[test]
+    fn a_half_episode_is_not_the_episode_before_it() {
+        assert_eq!(
+            parsed("[Group] Show Name - 12.5 [1080p].mkv"),
+            ("Show Name - 12.5".into(), None, None, None)
+        );
+    }
+
+    /// The decimal rule stops at two digits, so a resolution glued on with a
+    /// dot leaves the episode number alone.
+    #[test]
+    fn a_resolution_after_a_dot_does_not_hide_the_episode() {
+        assert_eq!(
+            parsed("Show Name - 05.1080p.mkv"),
+            ("Show Name".into(), None, Some(5), None)
+        );
+    }
+
    /// A version suffix still names the same episode.
    #[test]
    fn a_versioned_fansub_episode_keeps_its_number() {
@@ -60,6 +60,211 @@ pub struct PlaybackPrefs {
    /// everything at 1.25, and a speed that reset every episode would be a
    /// setting nobody could use.
    pub speed: f64,
+    /// How plain subtitles look. Kept with the rest because it is the same
+    /// kind of choice: made once, for every file after.
+    pub subtitle_style: SubtitleStyle,
+}
+
+/// How subtitles are drawn.
+///
+/// Every default is mpv's own, so a viewer who never opens the section sees
+/// what any mpv shows. Plain (SRT) tracks take all of it. A styled (ASS) track
+/// was typeset by somebody, its signs placed and coloured by hand, and painting
+/// over that undoes the work — so by default it takes none of this, and moves
+/// only to stay clear of the player's controls. All of it reaches a styled
+/// track only with [`Self::restyle_styled`].
+#[derive(Debug, Clone, PartialEq, serde::Serialize, serde::Deserialize)]
+#[serde(default)]
+pub struct SubtitleStyle {
+    /// Relative to mpv's own size, which is itself relative to the video's
+    /// height — so one setting reads the same on a phone and a television.
+    pub scale: f64,
+    /// A font family name. `None` is mpv's `sans-serif`. A name this device
+    /// does not have falls back the same way, which is what makes it safe to
+    /// sync.
+    pub font: Option<String>,
+    pub bold: bool,
+    pub italic: bool,
+    pub colour: Colour,
+    pub backdrop: SubtitleBackdrop,
+    pub outline_colour: Colour,
+    /// In mpv's scaled pixels, as `sub-outline-size`.
+    pub outline_size: f64,
+    /// The box's colour, its alpha the box's opacity. Only with
+    /// [`SubtitleBackdrop::Box`].
+    pub box_colour: Colour,
+    pub shadow_colour: Colour,
+    /// How far the shadow falls; 0 is none, which is mpv's default.
+    pub shadow_offset: f64,
+    /// How soft the edges are, 0–20.
+    pub blur: f64,
+    /// Where the line sits, as a percentage of the picture's height from the
+    /// top: 100 is the bottom edge, mpv's usual place.
+    pub position: f64,
+    /// Whether styled (ASS) tracks are drawn in this style too, size and
+    /// position included. Off by default: it turns signs and karaoke into
+    /// dialogue-looking text.
+    pub restyle_styled: bool,
+}
+
+impl SubtitleStyle {
+    /// The family a style with no font of its own is set in: mpv's default,
+    /// which fontconfig resolves to the system's sans-serif face.
+    pub const DEFAULT_FONT: &str = "sans-serif";
+    pub const MIN_SCALE: f64 = 0.5;
+    pub const MAX_SCALE: f64 = 2.5;
+    pub const MAX_OUTLINE: f64 = 10.0;
+    pub const MAX_SHADOW: f64 = 10.0;
+    pub const MAX_BLUR: f64 = 20.0;
+
+    /// The same style with every number brought back into range.
+    ///
+    /// A hand-edited or synced file can hold anything, and mpv refuses an
+    /// out-of-range value outright — which would cost the rest of the style.
+    pub fn sanitized(mut self) -> Self {
+        let defaults = Self::default();
+        let clamp = |value: f64, default: f64, min: f64, max: f64| {
+            if value.is_finite() {
+                value.clamp(min, max)
+            } else {
+                default
+            }
+        };
+        self.scale = clamp(self.scale, defaults.scale, Self::MIN_SCALE, Self::MAX_SCALE);
+        self.outline_size = clamp(
+            self.outline_size,
+            defaults.outline_size,
+            0.0,
+            Self::MAX_OUTLINE,
+        );
+        self.shadow_offset = clamp(
+            self.shadow_offset,
+            defaults.shadow_offset,
+            0.0,
+            Self::MAX_SHADOW,
+        );
+        self.blur = clamp(self.blur, defaults.blur, 0.0, Self::MAX_BLUR);
+        self.position = clamp(self.position, defaults.position, 0.0, 100.0);
+        self.font = self
+            .font
+            .map(|font| font.trim().to_owned())
+            .filter(|font| !font.is_empty());
+        self
+    }
+}
+
+impl Default for SubtitleStyle {
+    fn default() -> Self {
+        Self {
+            scale: 1.0,
+            font: None,
+            bold: false,
+            italic: false,
+            colour: Colour::rgba(0xFF, 0xFF, 0xFF, 0xFF),
+            backdrop: SubtitleBackdrop::Outline,
+            outline_colour: Colour::rgba(0, 0, 0, 0xFF),
+            outline_size: 1.65,
+            // About seventy percent black.
+            box_colour: Colour::rgba(0, 0, 0, 0xB0),
+            shadow_colour: Colour::rgba(0, 0, 0, 0xAF),
+            shadow_offset: 0.0,
+            blur: 0.0,
+            position: 100.0,
+            restyle_styled: false,
+        }
+    }
+}
+
+/// What keeps the text readable against the picture.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Default, serde::Serialize, serde::Deserialize)]
+#[serde(rename_all = "kebab-case")]
+pub enum SubtitleBackdrop {
+    /// An outline round each letter: mpv's own, and the default.
+    #[default]
+    Outline,
+    /// A box behind each line. Uglier, and the only thing that holds up on
+    /// snow, sky and white walls.
+    Box,
+}
+
+impl SubtitleBackdrop {
+    pub const ALL: [Self; 2] = [Self::Outline, Self::Box];
+
+    pub fn label(self) -> &'static str {
+        match self {
+            Self::Outline => "Outline",
+            Self::Box => "Box",
+        }
+    }
+}
+
+/// A colour with opacity, written `#RRGGBBAA` the way CSS writes one.
+///
+/// Not mpv's order: mpv reads `#AARRGGBB`, which nobody hand-editing a file
+/// would guess. [`Self::to_mpv`] does the translation.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, serde::Serialize, serde::Deserialize)]
+#[serde(try_from = "String", into = "String")]
+pub struct Colour {
+    pub r: u8,
+    pub g: u8,
+    pub b: u8,
+    pub a: u8,
+}
+
+impl Colour {
+    pub const fn rgba(r: u8, g: u8, b: u8, a: u8) -> Self {
+        Self { r, g, b, a }
+    }
+
+    /// `#RRGGBB` or `#RRGGBBAA`, the `#` optional. Six digits are opaque.
+    pub fn parse(text: &str) -> Option<Self> {
+        let hex = text.trim().strip_prefix('#').unwrap_or(text.trim());
+        if !(hex.len() == 6 || hex.len() == 8) || !hex.bytes().all(|b| b.is_ascii_hexdigit()) {
+            return None;
+        }
+        let byte = |at: usize| u8::from_str_radix(&hex[at..at + 2], 16).ok();
+        let a = if hex.len() == 8 { byte(6)? } else { 0xFF };
+        Some(Self::rgba(byte(0)?, byte(2)?, byte(4)?, a))
+    }
+
+    /// As mpv's colour options take it.
+    pub fn to_mpv(self) -> String {
+        format!("#{:02X}{:02X}{:02X}{:02X}", self.a, self.r, self.g, self.b)
+    }
+
+    pub fn to_array(self) -> [u8; 4] {
+        [self.r, self.g, self.b, self.a]
+    }
+}
+
+impl From<[u8; 4]> for Colour {
+    fn from([r, g, b, a]: [u8; 4]) -> Self {
+        Self::rgba(r, g, b, a)
+    }
+}
+
+impl std::fmt::Display for Colour {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        write!(
+            f,
+            "#{:02X}{:02X}{:02X}{:02X}",
+            self.r, self.g, self.b, self.a
+        )
+    }
+}
+
+impl From<Colour> for String {
+    fn from(colour: Colour) -> Self {
+        colour.to_string()
+    }
+}
+
+impl TryFrom<String> for Colour {
+    type Error = String;
+
+    fn try_from(text: String) -> std::result::Result<Self, Self::Error> {
+        Self::parse(&text).ok_or_else(|| format!("not a colour: {text:?}"))
+    }
 }

 impl Default for PlaybackPrefs {
@@ -73,6 +278,7 @@ impl Default for PlaybackPrefs {
            autoplay_next: true,
            auto_skip: false,
            speed: 1.0,
+            subtitle_style: SubtitleStyle::default(),
        }
    }
 }
@@ -93,6 +299,7 @@ impl PlaybackPrefs {
        self.speed = self.speed.clamp(MIN_SPEED, MAX_SPEED);
        self.audio_language = self.audio_language.filter(|tag| !tag.trim().is_empty());
        self.subtitle_language = self.subtitle_language.filter(|tag| !tag.trim().is_empty());
+        self.subtitle_style = self.subtitle_style.sanitized();
        self
    }
 }
@@ -149,6 +356,16 @@ mod tests {
            autoplay_next: false,
            auto_skip: true,
            speed: 1.5,
+            subtitle_style: SubtitleStyle {
+                scale: 1.5,
+                font: Some("Noto Sans".into()),
+                italic: true,
+                colour: Colour::rgba(0xFF, 0xE6, 0x00, 0xFF),
+                backdrop: SubtitleBackdrop::Box,
+                box_colour: Colour::rgba(0x10, 0x10, 0x10, 0x80),
+                restyle_styled: true,
+                ..SubtitleStyle::default()
+            },
        };
        save(&dirs, &prefs).unwrap();
        assert_eq!(load(&dirs).unwrap(), prefs);
@@ -156,6 +373,46 @@ mod tests {
        std::fs::remove_dir_all(&temp).ok();
    }

+    #[test]
+    fn a_file_from_before_subtitle_styles_loads_with_the_default_style() {
+        let prefs: PlaybackPrefs =
+            serde_json::from_str(r#"{"volume": 60.0, "subtitles": true, "speed": 1.0}"#).unwrap();
+        assert_eq!(prefs.subtitle_style, SubtitleStyle::default());
+        assert_eq!(prefs.volume, 60.0);
+    }
+
+    #[test]
+    fn a_colour_is_written_rgba_and_handed_to_mpv_as_argb() {
+        let colour = Colour::parse("#FFE60080").unwrap();
+        assert_eq!(colour, Colour::rgba(0xFF, 0xE6, 0x00, 0x80));
+        assert_eq!(colour.to_string(), "#FFE60080");
+        assert_eq!(colour.to_mpv(), "#80FFE600");
+        assert_eq!(
+            Colour::parse("ffe600"),
+            Some(Colour::rgba(0xFF, 0xE6, 0, 0xFF))
+        );
+        assert_eq!(Colour::parse("#FFE6"), None);
+        assert_eq!(Colour::parse("#GGGGGG"), None);
+    }
+
+    #[test]
+    fn a_subtitle_style_out_of_range_is_brought_back_into_it() {
+        let style = SubtitleStyle {
+            scale: 40.0,
+            outline_size: -3.0,
+            blur: f64::NAN,
+            position: 400.0,
+            font: Some("   ".into()),
+            ..SubtitleStyle::default()
+        }
+        .sanitized();
+        assert_eq!(style.scale, SubtitleStyle::MAX_SCALE);
+        assert_eq!(style.outline_size, 0.0);
+        assert_eq!(style.blur, 0.0);
+        assert_eq!(style.position, 100.0);
+        assert_eq!(style.font, None);
+    }
+
    #[test]
    fn a_volume_no_player_could_honour_is_clamped_rather_than_passed_on() {
        let prefs = PlaybackPrefs {
@@ -0,0 +1,808 @@
+//! The rest of what makes the app look the same on every device: the shares,
+//! the settings, the hand-picked metadata matches and the per-show track
+//! choices. Synced next to watch history by [`crate::sync`], in the same file.
+//!
+//! ## Registers
+//!
+//! Each synced thing is one *register*: a key (`share/<id>`,
+//! `settings/playback`, `tracks/<title>`, …), its latest value, and when it
+//! last changed. Merging is the same rule as watch history — the newer
+//! `updated_at` wins, per key — so it is idempotent and order-free across any
+//! number of devices. A removed share is a register with no value, so a
+//! removal travels like any other change.
+//!
+//! ## Noticing changes
+//!
+//! Nothing that writes a setting or a share knows about sync. Instead
+//! `sync-state.json` remembers every register as last synced, and each sync
+//! compares it with what is on this device: whatever differs changed since,
+//! and is stamped with the time of the sync. That costs a change made between
+//! syncs its exact time, which matters only when two devices change the same
+//! setting within one sync interval of each other.
+//!
+//! The first sync of an installation stamps what it finds at zero rather than
+//! now. A fresh install holds only defaults, and those must not outrank the
+//! library every other device already agreed on; what it has that nobody else
+//! does is still added, since nothing older competes with it.
+//!
+//! ## What does not travel
+//!
+//! The volume and mute, which belong to the speakers in front of the viewer,
+//! and every setting the front ends keep themselves: the cache budget, Wi-Fi
+//! only, background audio, hardware decoding, window geometry.
+//!
+//! ## Secrets
+//!
+//! A share's register carries its link, fragment included, and its custom
+//! password, and the TMDB API key travels too: without them another device
+//! could list the share but never open it. The file holding them is in the
+//! viewer's own Drive, end-to-end encrypted with their account's keys, which is
+//! the same trust the credential store gives them locally; they are never
+//! written anywhere else in plain text.
+
+use std::collections::{BTreeMap, BTreeSet};
+use std::path::PathBuf;
+
+use parking_lot::Mutex;
+use serde::{Deserialize, Serialize};
+use serde_json::Value;
+
+use crate::catalog::{Catalog, TitleTrackPrefs};
+use crate::config::{AppDirs, read_json, write_json};
+use crate::error::Result;
+use crate::metadata::{MetadataConfig, MetadataRecord, ProviderId, TitleMetadata};
+use crate::shares::{AccountFolder, Share, ShareSecrets, ShareStore};
+
+const SHARE: &str = "share/";
+const TRACKS: &str = "tracks/";
+const MATCH: &str = "match/";
+
+/// The settings files that travel, by register, and the fields in each that
+/// stay on the device that wrote them.
+const SETTINGS: [(&str, &str, &[&str]); 3] = [
+    ("settings/playback", "playback.json", &["volume", "muted"]),
+    ("settings/appearance", "appearance.json", &[]),
+    ("settings/metadata", "metadata.json", &[]),
+];
+
+const METADATA_SETTINGS: &str = "settings/metadata";
+
+/// One synced value and when it last changed.
+#[derive(Debug, Clone, PartialEq, Serialize, Deserialize)]
+pub(crate) struct Register {
+    /// `None` is a removal.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub value: Option<Value>,
+    pub updated_at: i64,
+}
+
+pub(crate) type Registers = BTreeMap<String, Register>;
+
+/// What this installation last synced, kept beside its sync identity.
+#[derive(Debug, Default, Serialize, Deserialize)]
+struct State {
+    registers: Registers,
+}
+
+/// A share as it travels: everything another device needs to open it.
+#[derive(Debug, Clone, PartialEq, Serialize, Deserialize)]
+struct SyncedShare {
+    name: String,
+    #[serde(default, skip_serializing_if = "String::is_empty")]
+    token: String,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    url: Option<String>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    custom_password: Option<String>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    folder: Option<AccountFolder>,
+}
+
+/// A match the viewer picked by hand. Automatic ones are not synced: every
+/// device with enrichment on finds them again, and they expire anyway.
+#[derive(Debug, Clone, PartialEq, Serialize, Deserialize)]
+struct SyncedMatch {
+    provider: ProviderId,
+    metadata: Option<TitleMetadata>,
+    fetched_at: i64,
+}
+
+/// What applying other devices' registers changed here, for the front end to
+/// act on: reopen and crawl shares, repaint, reload the library.
+#[derive(Debug, Clone, Default, PartialEq, Eq)]
+pub struct ProfileChanges {
+    /// Shares this device did not have, now configured. Not yet crawled.
+    pub shares_added: Vec<String>,
+    /// Shares whose name or secrets changed.
+    pub shares_changed: Vec<String>,
+    /// Shares removed elsewhere, now gone from the configuration here. Their
+    /// catalog rows and offline files are the front end's to drop, the same
+    /// way it does for a share removed on this device.
+    pub shares_removed: Vec<String>,
+    /// Whether any settings file or the TMDB key changed.
+    pub settings: bool,
+    /// Hand-picked matches and per-show track choices taken.
+    pub titles: usize,
+}
+
+impl ProfileChanges {
+    pub fn is_empty(&self) -> bool {
+        *self == Self::default()
+    }
+
+    pub fn shares(&self) -> bool {
+        !(self.shares_added.is_empty()
+            && self.shares_changed.is_empty()
+            && self.shares_removed.is_empty())
+    }
+}
+
+/// The local side of profile sync: where the state file lives, and the stores
+/// registers are read from and applied to.
+pub(crate) struct Profile<'a> {
+    pub store: &'a ShareStore,
+    pub catalog: &'a Mutex<Catalog>,
+}
+
+/// What is on this device, register by register.
+#[derive(Debug, Default)]
+struct Observed {
+    values: BTreeMap<String, Value>,
+    /// Keys that exist but could not be read — a share whose secret will not
+    /// decrypt. Neither a change nor a removal.
+    unknown: BTreeSet<String>,
+    /// Whether the share list itself could be read. Without it, a share
+    /// missing from `values` says nothing about whether it was removed.
+    shares_listed: bool,
+}
+
+fn state_file(dirs: &AppDirs) -> PathBuf {
+    dirs.config.join("sync-state.json")
+}
+
+fn tmdb_secret() -> String {
+    format!("metadata-{}", ProviderId::Tmdb.as_str())
+}
+
+const TMDB_KEY: &str = "secret/metadata-tmdb";
+
+impl Profile<'_> {
+    fn dirs(&self) -> &AppDirs {
+        &self.store.dirs
+    }
+
+    /// Read the state, notice what changed here since, take what other
+    /// devices have newer, and write the state back. Returns the registers to
+    /// upload and what changed on this device.
+    pub fn sync<'r>(
+        &self,
+        remote: impl IntoIterator<Item = &'r Registers>,
+        now: i64,
+    ) -> Result<(Registers, ProfileChanges)> {
+        let path = state_file(self.dirs());
+        let stored = read_json::<State>(&path)?;
+        let first = stored.is_none();
+        let mut state = stored.unwrap_or_default();
+
+        let observed = self.observe();
+        stamp(&mut state.registers, observed, if first { 0 } else { now });
+        let winners = merge(&state.registers, remote);
+        let changes = self.apply(&mut state.registers, winners);
+        write_json(&path, &state)?;
+        Ok((state.registers, changes))
+    }
+
+    fn observe(&self) -> Observed {
+        let mut observed = Observed::default();
+        for (key, file, local) in SETTINGS {
+            match read_json::<Value>(&self.dirs().config.join(file)) {
+                Ok(Some(value)) => {
+                    observed
+                        .values
+                        .insert(key.to_owned(), without(value, local));
+                }
+                Ok(None) => {}
+                Err(error) => {
+                    tracing::warn!(%error, file, "a settings file was not synced");
+                    observed.unknown.insert(key.to_owned());
+                }
+            }
+        }
+        match self.store.secrets.get(&tmdb_secret()) {
+            Ok(Some(key)) => {
+                observed
+                    .values
+                    .insert(TMDB_KEY.to_owned(), Value::String(key));
+            }
+            Ok(None) => {}
+            Err(_) => {
+                observed.unknown.insert(TMDB_KEY.to_owned());
+            }
+        }
+
+        if let Ok(shares) = self.store.list() {
+            observed.shares_listed = true;
+            for share in shares {
+                let key = format!("{SHARE}{}", share.id);
+                let secrets = if share.folder.is_some() {
+                    None
+                } else {
+                    match self.store.secrets_of(&share.id) {
+                        Ok(secrets) => Some(secrets),
+                        Err(_) => {
+                            observed.unknown.insert(key);
+                            continue;
+                        }
+                    }
+                };
+                let synced = SyncedShare {
+                    name: share.name,
+                    token: share.token,
+                    url: secrets.as_ref().map(|secrets| secrets.url.clone()),
+                    custom_password: secrets.and_then(|secrets| secrets.custom_password),
+                    folder: share.folder,
+                };
+                if let Ok(value) = serde_json::to_value(synced) {
+                    observed.values.insert(key, value);
+                }
+            }
+        }
+
+        let catalog = self.catalog.lock();
+        if let Ok(tracks) = catalog.all_title_track_prefs() {
+            for (title, prefs) in tracks {
+                if let Ok(value) = serde_json::to_value(prefs) {
+                    observed.values.insert(format!("{TRACKS}{title}"), value);
+                }
+            }
+        }
+        if let Ok(records) = catalog.all_metadata() {
+            for (title, record) in records {
+                if !record.manual {
+                    continue;
+                }
+                let synced = SyncedMatch {
+                    provider: record.provider,
+                    metadata: record.metadata,
+                    fetched_at: record.fetched_at,
+                };
+                if let Ok(value) = serde_json::to_value(synced) {
+                    observed.values.insert(format!("{MATCH}{title}"), value);
+                }
+            }
+        }
+        observed
+    }
+
+    /// Apply each winning register here, recording it in `registers` once it
+    /// took. One that fails is left out, so the next sync tries it again.
+    fn apply(&self, registers: &mut Registers, winners: Registers) -> ProfileChanges {
+        let mut changes = ProfileChanges::default();
+        for (key, register) in winners {
+            match self.apply_one(&key, register.value.as_ref(), &mut changes) {
+                Ok(()) => {
+                    registers.insert(key, register);
+                }
+                Err(error) => tracing::warn!(%error, key, "a synced change was not applied"),
+            }
+        }
+        changes
+    }
+
+    fn apply_one(
+        &self,
+        key: &str,
+        value: Option<&Value>,
+        changes: &mut ProfileChanges,
+    ) -> Result<()> {
+        if let Some(id) = key.strip_prefix(SHARE) {
+            return self.apply_share(id, value, changes);
+        }
+        if let Some(title) = key.strip_prefix(TRACKS) {
+            if let Some(value) = value {
+                let prefs: TitleTrackPrefs = parse(value)?;
+                self.catalog.lock().set_title_track_prefs(title, &prefs)?;
+                changes.titles += 1;
+            }
+            return Ok(());
+        }
+        if let Some(title) = key.strip_prefix(MATCH) {
+            if let Some(value) = value {
+                let synced: SyncedMatch = parse(value)?;
+                self.catalog.lock().set_metadata(&MetadataRecord {
+                    title_key: title.to_owned(),
+                    provider: synced.provider,
+                    metadata: synced.metadata,
+                    fetched_at: synced.fetched_at,
+                    manual: true,
+                })?;
+                changes.titles += 1;
+            }
+            return Ok(());
+        }
+        if key == TMDB_KEY {
+            match value.and_then(Value::as_str) {
+                Some(secret) => self.store.secrets.set(&tmdb_secret(), secret)?,
+                None => self.store.secrets.delete(&tmdb_secret())?,
+            }
+            changes.settings = true;
+            return Ok(());
+        }
+        if let Some((_, file, local)) = SETTINGS.iter().find(|(name, ..)| *name == key) {
+            let Some(Value::Object(incoming)) = value else {
+                return Ok(());
+            };
+            let path = self.dirs().config.join(file);
+            let before = read_json::<Value>(&path)?;
+            let mut merged = match &before {
+                Some(Value::Object(existing)) => existing.clone(),
+                _ => serde_json::Map::new(),
+            };
+            for (field, field_value) in incoming {
+                if !local.contains(&field.as_str()) {
+                    merged.insert(field.clone(), field_value.clone());
+                }
+            }
+            let merged = Value::Object(merged);
+            if key == METADATA_SETTINGS {
+                self.metadata_settings_changing(before.as_ref(), &merged)?;
+            }
+            write_json(&path, &merged)?;
+            changes.settings = true;
+            return Ok(());
+        }
+        // A register a newer build writes. Kept, so it travels on.
+        Ok(())
+    }
+
+    fn apply_share(
+        &self,
+        id: &str,
+        value: Option<&Value>,
+        changes: &mut ProfileChanges,
+    ) -> Result<()> {
+        let existing = self.store.list()?.into_iter().find(|share| share.id == id);
+        let Some(value) = value else {
+            if existing.is_some() {
+                self.store.remove(id)?;
+                changes.shares_removed.push(id.to_owned());
+            }
+            return Ok(());
+        };
+        let synced: SyncedShare = parse(value)?;
+        let expected = match (&synced.folder, &synced.url) {
+            (Some(folder), _) => folder.share_id(),
+            (None, Some(_)) => format!("share-{}", synced.token),
+            (None, None) => return Err(invalid("a synced link has no URL")),
+        };
+        if expected != id {
+            return Err(invalid("a synced share's id does not match what it opens"));
+        }
+        let secrets = synced.url.map(|url| ShareSecrets {
+            url,
+            custom_password: synced.custom_password,
+        });
+        let share = Share {
+            id: id.to_owned(),
+            name: synced.name,
+            token: synced.token,
+            has_custom_password: secrets
+                .as_ref()
+                .is_some_and(|secrets| secrets.custom_password.is_some()),
+            folder: synced.folder,
+        };
+        if existing.as_ref() == Some(&share)
+            && secrets.as_ref().is_none_or(|secrets| {
+                self.store
+                    .secrets_of(id)
+                    .is_ok_and(|stored| &stored == secrets)
+            })
+        {
+            return Ok(());
+        }
+        self.store.put_synced(share, secrets.as_ref())?;
+        if existing.is_some() {
+            changes.shares_changed.push(id.to_owned());
+        } else {
+            changes.shares_added.push(id.to_owned());
+        }
+        Ok(())
+    }
+
+    /// Turning enrichment off or switching provider drops every stored answer
+    /// on the device that did it, which the settings page also does here.
+    fn metadata_settings_changing(&self, before: Option<&Value>, after: &Value) -> Result<()> {
+        let config = |value: Option<&Value>| -> MetadataConfig {
+            value
+                .and_then(|value| serde_json::from_value(value.clone()).ok())
+                .unwrap_or_default()
+        };
+        let (before, after) = (config(before), config(Some(after)));
+        if !after.enabled || before.provider != after.provider {
+            self.catalog.lock().clear_metadata()?;
+        }
+        Ok(())
+    }
+}
+
+/// Record what changed on this device since the last sync, stamped `now`.
+fn stamp(registers: &mut Registers, observed: Observed, now: i64) {
+    for (key, register) in registers.iter_mut() {
+        if register.value.is_some()
+            && key.starts_with(SHARE)
+            && observed.shares_listed
+            && !observed.values.contains_key(key)
+            && !observed.unknown.contains(key)
+        {
+            *register = Register {
+                value: None,
+                updated_at: now,
+            };
+        }
+    }
+    for (key, value) in observed.values {
+        let unchanged = registers
+            .get(&key)
+            .is_some_and(|register| same(&key, register.value.as_ref(), Some(&value)));
+        if !unchanged {
+            registers.insert(
+                key,
+                Register {
+                    value: Some(value),
+                    updated_at: now,
+                },
+            );
+        }
+    }
+}
+
+/// Whether two values of one register are the same choice.
+///
+/// A match is compared by what it points at: its stored details move every
+/// time the provider is asked again, and a register re-stamped by every
+/// refresh would bounce between devices for ever.
+fn same(key: &str, a: Option<&Value>, b: Option<&Value>) -> bool {
+    if key.starts_with(MATCH) {
+        let pointer = |value: Option<&Value>| {
+            value.map(|value| {
+                (
+                    value.get("provider").cloned(),
+                    value
+                        .get("metadata")
+                        .and_then(|metadata| metadata.get("remote_id"))
+                        .cloned(),
+                )
+            })
+        };
+        return pointer(a) == pointer(b);
+    }
+    a == b
+}
+
+/// The registers from other devices that are newer than this one's.
+fn merge<'r>(local: &Registers, remote: impl IntoIterator<Item = &'r Registers>) -> Registers {
+    let mut winners = Registers::new();
+    for registers in remote {
+        for (key, register) in registers {
+            let current = winners.get(key).or_else(|| local.get(key));
+            if current.is_none_or(|current| newer(register, current)) {
+                winners.insert(key.clone(), register.clone());
+            }
+        }
+    }
+    winners
+}
+
+/// Newer wins; a tie between two different values goes the same way on every
+/// device, or two of them would each keep their own.
+fn newer(candidate: &Register, current: &Register) -> bool {
+    if candidate.updated_at != current.updated_at {
+        return candidate.updated_at > current.updated_at;
+    }
+    let order = |register: &Register| {
+        register
+            .value
+            .as_ref()
+            .map(Value::to_string)
+            .unwrap_or_default()
+    };
+    order(candidate) > order(current)
+}
+
+/// `value` without the fields that stay on this device.
+fn without(value: Value, local: &[&str]) -> Value {
+    match value {
+        Value::Object(mut fields) => {
+            for field in local {
+                fields.remove(*field);
+            }
+            Value::Object(fields)
+        }
+        other => other,
+    }
+}
+
+fn parse<T: serde::de::DeserializeOwned>(value: &Value) -> Result<T> {
+    serde_json::from_value(value.clone()).map_err(|e| invalid(&e.to_string()))
+}
+
+fn invalid(reason: &str) -> crate::Error {
+    crate::Error::Config(format!("synced setting: {reason}"))
+}
+
+#[cfg(test)]
+pub(crate) mod tests {
+    use std::collections::HashMap;
+    use std::sync::Arc;
+
+    use super::*;
+    use crate::shares::SecretStore;
+
+    #[derive(Default)]
+    struct MemorySecrets(Mutex<HashMap<String, String>>);
+
+    impl SecretStore for MemorySecrets {
+        fn set(&self, key: &str, value: &str) -> Result<()> {
+            self.0.lock().insert(key.to_owned(), value.to_owned());
+            Ok(())
+        }
+        fn get(&self, key: &str) -> Result<Option<String>> {
+            Ok(self.0.lock().get(key).cloned())
+        }
+        fn delete(&self, key: &str) -> Result<()> {
+            self.0.lock().remove(key);
+            Ok(())
+        }
+    }
+
+    /// One installation's configuration and catalog.
+    pub(crate) struct Device {
+        root: PathBuf,
+        pub store: ShareStore,
+        pub catalog: Mutex<Catalog>,
+    }
+
+    impl Device {
+        pub(crate) fn new(tag: &str) -> Self {
+            let mut bytes = [0_u8; 8];
+            getrandom::fill(&mut bytes).unwrap();
+            let unique: String = bytes.iter().map(|byte| format!("{byte:02x}")).collect();
+            let root = std::env::temp_dir().join(format!("pstr-profile-{tag}-{unique}"));
+            let dirs = AppDirs::from_paths(root.join("c"), root.join("d"), root.join("k")).unwrap();
+            Self {
+                root,
+                store: ShareStore::with_secret_store(dirs, Arc::new(MemorySecrets::default())),
+                catalog: Mutex::new(Catalog::in_memory().unwrap()),
+            }
+        }
+
+        pub(crate) fn lock(&self) -> parking_lot::MutexGuard<'_, Catalog> {
+            self.catalog.lock()
+        }
+
+        pub(crate) fn profile(&self) -> Profile<'_> {
+            Profile {
+                store: &self.store,
+                catalog: &self.catalog,
+            }
+        }
+
+        fn sync(&self, remote: &[&Registers], now: i64) -> (Registers, ProfileChanges) {
+            self.profile().sync(remote.iter().copied(), now).unwrap()
+        }
+
+        fn share_names(&self) -> Vec<String> {
+            self.store
+                .list()
+                .unwrap()
+                .into_iter()
+                .map(|share| share.name)
+                .collect()
+        }
+    }
+
+    impl Drop for Device {
+        fn drop(&mut self) {
+            let _ = std::fs::remove_dir_all(&self.root);
+        }
+    }
+
+    const LINK: &str = "https://drive.proton.me/urls/ABCDEFGHIJ#secretpart";
+
+    #[test]
+    fn a_share_added_on_one_device_arrives_on_another_with_its_secrets() {
+        let laptop = Device::new("laptop");
+        let phone = Device::new("phone");
+        laptop.sync(&[], 10);
+        laptop.store.add("Anime", LINK, Some("hunter2")).unwrap();
+        let (sent, _) = laptop.sync(&[], 20);
+
+        let (_, changes) = phone.sync(&[&sent], 30);
+
+        assert_eq!(changes.shares_added, ["share-ABCDEFGHIJ"]);
+        assert_eq!(phone.share_names(), ["Anime"]);
+        let secrets = phone.store.secrets_of("share-ABCDEFGHIJ").unwrap();
+        assert_eq!(secrets.url, LINK);
+        assert_eq!(secrets.custom_password.as_deref(), Some("hunter2"));
+    }
+
+    #[test]
+    fn a_share_removed_on_one_device_is_removed_on_the_others() {
+        let laptop = Device::new("laptop");
+        let phone = Device::new("phone");
+        laptop.store.add("Anime", LINK, None).unwrap();
+        let (sent, _) = laptop.sync(&[], 10);
+        let (phone_sent, _) = phone.sync(&[&sent], 20);
+
+        laptop.store.remove("share-ABCDEFGHIJ").unwrap();
+        let (sent, _) = laptop.sync(&[&phone_sent], 30);
+        let (_, changes) = phone.sync(&[&sent], 40);
+
+        assert_eq!(changes.shares_removed, ["share-ABCDEFGHIJ"]);
+        assert!(phone.share_names().is_empty());
+    }
+
+    #[test]
+    fn a_fresh_installation_takes_the_library_rather_than_its_defaults() {
+        let laptop = Device::new("laptop");
+        let phone = Device::new("phone");
+        laptop.sync(&[], 10);
+        let mut prefs = crate::prefs::load(&laptop.store.dirs).unwrap();
+        prefs.autoplay_next = false;
+        prefs.speed = 1.5;
+        crate::prefs::save(&laptop.store.dirs, &prefs).unwrap();
+        let (sent, _) = laptop.sync(&[], 20);
+
+        // The new phone has written its defaults before it ever synced.
+        crate::prefs::save(&phone.store.dirs, &crate::prefs::PlaybackPrefs::default()).unwrap();
+        let (_, changes) = phone.sync(&[&sent], 30);
+
+        assert!(changes.settings);
+        let taken = crate::prefs::load(&phone.store.dirs).unwrap();
+        assert!(!taken.autoplay_next);
+        assert_eq!(taken.speed, 1.5);
+    }
+
+    #[test]
+    fn volume_and_mute_stay_on_the_device_that_set_them() {
+        let laptop = Device::new("laptop");
+        let phone = Device::new("phone");
+        laptop.sync(&[], 10);
+        let mut prefs = crate::prefs::PlaybackPrefs {
+            volume: 20.0,
+            muted: true,
+            ..Default::default()
+        };
+        crate::prefs::save(&laptop.store.dirs, &prefs).unwrap();
+        let (sent, _) = laptop.sync(&[], 20);
+        prefs.volume = 80.0;
+        prefs.muted = false;
+        prefs.subtitles = false;
+        crate::prefs::save(&phone.store.dirs, &prefs).unwrap();
+        phone.sync(&[], 5);
+
+        phone.sync(&[&sent], 30);
+
+        let taken = crate::prefs::load(&phone.store.dirs).unwrap();
+        assert_eq!(taken.volume, 80.0);
+        assert!(!taken.muted);
+        assert!(taken.subtitles, "the laptop's later choice wins");
+    }
+
+    #[test]
+    fn the_newer_change_wins_whichever_device_syncs_first() {
+        let laptop = Device::new("laptop");
+        let phone = Device::new("phone");
+        laptop.sync(&[], 1);
+        phone.sync(&[], 1);
+        let mut appearance = crate::appearance::load(&laptop.store.dirs).unwrap();
+        appearance.gradients = false;
+        crate::appearance::save(&laptop.store.dirs, &appearance).unwrap();
+        let (from_laptop, _) = laptop.sync(&[], 10);
+        appearance.gradients = true;
+        appearance.accent = crate::appearance::Accent::Peach;
+        crate::appearance::save(&phone.store.dirs, &appearance).unwrap();
+        let (from_phone, _) = phone.sync(&[&from_laptop], 20);
+        laptop.sync(&[&from_phone], 30);
+
+        for device in [&laptop, &phone] {
+            let seen = crate::appearance::load(&device.store.dirs).unwrap();
+            assert_eq!(seen.accent, crate::appearance::Accent::Peach);
+            assert!(seen.gradients);
+        }
+    }
+
+    #[test]
+    fn an_unchanged_device_sends_the_same_registers_again() {
+        let laptop = Device::new("laptop");
+        laptop.store.add("Anime", LINK, None).unwrap();
+        let (first, _) = laptop.sync(&[], 10);
+        let (second, changes) = laptop.sync(&[&first], 20);
+        assert_eq!(first, second);
+        assert!(changes.is_empty());
+    }
+
+    #[test]
+    fn a_share_whose_secret_cannot_be_read_is_not_removed_elsewhere() {
+        let laptop = Device::new("laptop");
+        laptop.store.add("Anime", LINK, None).unwrap();
+        laptop.sync(&[], 10);
+        laptop.store.secrets.delete("share-ABCDEFGHIJ").unwrap();
+        let (sent, _) = laptop.sync(&[], 20);
+        assert!(sent["share/share-ABCDEFGHIJ"].value.is_some());
+    }
+
+    #[test]
+    fn a_hand_picked_match_and_a_shows_track_choice_travel() {
+        let laptop = Device::new("laptop");
+        let phone = Device::new("phone");
+        laptop.sync(&[], 1);
+        let metadata = TitleMetadata {
+            provider: ProviderId::AniList,
+            remote_id: "21".to_owned(),
+            name: "One Piece".to_owned(),
+            original_name: None,
+            overview: None,
+            year: Some(1999),
+            kind: crate::library::TitleKind::Series,
+            poster_url: None,
+            backdrop_url: None,
+            rating: None,
+            genres: Vec::new(),
+            episodes: None,
+            url: None,
+            details: None,
+        };
+        laptop
+            .catalog
+            .lock()
+            .set_metadata(&MetadataRecord {
+                title_key: "one piece".to_owned(),
+                provider: ProviderId::AniList,
+                metadata: Some(metadata),
+                fetched_at: 5,
+                manual: true,
+            })
+            .unwrap();
+        let tracks = TitleTrackPrefs {
+            audio_language: Some("jpn".to_owned()),
+            ..Default::default()
+        };
+        laptop
+            .catalog
+            .lock()
+            .set_title_track_prefs("one piece", &tracks)
+            .unwrap();
+        let (sent, _) = laptop.sync(&[], 10);
+
+        let (_, changes) = phone.sync(&[&sent], 20);
+
+        assert_eq!(changes.titles, 2);
+        let catalog = phone.catalog.lock();
+        let record = catalog.metadata("one piece").unwrap().unwrap();
+        assert!(record.manual);
+        assert_eq!(record.metadata.unwrap().remote_id, "21");
+        assert_eq!(
+            catalog.title_track_prefs("one piece").unwrap(),
+            Some(tracks)
+        );
+    }
+
+    #[test]
+    fn a_synced_share_that_names_another_id_is_refused() {
+        let phone = Device::new("phone");
+        let mut forged = Registers::new();
+        forged.insert(
+            "share/share-OTHER".to_owned(),
+            Register {
+                value: Some(serde_json::json!({
+                    "name": "x", "token": "ABCDEFGHIJ", "url": LINK
+                })),
+                updated_at: 10,
+            },
+        );
+        let (registers, changes) = phone.sync(&[&forged], 20);
+        assert!(changes.shares_added.is_empty());
+        assert!(!registers.contains_key("share/share-OTHER"));
+    }
+}
@@ -0,0 +1,202 @@
+//! Which of a file's subtitle tracks is the one to read.
+//!
+//! Anime releases often carry two subtitle tracks in one language: the
+//! dialogue, and a "Signs & Songs" track that only translates the on-screen
+//! text and the lyrics. The second is the one marked default or forced as
+//! often as not, and mpv, picking by language, plays it — an episode where
+//! nobody seems to speak. A language cannot tell the two apart; the track's
+//! name and its forced flag can.
+//!
+//! Nothing here talks to a player. Every client reads the track list out of
+//! mpv once a file is loaded and asks [`full_instead`] whether to switch.
+
+use crate::language::same_language;
+
+/// One subtitle track of the open file, as mpv lists it.
+#[derive(Debug, Clone, PartialEq, Eq, Default)]
+pub struct SubtitleTrack {
+    /// mpv's id for it, what `sid` is set to.
+    pub id: i64,
+    pub language: Option<String>,
+    /// The name the muxer gave it: "Dialogue", "Signs & Songs".
+    pub title: Option<String>,
+    /// The container marks it as the default choice.
+    pub default: bool,
+    /// The container marks it as forced: on-screen text only, by convention.
+    pub forced: bool,
+    /// It is the one playing.
+    pub selected: bool,
+}
+
+/// How much of what is said a track carries, as far as its name and flags say.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, PartialOrd, Ord)]
+pub enum Coverage {
+    /// Signs, songs, or forced: not the dialogue.
+    Partial,
+    /// Nothing says either way.
+    Unknown,
+    /// Named as the dialogue: "Dialogue", "Full Subtitles", "SDH".
+    Full,
+}
+
+/// Words in a track's name that make it the whole dialogue. They win over the
+/// partial ones: "Full (with Signs)" is still the full track.
+const FULL_WORDS: [&str; 6] = ["full", "dialogue", "dialog", "dialogues", "sdh", "cc"];
+
+/// Words in a track's name that make it something other than the dialogue.
+const PARTIAL_WORDS: [&str; 13] = [
+    "sign", "signs", "song", "songs", "s&s", "forced", "karaoke", "lyrics", "op", "ed", "oped",
+    "opening", "ending",
+];
+
+impl SubtitleTrack {
+    pub fn coverage(&self) -> Coverage {
+        let title = self.title.as_deref().unwrap_or_default().to_lowercase();
+        let words: Vec<&str> = title
+            .split(|c: char| !c.is_alphanumeric() && c != '&')
+            .filter(|word| !word.is_empty())
+            .collect();
+        let has = |list: &[&str]| words.iter().any(|word| list.contains(word));
+        if has(&FULL_WORDS) {
+            Coverage::Full
+        } else if self.forced || has(&PARTIAL_WORDS) {
+            Coverage::Partial
+        } else {
+            Coverage::Unknown
+        }
+    }
+}
+
+/// The track to play in place of the one mpv chose, if it chose the wrong one.
+///
+/// Only a track in the same language as the playing one is considered — the
+/// language is the viewer's choice, and this only corrects which of its tracks
+/// was taken. The playing track is replaced when it is partial and the file has
+/// one in its language that is not, or when nothing names it and another is
+/// named as the dialogue. Among the rest, a track named as the dialogue comes
+/// first, then the container's default, then the file's order. `None` leaves
+/// the selection as it is, which includes subtitles being off.
+pub fn full_instead(tracks: &[SubtitleTrack]) -> Option<i64> {
+    let playing = tracks.iter().find(|track| track.selected)?;
+    let current = playing.coverage();
+    if current == Coverage::Full {
+        return None;
+    }
+    let same = |track: &SubtitleTrack| match (&playing.language, &track.language) {
+        (Some(a), Some(b)) => same_language(a, b),
+        (None, None) => true,
+        _ => false,
+    };
+    tracks
+        .iter()
+        .filter(|track| track.id != playing.id && same(track))
+        .filter(|track| track.coverage() > current)
+        // `max_by_key` keeps the last of equals; reversed, the first.
+        .rev()
+        .max_by_key(|track| (track.coverage(), track.default))
+        .map(|track| track.id)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn track(id: i64, language: &str, title: &str) -> SubtitleTrack {
+        SubtitleTrack {
+            id,
+            language: Some(language.into()),
+            title: (!title.is_empty()).then(|| title.into()),
+            ..SubtitleTrack::default()
+        }
+    }
+
+    fn playing(mut track: SubtitleTrack) -> SubtitleTrack {
+        track.selected = true;
+        track
+    }
+
+    #[test]
+    fn signs_and_songs_playing_gives_way_to_the_dialogue_in_its_language() {
+        let tracks = [
+            playing(track(1, "eng", "Signs & Songs")),
+            track(2, "eng", "Dialogue"),
+        ];
+        assert_eq!(full_instead(&tracks), Some(2));
+    }
+
+    #[test]
+    fn an_unnamed_track_gives_way_to_one_named_as_the_dialogue() {
+        let tracks = [playing(track(1, "en", "")), track(2, "en", "Dialogue")];
+        assert_eq!(full_instead(&tracks), Some(2));
+    }
+
+    #[test]
+    fn a_forced_track_gives_way_to_an_unnamed_one_and_the_default_comes_first() {
+        let mut forced = playing(track(1, "eng", "English"));
+        forced.forced = true;
+        let mut default = track(3, "eng", "");
+        default.default = true;
+        let tracks = [forced, track(2, "eng", ""), default];
+        assert_eq!(full_instead(&tracks), Some(3));
+    }
+
+    #[test]
+    fn equal_candidates_resolve_to_the_first_in_the_file() {
+        let tracks = [
+            playing(track(1, "eng", "Songs")),
+            track(2, "eng", ""),
+            track(3, "eng", ""),
+        ];
+        assert_eq!(full_instead(&tracks), Some(2));
+    }
+
+    #[test]
+    fn a_track_in_another_language_is_never_switched_to() {
+        let tracks = [
+            playing(track(1, "eng", "Signs")),
+            track(2, "ger", "Dialogue"),
+        ];
+        assert_eq!(full_instead(&tracks), None);
+    }
+
+    #[test]
+    fn two_letter_and_three_letter_tags_are_one_language() {
+        let tracks = [playing(track(1, "en", "OP/ED")), track(2, "eng", "")];
+        assert_eq!(full_instead(&tracks), Some(2));
+    }
+
+    #[test]
+    fn the_dialogue_playing_stays_and_subtitles_off_stay_off() {
+        let tracks = [
+            track(1, "eng", "Signs & Songs"),
+            playing(track(2, "eng", "Dialogue")),
+        ];
+        assert_eq!(full_instead(&tracks), None);
+        let off = [
+            track(1, "eng", "Signs & Songs"),
+            track(2, "eng", "Dialogue"),
+        ];
+        assert_eq!(full_instead(&off), None);
+    }
+
+    #[test]
+    fn a_full_word_outweighs_a_partial_one_in_the_same_name() {
+        assert_eq!(
+            track(1, "eng", "Full (with Signs)").coverage(),
+            Coverage::Full
+        );
+        assert_eq!(track(1, "eng", "Signs/Songs").coverage(), Coverage::Partial);
+        assert_eq!(track(1, "eng", "English").coverage(), Coverage::Unknown);
+        // A word inside another is not that word.
+        assert_eq!(
+            track(1, "eng", "Designer cut").coverage(),
+            Coverage::Unknown
+        );
+    }
+
+    #[test]
+    fn a_partial_track_with_only_partial_company_stays() {
+        let tracks = [playing(track(1, "eng", "Signs")), track(2, "eng", "Songs")];
+        assert_eq!(full_instead(&tracks), None);
+    }
+}
@@ -379,6 +379,12 @@ impl AniList {
 /// tokenisation: by dropping the `s` it was holding on to. It is asked for only
 /// after the name as written found nothing, which is what keeps it from
 /// broadening a search that was already working.
+///
+/// A film's version number is the same kind of miss. `Evangelion - 1.11 You
+/// Are (Not) Alone` is the file of a film AniList calls `Evangelion: 1.0 You
+/// Are (Not) Alone`, and `1.11` is not a word of that name — so the last
+/// fallback asks without it, and leaves telling the films apart to the scoring,
+/// which still sees the whole name.
 fn search_terms(name: &str) -> Vec<String> {
    let mut terms = vec![name.to_string()];

@@ -386,9 +392,31 @@ fn search_terms(name: &str) -> Vec<String> {
    if depossessed != name {
        terms.push(depossessed);
    }
+    let unversioned = without_version_numbers(name);
+    if !unversioned.is_empty() && !terms.contains(&unversioned) {
+        terms.push(unversioned);
+    }
    terms
 }

+/// `Evangelion - 1.11 You Are Alone` → `Evangelion - You Are Alone`.
+///
+/// A version is digits with a dot in them (`1.11`, `3.0+1.01`); a bare number
+/// is left alone, because in `Kaijuu 8-gou` or `86` it is the name.
+fn without_version_numbers(name: &str) -> String {
+    name.split(' ')
+        .filter(|word| {
+            let versioned = word.contains('.')
+                && word.chars().any(|c| c.is_ascii_digit())
+                && word
+                    .chars()
+                    .all(|c| c.is_ascii_digit() || matches!(c, '.' | '+'));
+            !versioned
+        })
+        .collect::<Vec<_>>()
+        .join(" ")
+}
+
 /// `Heavens Feel` → `Heaven Feel`.
 ///
 /// Only words long enough to still mean something without it, and only where
@@ -836,6 +864,29 @@ mod tests {
        );
    }

+    /// **What three of the four Rebuild films matched as: nothing.** AniList
+    /// requires every word, and a film's version number is not one of its
+    /// title's.
+    #[test]
+    fn a_films_version_number_is_searched_for_again_without_it() {
+        assert_eq!(
+            search_terms("Evangelion - 1.11 You Are Alone"),
+            vec![
+                "Evangelion - 1.11 You Are Alone".to_string(),
+                "Evangelion - You Are Alone".to_string(),
+            ]
+        );
+        assert_eq!(
+            search_terms("Evangelion - 3.0+1.01 Thrice Upon a Time")[1],
+            "Evangelion - Thrice Upon a Time"
+        );
+        assert_eq!(
+            search_terms("Kaijuu 8-gou"),
+            vec!["Kaijuu 8-gou"],
+            "a number that is part of the name stays"
+        );
+    }
+
    /// Byte slicing, on names that are not ASCII.
    #[test]
    fn a_multi_byte_name_is_not_cut_inside_a_character() {
@@ -421,6 +421,22 @@ impl MetadataService {
        }
    }

+    /// Pin `title` to the entry the viewer picked, and enrich it.
+    ///
+    /// Both halves, always: the point of choosing an entry by hand is usually
+    /// that the episode names were wrong too, so a choice that stored only the
+    /// title record left the episodes, the backdrop and the franchise chain of
+    /// the *old* match — or none — until some later match run got round to it.
+    /// A failed enrichment still keeps the choice, as in [`Self::work`].
+    pub async fn choose(&self, title: &Title, found: TitleMetadata) -> Outcome {
+        let enrichment = self.enrich_or_log(title, &found).await;
+        Outcome {
+            title_key: title.key.clone(),
+            record: Some(self.chosen(title.key.clone(), found)),
+            enrichment,
+        }
+    }
+
    async fn enrich_or_log(&self, title: &Title, found: &TitleMetadata) -> Option<Enrichment> {
        self.enrich(title, found)
            .await
@@ -42,7 +42,7 @@ use libloading::Library;
 ///
 /// EGL leads on a Wayland session and GLX on an X11 one, matching what glutin
 /// will have picked — though with `libglvnd` in the way, either order works.
-#[cfg(unix)]
+#[cfg(all(unix, not(target_os = "macos")))]
 fn candidates() -> Vec<&'static str> {
    let wayland = std::env::var_os("WAYLAND_DISPLAY").is_some();
    if wayland {
@@ -52,6 +52,15 @@ fn candidates() -> Vec<&'static str> {
    }
 }

+/// eframe's context on macOS is CGL, and the framework exports every GL
+/// function it implements as a plain symbol — there is no `GetProcAddress` to
+/// go through, so the direct lookup in [`GlLoader::resolve`] answers for all of
+/// them.
+#[cfg(target_os = "macos")]
+fn candidates() -> Vec<&'static str> {
+    vec!["/System/Library/Frameworks/OpenGL.framework/OpenGL"]
+}
+
 #[cfg(windows)]
 fn candidates() -> Vec<&'static str> {
    vec!["opengl32.dll"]
@@ -49,7 +49,8 @@ pub use chapters::{Chapter, ChapterRole, chapter_at, chapter_end, credits_start,
 pub use error::{Error, Result};
 pub use player::{
    EndReason, MAX_VOLUME, Player, PlayerConfig, PlayerEvent, READAHEAD_BLOCKS, VideoOutput,
+    subtitle_options,
 };
 pub use registry::{PROTOCOL, StreamHandle, StreamRegistry};
 pub use render::VideoRenderer;
-pub use tracks::{Track, TrackKind, language_name, pick_track};
+pub use tracks::{LANGUAGES, Track, TrackKind, full_subtitles_instead, language_name, pick_track};
@@ -12,6 +12,7 @@ use std::sync::Arc;

 use libmpv2::events::{Event, PropertyData};
 use libmpv2::{Format, Mpv};
+use pstr_core::prefs::{SubtitleBackdrop, SubtitleStyle};
 use pstr_stream::VideoStream;
 use tokio::runtime::Runtime;

@@ -181,6 +182,8 @@ pub struct PlayerConfig {
    /// Whether subtitles are shown at all. Off is a choice a viewer makes once
    /// and expects to keep, and no language preference can express it.
    pub subtitles: bool,
+    /// How subtitles look. See [`subtitle_options`].
+    pub subtitle_style: SubtitleStyle,
    /// Raw mpv options, applied last, so anything here wins.
    pub options: Vec<(String, String)>,
 }
@@ -206,6 +209,7 @@ impl Default for PlayerConfig {
            audio_language: None,
            subtitle_language: None,
            subtitles: true,
+            subtitle_style: SubtitleStyle::default(),
            options: Vec::new(),
        }
    }
@@ -217,6 +221,9 @@ pub struct Player {
    /// no stream callback can be running.
    mpv: Mpv,
    registry: Arc<StreamRegistry>,
+    /// [`Self::play_from`] set mpv's `start`, which holds for every file
+    /// after until it is put back.
+    start_set: std::sync::atomic::AtomicBool,
 }

 impl Player {
@@ -290,6 +297,9 @@ impl Player {
            if !config.subtitles {
                init.set_property("sid", "no")?;
            }
+            apply_subtitle_options(&config.subtitle_style, |name, value| {
+                init.set_property(name, value).map_err(Error::from)
+            });
            for (name, value) in &config.options {
                init.set_property(name.as_str(), value.as_str())?;
            }
@@ -298,7 +308,11 @@ impl Player {

        protocol::register(&mpv, &registry)?;

-        let player = Self { mpv, registry };
+        let player = Self {
+            mpv,
+            registry,
+            start_set: std::sync::atomic::AtomicBool::new(false),
+        };
        player.observe_playback_properties()?;
        Ok(player)
    }
@@ -325,11 +339,64 @@ impl Player {
    /// The returned handle keeps the URL resolvable; drop it once the file is
    /// done with. Dropping it does not interrupt playback already underway.
    pub fn play(&self, stream: VideoStream) -> Result<StreamHandle> {
+        self.clear_start();
+        self.load(stream)
+    }
+
+    fn load(&self, stream: VideoStream) -> Result<StreamHandle> {
        let handle = self.registry.publish(stream);
        self.mpv.command("loadfile", &[&handle.url()])?;
        Ok(handle)
    }

+    /// Add a subtitle file to the one playing, read through the same
+    /// registry as the video, so mpv never learns where either came from.
+    ///
+    /// Only once the video has loaded: mpv attaches an external track to the
+    /// file open now. `select` turns it on; otherwise it waits in the list.
+    /// The handle keeps it readable, like [`Self::play`]'s.
+    pub fn add_subtitle(
+        &self,
+        stream: VideoStream,
+        title: &str,
+        language: Option<&str>,
+        select: bool,
+    ) -> Result<StreamHandle> {
+        let handle = self.registry.publish(stream);
+        let url = handle.url();
+        let flag = if select { "select" } else { "auto" };
+        let mut args = vec![url.as_str(), flag, title];
+        args.extend(language);
+        self.mpv.command("sub-add", &args)?;
+        Ok(handle)
+    }
+
+    /// Start playing a stream `seconds` in.
+    ///
+    /// Through mpv's `start` option rather than a seek once the file has
+    /// loaded: by then the demuxer has begun reading ahead from the
+    /// beginning, which on a stream is blocks fetched only to be thrown away,
+    /// queued in front of the ones the seek wants.
+    pub fn play_from(&self, stream: VideoStream, seconds: f64) -> Result<StreamHandle> {
+        self.mpv.set_property("start", format!("{seconds}"))?;
+        self.start_set
+            .store(true, std::sync::atomic::Ordering::Release);
+        self.load(stream)
+    }
+
+    /// Put `start` back once the file it was for has loaded, so the next
+    /// one starts at its beginning. [`Self::play`] puts it back too, for a
+    /// file that never loaded.
+    fn clear_start(&self) {
+        if self
+            .start_set
+            .swap(false, std::sync::atomic::Ordering::AcqRel)
+            && let Err(error) = self.mpv.set_property("start", "none")
+        {
+            tracing::warn!(%error, "could not clear mpv's start");
+        }
+    }
+
    /// Play anything else mpv can open: a local path, or one of its own
    /// pseudo-protocols.
    ///
@@ -351,7 +418,15 @@ impl Player {
    /// property that briefly has no value is normal, not fatal.
    pub fn poll_event(&self, timeout: f64) -> Option<PlayerEvent> {
        match self.mpv.wait_event(timeout)? {
-            Ok(event) => Some(translate(event)),
+            Ok(event) => {
+                let event = translate(event);
+                // Not on an end of file: loading one file ends the one it
+                // replaces, before the new one has read `start`.
+                if matches!(event, PlayerEvent::FileLoaded) {
+                    self.clear_start();
+                }
+                Some(event)
+            }
            Err(error) => {
                tracing::debug!(%error, "mpv event carried an error");
                Some(PlayerEvent::Other)
@@ -469,6 +544,18 @@ impl Player {
        Ok(())
    }

+    /// Restyle subtitles now, on the line already showing.
+    pub fn apply_subtitle_style(&self, style: &SubtitleStyle) {
+        apply_subtitle_options(style, |name, value| self.set_option(name, value));
+    }
+
+    /// Show subtitles `seconds` later (or, negative, earlier) than the file
+    /// says. For a release whose subtitles were timed against another cut.
+    pub fn set_subtitle_delay(&self, seconds: f64) -> Result<()> {
+        self.mpv.set_property("sub-delay", seconds)?;
+        Ok(())
+    }
+
    /// Playback speed, where 1.0 is normal. Pitch is corrected, which is mpv's
    /// default and what keeps a voice a voice at 1.5×.
    pub fn set_speed(&self, speed: f64) -> Result<()> {
@@ -525,6 +612,78 @@ impl Player {
    }
 }

+/// The first option of the block that only makes sense on top of it. See
+/// [`apply_subtitle_options`].
+const BORDER_STYLE: &str = "sub-border-style";
+
+/// The mpv options that draw `style`, every one of them every time, so that
+/// changing a value back to its default while playing lands too.
+///
+/// `sub-ass-override` is `yes` unless the viewer asked otherwise, so a styled
+/// track keeps its own size, fonts and colours. Not mpv's default, `scale`,
+/// which hands it `sub-scale` as well. `force` repaints it whole. See
+/// [`SubtitleStyle`] for why that is opt-in. `sub-pos` reaches a styled track
+/// under `yes` too, so where a styled track sits is the caller's to decide:
+/// see `pstr-app`'s `Playback::lift_subtitles`.
+/// The border options come last, led by [`BORDER_STYLE`].
+pub fn subtitle_options(style: &SubtitleStyle) -> Vec<(&'static str, String)> {
+    let flag = |on: bool| if on { "yes" } else { "no" }.to_owned();
+    let mut options = vec![
+        (
+            "sub-ass-override",
+            if style.restyle_styled { "force" } else { "yes" }.to_owned(),
+        ),
+        ("sub-scale", format!("{:.2}", style.scale)),
+        (
+            "sub-font",
+            style
+                .font
+                .clone()
+                .unwrap_or_else(|| SubtitleStyle::DEFAULT_FONT.to_owned()),
+        ),
+        ("sub-bold", flag(style.bold)),
+        ("sub-italic", flag(style.italic)),
+        ("sub-color", style.colour.to_mpv()),
+        // mpv's name for the shadow's colour, older than the shadow alias.
+        ("sub-back-color", style.shadow_colour.to_mpv()),
+        ("sub-shadow-offset", format!("{:.2}", style.shadow_offset)),
+        ("sub-blur", format!("{:.2}", style.blur)),
+        ("sub-pos", format!("{:.0}", style.position)),
+    ];
+    match style.backdrop {
+        SubtitleBackdrop::Outline => options.extend([
+            (BORDER_STYLE, "outline-and-shadow".to_owned()),
+            ("sub-outline-color", style.outline_colour.to_mpv()),
+            ("sub-outline-size", format!("{:.2}", style.outline_size)),
+        ]),
+        // `opaque-box` draws the outline as a box hugging each line, so the
+        // outline's colour and size become the box's colour and margin.
+        SubtitleBackdrop::Box => options.extend([
+            (BORDER_STYLE, "opaque-box".to_owned()),
+            ("sub-outline-color", style.box_colour.to_mpv()),
+            ("sub-outline-size", "6".to_owned()),
+        ]),
+    }
+    options
+}
+
+/// Hand `style` to `set` option by option, best effort.
+///
+/// An option this libmpv refuses costs that option, not the player:
+/// `sub-border-style` is mpv 0.38's, and Ubuntu 24.04 ships 0.37. A refused
+/// border style ends the run, though, because what follows it only makes sense
+/// on top of it: a box's colour and margin on a plain outline is a fat smear.
+fn apply_subtitle_options(style: &SubtitleStyle, mut set: impl FnMut(&str, &str) -> Result<()>) {
+    for (name, value) in subtitle_options(style) {
+        if let Err(error) = set(name, &value) {
+            tracing::warn!("subtitle style {name}={value}: {error}");
+            if name == BORDER_STYLE {
+                break;
+            }
+        }
+    }
+}
+
 /// mpv's borrowed event to ours.
 fn translate(event: Event<'_>) -> PlayerEvent {
    match event {
@@ -552,6 +711,81 @@ fn translate(event: Event<'_>) -> PlayerEvent {
 mod tests {
    use super::*;

+    fn option<'a>(options: &'a [(&'static str, String)], name: &str) -> Option<&'a str> {
+        options
+            .iter()
+            .find(|(option, _)| *option == name)
+            .map(|(_, value)| value.as_str())
+    }
+
+    #[test]
+    fn the_default_subtitle_style_is_what_mpv_would_do_anyway() {
+        let options = subtitle_options(&SubtitleStyle::default());
+        // mpv 0.41's own defaults, from `mpv --list-options` — all but
+        // `sub-ass-override`, which mpv has at `scale`.
+        for (name, value) in [
+            ("sub-ass-override", "yes"),
+            ("sub-scale", "1.00"),
+            ("sub-font", "sans-serif"),
+            ("sub-bold", "no"),
+            ("sub-italic", "no"),
+            ("sub-color", "#FFFFFFFF"),
+            ("sub-back-color", "#AF000000"),
+            ("sub-shadow-offset", "0.00"),
+            ("sub-blur", "0.00"),
+            ("sub-pos", "100"),
+            ("sub-border-style", "outline-and-shadow"),
+            ("sub-outline-color", "#FF000000"),
+            ("sub-outline-size", "1.65"),
+        ] {
+            assert_eq!(option(&options, name), Some(value), "{name}");
+        }
+    }
+
+    #[test]
+    fn a_boxed_subtitle_style_turns_the_outline_into_a_box_of_its_colour() {
+        let style = SubtitleStyle {
+            backdrop: SubtitleBackdrop::Box,
+            box_colour: pstr_core::prefs::Colour::rgba(0x20, 0x10, 0x00, 0x80),
+            ..SubtitleStyle::default()
+        };
+        let options = subtitle_options(&style);
+        assert_eq!(option(&options, "sub-border-style"), Some("opaque-box"));
+        assert_eq!(option(&options, "sub-outline-color"), Some("#80201000"));
+    }
+
+    #[test]
+    fn styled_subtitles_are_repainted_or_resized_only_when_asked() {
+        // `scale` would hand a styled track the size; `yes` hands it nothing
+        // but the `sub-ass-*` options, none of which this sets.
+        let kept = subtitle_options(&SubtitleStyle {
+            scale: 1.5,
+            ..SubtitleStyle::default()
+        });
+        assert_eq!(option(&kept, "sub-ass-override"), Some("yes"));
+        let repainted = subtitle_options(&SubtitleStyle {
+            restyle_styled: true,
+            ..SubtitleStyle::default()
+        });
+        assert_eq!(option(&repainted, "sub-ass-override"), Some("force"));
+    }
+
+    #[test]
+    fn a_refused_border_style_skips_what_depends_on_it_and_nothing_before() {
+        let mut set = Vec::new();
+        apply_subtitle_options(&SubtitleStyle::default(), |name, _| {
+            set.push(name.to_owned());
+            if name == BORDER_STYLE {
+                Err(Error::NulByte("test"))
+            } else {
+                Ok(())
+            }
+        });
+        assert_eq!(set.last().map(String::as_str), Some(BORDER_STYLE));
+        assert!(set.iter().any(|name| name == "sub-color"));
+        assert!(!set.iter().any(|name| name == "sub-outline-color"));
+    }
+
    #[test]
    fn every_end_reason_maps_to_something_the_ui_can_act_on() {
        use libmpv2::mpv_end_file_reason as raw;
@@ -12,6 +12,7 @@
 //! an empty string.

 use libmpv2::Mpv;
+use pstr_core::subtitles::{SubtitleTrack, full_instead};

 /// What a track carries.
 #[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
@@ -69,6 +70,9 @@ pub struct Track {
    pub selected: bool,
    /// Whether the container marks it as the default choice.
    pub default: bool,
+    /// Whether the container marks it as forced: a subtitle track of the
+    /// on-screen text alone.
+    pub forced: bool,
    /// True for a track added from outside the file — a sidecar subtitle. None
    /// of ours are, yet.
    pub external: bool,
@@ -152,9 +156,22 @@ pub fn pick_track(
    )
 }

-/// Whether two container tags name the same language: "en" and "eng" do.
-fn same_language(a: &str, b: &str) -> bool {
-    a.eq_ignore_ascii_case(b) || language_name(a) == language_name(b)
+/// The dialogue track to play in place of the subtitle track mpv chose, when
+/// mpv chose signs and songs; see [`pstr_core::subtitles::full_instead`].
+pub fn full_subtitles_instead(tracks: &[Track]) -> Option<i64> {
+    let subtitles: Vec<_> = tracks
+        .iter()
+        .filter(|track| track.kind == TrackKind::Subtitle)
+        .map(|track| SubtitleTrack {
+            id: track.id,
+            language: track.language.clone(),
+            title: track.title.clone(),
+            default: track.default,
+            forced: track.forced,
+            selected: track.selected,
+        })
+        .collect();
+    full_instead(&subtitles)
 }

 fn read_one(mpv: &Mpv, index: i64) -> Option<Track> {
@@ -172,6 +189,7 @@ fn read_one(mpv: &Mpv, index: i64) -> Option<Track> {
        codec: text(mpv, index, "codec"),
        selected: flag(mpv, index, "selected"),
        default: flag(mpv, index, "default"),
+        forced: flag(mpv, index, "forced"),
        external: flag(mpv, index, "external"),
    })
 }
@@ -190,63 +208,7 @@ fn flag(mpv: &Mpv, index: i64, field: &str) -> bool {
        .unwrap_or(false)
 }

-/// A readable name for a language tag, falling back to the tag itself.
-///
-/// Deliberately a short list rather than a full ISO 639 table: it covers what
-/// the shares this app is pointed at actually contain, and an unrecognised tag
-/// still shows as something a viewer can pick between — `"por-BR"` reads fine
-/// on its own.
-pub fn language_name(tag: &str) -> String {
-    // Container tags come in both the two- and three-letter forms, and often
-    // with a region suffix: "en", "eng", "en-US", "pt-BR".
-    let base = tag
-        .split(['-', '_'])
-        .next()
-        .unwrap_or(tag)
-        .to_ascii_lowercase();
-
-    let name = match base.as_str() {
-        "en" | "eng" => "English",
-        "ja" | "jpn" => "Japanese",
-        "de" | "ger" | "deu" => "German",
-        "fr" | "fre" | "fra" => "French",
-        "es" | "spa" => "Spanish",
-        "it" | "ita" => "Italian",
-        "pt" | "por" => "Portuguese",
-        "nl" | "dut" | "nld" => "Dutch",
-        "ru" | "rus" => "Russian",
-        "pl" | "pol" => "Polish",
-        "sv" | "swe" => "Swedish",
-        "da" | "dan" => "Danish",
-        "no" | "nor" => "Norwegian",
-        "fi" | "fin" => "Finnish",
-        "cs" | "cze" | "ces" => "Czech",
-        "hu" | "hun" => "Hungarian",
-        "tr" | "tur" => "Turkish",
-        "ar" | "ara" => "Arabic",
-        "he" | "heb" => "Hebrew",
-        "hi" | "hin" => "Hindi",
-        "ko" | "kor" => "Korean",
-        "zh" | "chi" | "zho" => "Chinese",
-        "th" | "tha" => "Thai",
-        "vi" | "vie" => "Vietnamese",
-        "uk" | "ukr" => "Ukrainian",
-        "ro" | "rum" | "ron" => "Romanian",
-        "el" | "gre" | "ell" => "Greek",
-        "id" | "ind" => "Indonesian",
-        "ms" | "may" | "msa" => "Malay",
-        _ => return tag.to_string(),
-    };
-
-    // The region matters when there is one — Brazilian Portuguese is not
-    // Portuguese to anyone choosing between the two.
-    match tag.split_once(['-', '_']) {
-        Some((_, region)) if !region.is_empty() => {
-            format!("{name} ({})", region.to_ascii_uppercase())
-        }
-        _ => name.to_string(),
-    }
-}
+pub use pstr_core::language::{LANGUAGES, language_name, same_language};

 #[cfg(test)]
 mod tests {
@@ -261,6 +223,7 @@ mod tests {
            codec: None,
            selected: false,
            default: false,
+            forced: false,
            external: false,
        }
    }
@@ -282,16 +245,6 @@ mod tests {
        assert_eq!(sub.label(), "English — Signs & Songs [ass]");
    }

-    #[test]
-    fn language_tags_resolve_in_both_iso_forms_and_keep_their_region() {
-        assert_eq!(language_name("jpn"), "Japanese");
-        assert_eq!(language_name("ja"), "Japanese");
-        assert_eq!(language_name("pt-BR"), "Portuguese (BR)");
-        // An unknown tag is shown as it stands rather than as "Unknown", which
-        // would make two of them indistinguishable.
-        assert_eq!(language_name("mis"), "mis");
-    }
-
    fn named(kind: TrackKind, id: i64, language: Option<&str>, title: Option<&str>) -> Track {
        Track {
            language: language.map(Into::into),
@@ -42,4 +42,4 @@ pub use proton_sdk::ids::NodeUid;
 pub use reader::{FileBlocks, LibraryOpener, RevisionBlocks};
 pub use ring::{DEFAULT_RING_BYTES, RingStats};
 pub use source::{RevisionOpener, StreamConfig, StreamSource};
-pub use stream::{DEFAULT_READAHEAD_BLOCKS, StreamStats, VideoStream};
+pub use stream::{COPY_BLOCKS_IN_FLIGHT, DEFAULT_READAHEAD_BLOCKS, StreamStats, VideoStream};
@@ -13,7 +13,6 @@ use std::sync::Arc;
 use std::time::Duration;

 use async_trait::async_trait;
-use proton_drive_rs::ProtonDrivePublicLinkClient;
 use proton_sdk::error::ProtonError;
 use proton_sdk::ids::NodeUid;

@@ -159,7 +158,7 @@ impl LibraryOpener {
        Self { library }
    }

-    fn client(&self, share_id: &str) -> Result<&ProtonDrivePublicLinkClient> {
+    fn client(&self, share_id: &str) -> Result<&pstr_core::ShareClient> {
        self.library
            .client(share_id)
            .ok_or_else(|| Error::NotFound(format!("share {share_id} is not open")))
@@ -63,6 +63,12 @@ const MAX_CONCURRENT_BLOCKS_PER_READ: usize = 4;
 /// bandwidth on cancelled prefetches. Well past a 1080p bitrate either way.
 pub const DEFAULT_READAHEAD_BLOCKS: usize = 12;

+/// How many blocks of one offline copy are fetched at once, for
+/// [`VideoStream::blocks_in_order`]. The same as one read is allowed, for the
+/// same reason: enough to hide a round trip, few enough that a couple of
+/// copies running together do not swamp a player.
+pub const COPY_BLOCKS_IN_FLIGHT: usize = 4;
+
 /// How far a read may land from where the previous one ended and still count as
 /// a continuation rather than a seek.
 ///
@@ -217,20 +223,48 @@ impl VideoStream {
    /// seek, and a seek cancels read-ahead — which here would cancel the very
    /// fetch it was meant to have started.
    pub fn warm_edges(&self) {
-        let Ok(runtime) = tokio::runtime::Handle::try_current() else {
-            return;
-        };
        let count = self.inner.map.len();
        let edges: &[usize] = match count {
            0 => &[],
            1 => &[0],
            _ => &[0, count - 1],
        };
-        for &index in edges {
+        self.warm(edges);
+    }
+
+    /// [`Self::warm_edges`], and the block `fraction` of the way through the
+    /// file: where a resumed episode seeks once its index is read.
+    ///
+    /// An estimate, from the bytes being spread evenly over the running time.
+    /// A video's bitrate is not even, so it can land a block off the one the
+    /// seek wants. Then it is one block fetched for nothing, against a round
+    /// trip saved, after the two the edges cost, when it lands.
+    pub fn warm_resume(&self, fraction: f64) {
+        self.warm_edges();
+        if !(0.0..1.0).contains(&fraction) {
+            return;
+        }
+        let offset = (self.inner.map.size() as f64 * fraction) as u64;
+        let count = self.inner.map.len();
+        if let Some(index) = self.inner.map.block_at(offset)
+            && index != 0
+            && index + 1 != count
+        {
+            self.warm(&[index]);
+        }
+    }
+
+    /// Fetch these blocks in the background. Detached: see
+    /// [`Self::warm_edges`] for why not read-ahead.
+    fn warm(&self, indices: &[usize]) {
+        let Ok(runtime) = tokio::runtime::Handle::try_current() else {
+            return;
+        };
+        for &index in indices {
            let inner = Arc::clone(&self.inner);
            runtime.spawn(async move {
                if let Err(error) = block_at(inner, index).await {
-                    tracing::debug!(index, %error, "warming an edge block failed");
+                    tracing::debug!(index, %error, "warming a block failed");
                }
            });
        }
@@ -299,6 +333,42 @@ impl VideoStream {
        Ok(buf)
    }

+    /// Every block from `first` on, fetched `in_flight` at a time and yielded
+    /// in file order.
+    ///
+    /// What an offline copy reads through. File order is what a partial file's
+    /// "its length is a block boundary" resume rule needs, and a few blocks in
+    /// flight is what keeps a copy from running one round trip per block. Use
+    /// it on a stream from [`crate::StreamSource::open_for_copy`]: a playback
+    /// stream would add its own read-ahead on top.
+    pub fn blocks_in_order(
+        &self,
+        first: usize,
+        in_flight: usize,
+    ) -> futures::stream::BoxStream<'static, Result<Vec<u8>>> {
+        let start: u64 = self.block_sizes()[..first.min(self.block_sizes().len())]
+            .iter()
+            .sum();
+        let ranges: Vec<(u64, u64)> = self
+            .block_sizes()
+            .iter()
+            .skip(first)
+            .scan(start, |offset, size| {
+                let range = (*offset, *size);
+                *offset += size;
+                Some(range)
+            })
+            .collect();
+        let stream = self.clone();
+        stream::iter(ranges)
+            .map(move |(offset, size)| {
+                let stream = stream.clone();
+                async move { stream.read_range(offset, size).await }
+            })
+            .buffered(in_flight.max(1))
+            .boxed()
+    }
+
    pub fn stats(&self) -> StreamStats {
        StreamStats {
            ring: self.inner.ring.stats(),
@@ -995,6 +1065,21 @@ mod tests {
        assert_eq!(fake.fetches(), 2);
    }

+    #[tokio::test]
+    async fn warming_a_resume_fetches_the_block_that_far_in_besides_the_edges() {
+        let fake = Fake::new(&[1000; 10]);
+        let stream = stream_over(Arc::clone(&fake), 0);
+
+        stream.warm_resume(0.45);
+        assert!(
+            eventually(|| {
+                fake.fetches_of(0) == 1 && fake.fetches_of(4) == 1 && fake.fetches_of(9) == 1
+            })
+            .await
+        );
+        assert_eq!(fake.fetches(), 3);
+    }
+
    #[tokio::test]
    async fn a_fetched_block_reaches_the_disk_cache_without_the_read_waiting_for_it() {
        let disk = disk_in("fill").await;
@@ -0,0 +1,69 @@
+# Account and sync
+
+Signing in to Proton is optional. Without it, the app plays public share links and keeps
+everything on one device. Signing in adds two things:
+
+- **Folders of your own Drive** as shares, with no link to copy.
+- **Sync** of your place in every episode, your shares and your settings, across every device
+  you sign in on.
+
+## Signing in
+
+The **Proton account** section is at the top of the **Shares** page.
+
+1. Enter your Proton address and password, then **Sign in**.
+2. If your account has two-factor authentication, enter the code from your authenticator app.
+3. If your account has a separate mailbox password, enter it and choose **Unlock**.
+
+Proton sometimes asks to confirm you are human. The app then opens a small window with Proton's
+own CAPTCHA page. Solve it, and sign-in continues.
+
+The app keeps a session, not your password. The session goes into the system keyring. **Sign
+out** ends it on Proton's side and deletes it here.
+
+Not supported yet:
+
+- **Security keys** (FIDO2). An account whose only second factor is a security key cannot sign
+  in. Add an authenticator app as a second method in your Proton settings.
+- **Email or SMS verification** instead of a CAPTCHA.
+
+## Adding a folder of your Drive
+
+1. Sign in.
+2. Under **Add from your Drive**, choose **Browse your Drive**.
+3. Open folders until you reach the one that holds your videos.
+4. Choose **Add this folder**.
+
+The folder becomes a share like any link: it is crawled, shown in the library and streamed. It is
+read through your account, so there is no link or password to store. The same folder has the
+same identity on every device, so watch history follows it.
+
+## Sync
+
+When you are signed in, each device keeps a small file in your Drive. You find them under
+**Computers** on the Proton Drive website, in a device called `proton-stream`, in the folder
+`watch-history`.
+
+**What syncs:**
+
+- Where you stopped in each episode, and which episodes you watched
+- Your shares, including their links and passwords (end-to-end encrypted, like every file in
+  your Drive)
+- Settings: playback, appearance and posters and descriptions, including a TMDB key
+- Matches you picked by hand, and your audio and subtitle choice for each show
+
+**What stays on each device:** volume and mute, the streaming cache size, text size, Wi-Fi only,
+background audio, hardware decoding, window size, and the library's filter and sort order.
+
+**When it syncs:** when the app starts, every 5 minutes while it is open, when you stop playing,
+and when it closes. **Sync now** runs it at once. Android also syncs in the background shortly
+after you leave the app.
+
+**How conflicts are settled:** each device writes only its own file, and reads everyone else's.
+For each episode and each setting, the newest change wins. A device that signs in for the first
+time takes the others' state and does not overwrite it with its own defaults.
+
+A device that has not synced for 90 days has its file moved to the Drive trash.
+
+The status line under your address says how the last sync went, for example *Synced 3 min ago ·
+2 positions from other devices*. To stop syncing, sign out.
@@ -7,6 +7,18 @@ screens, while UniFFI exposes the existing catalog, share, streaming, watch-stat
 and offline logic. Keep reusable behavior in the Rust crates rather than
 reimplementing it in Kotlin.

+## Android TV
+
+The same build installs on Android TV: it is listed in the TV launcher
+(`LEANBACK_LAUNCHER`, with the banner `scripts/render-tv-banner.sh` renders)
+and requires neither a touch screen nor leanback. Every screen is Compose
+`clickable`s, which the D-pad already moves between. The player takes a
+remote's keys while its controls are down: left and right seek ten seconds,
+the middle button brings the controls up, and play/pause works as on a
+keyboard. There is no TV-specific layout yet, and none of it has been run on a
+TV. Signing in to an account, so that shares arrive through sync, is the way
+to set one up without typing a share link on a remote.
+
 ## Toolchain

 Install JDK 17, Android SDK Platform/Build Tools 36, NDK
@@ -55,15 +67,15 @@ installs the signed minified APK and runs instrumentation against it, which is
 the only path that exercises R8 — the step that has broken this app five distinct
 ways that a debug build cannot reproduce. Without the `ANDROID_RELEASE_*`
 variables below, drop `--release` and the debug APK is used instead. The matrix — phone and tablet layouts, rotation,
-process recreation, playback and background controls, Picture-in-Picture,
+process recreation, playback and background controls,
 download cancellation/resume, and an offline launch with networking disabled —
 is `scripts/android-acceptance.sh`; `--list` prints every case and what it
 needs, and `PSTR_ACCEPTANCE_ONLY=name` runs one. Five cases need a real share,
 given as `PSTR_ACCEPTANCE_SHARE_URL` and `PSTR_ACCEPTANCE_SHARE_PASSWORD`; they
 reach the device as instrumentation arguments and are stored nowhere. Without
-them those cases report `skip`. `picture-in-picture` is still `pending`, so the
-run tells you the matrix is incomplete — but no longer because of B40, which is
-fixed; the case now just needs writing. `docs/TESTING.md` has the layer-by-layer
+them those cases report `skip`. There is no Picture-in-Picture: it was removed
+after a PiP window that never sized its video right proved less use than
+background audio and the lock-screen transport. `docs/TESTING.md` has the layer-by-layer
 detail, including why lint runs against a baseline.

 Requires JDK 17. `build-android.sh` locates it, because a newer JVM does not
@@ -110,6 +122,6 @@ ABIs, plus a source archive and revision record, under
 packages the staged libraries, and compiles `pstr_mpv`, the JNI/EGL adapter. It
 feeds libmpv through the Rust stream C ABI; decrypted bytes remain in native
 memory. `PlaybackService` owns the mpv core for background audio and media
-controls, while the activity supplies the current `Surface` and enters PiP.
+controls, while the activity supplies the current `Surface`.
 Do not publish an Android binary until this exact pipeline is verified on real
 arm64 hardware and an x86_64 emulator.