chore: ignore bin directory in git repository

The fingerprint row reused the no-name placeholder as its label, so it read
"A nearby device — aaab1c58", and it duplicated the device id shown
directly beneath it. Now one selectable full id, which is what someone
comparing devices actually needs.

.claude/settings.local.json

@@ -0,0 +1,7 @@
+{
+  "permissions": {
+    "allow": [
+      "Bash(swift test *)"
+    ]
+  }
+}

.gitignore

@@ -20,9 +20,11 @@ node_modules/
 target/
 .junie
 config.override.mk
+bin/
 
 # Local design export scratch
 output/
+.scratch/
 .screenshots
 apple/RELEASE-MACOS.md
 apple/Generated/*.xcconfig

Cargo.lock

@@ -219,6 +219,18 @@ dependencies = [
  "syn 2.0.118",
 ]
 
+[[package]]
+name = "async-broadcast"
+version = "0.7.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "435a87a52755b8f27fcf321ac4f04b2802e337c8c4872923137471ec39c37532"
+dependencies = [
+ "event-listener",
+ "event-listener-strategy",
+ "futures-core",
+ "pin-project-lite",
+]
+
 [[package]]
 name = "async-channel"
 version = "2.5.0"
@@ -244,6 +256,17 @@ dependencies = [
  "tokio",
 ]
 
+[[package]]
+name = "async-recursion"
+version = "1.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3b43422f69d8ff38f95f1b2bb76517c91589a924d1559a0e935d7c8ce0274c11"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.118",
+]
+
 [[package]]
 name = "async-trait"
 version = "0.1.89"
@@ -421,6 +444,15 @@ dependencies = [
  "hybrid-array",
 ]
 
+[[package]]
+name = "block-padding"
+version = "0.3.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a8894febbff9f758034a5b8e12d87918f56dfc64a8e1fe757d65e29041538d93"
+dependencies = [
+ "generic-array",
+]
+
 [[package]]
 name = "block2"
 version = "0.6.2"
@@ -483,6 +515,15 @@ dependencies = [
  "thiserror 2.0.18",
 ]
 
+[[package]]
+name = "cbc"
+version = "0.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "26b52a9543ae338f279b96b0b9fed9c8093744685043739079ce85cd58f289a6"
+dependencies = [
+ "cipher",
+]
+
 [[package]]
 name = "cc"
 version = "1.2.65"
@@ -864,7 +905,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ccc2776f0c61eca1ca32528f85548abd1a4be8fb53d1b21c013e4f18da1e7090"
 dependencies = [
  "data-encoding",
- "syn 1.0.109",
+ "syn 2.0.118",
 ]
 
 [[package]]
@@ -1049,6 +1090,12 @@ version = "0.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "edd0f118536f44f5ccd48bcb8b111bdc3de888b58c74639dfb034a357d0f206d"
 
+[[package]]
+name = "endi"
+version = "1.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "66b7e2430c6dff6a955451e2cfc438f09cea1965a9d6f87f7e3b90decc014099"
+
 [[package]]
 name = "enum-assoc"
 version = "1.3.0"
@@ -1060,6 +1107,27 @@ dependencies = [
  "syn 2.0.118",
 ]
 
+[[package]]
+name = "enumflags2"
+version = "0.7.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1027f7680c853e056ebcec683615fb6fbbc07dbaa13b4d5d9442b146ded4ecef"
+dependencies = [
+ "enumflags2_derive",
+ "serde",
+]
+
+[[package]]
+name = "enumflags2_derive"
+version = "0.7.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "67c78a4d8fdf9953a5c9d458f9efe940fd97a0cab0941c075a813ac594733827"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.118",
+]
+
 [[package]]
 name = "equivalent"
 version = "1.0.2"
@@ -1930,6 +1998,7 @@ version = "0.1.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "879f10e63c20629ecabbb64a8010319738c66a5cd0c29b02d63d272b03751d01"
 dependencies = [
+ "block-padding",
  "generic-array",
 ]
 
@@ -2511,6 +2580,15 @@ version = "2.8.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "88904434abc2901f197fe8cc55f0445e7ded921dba5911dad2e2b39b48e663c4"
 
+[[package]]
+name = "memoffset"
+version = "0.9.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "488016bfae457b036d996092f6cb448677611ce4449e970ceaf42695203f218a"
+dependencies = [
+ "autocfg",
+]
+
 [[package]]
 name = "minimal-lexical"
 version = "0.2.1"
@@ -2811,6 +2889,20 @@ dependencies = [
  "windows-sys 0.61.2",
 ]
 
+[[package]]
+name = "num"
+version = "0.4.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "35bd024e8b2ff75562e5f34e7f4905839deb4b22955ef5e73d2fea1b9813cb23"
+dependencies = [
+ "num-bigint",
+ "num-complex",
+ "num-integer",
+ "num-iter",
+ "num-rational",
+ "num-traits",
+]
+
 [[package]]
 name = "num-bigint"
 version = "0.4.6"
@@ -2837,6 +2929,15 @@ dependencies = [
  "zeroize",
 ]
 
+[[package]]
+name = "num-complex"
+version = "0.4.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "73f88a1307638156682bada9d7604135552957b7818057dcef22705b4d509495"
+dependencies = [
+ "num-traits",
+]
+
 [[package]]
 name = "num-conv"
 version = "0.2.2"
@@ -2863,6 +2964,17 @@ dependencies = [
  "num-traits",
 ]
 
+[[package]]
+name = "num-rational"
+version = "0.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f83d14da390562dca69fc84082e73e548e1ad308d24accdedd2720017cb37824"
+dependencies = [
+ "num-bigint",
+ "num-integer",
+ "num-traits",
+]
+
 [[package]]
 name = "num-traits"
 version = "0.2.19"
@@ -3032,6 +3144,16 @@ version = "0.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7c87def4c32ab89d880effc9e097653c8da5d6ef28e6b539d313baaacfbafcbe"
 
+[[package]]
+name = "ordered-stream"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9aa2b01e1d916879f73a53d01d1d6cee68adbb31d6d9177a8cfce093cced1d50"
+dependencies = [
+ "futures-core",
+ "pin-project-lite",
+]
+
 [[package]]
 name = "papaya"
 version = "0.2.4"
@@ -3866,6 +3988,25 @@ dependencies = [
  "syn 2.0.118",
 ]
 
+[[package]]
+name = "secret-service"
+version = "5.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9a62d7f86047af0077255a29494136b9aaaf697c76ff70b8e49cded4e2623c14"
+dependencies = [
+ "aes",
+ "cbc",
+ "futures-util",
+ "generic-array",
+ "getrandom 0.2.17",
+ "hkdf",
+ "num",
+ "once_cell",
+ "serde",
+ "sha2 0.10.9",
+ "zbus",
+]
+
 [[package]]
 name = "security-framework"
 version = "3.7.0"
@@ -3974,6 +4115,17 @@ dependencies = [
  "zmij",
 ]
 
+[[package]]
+name = "serde_repr"
+version = "0.1.21"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8d3b1629de253c70a0508c3899572da79ca359fdab27c7920ff00406df418906"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 3.0.3",
+]
+
 [[package]]
 name = "serde_spanned"
 version = "1.1.1"
@@ -4485,6 +4637,17 @@ dependencies = [
  "unicode-ident",
 ]
 
+[[package]]
+name = "syn"
+version = "3.0.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "53e9bae58849f64dfa4f5d5ae372c8341f7305f82a3868709269343628b659a3"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "unicode-ident",
+]
+
 [[package]]
 name = "syn-mid"
 version = "0.5.4"
@@ -4550,7 +4713,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "32497e9a4c7b38532efcdebeef879707aa9f794296a4f0244f6f69e9bc8574bd"
 dependencies = [
  "fastrand",
- "getrandom 0.3.4",
+ "getrandom 0.4.3",
  "once_cell",
  "rustix",
  "windows-sys 0.61.2",
@@ -4684,6 +4847,7 @@ dependencies = [
  "signal-hook-registry",
  "socket2",
  "tokio-macros",
+ "tracing",
  "windows-sys 0.61.2",
 ]
 
@@ -4977,6 +5141,17 @@ version = "1.20.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b6f5e870be6c3b371b77fe0ee0bafb859fa4964b4404c27de1d380043c4dda20"
 
+[[package]]
+name = "uds_windows"
+version = "1.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f2f6fb2847f6742cd76af783a2a2c49e9375d0a111c7bef6f71cd9e738c72d6e"
+dependencies = [
+ "memoffset",
+ "tempfile",
+ "windows-sys 0.61.2",
+]
+
 [[package]]
 name = "unicode-bidi"
 version = "0.3.18"
@@ -5227,14 +5402,19 @@ dependencies = [
  "data-encoding",
  "futures",
  "futures-lite",
+ "getrandom 0.3.4",
  "iroh",
  "iroh-blobs",
  "iroh-relay",
  "irpc",
  "irpc-iroh",
+ "jni 0.21.1",
  "libc",
  "n0-future",
+ "ndk-context",
  "num_cpus",
+ "secret-service",
+ "security-framework",
  "serde",
  "serde_json",
  "sqlx",
@@ -5247,6 +5427,7 @@ dependencies = [
  "uniffi",
  "uuid",
  "walkdir",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -5442,7 +5623,7 @@ version = "0.1.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c2a7b1c03c876122aa43f3020e6c3c3ee5c05081c9a00739faf7503aeba10d22"
 dependencies = [
- "windows-sys 0.48.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -5916,6 +6097,62 @@ dependencies = [
  "synstructure",
 ]
 
+[[package]]
+name = "zbus"
+version = "5.18.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fe18fb60dc696039e738717b76eaea21e7a4489bbb1885020b43c94236d7e98a"
+dependencies = [
+ "async-broadcast",
+ "async-recursion",
+ "async-trait",
+ "enumflags2",
+ "event-listener",
+ "futures-core",
+ "futures-lite",
+ "hex",
+ "libc",
+ "ordered-stream",
+ "rustix",
+ "serde",
+ "serde_repr",
+ "tokio",
+ "tracing",
+ "uds_windows",
+ "uuid",
+ "windows-sys 0.61.2",
+ "winnow 1.0.3",
+ "zbus_macros",
+ "zbus_names",
+ "zvariant",
+]
+
+[[package]]
+name = "zbus_macros"
+version = "5.18.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fe96480bed92df2b442a1a30df364e12d08eed03aeb061f2b8dc6afb2be91119"
+dependencies = [
+ "proc-macro-crate",
+ "proc-macro2",
+ "quote",
+ "syn 2.0.118",
+ "zbus_names",
+ "zvariant",
+ "zvariant_utils",
+]
+
+[[package]]
+name = "zbus_names"
+version = "4.3.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d8bf88b4a3ff53e883001e0e0115b297a9d53c31b9c1edd2bfdd853e3428624e"
+dependencies = [
+ "serde",
+ "winnow 1.0.3",
+ "zvariant",
+]
+
 [[package]]
 name = "zerocopy"
 version = "0.8.52"
@@ -6015,3 +6252,43 @@ name = "zmij"
 version = "1.0.21"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b8848ee67ecc8aedbaf3e4122217aff892639231befc6a1b58d29fff4c2cabaa"
+
+[[package]]
+name = "zvariant"
+version = "5.13.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bee2a0bcd2a907786a456fff45aaaaf54c9ba5f50b71ae9ec1a4edd200c94911"
+dependencies = [
+ "endi",
+ "enumflags2",
+ "serde",
+ "winnow 1.0.3",
+ "zvariant_derive",
+ "zvariant_utils",
+]
+
+[[package]]
+name = "zvariant_derive"
+version = "5.13.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "38a708216a18780796770bfe3f4739c7c83a3e8f789b755534bbbc06e4e23e12"
+dependencies = [
+ "proc-macro-crate",
+ "proc-macro2",
+ "quote",
+ "syn 2.0.118",
+ "zvariant_utils",
+]
+
+[[package]]
+name = "zvariant_utils"
+version = "3.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "90cb9383f9b45290407a1258b202d3f8f01db719eb60b4e4055c6375af4fc7c7"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "serde",
+ "syn 2.0.118",
+ "winnow 1.0.3",
+]

DESIGN-DEVICE-HISTORY.md

@@ -0,0 +1,524 @@
+# Design — Saved devices and targeted transfers
+
+Status: **proposed for the experimental 0.3.x line**.
+
+This document supersedes the previous device-history design. The implementation
+currently on `feat/device-history` is an unreleased prototype. Its database and
+wire formats are not compatibility commitments and may be replaced.
+
+The feature lets two VniDrop installations remember one another after a
+successful transfer, with explicit consent on both devices. A saved device can
+then request a new transfer without another invitation, QR scan, or NFC tap.
+The receiver must still approve every transfer.
+
+The Rust core, protocol, persistence, credential-storage integration, and
+platform contracts are the first delivery scope. Product UI is intentionally
+deferred to a separate design and implementation session.
+
+---
+
+## 1. Vocabulary and invariants
+
+### Saved device
+
+A `SavedDevice` is a remote VniDrop **app-installation identity**. It is not a
+person, account, address-book contact, or reliably identifiable piece of
+physical hardware.
+
+The identity is the remote iroh endpoint identity. A reinstall or unrecoverable
+endpoint-key loss creates a new identity and requires a new successful transfer
+and mutual consent. Display names, platform hints, IP addresses, and physical
+device properties must never merge identities.
+
+### Device relationship
+
+A `DeviceRelationship` is a mutually acknowledged relationship between two
+saved-device identities. It contains two directional grants: one issued in
+each direction. The relationship is usable only after both grants have been
+acknowledged.
+
+### Targeted transfer
+
+A `TargetedTransfer` is an immutable one-sender, one-receiver transfer. It is a
+separate domain from the existing invitation-based `Share`, which may serve
+multiple receivers.
+
+The following invariants are mandatory:
+
+- Saving a device requires a fully completed authenticated transfer and
+  explicit consent on both devices.
+- Remembering a device never authorizes automatic receipt. Every targeted
+  transfer requires explicit receiver approval.
+- A targeted transfer has exactly one sender identity, one receiver identity,
+  one transfer ID, and one immutable manifest.
+- Authorization is bound to the selected receiver. A leaked capability or
+  ticket must not authorize any other identity.
+- Relays may forward end-to-end encrypted traffic according to the active
+  network profile, but VniDrop has no intermediary file store, relationship
+  service, delivery queue, push service, or account system.
+- Existing invitation-based transfers retain their current behavior and domain
+  model.
+
+---
+
+## 2. Goals and non-goals
+
+### Goals
+
+- Send to a previously saved device without exchanging another invitation.
+- Make mutual consent cryptographically enforceable rather than a UI promise.
+- Keep receiver approval mandatory for each new transfer.
+- Give forget, revoke, block, cancellation, and deletion immediate local
+  security effect even when the peer is offline.
+- Persist accepted interrupted transfers so they can resume when both devices
+  are online again.
+- Protect endpoint identity keys and relationship secrets with platform-backed
+  credential storage.
+- Provide versioned, typed Rust and UniFFI contracts that every platform can
+  exercise before UI work begins.
+
+### Non-goals
+
+- Automatic acceptance or unattended writes to a receiver's device.
+- Offline store-and-forward, automatic peer polling, background inboxes, or
+  push notifications.
+- Server-side device discovery, relationship storage, history synchronization,
+  backup, export, or restoration onto another installation.
+- Presence indicators or a promise that a suspended mobile application is
+  reachable.
+- Groups or a multi-recipient variant of `TargetedTransfer`.
+- Associating several saved devices with a person or account.
+- UI screens, navigation, wording, and presentation architecture in this phase.
+
+---
+
+## 3. Network and privacy model
+
+Saved-device operations use the same configured iroh network profile as
+ordinary transfers:
+
+- `Automatic` may use configured/default relays and direct paths.
+- Custom-relay modes remain restricted to their configured relays and fallback
+  policy.
+- `LocalOnly` must not silently enable public discovery or a relay.
+
+An endpoint ID authenticates a peer; it is not, by itself, a routable address.
+Address discovery and file transport may use a relay. VniDrop and the endpoints
+still provide end-to-end authentication and encryption, so the relay cannot
+decrypt content or authorize a recipient. A relay may observe transport
+metadata such as network addresses, timing, and volume. VniDrop must not claim
+that relayed traffic is anonymous, metadata-free, or relay-free.
+
+VniDrop does not upload a transfer for later delivery. The sender and receiver
+cores must both be reachable while an offer is negotiated. A relay cannot wake
+a terminated or suspended application. The first release therefore reports a
+typed unavailable or timeout result when the receiver's core cannot answer.
+
+Current direct address candidates may be exchanged over an authenticated
+connection and cached for the connection or a short local lifetime. The app
+must not accumulate a historical IP-address log.
+
+---
+
+## 4. Identity and credential custody
+
+The endpoint private key and all relationship capability secrets are protected
+by platform-backed credential storage:
+
+| Platform | Required protection |
+|---|---|
+| Apple | Keychain with a non-synchronizing, device-appropriate accessibility class |
+| Android | Keystore-backed encryption; only ciphertext may live outside Keystore |
+| Windows | DPAPI scoped to the current user |
+| Linux | Secret Service/libsecret |
+
+There is no plaintext fallback.
+
+Rust owns identity use, cryptographic operations, relationship state, and
+authorization. Platforms provide a narrow secure-secret-store adapter. Public
+bindings exchange opaque handles and typed outcomes, never raw grants, pairing
+tokens, or private keys.
+
+If the endpoint identity key is temporarily unavailable, networking is
+temporarily unavailable because VniDrop cannot authenticate as the same
+endpoint. If the endpoint key is available but relationship grants are not,
+ordinary invitation transfers remain available while saved-device operations
+fail closed. Neither case may generate a replacement identity automatically.
+
+### 4.1 Legacy endpoint-key migration
+
+Migration of an existing endpoint key must be recoverable:
+
+1. Read the legacy key.
+2. Write it to protected storage.
+3. Read it back and prove that it derives the same endpoint ID.
+4. Commit a storage-version marker.
+5. Only then remove the legacy copy.
+
+A crash at any step must preserve at least one valid copy and must not change
+the endpoint identity. Confirmed unrecoverable loss or an explicit identity
+reset is required before replacement.
+
+Secrets must not synchronize through platform cloud backup. Restored metadata
+without its device-bound secrets reconciles to disabled relationships, never a
+cloned identity.
+
+---
+
+## 5. Pairing eligibility
+
+Only a **fully completed authenticated transfer** creates pairing eligibility.
+A handshake, partial download, failed export, cancellation, decline, or failed
+transfer does not qualify. Either the sender or receiver may initiate pairing
+after a qualifying transfer.
+
+During the qualifying transfer, the peers establish a cryptographic,
+single-use pairing eligibility capability bound to:
+
+- Both endpoint identities.
+- The qualifying transfer/session.
+- The saved-device protocol version.
+- A 24-hour local expiry.
+
+The capability becomes usable only after the transfer reaches its durable
+completed state. It is stored locally in encrypted form without filenames or a
+transfer-history record. It is deleted when consumed, declined, expired,
+forgotten, blocked, or reset.
+
+Requests without valid eligibility are silently rejected. This prevents a
+modified stranger from generating unsolicited pairing prompts.
+
+---
+
+## 6. Mutual-consent protocol
+
+The protocol uses explicit pending states rather than exposing partial contacts
+as usable saved devices:
+
+- `PendingOutgoing`
+- `PendingIncoming`
+- `Saved`
+
+The normal exchange is:
+
+1. Alice locally chooses to remember Bob after a qualifying transfer.
+2. Alice sends a token-bound pairing request.
+3. Bob explicitly consents.
+4. Alice and Bob exchange fresh directional grants.
+5. Alice acknowledges Bob's grant.
+6. Both sides activate the relationship as `Saved` only after the mutual
+   exchange is acknowledged.
+
+Failure before activation remains a bounded pending operation and cannot be
+used to initiate a transfer. Pending operations expire and are recoverable or
+cleaned after crashes.
+
+If both devices initiate simultaneously, the protocol deterministically merges
+the attempts using the endpoint identities and the transfer-bound eligibility
+capability. It creates one relationship and one active grant per direction,
+without duplicate prompts or rows.
+
+Declining consumes the eligibility for that qualifying transfer. It cannot
+prompt again. A later completed transfer may establish new eligibility, but
+another request still requires fresh local initiation.
+
+---
+
+## 7. Directional grants
+
+Each direction has one active, high-entropy capability bound to:
+
+- Issuer endpoint identity.
+- Holder endpoint identity.
+- Relationship generation.
+- Minimum negotiated protocol generation.
+
+Proof uses the authenticated iroh channel plus established, domain-separated
+cryptographic primitives, challenge binding, and replay protection. Display
+names, addresses, and transfer IDs alone are never authentication. The protocol
+must have independent, reviewable test vectors.
+
+Relationships do not expire merely through inactivity. They remain until
+forget, block, explicit revocation, identity loss, or reset. Long-unseen devices
+may later be represented as inactive by UI, but inactivity does not silently
+remove permission.
+
+Activating a replacement grant first makes the prior relationship generation
+locally invalid. Exactly one generation is active per direction. Minimal
+non-secret revocation tombstones are retained for as long as an old generation
+could otherwise be replayed; tombstones contain no names, filenames, transfer
+history, or capability material.
+
+An established relationship records its minimum supported protocol generation
+and must never silently downgrade below it.
+
+---
+
+## 8. Forget, block, and identity replacement
+
+### Forget
+
+Forget makes the local relationship and its grants unusable immediately,
+cancels active or resumable targeted transfers for that relationship, removes
+relationship secrets and metadata, and sends a signed/bound best-effort remote
+revocation when possible. Correctness never depends on remote delivery.
+
+An independently approved invitation transfer already in progress may continue
+because it belongs to the existing share domain.
+
+### Block
+
+Block is identity-wide and immediate. It rejects or cancels current and future
+traffic from the blocked endpoint across:
+
+- Pairing and grant operations.
+- Targeted offers and transfers.
+- Ordinary invitation handshakes and transfers.
+- Revocation and probing endpoints, except for indistinguishable rejection
+  needed to avoid exposing block state.
+
+Blocking deletes active relationship grants but retains the minimal identity
+deny record and replay tombstones. Unblocking removes only the deny rule. It
+does not restore grants, relationships, or cancelled transfers. Saving the
+device again requires another qualifying transfer and fresh mutual consent.
+
+A peer reinstall produces a new endpoint identity. It is never linked to the
+old device by name, address, or platform. The old saved entry remains
+unavailable until forgotten; the new identity follows the complete first-
+transfer and consent flow.
+
+---
+
+## 9. Targeted-transfer model
+
+`TargetedTransfer` is not an access mode on an ordinary share. It has its own
+protocol types, repository records, authorization rules, and public APIs.
+Internal blob storage, import, hashing, streaming, and output-sink machinery may
+be reused.
+
+The following fields are immutable after creation:
+
+- Transfer ID.
+- Sender endpoint identity.
+- Receiver endpoint identity.
+- Manifest identity and content hashes.
+- File count and total size.
+
+Sending identical content to several saved devices creates independent
+targeted transfers. Internal blobs may be deduplicated, but approval, progress,
+cancellation, retry, authorization, and durable state remain independent.
+
+The durable state machine is:
+
+```text
+Preparing -> Offering -> AwaitingApproval -> Approved -> Connecting
+          -> Transferring -> Completed
+                         \-> Interrupted -> Connecting
+
+Terminal alternatives: Declined, Cancelled, Failed, Deleted
+```
+
+Rust centrally validates transitions. Platform code invokes typed operations
+and consumes snapshots/events; it cannot fabricate states.
+
+---
+
+## 10. Offer and approval protocol
+
+An offer is online-only and bounded:
+
+1. The sender creates an immutable targeted transfer for one saved-device
+   identity.
+2. The peers authenticate the saved relationship and negotiate the targeted-
+   transfer protocol version.
+3. The sender submits a bounded offer containing a stable transfer ID and an
+   authenticated manifest summary, but no reusable ordinary-share ticket.
+4. The receiver validates all framing, limits, identity bindings, relay-policy
+   compatibility, and manifest claims before surfacing approval.
+5. The receiver explicitly approves or declines.
+6. On approval, the sender issues authorization bound to the exact transfer,
+   manifest, and receiver endpoint.
+7. The receiver pulls the content through the existing safe streaming and
+   output-sink machinery.
+
+The approved authorization covers the exact manifest, content hashes, sizes,
+sender, receiver, transfer ID, and protocol generation. Any mismatch or content
+mutation invalidates the transfer and requires a new transfer ID and approval.
+A leaked capability must fail when presented by another endpoint.
+
+Every operation is idempotent. Replaying the same pairing request, offer,
+approval, acknowledgement, cancellation, or completion returns the existing
+result and cannot create duplicate prompts, grants, authorizations, or rows.
+
+Declining rejects only that transfer. It neither forgets nor blocks the sender.
+
+---
+
+## 11. Online, interruption, and deletion semantics
+
+An unapproved offer exists only in a bounded live-session queue. Sender
+cancellation, decline, timeout, disconnect, or core restart removes it. There
+is no sender-held offline offer, receiver polling loop, background inbox, or
+automatic retry that can produce a later prompt.
+
+After approval, the transfer and its recipient-scoped authorization are
+durable. Interruption retains verified progress and may resume when both devices
+are online again. Resuming the same immutable transfer does not request another
+approval. Changed content or metadata requires a new transfer.
+
+Cancellation before approval withdraws the offer. Cancellation after approval
+stops authorization and active streaming synchronously before asynchronous
+cleanup. It affects only that transfer.
+
+Deletion must make authorization unusable, stop content service for that
+transfer, remove resumable state, and clean related secrets. Remote cleanup is
+best-effort; immediate durable local denial is mandatory.
+
+Several separately approved targeted transfers may run concurrently between
+the same devices under existing global stream and resource limits.
+
+---
+
+## 12. Local data and consistency
+
+The private application database may contain only the relationship and transfer
+metadata needed for the feature, including:
+
+- Endpoint identity/public identifier.
+- User-owned local label and untrusted platform/name hints.
+- Pending/saved/blocked/revoked state and state revision.
+- Opaque secure-store handles.
+- Protocol and relationship generation.
+- Last successful authenticated contact time.
+- Minimal replay and revocation tombstones.
+- Durable targeted-transfer state after approval.
+
+It must not become a transfer-history log. Pairing does not justify retaining
+filenames, previous IP addresses, or lists of past transfers.
+
+Credential-store and SQLite updates cannot share a native transaction. Use
+recoverable staged transitions:
+
+1. Write secret material under a versioned opaque handle.
+2. Verify the protected write.
+3. Commit metadata referencing that handle in a non-active state.
+4. Finalize activation.
+
+Startup reconciliation removes orphaned secrets and disables metadata whose
+required secrets are missing. Revocation becomes locally effective before any
+network notification. Relationship mutations are serialized per remote
+endpoint, while unrelated devices proceed concurrently. Database, relationship,
+and credential-store guards must never be held across network awaits.
+
+---
+
+## 13. Core and platform contract
+
+The Rust core exposes separate typed models and operations for:
+
+- Pairing eligibility and pending pairing requests.
+- Listing, renaming, forgetting, blocking, and unblocking saved devices.
+- Creating and submitting targeted transfers.
+- Approving, declining, cancelling, resuming, and deleting transfers.
+- Querying durable state and current capability availability.
+- Subscribing to typed events carrying stable IDs and monotonic state revisions.
+
+Bindings must not expose raw secrets or generic state mutation. Events are
+wake-up notifications, not authoritative storage. They may be delivered at
+least once; consumers deduplicate by stable ID and revision, then query current
+state after reconnect or restart.
+
+Failures remain typed where callers can act differently, including:
+
+- Device unavailable or offer timeout.
+- Protocol incompatibility or forbidden downgrade.
+- Revoked or blocked relationship.
+- Relay-policy incompatibility.
+- Secure storage locked, unavailable, missing, or corrupted.
+- Approval decline, cancellation, interruption, and invalid transition.
+
+Production errors and diagnostics must not expose endpoint IDs, direct
+addresses, tickets, grants, pairing capabilities, filenames, or secret-store
+payloads.
+
+---
+
+## 14. Limits and hostile-peer handling
+
+A saved relationship proves a remote app identity and permits it to request
+approval. It does not make remote metadata, filenames, paths, sizes, messages,
+or content trusted.
+
+The feature reuses all existing filesystem safety, output-sink, no-overwrite,
+ticket validation, and resource-limit invariants. Before approval it also
+enforces:
+
+- One unresolved offer per sender identity.
+- A bounded global pending-offer queue.
+- Strict request, manifest, metadata, file-count, and size limits.
+- Connection, pairing, offer, approval, and acknowledgement timeouts.
+- Per-identity cooldown after repeated malformed traffic or declines.
+- Silent rejection of unauthenticated, ineligible, blocked, or invalid traffic.
+- A configurable `CoreLimits.max_saved_devices`, defaulting to 256.
+
+These are control-plane and local-resource protections. They do not impose a
+quota on accepted transfers, files, bytes, or bandwidth.
+
+VniDrop cannot protect against a compromised or unlocked endpoint, malicious
+files the receiver knowingly accepts, operating-system credential compromise,
+network traffic analysis, or a reinstalled peer appearing under a new identity.
+
+---
+
+## 15. Compatibility and release policy
+
+Saved devices and targeted transfers use explicit, versioned protocol
+capabilities. A peer without compatible support cannot be paired or receive a
+targeted transfer and falls back to the existing invitation flow. A targeted
+transfer must never be reinterpreted as an ordinary share for compatibility.
+
+The feature is gated as experimental in the 0.3.x line. The wire protocol is
+versioned from its first merge. Removing the experimental gate requires:
+
+- Stable migrations from every released database version.
+- Compatible Apple, Android, Windows, and Linux credential-store adapters.
+- Rust and platform contract coverage.
+- Stable downgrade, revocation, recovery, and lifecycle behavior.
+- No regression in invitation-based multi-recipient transfers.
+
+The unreleased `feat/device-history` schema, held offers, polling behavior,
+expiring grants, `Contact` terminology, Apple-only feature UI, and ordinary-
+share offer authorization are prototype artifacts. They may be removed without
+a migration. Useful low-level cryptographic, repository, protocol, and test
+patterns may be retained only after they are checked against this design.
+
+---
+
+## 16. Verification requirements
+
+Rust tests must deterministically cover:
+
+- Mutual consent, decline, simultaneous initiation, timeouts, and lost
+  acknowledgements.
+- Pairing eligibility after completion and rejection after every non-completed
+  outcome.
+- Replay, malformed input, spoofed identity, blocking, revocation, grant
+  rotation, and protocol downgrade.
+- Recipient-bound authorization and rejection of leaked capabilities.
+- Direct, relay, custom-relay, local-only, and incompatible-profile behavior.
+- Restart and recovery at every durable state.
+- Cancellation, deletion, forget, and block during active streaming.
+- Credential-store failure and crash-point reconciliation.
+- Concurrent independent targeted transfers.
+- Existing invitation-based multi-recipient behavior remaining unchanged.
+
+Each platform secure-storage adapter requires contract coverage for create,
+read, update, delete, locked/unavailable behavior, migration, device-bound
+persistence, orphan cleanup, and redaction. Platform harnesses must prove that
+secrets do not appear in generated bindings, logs, diagnostics, or ordinary
+database columns.
+
+The core/platform foundation is complete only when these contracts are
+implemented, documented, exposed through typed UniFFI APIs, and pass the
+relevant Rust and platform checks. UI polish is not part of that completion
+boundary.

androidApp/src/main/kotlin/com/vnidrop/app/MainActivity.kt

@@ -7,6 +7,7 @@ import androidx.activity.ComponentActivity
 import androidx.activity.compose.setContent
 import androidx.activity.enableEdgeToEdge
 import androidx.lifecycle.lifecycleScope
+import com.vnidrop.app.core.initializeAndroidCoreRuntime
 import com.vnidrop.app.feature.receive.ExternalInvitationController
 import com.vnidrop.app.feature.receive.MaxVniDropInvitationBytes
 import com.vnidrop.app.feature.receive.VniDropInvitationExtension
@@ -22,6 +23,7 @@ class MainActivity : ComponentActivity() {
 	override fun onCreate(savedInstanceState: Bundle?) {
 		enableEdgeToEdge()
 		super.onCreate(savedInstanceState)
+		initializeAndroidCoreRuntime(applicationContext)
 		setContent {
 			App(rememberAndroidAppDependencies(this, externalInvitations))
 		}

apple/Package.swift

@@ -1,43 +0,0 @@
-// swift-tools-version:5.9
-import PackageDescription
-
-// Core/UI Swift sources built as a library so the shared logic can be typechecked
-// and unit-tested from the command line (macOS). The iOS/macOS app target in the
-// Xcode project links the same sources plus the app entry point.
-let package = Package(
-	name: "VniDropApp",
-	defaultLocalization: "en",
-	platforms: [
-		.iOS(.v16),
-		.macOS(.v13),
-	],
-	products: [
-		.library(name: "VniDropApp", targets: ["VniDropApp"]),
-	],
-	dependencies: [
-		.package(path: "VnidropCore"),
-	],
-	targets: [
-		.target(
-			name: "VniDropApp",
-			dependencies: [.product(name: "VnidropCore", package: "VnidropCore")],
-			path: "VniDrop",
-			// The @main entry belongs to the Xcode app target only; excluding it
-			// keeps this library free of a conflicting `_main` symbol for tests.
-			exclude: ["Resources", "App/VniDropApp.swift"],
-			// The Rust core (iroh network stack) links these system libraries. The
-			// Xcode app target must add the same frameworks under "Link Binary With
-			// Libraries" (SystemConfiguration, Security, libresolv).
-			linkerSettings: [
-				.linkedFramework("SystemConfiguration"),
-				.linkedFramework("Security"),
-				.linkedLibrary("resolv"),
-			]
-		),
-		.testTarget(
-			name: "VniDropAppTests",
-			dependencies: ["VniDropApp"],
-			path: "Tests"
-		),
-	]
-)

apple/README.md

@@ -18,9 +18,8 @@ apple/
     UI/Theme|Components|Navigation|Feedback|Shell/
     Platform/               # pickers, QR, NFC, share/export, per-OS file services
     Resources/              # Localizable.xcstrings, Info.plist, entitlements, assets
-  Tests/                    # XCTest (ported progress-derivation assertions)
-  Package.swift             # builds VniDrop/ as a library for CLI build/test
-  project.yml               # XcodeGen spec for the iOS/macOS app target
+  Tests/                    # XCTest bundle (VniDropTests target)
+  project.yml               # XcodeGen spec for the iOS/macOS app and test targets
 ```
 
 ## Build & run
@@ -72,19 +71,22 @@ opt in with `APPLE_CODE_SIGNING=YES`. For signed builds from Xcode, create the
 ignored `apple/Local.xcconfig` and override the signing settings there, including
 the development team.
 
-## Command-line typecheck & tests
+## Typecheck & tests
 
-`Package.swift` builds the same sources as a library (minus the `@main` entry),
-so the shared logic can be checked and unit-tested without Xcode:
+The Xcode project is the only build definition: it owns the UI, its package
+dependencies, and the `VniDropTests` bundle (module `VniDrop`, which is what the
+tests import). Everything runs through `xcodebuild`:
 
 ```bash
-cd apple
-swift build                       # macOS
-swift test                        # runs Tests/ (ported progress-derivation assertions)
-# iOS typecheck:
-swift build --triple arm64-apple-ios16.0-simulator --sdk "$(xcrun --sdk iphonesimulator --show-sdk-path)"
+make check-apple         # iOS simulator unit tests
+make build-apple-macos   # unsigned macOS build (typecheck)
 ```
 
+There is deliberately no SwiftPM manifest for the app. A second build definition
+would duplicate the target's package dependencies, and the previous one had
+already drifted out of sync with `project.yml` badly enough that neither
+`swift build` nor `swift test` worked.
+
 ## Generated / ignored artifacts
 
 `build-core.sh` produces build outputs that are gitignored (see `apple/.gitignore`):
@@ -106,8 +108,7 @@ Rust crate itself is never changed.
 ## System frameworks
 
 The Rust core (iroh network stack) links `SystemConfiguration`, `Security`, and
-`libresolv`. These are declared in both `Package.swift` (for CLI build/test) and
-`project.yml` (for the app target).
+`libresolv`. These are declared in `project.yml` for the app target.
 
 ## Parity & scope
 

apple/Tests/ContactsModelTests.swift

@@ -0,0 +1,640 @@
+import XCTest
+@testable import VniDrop
+
+@MainActor
+final class ContactsModelTests: XCTestCase {
+	private func makeModel(
+		_ gateway: FakeCoreGateway
+	) -> (ContactsModel, AppPreferencesRepository) {
+		let defaults = UserDefaults(suiteName: "contacts-tests-\(UUID().uuidString)")!
+		let preferences = AppPreferencesRepository(
+			defaults: defaults,
+			fallback: AppPreferencesDefaults(
+				username: "tester",
+				receiveFolder: ReceiveFolder(
+					kind: .fileSystemPath,
+					value: "/tmp",
+					displayName: "Downloads"
+				),
+				themeMode: .system
+			)
+		)
+		let model = ContactsModel(
+			repository: gateway,
+			messages: UiMessageController(),
+			preferences: preferences,
+			fileSystemService: FakeFileSystemService()
+		)
+		return (model, preferences)
+	}
+
+	private func contact(
+		_ endpointId: String,
+		label: String? = nil,
+		remoteName: String? = nil,
+		canSend: Bool = true
+	) -> DeviceContact {
+		DeviceContact(
+			endpointId: endpointId,
+			localLabel: label,
+			remoteDisplayName: remoteName,
+			lastTransferAt: nil,
+			createdAt: 0,
+			canSend: canSend
+		)
+	}
+
+	private func offer(_ offerId: String, from endpointId: String = "peer") -> IncomingOfferModel {
+		IncomingOfferModel(
+			offerId: offerId,
+			fromEndpointId: endpointId,
+			senderDisplayName: "Peer",
+			transferName: "photos",
+			fileCount: 2,
+			totalBytes: 1_024,
+			receivedAt: 0
+		)
+	}
+
+	func testRefreshLoadsContactsBlocksAndPrompts() async {
+		let gateway = FakeCoreGateway()
+		gateway.contactsResult = .success([contact("a"), contact("b")])
+		gateway.blockedResult = .success(["blocked-one"])
+		gateway.pairings = [PendingPairingModel(endpointId: "c", displayName: "Laptop", receivedAt: 0)]
+		gateway.offers = [offer("offer-1")]
+		let (model, _) = makeModel(gateway)
+
+		await model.refresh()
+
+		XCTAssertEqual(model.state.contacts.count, 2)
+		XCTAssertEqual(model.state.blocked, ["blocked-one"])
+		XCTAssertEqual(model.state.currentPairing?.endpointId, "c")
+		XCTAssertEqual(model.state.currentOffer?.offerId, "offer-1")
+		XCTAssertFalse(model.state.isLoading)
+	}
+
+	/// Accepting an offer is the only path that yields a ticket; the caller needs
+	/// it to run the receive with its own destination.
+	func testAcceptingAnOfferReturnsTheTicket() async {
+		let gateway = FakeCoreGateway()
+		gateway.offers = [offer("offer-1")]
+		gateway.offerTicket = "vnd1:abc"
+		let (model, _) = makeModel(gateway)
+		await model.refresh()
+
+		let ticket = await model.respondToOffer(offerId: "offer-1", accepted: true)
+
+		XCTAssertEqual(ticket, "vnd1:abc")
+		XCTAssertTrue(model.state.pendingOffers.isEmpty)
+		XCTAssertEqual(gateway.offerResponses.map(\.accepted), [true])
+	}
+
+	func testDecliningAnOfferYieldsNoTicketAndClearsThePrompt() async {
+		let gateway = FakeCoreGateway()
+		gateway.offers = [offer("offer-1")]
+		let (model, _) = makeModel(gateway)
+		await model.refresh()
+
+		let ticket = await model.respondToOffer(offerId: "offer-1", accepted: false)
+
+		XCTAssertNil(ticket, "a declined offer must not hand over a capability")
+		XCTAssertTrue(model.state.pendingOffers.isEmpty)
+	}
+
+	/// Declining to be remembered must leave nothing behind for the peer.
+	func testDecliningPairingClearsThePromptWithoutAddingAContact() async {
+		let gateway = FakeCoreGateway()
+		gateway.pairings = [PendingPairingModel(endpointId: "peer", displayName: nil, receivedAt: 0)]
+		let (model, _) = makeModel(gateway)
+		await model.refresh()
+
+		await model.respondToPairing(endpointId: "peer", accepted: false)
+
+		XCTAssertTrue(model.state.pendingPairings.isEmpty)
+		XCTAssertTrue(model.state.contacts.isEmpty)
+		XCTAssertEqual(gateway.pairingResponses.map(\.accepted), [false])
+	}
+
+	func testAcceptingPairingAddsTheContact() async {
+		let gateway = FakeCoreGateway()
+		gateway.pairings = [PendingPairingModel(endpointId: "peer", displayName: "Laptop", receivedAt: 0)]
+		let (model, _) = makeModel(gateway)
+		await model.refresh()
+		gateway.contactsResult = .success([contact("peer", remoteName: "Laptop")])
+
+		await model.respondToPairing(endpointId: "peer", accepted: true)
+
+		XCTAssertTrue(model.state.pendingPairings.isEmpty)
+		XCTAssertEqual(model.state.contacts.map(\.endpointId), ["peer"])
+	}
+
+	func testForgettingClearsTheSelectionAndReloads() async {
+		let gateway = FakeCoreGateway()
+		gateway.contactsResult = .success([contact("peer")])
+		let (model, _) = makeModel(gateway)
+		await model.refresh()
+		model.select("peer")
+
+		gateway.contactsResult = .success([])
+		await model.forget(endpointId: "peer")
+
+		XCTAssertEqual(gateway.forgottenContacts, ["peer"])
+		XCTAssertNil(model.state.selectedEndpointId)
+		XCTAssertTrue(model.state.contacts.isEmpty)
+	}
+
+	func testBlockingRemovesTheContactAndKeepsItListedAsBlocked() async {
+		let gateway = FakeCoreGateway()
+		gateway.contactsResult = .success([contact("peer")])
+		let (model, _) = makeModel(gateway)
+		await model.refresh()
+		model.select("peer")
+
+		gateway.contactsResult = .success([])
+		gateway.blockedResult = .success(["peer"])
+		await model.block(endpointId: "peer")
+
+		XCTAssertEqual(gateway.blockedContactIds, ["peer"])
+		XCTAssertNil(model.state.selectedEndpointId)
+		XCTAssertEqual(model.state.blocked, ["peer"])
+	}
+
+	/// An empty label clears the override rather than storing whitespace, so the
+	/// row falls back to the name the device reports.
+	func testBlankLabelClearsTheLocalName() async {
+		let gateway = FakeCoreGateway()
+		let (model, _) = makeModel(gateway)
+
+		await model.setLabel(endpointId: "peer", label: "   ")
+
+		XCTAssertEqual(gateway.contactLabels.count, 1)
+		XCTAssertNil(gateway.contactLabels[0].label)
+	}
+
+	func testLabelIsTrimmedBeforeStoring() async {
+		let gateway = FakeCoreGateway()
+		let (model, _) = makeModel(gateway)
+
+		await model.setLabel(endpointId: "peer", label: "  Work Mac  ")
+
+		XCTAssertEqual(gateway.contactLabels[0].label, "Work Mac")
+	}
+
+	/// The core holds the lifetime in memory only, so the stored preference is
+	/// the durable copy and both have to move together.
+	func testGrantLifetimeIsPersistedAndPushedToTheCore() async {
+		let gateway = FakeCoreGateway()
+		let (model, preferences) = makeModel(gateway)
+
+		model.setGrantLifetime(.days365)
+		await Task.yield()
+
+		XCTAssertEqual(model.state.grantLifetime, .days365)
+		XCTAssertEqual(preferences.preferences.grantLifetime, .days365)
+		XCTAssertEqual(gateway.grantLifetimes.last, .days365)
+	}
+
+	func testDefaultGrantLifetimeIsNinetyDays() {
+		let gateway = FakeCoreGateway()
+		let (model, _) = makeModel(gateway)
+
+		XCTAssertEqual(model.state.grantLifetime, .days90)
+	}
+
+	/// The local label wins over whatever the peer calls itself.
+	func testDisplayNamePrefersTheLocalLabel() {
+		let subject = contact("peer", label: "Work Mac", remoteName: "Totally Not Evil")
+
+		XCTAssertEqual(subject.displayName, "Work Mac")
+	}
+
+	func testDisplayNameFallsBackToTheReportedName() {
+		let subject = contact("peer", remoteName: "Laptop")
+
+		XCTAssertEqual(subject.displayName, "Laptop")
+	}
+
+	/// Files picked for a device go out as an offer, never as an invitation
+	/// anyone holding the ticket could use.
+	func testSendingToAContactUsesTheContactDestination() async {
+		let gateway = FakeCoreGateway()
+		let files = FakeFileSystemService()
+		let defaults = UserDefaults(suiteName: "contacts-send-\(UUID().uuidString)")!
+		let preferences = AppPreferencesRepository(
+			defaults: defaults,
+			fallback: AppPreferencesDefaults(
+				username: "tester",
+				receiveFolder: ReceiveFolder(kind: .fileSystemPath, value: "/tmp", displayName: "Downloads"),
+				themeMode: .system
+			)
+		)
+		let model = ContactsModel(
+			repository: gateway,
+			messages: UiMessageController(),
+			preferences: preferences,
+			fileSystemService: files
+		)
+		gateway.sendToContactResult = .success(
+			ContactSendOutcome(
+				share: Share(
+					transferId: 1, ticket: "vnd1:x", transferName: "doc",
+					contentHash: "h", fileCount: 1, totalSize: 2
+				),
+				delivered: true
+			)
+		)
+
+		model.chooseFilesToSend(to: "peer")
+		XCTAssertTrue(model.pendingFilePick)
+		await model.onFilesPicked([
+			PickedShareFile(value: "/tmp/doc.txt", displayName: "doc.txt", isDirectory: false)
+		])
+
+		XCTAssertEqual(files.shareDestinations, [.contact(endpointId: "peer")])
+		XCTAssertEqual(gateway.sentToContacts, ["peer"])
+	}
+
+	/// A pick that arrives with no target must not be sent anywhere.
+	func testPickedFilesWithoutATargetAreIgnored() async {
+		let gateway = FakeCoreGateway()
+		let files = FakeFileSystemService()
+		let defaults = UserDefaults(suiteName: "contacts-send-\(UUID().uuidString)")!
+		let preferences = AppPreferencesRepository(
+			defaults: defaults,
+			fallback: AppPreferencesDefaults(
+				username: "tester",
+				receiveFolder: ReceiveFolder(kind: .fileSystemPath, value: "/tmp", displayName: "Downloads"),
+				themeMode: .system
+			)
+		)
+		let model = ContactsModel(
+			repository: gateway,
+			messages: UiMessageController(),
+			preferences: preferences,
+			fileSystemService: files
+		)
+
+		await model.onFilesPicked([
+			PickedShareFile(value: "/tmp/doc.txt", displayName: "doc.txt", isDirectory: false)
+		])
+
+		XCTAssertTrue(files.shareDestinations.isEmpty)
+		XCTAssertTrue(gateway.sentToContacts.isEmpty)
+	}
+
+	/// Polling is opt-in: it tells every contact the app was opened.
+	func testForegroundCheckIsSkippedUnlessEnabled() async {
+		let gateway = FakeCoreGateway()
+		let (model, _) = makeModel(gateway)
+
+		await model.checkForOffersOnForeground()
+
+		XCTAssertEqual(gateway.pollCount, 0)
+	}
+
+	func testForegroundCheckRunsOnceEnabled() async {
+		let gateway = FakeCoreGateway()
+		let (model, preferences) = makeModel(gateway)
+
+		model.setCheckForOffersOnOpen(true)
+		await model.checkForOffersOnForeground()
+
+		XCTAssertEqual(gateway.pollCount, 1)
+		XCTAssertTrue(preferences.preferences.checkForOffersOnOpen)
+	}
+
+	/// The explicit "check now" ignores the setting: the user just asked.
+	func testExplicitCheckRunsEvenWhenTheSettingIsOff() async {
+		let gateway = FakeCoreGateway()
+		gateway.pollResult = .success(2)
+		let (model, _) = makeModel(gateway)
+
+		let collected = await model.collectWaitingOffers()
+
+		XCTAssertEqual(collected, 2)
+		XCTAssertEqual(gateway.pollCount, 1)
+	}
+
+	/// A transfer that could not be delivered is reported as waiting, not as a
+	/// success nobody has received.
+	func testAnUndeliveredSendIsReportedAsWaiting() async {
+		let gateway = FakeCoreGateway()
+		let files = FakeFileSystemService()
+		let defaults = UserDefaults(suiteName: "contacts-held-\(UUID().uuidString)")!
+		let preferences = AppPreferencesRepository(
+			defaults: defaults,
+			fallback: AppPreferencesDefaults(
+				username: "tester",
+				receiveFolder: ReceiveFolder(kind: .fileSystemPath, value: "/tmp", displayName: "Downloads"),
+				themeMode: .system
+			)
+		)
+		let messages = UiMessageController()
+		let model = ContactsModel(
+			repository: gateway,
+			messages: messages,
+			preferences: preferences,
+			fileSystemService: files
+		)
+		gateway.sendToContactResult = .success(
+			ContactSendOutcome(
+				share: Share(
+					transferId: 1, ticket: "vnd1:x", transferName: "doc",
+					contentHash: "h", fileCount: 1, totalSize: 2
+				),
+				delivered: false
+			)
+		)
+
+		model.chooseFilesToSend(to: "peer")
+		await model.onFilesPicked([
+			PickedShareFile(value: "/tmp/doc.txt", displayName: "doc.txt", isDirectory: false)
+		])
+
+		XCTAssertEqual(messages.current?.tone, .info)
+	}
+
+	func testHeldOffersAreLoadedForDisplay() async {
+		let gateway = FakeCoreGateway()
+		gateway.heldOffersResult = .success([
+			HeldOfferModel(
+				offerId: "held-1",
+				endpointId: "peer",
+				transferId: 1,
+				transferName: "doc",
+				fileCount: 1,
+				totalBytes: 2,
+				createdAt: 0
+			)
+		])
+		let (model, _) = makeModel(gateway)
+
+		await model.refresh()
+
+		XCTAssertEqual(model.state.heldOffers.map(\.offerId), ["held-1"])
+	}
+
+	/// Offering an existing transfer reuses it rather than creating another.
+	func testOfferingAnExistingTransferReportsAcceptance() async {
+		let gateway = FakeCoreGateway()
+		gateway.offerTransferResult = .success(
+			ContactSendOutcome(
+				share: Share(
+					transferId: 7, ticket: "vnd1:x", transferName: "doc",
+					contentHash: "h", fileCount: 1, totalSize: 2
+				),
+				delivered: true
+			)
+		)
+		let (model, _) = makeModel(gateway)
+
+		let delivered = await model.offerTransfer(transferId: 7, to: contact("peer"))
+
+		XCTAssertTrue(delivered)
+		XCTAssertEqual(gateway.offeredTransfers.map(\.transferId), [7])
+		XCTAssertEqual(gateway.offeredTransfers.map(\.endpointId), ["peer"])
+	}
+
+	/// An offer to a closed device is reported as waiting, not accepted.
+	func testOfferingToAClosedDeviceReportsItAsWaiting() async {
+		let gateway = FakeCoreGateway()
+		gateway.offerTransferResult = .success(
+			ContactSendOutcome(
+				share: Share(
+					transferId: 7, ticket: "vnd1:x", transferName: "doc",
+					contentHash: "h", fileCount: 1, totalSize: 2
+				),
+				delivered: false
+			)
+		)
+		let (model, _) = makeModel(gateway)
+
+		let delivered = await model.offerTransfer(transferId: 7, to: contact("peer"))
+
+		XCTAssertFalse(delivered)
+	}
+
+	/// A refusal by the person on the other device is information, not an error.
+	func testADeclinedOfferIsReportedWithoutAnErrorTone() async {
+		let gateway = FakeCoreGateway()
+		gateway.offerTransferResult = .failure(
+			InvitationError.raw("permission error: device did not accept the transfer: receiver-declined")
+		)
+		let defaults = UserDefaults(suiteName: "contacts-declined-\(UUID().uuidString)")!
+		let preferences = AppPreferencesRepository(
+			defaults: defaults,
+			fallback: AppPreferencesDefaults(
+				username: "tester",
+				receiveFolder: ReceiveFolder(kind: .fileSystemPath, value: "/tmp", displayName: "Downloads"),
+				themeMode: .system
+			)
+		)
+		let messages = UiMessageController()
+		let model = ContactsModel(
+			repository: gateway,
+			messages: messages,
+			preferences: preferences,
+			fileSystemService: FakeFileSystemService()
+		)
+
+		let delivered = await model.offerTransfer(transferId: 7, to: contact("peer"))
+
+		XCTAssertFalse(delivered)
+		XCTAssertEqual(messages.current?.tone, .info)
+	}
+
+	func testUnreachableContactIsSurfacedForRepairing() async {
+		let gateway = FakeCoreGateway()
+		gateway.contactsResult = .success([contact("peer", canSend: false)])
+		let (model, _) = makeModel(gateway)
+
+		await model.refresh()
+
+		XCTAssertEqual(model.state.contacts.first?.canSend, false)
+	}
+}
+
+// MARK: - Post-transfer suggestions
+
+@MainActor
+final class PairingSuggestionTests: XCTestCase {
+	private func makeModel(
+		_ gateway: FakeCoreGateway,
+		defaults: UserDefaults
+	) -> (ContactsModel, AppPreferencesRepository) {
+		let preferences = AppPreferencesRepository(
+			defaults: defaults,
+			fallback: AppPreferencesDefaults(
+				username: "tester",
+				receiveFolder: ReceiveFolder(
+					kind: .fileSystemPath,
+					value: "/tmp",
+					displayName: "Downloads"
+				),
+				themeMode: .system
+			)
+		)
+		let model = ContactsModel(
+			repository: gateway,
+			messages: UiMessageController(),
+			preferences: preferences,
+			fileSystemService: FakeFileSystemService()
+		)
+		return (model, preferences)
+	}
+
+	private func newDefaults() -> UserDefaults {
+		UserDefaults(suiteName: "suggestion-tests-\(UUID().uuidString)")!
+	}
+
+	private func completedReceive(from peerId: String?) -> Transfer {
+		Transfer(
+			localId: "local-1",
+			transferId: 1,
+			direction: .receive,
+			status: .done,
+			peerId: peerId,
+			transferName: "photos",
+			contentHash: nil,
+			fileCount: 1,
+			totalSize: 10,
+			ticket: nil,
+			accessPolicy: .requireApproval,
+			createdAt: 0,
+			updatedAt: 0
+		)
+	}
+
+	private func state(with transfers: [Transfer]) -> CoreState {
+		var core = CoreState()
+		core.isInitialized = true
+		core.transfers = transfers
+		return core
+	}
+
+	func testCompletedReceiveSuggestsItsSender() async {
+		let gateway = FakeCoreGateway()
+		let (model, _) = makeModel(gateway, defaults: newDefaults())
+		await model.refresh()
+
+		gateway.setState(state(with: [completedReceive(from: "sender-endpoint")]))
+		await Task.yield()
+
+		XCTAssertEqual(model.state.currentSuggestion?.endpointId, "sender-endpoint")
+	}
+
+	/// A transfer that never recorded a peer cannot be turned into a suggestion.
+	func testReceiveWithoutAPeerIsNotSuggested() async {
+		let gateway = FakeCoreGateway()
+		let (model, _) = makeModel(gateway, defaults: newDefaults())
+		await model.refresh()
+
+		gateway.setState(state(with: [completedReceive(from: nil)]))
+		await Task.yield()
+
+		XCTAssertNil(model.state.currentSuggestion)
+	}
+
+	func testAlreadyRememberedDeviceIsNotSuggested() async {
+		let gateway = FakeCoreGateway()
+		gateway.contactsResult = .success([
+			DeviceContact(
+				endpointId: "sender-endpoint",
+				localLabel: nil,
+				remoteDisplayName: nil,
+				lastTransferAt: nil,
+				createdAt: 0,
+				canSend: true
+			)
+		])
+		let (model, _) = makeModel(gateway, defaults: newDefaults())
+		await model.refresh()
+
+		gateway.setState(state(with: [completedReceive(from: "sender-endpoint")]))
+		await Task.yield()
+
+		XCTAssertNil(model.state.currentSuggestion)
+	}
+
+	func testBlockedDeviceIsNotSuggested() async {
+		let gateway = FakeCoreGateway()
+		gateway.blockedResult = .success(["sender-endpoint"])
+		let (model, _) = makeModel(gateway, defaults: newDefaults())
+		await model.refresh()
+
+		gateway.setState(state(with: [completedReceive(from: "sender-endpoint")]))
+		await Task.yield()
+
+		XCTAssertNil(model.state.currentSuggestion)
+	}
+
+	/// Declining has to stick, or every later transfer with the same device
+	/// re-asks the question the user already answered.
+	func testDecliningIsRememberedAcrossLaterTransfers() async {
+		let defaults = newDefaults()
+		let gateway = FakeCoreGateway()
+		let (model, preferences) = makeModel(gateway, defaults: defaults)
+		await model.refresh()
+		gateway.setState(state(with: [completedReceive(from: "sender-endpoint")]))
+		await Task.yield()
+		let suggestion = try? XCTUnwrap(model.state.currentSuggestion)
+
+		model.declineSuggestion(suggestion!)
+
+		XCTAssertNil(model.state.currentSuggestion)
+		XCTAssertTrue(preferences.preferences.declinedPairingSuggestions.contains("sender-endpoint"))
+
+		// A second transfer with the same device must stay silent.
+		gateway.setState(CoreState())
+		gateway.setState(state(with: [completedReceive(from: "sender-endpoint")]))
+		await Task.yield()
+		XCTAssertNil(model.state.currentSuggestion)
+	}
+
+	func testAcceptingASuggestionIssuesAGrantUnderTheLocalUsername() async {
+		let gateway = FakeCoreGateway()
+		let (model, _) = makeModel(gateway, defaults: newDefaults())
+		await model.refresh()
+		gateway.setState(state(with: [completedReceive(from: "sender-endpoint")]))
+		await Task.yield()
+		let suggestion = try? XCTUnwrap(model.state.currentSuggestion)
+
+		await model.acceptSuggestion(suggestion!)
+
+		XCTAssertEqual(gateway.allowedDevices.map(\.endpointId), ["sender-endpoint"])
+		XCTAssertEqual(gateway.allowedDevices.first?.displayName, "tester")
+		XCTAssertNil(model.state.currentSuggestion)
+	}
+
+	/// Pairing deliberately after declining should work, so the decline is
+	/// cleared rather than blocking the device forever.
+	func testAcceptingClearsAnEarlierDecline() async {
+		let defaults = newDefaults()
+		let gateway = FakeCoreGateway()
+		let (model, preferences) = makeModel(gateway, defaults: defaults)
+		let suggestion = PairingSuggestion(
+			endpointId: "sender-endpoint",
+			displayName: nil,
+			transferName: nil
+		)
+		model.declineSuggestion(suggestion)
+		XCTAssertTrue(preferences.preferences.declinedPairingSuggestions.contains("sender-endpoint"))
+
+		await model.acceptSuggestion(suggestion)
+
+		XCTAssertFalse(preferences.preferences.declinedPairingSuggestions.contains("sender-endpoint"))
+	}
+
+	func testTheSameDeviceIsOnlySuggestedOnce() async {
+		let gateway = FakeCoreGateway()
+		let (model, _) = makeModel(gateway, defaults: newDefaults())
+		await model.refresh()
+
+		gateway.setState(state(with: [completedReceive(from: "sender-endpoint")]))
+		await Task.yield()
+		gateway.setState(state(with: [completedReceive(from: "sender-endpoint")]))
+		await Task.yield()
+
+		XCTAssertEqual(model.state.suggestions.count, 1)
+	}
+}

apple/Tests/Fakes.swift

@@ -81,6 +81,98 @@ final class FakeCoreGateway: CoreGateway {
 		return responseResult
 	}
 	func refresh() async -> Result<Void, Error> { .success(()) }
+
+	// MARK: Device history
+
+	var contactsResult: Result<[DeviceContact], Error> = .success([])
+	var pairings: [PendingPairingModel] = []
+	var offers: [IncomingOfferModel] = []
+	var respondToPairingResult: Result<Bool, Error> = .success(true)
+	/// Ticket handed back when an offer is accepted; nil models a declined one.
+	var offerTicket: String? = "vnd1:offered"
+	var sendToContactResult: Result<ContactSendOutcome, Error> = .failure(TestError.unimplemented)
+	var heldOffersResult: Result<[HeldOfferModel], Error> = .success([])
+	var pollResult: Result<UInt64, Error> = .success(0)
+	private(set) var pollCount = 0
+	var forgetContactResult: Result<Void, Error> = .success(())
+	var blockedResult: Result<[String], Error> = .success([])
+
+	private(set) var allowedDevices: [(endpointId: String, displayName: String?)] = []
+	private(set) var pairingResponses: [(endpointId: String, accepted: Bool)] = []
+	private(set) var offerResponses: [(offerId: String, accepted: Bool)] = []
+	private(set) var forgottenContacts: [String] = []
+	private(set) var forgetAllCount = 0
+	private(set) var blockedContactIds: [String] = []
+	private(set) var unblockedContactIds: [String] = []
+	private(set) var contactLabels: [(endpointId: String, label: String?)] = []
+	private(set) var grantLifetimes: [GrantLifetimeOption] = []
+	private(set) var sentToContacts: [String] = []
+
+	func contacts() async -> Result<[DeviceContact], Error> { contactsResult }
+	func pendingPairings() async -> [PendingPairingModel] { pairings }
+	func pendingOffers() async -> [IncomingOfferModel] { offers }
+	func allowDeviceToReachMe(endpointId: String, displayName: String?) async -> Result<Void, Error> {
+		allowedDevices.append((endpointId, displayName))
+		return .success(())
+	}
+	func respondToPairing(endpointId: String, accepted: Bool) async -> Result<Bool, Error> {
+		pairingResponses.append((endpointId, accepted))
+		if case .success = respondToPairingResult {
+			pairings.removeAll { $0.endpointId == endpointId }
+		}
+		return respondToPairingResult
+	}
+	func respondToOffer(offerId: String, accepted: Bool) async -> String? {
+		offerResponses.append((offerId, accepted))
+		offers.removeAll { $0.offerId == offerId }
+		return accepted ? offerTicket : nil
+	}
+	func sendToContact(
+		endpointId: String,
+		sources: [ShareSource],
+		transferName: String,
+		senderName: String
+	) async -> Result<ContactSendOutcome, Error> {
+		sentToContacts.append(endpointId)
+		return sendToContactResult
+	}
+	private(set) var offeredTransfers: [(transferId: UInt64, endpointId: String)] = []
+	var offerTransferResult: Result<ContactSendOutcome, Error> = .failure(TestError.unimplemented)
+
+	func offerTransferToContact(
+		transferId: UInt64,
+		endpointId: String
+	) async -> Result<ContactSendOutcome, Error> {
+		offeredTransfers.append((transferId, endpointId))
+		return offerTransferResult
+	}
+	func heldOffers() async -> Result<[HeldOfferModel], Error> { heldOffersResult }
+	func pollContactsForOffers() async -> Result<UInt64, Error> {
+		pollCount += 1
+		return pollResult
+	}
+	func forgetContact(endpointId: String) async -> Result<Void, Error> {
+		forgottenContacts.append(endpointId)
+		return forgetContactResult
+	}
+	func forgetAllContacts() async -> Result<UInt64, Error> {
+		forgetAllCount += 1
+		return .success(0)
+	}
+	func blockContact(endpointId: String) async -> Result<Void, Error> {
+		blockedContactIds.append(endpointId)
+		return .success(())
+	}
+	func unblockContact(endpointId: String) async -> Result<Void, Error> {
+		unblockedContactIds.append(endpointId)
+		return .success(())
+	}
+	func blockedContacts() async -> Result<[String], Error> { blockedResult }
+	func setContactLabel(endpointId: String, label: String?) async -> Result<Void, Error> {
+		contactLabels.append((endpointId, label))
+		return .success(())
+	}
+	func setGrantLifetime(_ lifetime: GrantLifetimeOption) async { grantLifetimes.append(lifetime) }
 }
 
 /// Minimal `FileSystemService` fake — a writable path receive folder, no reveal.
@@ -92,8 +184,21 @@ final class FakeFileSystemService: FileSystemService {
 	func defaultReceiveFolder() -> ReceiveFolder { folder }
 	func validateReceiveFolder(_ folder: ReceiveFolder) async -> FolderAccessStatus { .writable }
 	func canRevealReceiveFolder(_ folder: ReceiveFolder) -> Bool { false }
-	func sharePickedFiles(repository: CoreGateway, files: [PickedShareFile], transferName: String, senderName: String, accessPolicy: ShareAccessPolicy) async -> Result<Share, Error> {
-		await repository.shareSources([], transferName: transferName, senderName: senderName, accessPolicy: accessPolicy)
+	private(set) var shareDestinations: [ShareDestination] = []
+
+	func sharePickedFiles(repository: CoreGateway, files: [PickedShareFile], transferName: String, senderName: String, destination: ShareDestination) async -> Result<ContactSendOutcome, Error> {
+		shareDestinations.append(destination)
+		switch destination {
+		case .invitation(let accessPolicy):
+			return await repository.shareSources(
+				[], transferName: transferName, senderName: senderName, accessPolicy: accessPolicy
+			)
+			.map { ContactSendOutcome(share: $0, delivered: true) }
+		case .contact(let endpointId):
+			return await repository.sendToContact(
+				endpointId: endpointId, sources: [], transferName: transferName, senderName: senderName
+			)
+		}
 	}
 }
 

apple/VniDrop/App/AppGraph.swift

@@ -12,6 +12,7 @@ final class AppGraph: ObservableObject {
 	let preferencesRepository: AppPreferencesRepository
 	let filePreviewRepository: FilePreviewRepository
 	let approvalCoordinator: ApprovalCoordinator
+	let contactsModel: ContactsModel
 	let transferNotificationCoordinator: TransferNotificationCoordinator
 	let backgroundActivity: BackgroundActivityController
 
@@ -27,6 +28,12 @@ final class AppGraph: ObservableObject {
 				themeMode: .system
 			)
 		)
+		self.contactsModel = ContactsModel(
+			repository: coreRepository,
+			messages: messages,
+			preferences: preferencesRepository,
+			fileSystemService: dependencies.fileSystemService
+		)
 		self.approvalCoordinator = ApprovalCoordinator(
 			repository: coreRepository,
 			notifications: dependencies.notificationService,

apple/VniDrop/App/RootView.swift

@@ -60,6 +60,11 @@ struct RootView: View {
 					approvals: graph.approvalCoordinator,
 					sendModel: sendModel
 				)
+				ContactPromptLayer(
+					contacts: graph.contactsModel,
+					receiveModel: receiveModel,
+					approvals: graph.approvalCoordinator
+				)
 				// Top-most so the toast is never covered by the approval overlay's
 				// full-bleed clear layer. Observes the live `graph.messages` directly.
 				SnackbarHost(controller: graph.messages)
@@ -88,6 +93,9 @@ struct RootView: View {
 				// unfocused/occluded (common on macOS) live events may not have
 				// rendered, leaving progress/status stale.
 				Task { _ = await graph.coreRepository.refresh() }
+				// Opt-in and foreground-only: collecting transfers held for this
+				// device also tells every contact that the app was opened.
+				Task { await graph.contactsModel.checkForOffersOnForeground() }
 			case .background:
 				graph.visibility.setForeground(false)
 				// Hold the process open for iOS's grace window so an active
@@ -165,9 +173,10 @@ struct RootView: View {
 	@ViewBuilder
 	private func screen(for destination: AppDestination, windowClass: WindowClass) -> some View {
 		switch destination {
-		case .send: SendScreen(model: sendModel, windowClass: windowClass)
+		case .send: SendScreen(model: sendModel, contacts: graph.contactsModel, windowClass: windowClass)
 		case .receive: ReceiveScreen(model: receiveModel, windowClass: windowClass)
-		case .settings: SettingsScreen(model: settingsModel, windowClass: windowClass)
+		case .settings:
+			SettingsScreen(model: settingsModel, contacts: graph.contactsModel, windowClass: windowClass)
 		}
 	}
 
@@ -283,3 +292,57 @@ import UIKit
 #else
 import AppKit
 #endif
+
+/// Hosts the device-history consent prompts, alongside `ApprovalLayer`.
+///
+/// Separate from the approval layer because the two never compete: an approval
+/// belongs to a transfer this device is sending, and these belong to a device
+/// asking to reach it. Both are suppressed while the other is up so the user is
+/// never answering two modals at once.
+private struct ContactPromptLayer: View {
+	@ObservedObject var contacts: ContactsModel
+	let receiveModel: ReceiveModel
+	@ObservedObject var approvals: ApprovalCoordinator
+
+	@State private var showPrompt = false
+
+	var body: some View {
+		ContactPromptHost(
+			isPresented: $showPrompt,
+			state: contacts.state,
+			onPairingResponse: { endpointId, accepted in
+				Task { await contacts.respondToPairing(endpointId: endpointId, accepted: accepted) }
+			},
+			onOfferResponse: { offerId, accepted in
+				Task {
+					// The ticket is released only on acceptance; the receive then
+					// runs through the ordinary path so the platform picks the
+					// destination.
+					if let ticket = await contacts.respondToOffer(offerId: offerId, accepted: accepted) {
+						receiveModel.receiveOffered(ticket: ticket)
+					}
+				}
+			},
+			onSuggestionResponse: { suggestion, accepted in
+				if accepted {
+					Task { await contacts.acceptSuggestion(suggestion) }
+				} else {
+					contacts.declineSuggestion(suggestion)
+				}
+			}
+		)
+		.onChange(of: promptKey) { _, key in
+			showPrompt = key != nil
+		}
+	}
+
+	/// One identity for "is there something to answer", so an offer replacing a
+	/// pairing prompt re-presents rather than silently swapping content.
+	private var promptKey: String? {
+		guard approvals.state.current == nil else { return nil }
+		if let offer = contacts.state.currentOffer { return "offer-\(offer.offerId)" }
+		if let pairing = contacts.state.currentPairing { return "pairing-\(pairing.endpointId)" }
+		if let suggestion = contacts.state.currentSuggestion { return "suggest-\(suggestion.endpointId)" }
+		return nil
+	}
+}

apple/VniDrop/Core/AppPreferences.swift

@@ -122,6 +122,14 @@ struct AppPreferences: Equatable {
 	var themeMode: ThemeMode
 	var diagnosticsInstallId: String
 	var relayConfiguration: RelayConfiguration
+	/// Idle lifetime applied to grants this device issues from now on.
+	var grantLifetime: GrantLifetimeOption
+	/// Devices the user declined to remember. Persisted so a repeat transfer
+	/// with the same device does not re-ask forever.
+	var declinedPairingSuggestions: Set<String>
+	/// Whether opening the app asks remembered devices for waiting transfers.
+	/// Off by default: it reveals app-open times to every contact.
+	var checkForOffersOnOpen: Bool
 }
 
 struct AppPreferencesDefaults {
@@ -145,6 +153,9 @@ final class AppPreferencesRepository: ObservableObject {
 		static let themeMode = "theme_mode"
 		static let diagnosticsInstallId = "diagnostics_install_id"
 		static let relayConfiguration = "relay_configuration"
+		static let grantLifetime = "grant_lifetime"
+		static let declinedPairingSuggestions = "declined_pairing_suggestions"
+		static let checkForOffersOnOpen = "check_for_offers_on_open"
 	}
 
 	init(defaults: UserDefaults = .standard, fallback: AppPreferencesDefaults) {
@@ -158,12 +169,18 @@ final class AppPreferencesRepository: ObservableObject {
 		let folder = resolveReceiveFolder(defaults, fallback: fallback.receiveFolder)
 		let themeMode = defaults.string(forKey: Key.themeMode).flatMap(ThemeMode.init(rawValue:)) ?? fallback.themeMode
 		let installId = defaults.string(forKey: Key.diagnosticsInstallId) ?? ""
+		let grantLifetime = defaults.string(forKey: Key.grantLifetime)
+			.flatMap(GrantLifetimeOption.init(rawValue:)) ?? .days90
+		let declined = Set(defaults.stringArray(forKey: Key.declinedPairingSuggestions) ?? [])
 		return AppPreferences(
 			username: username,
 			receiveFolder: folder,
 			themeMode: themeMode,
 			diagnosticsInstallId: installId,
-			relayConfiguration: resolveRelayConfiguration(defaults)
+			relayConfiguration: resolveRelayConfiguration(defaults),
+			grantLifetime: grantLifetime,
+			declinedPairingSuggestions: declined,
+			checkForOffersOnOpen: defaults.bool(forKey: Key.checkForOffersOnOpen)
 		)
 	}
 
@@ -209,6 +226,32 @@ final class AppPreferencesRepository: ObservableObject {
 		setReceiveFolder(fallback.receiveFolder)
 	}
 
+	func declinePairingSuggestion(_ endpointId: String) {
+		var declined = preferences.declinedPairingSuggestions
+		declined.insert(endpointId)
+		defaults.set(Array(declined), forKey: Key.declinedPairingSuggestions)
+		reload()
+	}
+
+	/// Clears the decline so the device can be suggested again, used when the
+	/// user pairs with it deliberately.
+	func clearDeclinedPairingSuggestion(_ endpointId: String) {
+		var declined = preferences.declinedPairingSuggestions
+		guard declined.remove(endpointId) != nil else { return }
+		defaults.set(Array(declined), forKey: Key.declinedPairingSuggestions)
+		reload()
+	}
+
+	func setCheckForOffersOnOpen(_ enabled: Bool) {
+		defaults.set(enabled, forKey: Key.checkForOffersOnOpen)
+		reload()
+	}
+
+	func setGrantLifetime(_ lifetime: GrantLifetimeOption) {
+		defaults.set(lifetime.rawValue, forKey: Key.grantLifetime)
+		reload()
+	}
+
 	func setThemeMode(_ mode: ThemeMode) {
 		defaults.set(mode.rawValue, forKey: Key.themeMode)
 		reload()

apple/VniDrop/Core/CoreGateway.swift

@@ -47,4 +47,42 @@ protocol CoreGateway: AnyObject {
 	func receiverRequests(transferId: UInt64) async -> Result<[ReceiverRequestModel], Error>
 	func respondReceiverRequest(requestId: String, accepted: Bool, reason: String?) async -> Result<Void, Error>
 	func refresh() async -> Result<Void, Error>
+
+	// MARK: Device history
+
+	func contacts() async -> Result<[DeviceContact], Error>
+	func pendingPairings() async -> [PendingPairingModel]
+	func pendingOffers() async -> [IncomingOfferModel]
+	/// Hand a device a revocable capability to reach this one.
+	func allowDeviceToReachMe(endpointId: String, displayName: String?) async -> Result<Void, Error>
+	/// Accept or decline a device's offer to be remembered.
+	func respondToPairing(endpointId: String, accepted: Bool) async -> Result<Bool, Error>
+	/// Answer an incoming offer. Returns the ticket on acceptance, which the
+	/// caller passes to `receive` with a platform-appropriate destination.
+	func respondToOffer(offerId: String, accepted: Bool) async -> String?
+	func sendToContact(
+		endpointId: String,
+		sources: [ShareSource],
+		transferName: String,
+		senderName: String
+	) async -> Result<ContactSendOutcome, Error>
+	/// Offer an existing share to a remembered device, alongside its QR code.
+	func offerTransferToContact(
+		transferId: UInt64,
+		endpointId: String
+	) async -> Result<ContactSendOutcome, Error>
+	/// Transfers this device is holding for contacts that were not running.
+	func heldOffers() async -> Result<[HeldOfferModel], Error>
+	/// Ask remembered devices whether they hold anything for this one.
+	///
+	/// Only ever called from a foreground transition or an explicit user action:
+	/// it reveals to every contact that this device is awake.
+	func pollContactsForOffers() async -> Result<UInt64, Error>
+	func forgetContact(endpointId: String) async -> Result<Void, Error>
+	func forgetAllContacts() async -> Result<UInt64, Error>
+	func blockContact(endpointId: String) async -> Result<Void, Error>
+	func unblockContact(endpointId: String) async -> Result<Void, Error>
+	func blockedContacts() async -> Result<[String], Error>
+	func setContactLabel(endpointId: String, label: String?) async -> Result<Void, Error>
+	func setGrantLifetime(_ lifetime: GrantLifetimeOption) async
 }

apple/VniDrop/Core/CoreModels.swift

@@ -72,6 +72,16 @@ enum ShareAccessPolicy: Equatable, Sendable {
 	case anyoneWithTransfer
 }
 
+/// Where a picked selection is going.
+///
+/// A contact destination deliberately carries no access policy: the core forces
+/// approval-required for offers, so exposing the choice here would imply a
+/// setting that does not exist.
+enum ShareDestination: Equatable, Sendable {
+	case invitation(accessPolicy: ShareAccessPolicy)
+	case contact(endpointId: String)
+}
+
 enum TransferDirection: Equatable, Sendable {
 	case send
 	case receive
@@ -168,6 +178,10 @@ enum CoreSignal: Equatable, Sendable {
 	case receiverHistoryChanged(transferId: UInt64)
 	/// Transfer status/history changed enough to re-read the durable snapshot.
 	case transfersChanged(transferId: UInt64)
+	/// Device history changed: a contact was added, forgotten, or blocked.
+	case contactsChanged
+	/// An incoming offer arrived or was answered.
+	case offersChanged
 }
 
 // MARK: - Transfer helpers (ported from AppUiModels.kt)
@@ -186,3 +200,112 @@ extension TransferStatus {
 		self == .done || self == .failed || self == .cancelled
 	}
 }
+
+// MARK: - Device history
+
+/// A device the user has chosen to remember.
+///
+/// `localLabel` is the user's own name for the device and is authoritative for
+/// display; `remoteDisplayName` is whatever the device last called itself and is
+/// untrusted. The endpoint id is the only real identity.
+struct DeviceContact: Equatable, Identifiable, Sendable {
+	let endpointId: String
+	let localLabel: String?
+	let remoteDisplayName: String?
+	let lastTransferAt: Int64?
+	let createdAt: Int64
+	/// Whether a live grant is held. False once the peer revoked, the grant
+	/// lapsed, or the peer reinstalled and lost its identity.
+	let canSend: Bool
+
+	var id: String { endpointId }
+
+	/// Name to show, preferring the local label the peer cannot influence.
+	var displayName: String {
+		if let localLabel, !localLabel.isEmpty { return localLabel }
+		if let remoteDisplayName, !remoteDisplayName.isEmpty { return remoteDisplayName }
+		return String(localized: L10n.Approval.nearbyDevice)
+	}
+
+	/// Short prefix of the endpoint id, for telling apart devices claiming the
+	/// same name.
+	var shortFingerprint: String { String(endpointId.prefix(8)) }
+}
+
+/// A device offering to be remembered, awaiting this user's decision.
+struct PendingPairingModel: Equatable, Identifiable, Sendable {
+	let endpointId: String
+	let displayName: String?
+	let receivedAt: Int64
+
+	var id: String { endpointId }
+
+	var resolvedName: String {
+		guard let displayName, !displayName.isEmpty else {
+			return String(localized: L10n.Approval.nearbyDevice)
+		}
+		return displayName
+	}
+}
+
+/// A transfer a remembered device is offering. Carries no ticket: that is a
+/// capability and the core releases it only once the user accepts.
+struct IncomingOfferModel: Equatable, Identifiable, Sendable {
+	let offerId: String
+	let fromEndpointId: String
+	let senderDisplayName: String?
+	let transferName: String
+	let fileCount: UInt64
+	let totalBytes: UInt64
+	let receivedAt: Int64
+
+	var id: String { offerId }
+
+	var resolvedSenderName: String {
+		guard let senderDisplayName, !senderDisplayName.isEmpty else {
+			return String(localized: L10n.Approval.nearbyDevice)
+		}
+		return senderDisplayName
+	}
+}
+
+/// A transfer waiting for its target device to come back online.
+struct HeldOfferModel: Equatable, Identifiable, Sendable {
+	let offerId: String
+	let endpointId: String
+	let transferId: UInt64
+	let transferName: String
+	let fileCount: UInt64
+	let totalBytes: UInt64
+	let createdAt: Int64
+
+	var id: String { offerId }
+}
+
+/// Outcome of sending straight to a remembered device.
+struct ContactSendOutcome: Equatable, Sendable {
+	let share: Share
+	/// False when the device was not running: the transfer is held locally and
+	/// collected the next time that device opens the app.
+	let delivered: Bool
+}
+
+/// How long a remembered device stays reachable while unused. The countdown
+/// restarts on every transfer.
+enum GrantLifetimeOption: String, CaseIterable, Identifiable, Sendable {
+	case days30
+	case days90
+	case days365
+	case never
+
+	var id: String { rawValue }
+
+	var days: Int? {
+		switch self {
+		case .days30: return 30
+		case .days90: return 90
+		case .days365: return 365
+		case .never: return nil
+		}
+	}
+}

apple/VniDrop/Core/CoreRepository.swift

@@ -53,9 +53,10 @@ struct NativeCoreBindingFactory: CoreBindingFactory {
 		case .localOnly:
 			nativeConfiguration = CoreNetworkConfig(mode: .localOnly, relayUrls: [])
 		}
-		return try VnidropCore.initializeWithNetworkConfig(
+		return try VnidropCore.initializeWithExperimentalSavedDevices(
 			appDataDir: appDataDir,
 			eventSink: eventSink,
+			limits: defaultCoreLimits(),
 			networkConfig: nativeConfiguration
 		)
 	}
@@ -293,6 +294,122 @@ final class CoreRepository: ObservableObject, CoreGateway {
 		}
 	}
 
+	// MARK: - Device history
+
+	func contacts() async -> Result<[DeviceContact], Error> {
+		await runCore {
+			try self.requireCore().listContacts().map { $0.toModel() }
+		}
+	}
+
+	func pendingPairings() async -> [PendingPairingModel] {
+		let result = await runCore { try self.requireCore().listPendingPairings().map { $0.toModel() } }
+		return (try? result.get()) ?? []
+	}
+
+	func pendingOffers() async -> [IncomingOfferModel] {
+		let result = await runCore { try self.requireCore().listPendingOffers().map { $0.toModel() } }
+		return (try? result.get()) ?? []
+	}
+
+	func allowDeviceToReachMe(endpointId: String, displayName: String?) async -> Result<Void, Error> {
+		await runCore {
+			try self.requireCore().allowDeviceToReachMe(endpointId: endpointId, displayName: displayName)
+		}
+	}
+
+	func respondToPairing(endpointId: String, accepted: Bool) async -> Result<Bool, Error> {
+		await runCore {
+			try self.requireCore().respondToPairing(endpointId: endpointId, accepted: accepted)
+		}
+	}
+
+	func respondToOffer(offerId: String, accepted: Bool) async -> String? {
+		let result = await runCore {
+			try self.requireCore().respondToOffer(offerId: offerId, accepted: accepted)
+		}
+		return (try? result.get()) ?? nil
+	}
+
+	func sendToContact(
+		endpointId: String,
+		sources: [ShareSource],
+		transferName: String,
+		senderName: String
+	) async -> Result<ContactSendOutcome, Error> {
+		guard !isNetworkTransitionInProgress else {
+			return .failure(CoreNetworkLifecycleError.transitionInProgress)
+		}
+		guard !sources.isEmpty else {
+			return .failure(InvitationError.shareEmpty)
+		}
+		return await runCore {
+			// The access mode is forced to approval-required by the core for
+			// offers; passing it here only keeps the metadata well-formed.
+			let result = try self.requireCore().sendToContact(
+				endpointId: endpointId,
+				sources: sources,
+				metadata: ShareMetadataInput(
+					transferId: Self.nextTransferId(),
+					transferName: transferName.isEmpty ? nil : transferName,
+					senderName: senderName.isEmpty ? nil : senderName,
+					accessMode: .approvalRequired
+				)
+			)
+			return ContactSendOutcome(share: result.share.toModel(), delivered: result.delivered)
+		}
+	}
+
+	func offerTransferToContact(
+		transferId: UInt64,
+		endpointId: String
+	) async -> Result<ContactSendOutcome, Error> {
+		await runCore {
+			let result = try self.requireCore().offerTransferToContact(
+				transferId: transferId, endpointId: endpointId
+			)
+			return ContactSendOutcome(share: result.share.toModel(), delivered: result.delivered)
+		}
+	}
+
+	func heldOffers() async -> Result<[HeldOfferModel], Error> {
+		await runCore { try self.requireCore().listHeldOffers().map { $0.toModel() } }
+	}
+
+	func pollContactsForOffers() async -> Result<UInt64, Error> {
+		await runCore { try self.requireCore().pollContactsForOffers() }
+	}
+
+	func forgetContact(endpointId: String) async -> Result<Void, Error> {
+		await runCore { try self.requireCore().forgetContact(endpointId: endpointId) }
+	}
+
+	func forgetAllContacts() async -> Result<UInt64, Error> {
+		await runCore { try self.requireCore().forgetAllContacts() }
+	}
+
+	func blockContact(endpointId: String) async -> Result<Void, Error> {
+		await runCore { try self.requireCore().blockContact(endpointId: endpointId) }
+	}
+
+	func unblockContact(endpointId: String) async -> Result<Void, Error> {
+		await runCore { try self.requireCore().unblockContact(endpointId: endpointId) }
+	}
+
+	func blockedContacts() async -> Result<[String], Error> {
+		await runCore { try self.requireCore().listBlockedContacts() }
+	}
+
+	func setContactLabel(endpointId: String, label: String?) async -> Result<Void, Error> {
+		await runCore {
+			try self.requireCore().setContactLabel(endpointId: endpointId, label: label)
+		}
+	}
+
+	func setGrantLifetime(_ lifetime: GrantLifetimeOption) async {
+		_ = await runCore { try self.requireCore().setGrantLifetime(lifetime: lifetime.toNative()) }
+	}
+
 	// MARK: - Event sink handling (ported from CoreRepository.sink)
 
 	private func handle(event: CoreEvent) {
@@ -302,6 +419,14 @@ final class CoreRepository: ObservableObject, CoreGateway {
 		if events.count > Self.maxEvents { events = Array(events.prefix(Self.maxEvents)) }
 		state.events = events
 
+		// Contacts and offers are endpoint-scoped: they carry no transfer id, so
+		// they are dispatched before the transfer-scoped handling below.
+		switch model.phase {
+		case "contacts": signalsSubject.send(.contactsChanged)
+		case "offer": signalsSubject.send(.offersChanged)
+		default: break
+		}
+
 		guard let transferId = model.transferId else { return }
 		switch model.phase {
 		case "approval", "access": signalsSubject.send(.approvalChanged(transferId: transferId))
@@ -519,3 +644,61 @@ private extension ReceiverRequest {
 		}
 	}
 }
+
+extension ContactSummary {
+	func toModel() -> DeviceContact {
+		DeviceContact(
+			endpointId: endpointId,
+			localLabel: localLabel,
+			remoteDisplayName: remoteDisplayName,
+			lastTransferAt: lastTransferAt,
+			createdAt: createdAt,
+			canSend: canSend
+		)
+	}
+}
+
+extension PendingPairing {
+	func toModel() -> PendingPairingModel {
+		PendingPairingModel(endpointId: endpointId, displayName: displayName, receivedAt: receivedAt)
+	}
+}
+
+extension IncomingOffer {
+	func toModel() -> IncomingOfferModel {
+		IncomingOfferModel(
+			offerId: offerId,
+			fromEndpointId: fromEndpointId,
+			senderDisplayName: senderDisplayName,
+			transferName: transferName,
+			fileCount: fileCount,
+			totalBytes: totalBytes,
+			receivedAt: receivedAt
+		)
+	}
+}
+
+extension HeldOfferSummary {
+	func toModel() -> HeldOfferModel {
+		HeldOfferModel(
+			offerId: offerId,
+			endpointId: endpointId,
+			transferId: transferId,
+			transferName: transferName,
+			fileCount: fileCount,
+			totalBytes: totalBytes,
+			createdAt: createdAt
+		)
+	}
+}
+
+extension GrantLifetimeOption {
+	func toNative() -> GrantLifetimeSetting {
+		switch self {
+		case .days30: return .days30
+		case .days90: return .days90
+		case .days365: return .days365
+		case .never: return .never
+		}
+	}
+}

apple/VniDrop/Core/FileSystemService.swift

@@ -33,13 +33,16 @@ protocol FileSystemService {
 	func revealReceiveFolder(_ folder: ReceiveFolder) async -> Result<Void, Error>
 	/// Releases only app-owned picker copies; never deletes original user sources.
 	func discardPickedFiles(_ files: [PickedShareFile]) async
+	/// Imports a picked selection, either as an invitation or straight to a
+	/// remembered device. One entry point so the platform's security-scoped
+	/// access handling covers both.
 	func sharePickedFiles(
 		repository: CoreGateway,
 		files: [PickedShareFile],
 		transferName: String,
 		senderName: String,
-		accessPolicy: ShareAccessPolicy
-	) async -> Result<Share, Error>
+		destination: ShareDestination
+	) async -> Result<ContactSendOutcome, Error>
 }
 
 extension FileSystemService {

apple/VniDrop/Features/Contacts/ContactPrompts.swift

@@ -0,0 +1,185 @@
+import SFSafeSymbols
+import SwiftUI
+
+/// Consent prompts for device history, presented as sheets like the receiver
+/// approval modal.
+///
+/// Both are dismissable by answering only. An incoming offer in particular must
+/// not be acceptable by accident, and a swipe-away would leave the sender
+/// waiting on a decision that never comes.
+struct ContactPromptHost: View {
+	/// Driven by the host so a prompt is never presented while another sheet is
+	/// still animating out — macOS silently drops the second one.
+	@Binding var isPresented: Bool
+	let state: ContactsState
+	let onPairingResponse: (String, Bool) -> Void
+	let onOfferResponse: (String, Bool) -> Void
+	let onSuggestionResponse: (PairingSuggestion, Bool) -> Void
+
+	var body: some View {
+		Color.clear
+			.sheet(isPresented: $isPresented) {
+				// Ordered by who is waiting: a sender is blocked on an offer, a
+				// pairing request keeps until its consent window lapses, and a
+				// post-transfer suggestion has nobody waiting at all.
+				if let offer = state.currentOffer {
+					OfferSheet(
+						offer: offer,
+						busy: state.busyOfferIds.contains(offer.offerId),
+						onRespond: onOfferResponse
+					)
+					.interactiveDismissDisabled(true)
+					.modifier(ContactPromptDetents())
+				} else if let pairing = state.currentPairing {
+					PairingSheet(
+						pairing: pairing,
+						busy: state.busyEndpoints.contains(pairing.endpointId),
+						onRespond: onPairingResponse
+					)
+					.interactiveDismissDisabled(true)
+					.modifier(ContactPromptDetents())
+				} else if let suggestion = state.currentSuggestion {
+					// Lowest priority: nobody is waiting on this answer, it just
+					// follows a transfer that already finished.
+					SuggestionSheet(
+						suggestion: suggestion,
+						busy: state.busyEndpoints.contains(suggestion.endpointId),
+						onRespond: onSuggestionResponse
+					)
+					.interactiveDismissDisabled(true)
+					.modifier(ContactPromptDetents())
+				}
+			}
+	}
+}
+
+private struct ContactPromptDetents: ViewModifier {
+	func body(content: Content) -> some View {
+		#if os(iOS)
+		content.presentationDetents([.medium])
+		#else
+		content.frame(minWidth: 420, minHeight: 300)
+		#endif
+	}
+}
+
+/// "A remembered device wants to send you files."
+private struct OfferSheet: View {
+	let offer: IncomingOfferModel
+	let busy: Bool
+	let onRespond: (String, Bool) -> Void
+
+	var body: some View {
+		VStack(spacing: 16) {
+			Image(systemSymbol: .trayAndArrowDownFill)
+				.font(.system(size: 44))
+				.foregroundStyle(.tint)
+				.padding(.top, 12)
+			Text(String(localized: L10n.Offer.title))
+				.font(.title2).fontWeight(.semibold)
+			Text(L10n.Offer.body(device: offer.resolvedSenderName, transferName: offer.transferName))
+				.multilineTextAlignment(.center)
+			Text(L10n.Transfer.fileCount(count: Int(offer.fileCount)))
+				.font(.caption)
+				.foregroundStyle(.secondary)
+			Spacer(minLength: 0)
+			HStack(spacing: 12) {
+				Button(role: .cancel) {
+					onRespond(offer.offerId, false)
+				} label: {
+					Text(String(localized: L10n.Offer.decline)).frame(maxWidth: .infinity)
+				}
+				Button {
+					onRespond(offer.offerId, true)
+				} label: {
+					Text(String(localized: L10n.Offer.accept)).frame(maxWidth: .infinity)
+				}
+				.buttonStyle(.borderedProminent)
+			}
+			.disabled(busy)
+		}
+		.padding(20)
+	}
+}
+
+/// "This device offered to let you reach it. Remember it?"
+private struct PairingSheet: View {
+	let pairing: PendingPairingModel
+	let busy: Bool
+	let onRespond: (String, Bool) -> Void
+
+	var body: some View {
+		VStack(spacing: 16) {
+			Image(systemSymbol: .macbookAndIphone)
+				.font(.system(size: 44))
+				.foregroundStyle(.tint)
+				.padding(.top, 12)
+			Text(String(localized: L10n.Pairing.requestTitle))
+				.font(.title2).fontWeight(.semibold)
+			Text(L10n.Pairing.requestBody(device: pairing.resolvedName))
+				.multilineTextAlignment(.center)
+			// Names are peer-supplied; the endpoint id is what actually identifies
+			// the device.
+			Text(L10n.Approval.endpointId(deviceId: pairing.endpointId))
+				.font(.caption)
+				.foregroundStyle(.secondary)
+				.multilineTextAlignment(.center)
+			Spacer(minLength: 0)
+			HStack(spacing: 12) {
+				Button(role: .cancel) {
+					onRespond(pairing.endpointId, false)
+				} label: {
+					Text(String(localized: L10n.Pairing.decline)).frame(maxWidth: .infinity)
+				}
+				Button {
+					onRespond(pairing.endpointId, true)
+				} label: {
+					Text(String(localized: L10n.Pairing.accept)).frame(maxWidth: .infinity)
+				}
+				.buttonStyle(.borderedProminent)
+			}
+			.disabled(busy)
+		}
+		.padding(20)
+	}
+}
+
+/// "You just transferred with this device. Let it reach you next time?"
+private struct SuggestionSheet: View {
+	let suggestion: PairingSuggestion
+	let busy: Bool
+	let onRespond: (PairingSuggestion, Bool) -> Void
+
+	var body: some View {
+		VStack(spacing: 16) {
+			Image(systemSymbol: .clockArrowCirclepath)
+				.font(.system(size: 44))
+				.foregroundStyle(.tint)
+				.padding(.top, 12)
+			Text(String(localized: L10n.Pairing.allowTitle))
+				.font(.title2).fontWeight(.semibold)
+			Text(L10n.Pairing.requestBody(device: suggestion.resolvedName))
+				.multilineTextAlignment(.center)
+			Text(String(localized: L10n.Pairing.allowBody))
+				.font(.caption)
+				.foregroundStyle(.secondary)
+				.multilineTextAlignment(.center)
+			Spacer(minLength: 0)
+			HStack(spacing: 12) {
+				Button(role: .cancel) {
+					onRespond(suggestion, false)
+				} label: {
+					Text(String(localized: L10n.Pairing.decline)).frame(maxWidth: .infinity)
+				}
+				Button {
+					onRespond(suggestion, true)
+				} label: {
+					Text(String(localized: L10n.Pairing.allowConfirm)).frame(maxWidth: .infinity)
+				}
+				.buttonStyle(.borderedProminent)
+			}
+			.disabled(busy)
+		}
+		.padding(20)
+	}
+}

apple/VniDrop/Features/Contacts/ContactsModel.swift

@@ -0,0 +1,451 @@
+import Combine
+import Foundation
+
+/// A device worth remembering after a completed transfer.
+///
+/// Only a suggestion: nothing is issued until the user agrees, because being
+/// reachable is a standing permission and a transfer is a one-off.
+struct PairingSuggestion: Equatable, Identifiable {
+	let endpointId: String
+	let displayName: String?
+	let transferName: String?
+
+	var id: String { endpointId }
+
+	var resolvedName: String {
+		guard let displayName, !displayName.isEmpty else {
+			return String(localized: L10n.Approval.nearbyDevice)
+		}
+		return displayName
+	}
+}
+
+struct ContactsState: Equatable {
+	var contacts: [DeviceContact] = []
+	var blocked: [String] = []
+	var pendingPairings: [PendingPairingModel] = []
+	var pendingOffers: [IncomingOfferModel] = []
+	var grantLifetime: GrantLifetimeOption = .days90
+	var isLoading = false
+	/// Endpoints with an in-flight decision, so a row can disable itself without
+	/// blocking the rest of the list.
+	var busyEndpoints: Set<String> = []
+	var busyOfferIds: Set<String> = []
+	var suggestions: [PairingSuggestion] = []
+	/// Transfers this device is holding for contacts that were not running.
+	var heldOffers: [HeldOfferModel] = []
+	var checkForOffersOnOpen = false
+	var isCheckingForOffers = false
+	var selectedEndpointId: String?
+
+	var selected: DeviceContact? {
+		guard let selectedEndpointId else { return nil }
+		return contacts.first { $0.endpointId == selectedEndpointId }
+	}
+
+	/// One prompt at a time: pairing consent is a modal decision and stacking
+	/// sheets on top of each other reads as a loop of dialogs.
+	var currentPairing: PendingPairingModel? { pendingPairings.first }
+	var currentOffer: IncomingOfferModel? { pendingOffers.first }
+	var currentSuggestion: PairingSuggestion? { suggestions.first }
+}
+
+/// Drives the device-history surfaces: the list, its detail, and the two
+/// consent prompts. Ported in the MVVM shape used by the other feature models.
+@MainActor
+final class ContactsModel: ObservableObject {
+	@Published private(set) var state = ContactsState()
+
+	/// Set when the detail screen asks for a file picker; the platform picker
+	/// modifier observes it, mirroring `SendModel`.
+	@Published var pendingFilePick = false
+	/// Device the picked files are destined for.
+	@Published private(set) var sendTarget: String?
+
+	private let repository: CoreGateway
+	private let messages: UiMessageController
+	private let preferences: AppPreferencesRepository
+	private let fileSystemService: FileSystemService
+	private var cancellables = Set<AnyCancellable>()
+
+	init(
+		repository: CoreGateway,
+		messages: UiMessageController,
+		preferences: AppPreferencesRepository,
+		fileSystemService: FileSystemService
+	) {
+		self.repository = repository
+		self.messages = messages
+		self.preferences = preferences
+		self.fileSystemService = fileSystemService
+		state.grantLifetime = preferences.preferences.grantLifetime
+		state.checkForOffersOnOpen = preferences.preferences.checkForOffersOnOpen
+
+		repository.signals
+			.sink { [weak self] signal in
+				guard let self else { return }
+				switch signal {
+				case .contactsChanged:
+					Task { await self.refresh() }
+				case .offersChanged:
+					Task { await self.refreshOffers() }
+				case .receiverHistoryChanged(let transferId), .transfersChanged(let transferId):
+					// A completed delivery names the device that received from us.
+					Task { await self.considerSendPeers(transferId: transferId) }
+				case .approvalChanged:
+					break
+				}
+			}
+			.store(in: &cancellables)
+
+		repository.statePublisher
+			.sink { [weak self] core in
+				guard let self, core.isInitialized else { return }
+				self.considerReceivePeers(core.transfers)
+			}
+			.store(in: &cancellables)
+
+		repository.statePublisher
+			.map(\.isInitialized)
+			.removeDuplicates()
+			.sink { [weak self] isInitialized in
+				guard let self, isInitialized else { return }
+				// The core owns the lifetime; push the stored preference on start
+				// so a restart does not silently fall back to the default.
+				Task {
+					await self.repository.setGrantLifetime(self.state.grantLifetime)
+					await self.refresh()
+				}
+			}
+			.store(in: &cancellables)
+	}
+
+	// MARK: - Loading
+
+	func refresh() async {
+		state.isLoading = true
+		defer { state.isLoading = false }
+
+		switch await repository.contacts() {
+		case .success(let contacts):
+			state.contacts = contacts
+		case .failure(let error):
+			messages.error(error)
+		}
+		if case .success(let blocked) = await repository.blockedContacts() {
+			state.blocked = blocked
+		}
+		if case .success(let held) = await repository.heldOffers() {
+			state.heldOffers = held
+		}
+		state.pendingPairings = await repository.pendingPairings()
+		await refreshOffers()
+	}
+
+	func refreshOffers() async {
+		state.pendingOffers = await repository.pendingOffers()
+	}
+
+	// MARK: - Post-transfer suggestions
+
+	/// A completed receive names its sender, so that device becomes a candidate.
+	private func considerReceivePeers(_ transfers: [Transfer]) {
+		let candidates = transfers
+			.filter { $0.direction == .receive && $0.status == .done }
+			.compactMap { transfer -> PairingSuggestion? in
+				guard let peerId = transfer.peerId else { return nil }
+				return PairingSuggestion(
+					endpointId: peerId,
+					displayName: nil,
+					transferName: transfer.transferName
+				)
+			}
+		add(suggestions: candidates)
+	}
+
+	/// A completed delivery names the device we sent to.
+	private func considerSendPeers(transferId: UInt64) async {
+		guard case .success(let requests) = await repository.receiverRequests(transferId: transferId) else {
+			return
+		}
+		let candidates = requests
+			.filter { $0.status == .completed }
+			.map { request in
+				PairingSuggestion(
+					endpointId: request.remoteEndpointId,
+					displayName: request.receiverName ?? request.receiverDeviceName,
+					transferName: request.transferName
+				)
+			}
+		add(suggestions: candidates)
+	}
+
+	/// Filters candidates down to devices actually worth asking about.
+	private func add(suggestions candidates: [PairingSuggestion]) {
+		let known = Set(state.contacts.map(\.endpointId))
+		let blocked = Set(state.blocked)
+		let declined = preferences.preferences.declinedPairingSuggestions
+		let pending = Set(state.suggestions.map(\.endpointId))
+
+		let fresh = candidates.filter { candidate in
+			!known.contains(candidate.endpointId)
+				&& !blocked.contains(candidate.endpointId)
+				&& !declined.contains(candidate.endpointId)
+				&& !pending.contains(candidate.endpointId)
+		}
+		guard !fresh.isEmpty else { return }
+		state.suggestions.append(contentsOf: fresh)
+	}
+
+	/// Agree to be reachable by a suggested device.
+	func acceptSuggestion(_ suggestion: PairingSuggestion) async {
+		state.suggestions.removeAll { $0.endpointId == suggestion.endpointId }
+		preferences.clearDeclinedPairingSuggestion(suggestion.endpointId)
+		await allowDeviceToReachMe(
+			endpointId: suggestion.endpointId,
+			displayName: preferences.preferences.username
+		)
+	}
+
+	/// Decline, and remember the decline so the next transfer does not re-ask.
+	func declineSuggestion(_ suggestion: PairingSuggestion) {
+		state.suggestions.removeAll { $0.endpointId == suggestion.endpointId }
+		preferences.declinePairingSuggestion(suggestion.endpointId)
+	}
+
+	// MARK: - Collecting waiting transfers
+
+	func setCheckForOffersOnOpen(_ enabled: Bool) {
+		state.checkForOffersOnOpen = enabled
+		preferences.setCheckForOffersOnOpen(enabled)
+	}
+
+	/// Called when the app comes to the foreground.
+	///
+	/// Opt-in, because asking every contact whether they have something waiting
+	/// also tells them the app was opened. Never runs in the background.
+	func checkForOffersOnForeground() async {
+		guard state.checkForOffersOnOpen else { return }
+		_ = await collectWaitingOffers()
+	}
+
+	/// Explicit "check now". Returns how many transfers were collected so the
+	/// caller can report an empty result, which a silent refresh cannot.
+	@discardableResult
+	func collectWaitingOffers() async -> UInt64 {
+		guard !state.isCheckingForOffers else { return 0 }
+		state.isCheckingForOffers = true
+		defer { state.isCheckingForOffers = false }
+
+		switch await repository.pollContactsForOffers() {
+		case .success(let collected):
+			await refreshOffers()
+			return collected
+		case .failure(let error):
+			messages.error(error)
+			return 0
+		}
+	}
+
+	// MARK: - Selection
+
+	func select(_ endpointId: String?) { state.selectedEndpointId = endpointId }
+
+	// MARK: - Pairing consent
+
+	/// Agree to be reachable by a device, typically right after a transfer.
+	func allowDeviceToReachMe(endpointId: String, displayName: String?) async {
+		state.busyEndpoints.insert(endpointId)
+		defer { state.busyEndpoints.remove(endpointId) }
+
+		if case .failure(let error) = await repository.allowDeviceToReachMe(
+			endpointId: endpointId,
+			displayName: displayName
+		) {
+			messages.error(error)
+			return
+		}
+		await refresh()
+	}
+
+	/// Answer a device's offer to be remembered.
+	func respondToPairing(endpointId: String, accepted: Bool) async {
+		state.busyEndpoints.insert(endpointId)
+		defer { state.busyEndpoints.remove(endpointId) }
+
+		switch await repository.respondToPairing(endpointId: endpointId, accepted: accepted) {
+		case .success:
+			// Drop the prompt immediately: the core has already consumed it, and
+			// leaving it on screen invites a second answer that does nothing.
+			state.pendingPairings.removeAll { $0.endpointId == endpointId }
+			if accepted { await refresh() }
+		case .failure(let error):
+			messages.error(error)
+		}
+	}
+
+	// MARK: - Incoming offers
+
+	/// Answer an incoming offer. Returns the ticket when accepted so the caller
+	/// can run the receive with a platform-appropriate destination; the core
+	/// releases it only on acceptance.
+	func respondToOffer(offerId: String, accepted: Bool) async -> String? {
+		state.busyOfferIds.insert(offerId)
+		defer { state.busyOfferIds.remove(offerId) }
+
+		let ticket = await repository.respondToOffer(offerId: offerId, accepted: accepted)
+		state.pendingOffers.removeAll { $0.offerId == offerId }
+		return ticket
+	}
+
+	// MARK: - Sending to a device
+
+	/// Start choosing files to send to a remembered device.
+	func chooseFilesToSend(to endpointId: String) {
+		sendTarget = endpointId
+		pendingFilePick = true
+	}
+
+	func onFilePickFailed(_ reason: String) {
+		sendTarget = nil
+		messages.error(InvitationError.raw(reason))
+	}
+
+	/// Send the picked selection straight to the chosen device.
+	///
+	/// Only the receiving user is prompted; this call returns once they have
+	/// answered, so the button stays busy until then.
+	func onFilesPicked(_ files: [PickedShareFile]) async {
+		guard let endpointId = sendTarget else { return }
+		sendTarget = nil
+		guard !files.isEmpty else { return }
+
+		state.busyEndpoints.insert(endpointId)
+		defer { state.busyEndpoints.remove(endpointId) }
+
+		let result = await fileSystemService.sharePickedFiles(
+			repository: repository,
+			files: files,
+			transferName: files.count == 1 ? files[0].displayName : "",
+			senderName: preferences.preferences.username,
+			destination: .contact(endpointId: endpointId)
+		)
+		await fileSystemService.discardPickedFiles(files)
+		switch result {
+		case .success(let outcome):
+			// A closed app is a delay, not a failure: say so rather than
+			// reporting success for something nobody has received.
+			let text: UiText = outcome.delivered
+				? .resource(L10n.Send.transferCreated)
+				: .resource(L10n.Contacts.offerHeld)
+			messages.tryShow(UiMessage(text: text, tone: outcome.delivered ? .success : .info))
+			await refresh()
+		case .failure(let error):
+			messages.error(error)
+		}
+	}
+
+	/// Fire-and-report variant of ``offerTransfer(transferId:to:)``.
+	///
+	/// Owned by the model rather than a view so the request survives the picker
+	/// being dismissed: the answer depends on a person at the other device.
+	func offerTransferInBackground(transferId: UInt64, to contact: DeviceContact) {
+		Task { await offerTransfer(transferId: transferId, to: contact) }
+	}
+
+	/// Push an existing transfer to a remembered device.
+	///
+	/// Returns whether it landed, so the caller can distinguish "accepted" from
+	/// "waiting for that device to open the app".
+	@discardableResult
+	func offerTransfer(transferId: UInt64, to contact: DeviceContact) async -> Bool {
+		state.busyEndpoints.insert(contact.endpointId)
+		defer { state.busyEndpoints.remove(contact.endpointId) }
+
+		switch await repository.offerTransferToContact(
+			transferId: transferId,
+			endpointId: contact.endpointId
+		) {
+		case .success(let outcome):
+			let text: UiText = outcome.delivered
+				? .dynamic(L10n.Contacts.sentToDevice(device: contact.displayName))
+				: .resource(L10n.Contacts.offerHeld)
+			messages.tryShow(UiMessage(text: text, tone: outcome.delivered ? .success : .info))
+			await refresh()
+			return outcome.delivered
+		case .failure(let error) where error.offerRefusal != nil:
+			// The offer was delivered and a person said no, or nobody answered.
+			// Neither is a failure of this device, so neither is shown as one.
+			let text = error.offerRefusal == .declined
+				? L10n.Contacts.declinedByDevice(device: contact.displayName)
+				: L10n.Contacts.noAnswer(device: contact.displayName)
+			messages.tryShow(UiMessage(text: .dynamic(text), tone: .info))
+			await refresh()
+			return false
+		case .failure(let error):
+			messages.error(error)
+			return false
+		}
+	}
+
+	// MARK: - Management
+
+	func setLabel(endpointId: String, label: String) async {
+		let trimmed = label.trimmingCharacters(in: .whitespacesAndNewlines)
+		if case .failure(let error) = await repository.setContactLabel(
+			endpointId: endpointId,
+			label: trimmed.isEmpty ? nil : trimmed
+		) {
+			messages.error(error)
+			return
+		}
+		await refresh()
+	}
+
+	func forget(endpointId: String) async {
+		state.busyEndpoints.insert(endpointId)
+		defer { state.busyEndpoints.remove(endpointId) }
+
+		if case .failure(let error) = await repository.forgetContact(endpointId: endpointId) {
+			messages.error(error)
+			return
+		}
+		if state.selectedEndpointId == endpointId { state.selectedEndpointId = nil }
+		await refresh()
+	}
+
+	func forgetAll() async {
+		if case .failure(let error) = await repository.forgetAllContacts() {
+			messages.error(error)
+			return
+		}
+		state.selectedEndpointId = nil
+		await refresh()
+	}
+
+	func block(endpointId: String) async {
+		state.busyEndpoints.insert(endpointId)
+		defer { state.busyEndpoints.remove(endpointId) }
+
+		if case .failure(let error) = await repository.blockContact(endpointId: endpointId) {
+			messages.error(error)
+			return
+		}
+		if state.selectedEndpointId == endpointId { state.selectedEndpointId = nil }
+		await refresh()
+	}
+
+	func unblock(endpointId: String) async {
+		if case .failure(let error) = await repository.unblockContact(endpointId: endpointId) {
+			messages.error(error)
+			return
+		}
+		await refresh()
+	}
+
+	func setGrantLifetime(_ lifetime: GrantLifetimeOption) {
+		state.grantLifetime = lifetime
+		preferences.setGrantLifetime(lifetime)
+		Task { await repository.setGrantLifetime(lifetime) }
+	}
+}

apple/VniDrop/Features/Contacts/ContactsScreen.swift

@@ -0,0 +1,344 @@
+import SFSafeSymbols
+import SwiftUI
+
+/// Device history: the remembered devices, their detail, and the block list.
+///
+/// Pushed from Settings rather than owning a tab — it is a management surface,
+/// not part of the send/receive flow.
+struct ContactsScreen: View {
+	@ObservedObject var model: ContactsModel
+	/// Reports an empty result, which a silent refresh cannot convey.
+	let onNothingWaiting: () -> Void
+
+	var body: some View {
+		Form {
+			Section {
+				Text(String(localized: L10n.Contacts.subtitle))
+					.font(.footnote)
+					.foregroundStyle(.secondary)
+			}
+
+			if model.state.contacts.isEmpty {
+				Section {
+					ContactsEmptyState()
+				}
+			} else {
+				Section(String(localized: L10n.Contacts.title)) {
+					ForEach(model.state.contacts) { contact in
+						NavigationLink(value: SettingsSection.contactDetail(endpointId: contact.endpointId)) {
+							ContactRow(contact: contact)
+						}
+					}
+				}
+			}
+
+			if !model.state.heldOffers.isEmpty {
+				Section(String(localized: L10n.Contacts.waitingTitle)) {
+					ForEach(model.state.heldOffers) { offer in
+						VStack(alignment: .leading, spacing: 2) {
+							Text(offer.transferName)
+							Text(String(offer.endpointId.prefix(16)))
+								.font(.caption.monospaced())
+								.foregroundStyle(.secondary)
+								.lineLimit(1)
+								.truncationMode(.middle)
+						}
+					}
+					Text(String(localized: L10n.Contacts.waitingHint))
+						.font(.footnote)
+						.foregroundStyle(.secondary)
+				}
+			}
+
+			if !model.state.blocked.isEmpty {
+				Section(String(localized: L10n.Contacts.blockedTitle)) {
+					ForEach(model.state.blocked, id: \.self) { endpointId in
+						BlockedRow(endpointId: endpointId) {
+							Task { await model.unblock(endpointId: endpointId) }
+						}
+					}
+					Text(String(localized: L10n.Contacts.unblockHint))
+						.font(.footnote)
+						.foregroundStyle(.secondary)
+				}
+			}
+
+			CollectOffersSection(model: model, onNothingWaiting: onNothingWaiting)
+
+			GrantLifetimeSection(model: model)
+
+			if !model.state.contacts.isEmpty {
+				Section {
+					ForgetAllButton { Task { await model.forgetAll() } }
+				}
+			}
+		}
+		.formStyle(.grouped)
+		.navigationTitle(Text(String(localized: L10n.Contacts.title)))
+		.task { await model.refresh() }
+	}
+}
+
+private struct ContactsEmptyState: View {
+	var body: some View {
+		VStack(spacing: 8) {
+			Image(systemSymbol: .macbookAndIphone)
+				.font(.system(size: 32))
+				.foregroundStyle(.tint)
+			Text(String(localized: L10n.Contacts.emptyTitle))
+				.font(.headline)
+			Text(String(localized: L10n.Contacts.emptyBody))
+				.font(.footnote)
+				.foregroundStyle(.secondary)
+				.multilineTextAlignment(.center)
+		}
+		.frame(maxWidth: .infinity)
+		.padding(.vertical, 12)
+	}
+}
+
+private struct ContactRow: View {
+	let contact: DeviceContact
+
+	var body: some View {
+		VStack(alignment: .leading, spacing: 2) {
+			Text(contact.displayName)
+			if contact.canSend {
+				if let lastTransferAt = contact.lastTransferAt {
+					Text(L10n.Contacts.lastTransfer(date: Self.format(lastTransferAt)))
+						.font(.caption)
+						.foregroundStyle(.secondary)
+				}
+			} else {
+				// Reachability is derived from holding a live grant, so this is
+				// the honest signal that sending will not work.
+				Label(
+					String(localized: L10n.Contacts.unreachable),
+					systemSymbol: .exclamationmarkTriangleFill
+				)
+				.font(.caption)
+				.foregroundStyle(.orange)
+			}
+		}
+	}
+
+	private static func format(_ millis: Int64) -> String {
+		let date = Date(timeIntervalSince1970: TimeInterval(millis) / 1_000)
+		return date.formatted(.relative(presentation: .named))
+	}
+}
+
+private struct BlockedRow: View {
+	let endpointId: String
+	let onUnblock: () -> Void
+
+	var body: some View {
+		HStack {
+			Text(String(endpointId.prefix(16)))
+				.font(.callout.monospaced())
+				.lineLimit(1)
+				.truncationMode(.middle)
+			Spacer()
+			Button(String(localized: L10n.Contacts.unblock), action: onUnblock)
+				.buttonStyle(.borderless)
+		}
+	}
+}
+
+private struct CollectOffersSection: View {
+	@ObservedObject var model: ContactsModel
+	let onNothingWaiting: () -> Void
+
+	var body: some View {
+		Section {
+			Toggle(
+				String(localized: L10n.Contacts.checkOnOpen),
+				isOn: Binding(
+					get: { model.state.checkForOffersOnOpen },
+					set: { model.setCheckForOffersOnOpen($0) }
+				)
+			)
+			Button {
+				Task {
+					let collected = await model.collectWaitingOffers()
+					if collected == 0 { onNothingWaiting() }
+				}
+			} label: {
+				HStack {
+					Text(String(localized: L10n.Contacts.checkNow))
+					if model.state.isCheckingForOffers {
+						Spacer()
+						ProgressView().controlSize(.small)
+					}
+				}
+			}
+			.disabled(model.state.isCheckingForOffers)
+		} footer: {
+			// The privacy cost is the point of the setting, so it is stated
+			// where the switch is, not buried elsewhere.
+			Text(String(localized: L10n.Contacts.checkOnOpenHint))
+		}
+	}
+}
+
+private struct GrantLifetimeSection: View {
+	@ObservedObject var model: ContactsModel
+
+	var body: some View {
+		Section {
+			Picker(
+				String(localized: L10n.Contacts.grantLifetimeTitle),
+				selection: Binding(
+					get: { model.state.grantLifetime },
+					set: { model.setGrantLifetime($0) }
+				)
+			) {
+				ForEach(GrantLifetimeOption.allCases) { option in
+					Text(Self.label(option)).tag(option)
+				}
+			}
+			Text(String(localized: L10n.Contacts.grantLifetimeHint))
+				.font(.footnote)
+				.foregroundStyle(.secondary)
+		}
+	}
+
+	private static func label(_ option: GrantLifetimeOption) -> String {
+		guard let days = option.days else {
+			return String(localized: L10n.Contacts.grantLifetimeNever)
+		}
+		return L10n.Contacts.grantLifetimeDays(count: days)
+	}
+}
+
+private struct ForgetAllButton: View {
+	let onConfirm: () -> Void
+	@State private var isConfirming = false
+
+	var body: some View {
+		Button(role: .destructive) {
+			isConfirming = true
+		} label: {
+			Text(String(localized: L10n.Contacts.forgetAll))
+		}
+		.confirmationDialog(
+			String(localized: L10n.Contacts.forgetAll),
+			isPresented: $isConfirming,
+			titleVisibility: .visible
+		) {
+			Button(String(localized: L10n.Contacts.forgetAll), role: .destructive, action: onConfirm)
+		} message: {
+			Text(String(localized: L10n.Contacts.forgetBody))
+		}
+	}
+}
+
+/// Detail for one remembered device: rename, send, forget, block.
+struct ContactDetailScreen: View {
+	@ObservedObject var model: ContactsModel
+	let endpointId: String
+
+	@State private var label = ""
+	@State private var isConfirmingForget = false
+	@State private var isConfirmingBlock = false
+
+	private var contact: DeviceContact? {
+		model.state.contacts.first { $0.endpointId == endpointId }
+	}
+
+	var body: some View {
+		Form {
+			if let contact {
+				Section {
+					TextField(
+						String(localized: L10n.Contacts.nameField),
+						text: $label,
+						prompt: Text(contact.displayName)
+					)
+					.onSubmit { commitLabel() }
+					Text(String(localized: L10n.Contacts.nameHint))
+						.font(.footnote)
+						.foregroundStyle(.secondary)
+				}
+
+				Section {
+					// The endpoint id is the only real identity: two devices can
+					// claim the same name, but not the same key. Shown in full
+					// and selectable so it can actually be compared.
+					Text(L10n.Approval.endpointId(deviceId: contact.endpointId))
+						.font(.caption.monospaced())
+						.foregroundStyle(.secondary)
+						.textSelection(.enabled)
+				}
+
+				if contact.canSend {
+					Section {
+						Button {
+							model.chooseFilesToSend(to: endpointId)
+						} label: {
+							Label(
+								String(localized: L10n.Contacts.sendTo),
+								systemSymbol: .paperplane
+							)
+						}
+						.disabled(model.state.busyEndpoints.contains(endpointId))
+					}
+				} else {
+					Section {
+						Label(
+							String(localized: L10n.Contacts.unreachableBody),
+							systemSymbol: .exclamationmarkTriangleFill
+						)
+						.font(.footnote)
+					}
+				}
+
+				Section {
+					Button(role: .destructive) {
+						isConfirmingForget = true
+					} label: {
+						Text(String(localized: L10n.Contacts.forget))
+					}
+					Button(role: .destructive) {
+						isConfirmingBlock = true
+					} label: {
+						Text(String(localized: L10n.Contacts.block))
+					}
+				}
+				.disabled(model.state.busyEndpoints.contains(endpointId))
+			}
+		}
+		.formStyle(.grouped)
+		.navigationTitle(Text(contact?.displayName ?? ""))
+		.contactSendPickers(model: model)
+		.onAppear { label = contact?.localLabel ?? "" }
+		.onDisappear { commitLabel() }
+		.confirmationDialog(
+			String(localized: L10n.Contacts.forget),
+			isPresented: $isConfirmingForget,
+			titleVisibility: .visible
+		) {
+			Button(String(localized: L10n.Contacts.forget), role: .destructive) {
+				Task { await model.forget(endpointId: endpointId) }
+			}
+		} message: {
+			Text(String(localized: L10n.Contacts.forgetBody))
+		}
+		.confirmationDialog(
+			String(localized: L10n.Contacts.block),
+			isPresented: $isConfirmingBlock,
+			titleVisibility: .visible
+		) {
+			Button(String(localized: L10n.Contacts.block), role: .destructive) {
+				Task { await model.block(endpointId: endpointId) }
+			}
+		} message: {
+			Text(String(localized: L10n.Contacts.unblockHint))
+		}
+	}
+
+	private func commitLabel() {
+		guard label != (contact?.localLabel ?? "") else { return }
+		Task { await model.setLabel(endpointId: endpointId, label: label) }
+	}
+}

apple/VniDrop/Features/Contacts/DevicePickerSheet.swift

@@ -0,0 +1,73 @@
+import SFSafeSymbols
+import SwiftUI
+
+/// Picks a remembered device to send an existing transfer to.
+///
+/// Offered next to the QR code as another way to deliver the same invitation,
+/// not as a second share of the same files.
+struct DevicePickerSheet: View {
+	@ObservedObject var model: ContactsModel
+	let transferId: UInt64
+	@Environment(\.dismiss) private var dismiss
+
+	/// Only devices holding a live grant: the rest cannot be reached until they
+	/// are paired again, so offering them here would fail on tap.
+	private var reachable: [DeviceContact] {
+		model.state.contacts.filter(\.canSend)
+	}
+
+	var body: some View {
+		NavigationStack {
+			Group {
+				if reachable.isEmpty {
+					ContentUnavailableView {
+						Label(
+							String(localized: L10n.Contacts.pickDeviceTitle),
+							systemSymbol: .macbookAndIphone
+						)
+					} description: {
+						Text(String(localized: L10n.Contacts.pickDeviceEmpty))
+					}
+				} else {
+					List(reachable) { contact in
+						Button {
+							// Close first. The other device's user has to accept,
+							// which can take as long as they take, and holding a
+							// modal open on someone else's decision reads as a
+							// hang. The outcome arrives as a message instead.
+							dismiss()
+							model.offerTransferInBackground(transferId: transferId, to: contact)
+						} label: {
+							HStack {
+								VStack(alignment: .leading, spacing: 2) {
+									Text(contact.displayName)
+									Text(contact.shortFingerprint)
+										.font(.caption.monospaced())
+										.foregroundStyle(.secondary)
+								}
+								Spacer()
+								if model.state.busyEndpoints.contains(contact.endpointId) {
+									ProgressView().controlSize(.small)
+								}
+							}
+						}
+						.disabled(model.state.busyEndpoints.contains(contact.endpointId))
+					}
+				}
+			}
+			.navigationTitle(Text(String(localized: L10n.Contacts.pickDeviceTitle)))
+			#if os(iOS)
+			.navigationBarTitleDisplayMode(.inline)
+			#endif
+			.toolbar {
+				ToolbarItem(placement: .cancellationAction) {
+					Button(String(localized: L10n.Button.cancel)) { dismiss() }
+				}
+			}
+		}
+		.task { await model.refresh() }
+		#if os(macOS)
+		.frame(minWidth: 380, minHeight: 320)
+		#endif
+	}
+}

apple/VniDrop/Features/Notifications/TransferNotificationCoordinator.swift

@@ -111,7 +111,7 @@ final class TransferNotificationCoordinator: ObservableObject {
 				switch signal {
 				case .receiverHistoryChanged(let transferId), .transfersChanged(let transferId):
 					Task { await self.syncReceivers(transferId: transferId) }
-				case .approvalChanged:
+				case .approvalChanged, .contactsChanged, .offersChanged:
 					break
 				}
 			}

apple/VniDrop/Features/Receive/ReceiveModel.swift

@@ -6,6 +6,9 @@ enum ReceiveMethod {
 	case invitationFile
 	case qrCode
 	case nfc
+	/// Pushed by a remembered device and already accepted by the user, so no
+	/// invitation was acquired by hand.
+	case offer
 }
 
 enum ReceiveHistoryDeleteTarget: Equatable {
@@ -154,6 +157,40 @@ final class ReceiveModel: ObservableObject {
 		}
 	}
 
+	/// Receive a transfer the user has already accepted in the offer prompt.
+	///
+	/// The consent happened in that prompt, so this does not ask again: it
+	/// inspects the ticket and starts, falling back to the ordinary review sheet
+	/// only when the destination is not usable and the user has to fix it.
+	func receiveOffered(ticket: String) {
+		let trimmed = ticket.trimmingCharacters(in: .whitespacesAndNewlines)
+		guard !trimmed.isEmpty else { return messages.error(.resource(L10n.Error.invitationEmpty)) }
+		state.ticket = trimmed
+		state.method = .offer
+		state.inspection = nil
+		state.isInspecting = true
+		Task {
+			switch await repository.inspectTicket(trimmed) {
+			case .success(let inspection):
+				state.inspection = inspection
+				state.isInspecting = false
+				if state.canReceive(coreInitialized: coreState.isInitialized) {
+					receive()
+				} else {
+					// Usually a missing or unwritable destination: show the review
+					// sheet so the user can point it somewhere valid.
+					state.isAcquisitionOpen = true
+				}
+			case .failure(let error):
+				state.ticket = ""
+				state.method = nil
+				state.inspection = nil
+				state.isInspecting = false
+				messages.error(error)
+			}
+		}
+	}
+
 	func receive() {
 		let current = state
 		guard let folder = current.receiveFolder else { return }

apple/VniDrop/Features/Send/SendModel.swift

@@ -96,6 +96,8 @@ final class SendModel: ObservableObject {
 				case .receiverHistoryChanged(let id), .approvalChanged(let id):
 					if id == self.state.selectedTransferId { self.refreshReceivers(id) }
 					self.refreshReceiverStatuses(for: id)
+				case .contactsChanged, .offersChanged:
+					break
 				}
 			}
 			.store(in: &cancellables)
@@ -351,9 +353,9 @@ final class SendModel: ObservableObject {
 				files: current.selectedFiles,
 				transferName: current.transferName.trimmingCharacters(in: .whitespacesAndNewlines),
 				senderName: current.senderName.trimmingCharacters(in: .whitespacesAndNewlines),
-				accessPolicy: current.accessPolicy
+				destination: .invitation(accessPolicy: current.accessPolicy)
 			)
-			switch result {
+			switch result.map(\.share) {
 			case .success(let share):
 				await fileSystemService.discardPickedFiles(current.selectedFiles)
 				if let thumb = current.selectedFiles.compactMap(\.thumbnailData).first {

apple/VniDrop/Features/Send/SendScreen.swift

@@ -5,6 +5,7 @@ import SFSafeSymbols
 /// with the composer and detail panels as native sheets and delete as an alert.
 struct SendScreen: View {
 	@ObservedObject var model: SendModel
+	@ObservedObject var contacts: ContactsModel
 	let windowClass: WindowClass
 
 	/// Transfer pending an inline (list-level) delete confirmation.
@@ -60,7 +61,7 @@ struct SendScreen: View {
 				onDismissed: model.shareSheetDidDismiss
 			) {
 				if let shareTarget {
-					TransferSharePanel(model: model, transfer: shareTarget)
+					TransferSharePanel(model: model, contacts: contacts, transfer: shareTarget)
 				}
 			}
 		}
@@ -93,7 +94,7 @@ struct SendScreen: View {
 	/// alert attached here so they present from the detail's own context (presenting
 	/// modals from the parent stack while a detail is pushed is unreliable on macOS).
 	private func detailView(for transfer: Transfer) -> some View {
-		TransferDetailsView(model: model, transfer: transfer, events: model.coreState.events)
+		TransferDetailsView(model: model, contacts: contacts, transfer: transfer, events: model.coreState.events)
 			.adaptiveDrawer(
 				isPresented: Binding(get: { model.state.detailPanel != nil }, set: { _ in }),
 				windowClass: windowClass,
@@ -101,7 +102,7 @@ struct SendScreen: View {
 				onDismissed: model.shareSheetDidDismiss
 			) {
 				if let panel = model.state.detailPanel {
-					DetailPanelContent(model: model, transfer: transfer, panel: panel)
+					DetailPanelContent(model: model, contacts: contacts, transfer: transfer, panel: panel)
 				}
 			}
 			.alert(

apple/VniDrop/Features/Send/TransferDetailsView.swift

@@ -6,6 +6,7 @@ import CoreImage.CIFilterBuiltins
 
 struct TransferDetailsView: View {
 	@ObservedObject var model: SendModel
+	@ObservedObject var contacts: ContactsModel
 	let transfer: Transfer
 	let events: [CoreEventModel]
 	@State private var showStopConfirmation = false
@@ -129,6 +130,7 @@ private struct DetailDestination: View {
 
 struct DetailPanelContent: View {
 	@ObservedObject var model: SendModel
+	@ObservedObject var contacts: ContactsModel
 	let transfer: Transfer
 	let panel: TransferDetailPanel
 
@@ -146,7 +148,7 @@ struct DetailPanelContent: View {
 				onAccept: model.acceptReceiver
 			)
 		case .share:
-			TransferSharePanel(model: model, transfer: transfer)
+			TransferSharePanel(model: model, contacts: contacts, transfer: transfer)
 		}
 	}
 }
@@ -296,6 +298,7 @@ private struct ReceiverRow: View {
 struct TransferSharePanel: View {
 	@Environment(\.vniColors) private var colors
 	@ObservedObject var model: SendModel
+	@ObservedObject var contacts: ContactsModel
 	let transfer: Transfer
 
 	var body: some View {
@@ -309,7 +312,7 @@ struct TransferSharePanel: View {
 						.font(VniType.bodySmall).foregroundStyle(colors.foregroundLighter)
 						.frame(maxWidth: .infinity)
 				}
-				ShareActionsView(model: model, transfer: transfer, ticket: ticket)
+				ShareActionsView(model: model, contacts: contacts, transfer: transfer, ticket: ticket)
 			case .preparing:
 				Text(String(localized: L10n.Transfer.eventPreparing)).foregroundStyle(colors.foregroundLighter)
 			case .unavailable:

apple/VniDrop/Features/Send/TransferShareActions.swift

@@ -20,14 +20,25 @@ protocol TransferShareActions: AnyObject {
 struct ShareActionsView: View {
 	@Environment(\.vniColors) private var colors
 	@ObservedObject var model: SendModel
+	@ObservedObject var contacts: ContactsModel
 	let transfer: Transfer
 	let ticket: String
 
 	@State private var actions: TransferShareActions = makePlatformShareActions()
 	@State private var writingNfc = false
+	@State private var choosingDevice = false
 
 	var body: some View {
 		VStack(spacing: 12) {
+			// Sending straight to a remembered device is another way to deliver
+			// this same invitation, so it belongs with the other delivery
+			// methods rather than in a separate flow.
+			if contacts.state.contacts.contains(where: \.canSend) {
+				SecondaryButton(
+					title: String(localized: L10n.Contacts.sendToDevice),
+					action: { choosingDevice = true }
+				)
+			}
 			if actions.nfcAvailability != .hidden {
 				SecondaryButton(
 					title: writingNfc ? String(localized: L10n.Transfer.nfcWaiting) : String(localized: L10n.Button.writeNfc),
@@ -57,5 +68,8 @@ struct ShareActionsView: View {
 			}, enabled: actions.canUseNativeShare)
 		}
 		.onDisappear { actions.cancelNfcWrite() }
+		.sheet(isPresented: $choosingDevice) {
+			DevicePickerSheet(model: contacts, transferId: transfer.transferId)
+		}
 	}
 }

apple/VniDrop/Features/Settings/SettingsModel.swift

@@ -8,6 +8,10 @@ enum SettingsSection: Hashable {
 	case appearance
 	case notifications
 	case network
+	case contacts
+	/// One device's detail. Part of this enum because the Settings stack has a
+	/// typed path: a link carrying any other value type cannot push onto it.
+	case contactDetail(endpointId: String)
 	case storage
 	case about
 	case bugReport
@@ -19,6 +23,7 @@ enum SettingsSection: Hashable {
 		case .appearance: return L10n.Appearance.title
 		case .notifications: return L10n.Notifications.title
 		case .network: return L10n.Settings.networkTitle
+		case .contacts, .contactDetail: return L10n.Contacts.title
 		case .storage: return L10n.Storage.title
 		case .about: return L10n.About.title
 		case .bugReport: return L10n.About.bugReport
@@ -174,6 +179,12 @@ final class SettingsModel: ObservableObject {
 		loadDeviceInfo()
 	}
 
+	/// Surfaces "nothing waiting" from the contacts screen, which has no
+	/// message controller of its own.
+	func reportNothingWaiting() {
+		messages.tryShow(UiMessage(text: .resource(L10n.Contacts.checkNone), tone: .info))
+	}
+
 	func selectSection(_ section: SettingsSection) {
 		state.selectedSection = section
 		if section == .about || section == .bugReport {

apple/VniDrop/Features/Settings/SettingsScreen.swift

@@ -5,6 +5,7 @@ import SFSafeSymbols
 /// navigation. The model stays the source of truth via a derived path binding.
 struct SettingsScreen: View {
 	@ObservedObject var model: SettingsModel
+	@ObservedObject var contacts: ContactsModel
 	let windowClass: WindowClass
 	@State private var showBugReport = false
 
@@ -14,6 +15,8 @@ struct SettingsScreen: View {
 				switch model.state.selectedSection {
 				case .overview: return []
 				case .bugReport: return [.about, .bugReport]
+				case .contactDetail(let endpointId):
+					return [.contacts, .contactDetail(endpointId: endpointId)]
 				case let section: return [section]
 				}
 			},
@@ -54,6 +57,15 @@ struct SettingsScreen: View {
 					NavigationLink(value: SettingsSection.storage) {
 						SettingsRow(icon: .internaldrive, title: String(localized: L10n.Storage.title), value: nil)
 					}
+					NavigationLink(value: SettingsSection.contacts) {
+						SettingsRow(
+							icon: .macbookAndIphone,
+							title: String(localized: L10n.Contacts.title),
+							value: contacts.state.contacts.isEmpty
+								? nil
+								: String(contacts.state.contacts.count)
+						)
+					}
 				}
 				Section(String(localized: L10n.Settings.advancedTitle)) {
 					NavigationLink(value: SettingsSection.network) {
@@ -80,6 +92,21 @@ struct SettingsScreen: View {
 
 	@ViewBuilder
 	private func sectionForm(_ section: SettingsSection) -> some View {
+		// Contacts brings its own Form and push destination, so it is not wrapped
+		// in the shared section chrome.
+		if case .contactDetail(let endpointId) = section {
+			ContactDetailScreen(model: contacts, endpointId: endpointId)
+		} else if section == .contacts {
+			ContactsScreen(model: contacts) {
+				model.reportNothingWaiting()
+			}
+		} else {
+			settingsSectionForm(section)
+		}
+	}
+
+	@ViewBuilder
+	private func settingsSectionForm(_ section: SettingsSection) -> some View {
 		let content = Form {
 			SettingsSectionContent(model: model, section: section)
 		}
@@ -130,6 +157,9 @@ private struct SettingsSectionContent: View {
 			NetworkSettings(model: model)
 		case .storage:
 			StorageSettings(model: model)
+		case .contacts, .contactDetail:
+			// Rendered by SettingsScreen itself, which owns the contacts model.
+			EmptyView()
 		case .about:
 			AboutSettings(model: model)
 		case .bugReport:

apple/VniDrop/Platform/FileSystemService+iOS.swift

@@ -59,15 +59,24 @@ struct IosFileSystemService: FileSystemService {
 		files: [PickedShareFile],
 		transferName: String,
 		senderName: String,
-		accessPolicy: ShareAccessPolicy
-	) async -> Result<Share, Error> {
+		destination: ShareDestination
+	) async -> Result<ContactSendOutcome, Error> {
 		guard !files.isEmpty else {
 			return .failure(InvitationError.shareEmpty)
 		}
 		let sources = files.map { $0.toIosShareSource() }
-		return await repository.shareSources(
-			sources, transferName: transferName, senderName: senderName, accessPolicy: accessPolicy
-		)
+		switch destination {
+		case .invitation(let accessPolicy):
+			return await repository.shareSources(
+				sources, transferName: transferName, senderName: senderName, accessPolicy: accessPolicy
+			)
+			.map { ContactSendOutcome(share: $0, delivered: true) }
+		case .contact(let endpointId):
+			return await repository.sendToContact(
+				endpointId: endpointId, sources: sources,
+				transferName: transferName, senderName: senderName
+			)
+		}
 	}
 
 	private func validateSecurityScopedUrl(_ value: String) -> FolderAccessStatus {

apple/VniDrop/Platform/FileSystemService+macOS.swift

@@ -39,8 +39,8 @@ struct MacFileSystemService: FileSystemService {
 		files: [PickedShareFile],
 		transferName: String,
 		senderName: String,
-		accessPolicy: ShareAccessPolicy
-	) async -> Result<Share, Error> {
+		destination: ShareDestination
+	) async -> Result<ContactSendOutcome, Error> {
 		guard !files.isEmpty else {
 			return .failure(InvitationError.shareEmpty)
 		}
@@ -63,9 +63,18 @@ struct MacFileSystemService: FileSystemService {
 		let sources = files.map {
 			ShareSource(kind: .path, value: $0.value, displayName: $0.displayName, isDirectory: $0.isDirectory)
 		}
-		return await repository.shareSources(
-			sources, transferName: transferName, senderName: senderName, accessPolicy: accessPolicy
-		)
+		switch destination {
+		case .invitation(let accessPolicy):
+			return await repository.shareSources(
+				sources, transferName: transferName, senderName: senderName, accessPolicy: accessPolicy
+			)
+			.map { ContactSendOutcome(share: $0, delivered: true) }
+		case .contact(let endpointId):
+			return await repository.sendToContact(
+				endpointId: endpointId, sources: sources,
+				transferName: transferName, senderName: senderName
+			)
+		}
 	}
 }
 #endif

apple/VniDrop/Platform/PlatformPickers.swift

@@ -70,6 +70,33 @@ struct SendPickers: ViewModifier {
 	}
 }
 
+/// File picker for "send to this device", reusing the share picker's selection
+/// handling so security-scoped bookmarks are captured the same way.
+struct ContactSendPickers: ViewModifier {
+	@ObservedObject var model: ContactsModel
+
+	func body(content: Content) -> some View {
+		content
+			.fileImporter(
+				isPresented: $model.pendingFilePick,
+				allowedContentTypes: [.item],
+				allowsMultipleSelection: true
+			) { result in
+				switch result {
+				case .success(let urls):
+					let files = urls.compactMap { PickerSupport.pickedFile(from: $0, isDirectory: false) }
+					if files.isEmpty {
+						model.onFilePickFailed("The selected document could not be opened")
+					} else {
+						Task { await model.onFilesPicked(files) }
+					}
+				case .failure(let error):
+					if !error.isUserCancellation { model.onFilePickFailed(error.technicalDetail) }
+				}
+			}
+	}
+}
+
 enum PickerSupport {
 	static func receiveFolder(from url: URL) -> ReceiveFolder {
 		#if os(iOS)
@@ -129,4 +156,8 @@ extension View {
 	func sendPickers(model: SendModel) -> some View {
 		modifier(SendPickers(model: model))
 	}
+
+	func contactSendPickers(model: ContactsModel) -> some View {
+		modifier(ContactSendPickers(model: model))
+	}
 }

apple/VniDrop/UI/Feedback/UserFacingError.swift

@@ -3,6 +3,12 @@ import VnidropCore
 
 /// Maps technical failures to stable, user-facing catalog keys. Ported from
 /// `ui/feedback/UserFacingError.kt`. Never exposes raw `reason=` blobs.
+/// How an offered transfer ended without being accepted.
+enum OfferRefusal {
+	case declined
+	case noAnswer
+}
+
 extension Error {
 	func toUiText() -> UiText {
 		if let invitation = self as? InvitationError {
@@ -32,6 +38,12 @@ extension Error {
 				return .resource(L10n.Error.generic)
 			case .InvalidInput:
 				return .resource(L10n.Error.invalidInput)
+			case .InvalidTransition:
+				return .resource(L10n.Error.invalidInput)
+			case .SecureStorageLocked, .SecureStorageUnavailable:
+				return .resource(L10n.Error.startingUp)
+			case .SecureStorageMissing, .SecureStorageCorrupted:
+				return .resource(L10n.Error.generic)
 			case .Initialization(let reason):
 				return initializationUiText(reason)
 			case .Internal(let reason):
@@ -57,6 +69,19 @@ extension Error {
 			|| haystack.contains("user canceled")
 	}
 
+	/// The other device answered, and the answer was no.
+	///
+	/// Not a failure of this device: the offer was delivered and a person
+	/// declined it, so it is reported as information rather than an error.
+	var offerRefusal: OfferRefusal? {
+		let haystack = technicalDetail.lowercased()
+		if haystack.contains("receiver-declined") || haystack.contains("declined-recently") {
+			return .declined
+		}
+		if haystack.contains("no-response") { return .noAnswer }
+		return nil
+	}
+
 	/// Prefers a `VnidropError` reason; else the localized description.
 	var technicalDetail: String {
 		if let vni = self as? VnidropError {
@@ -64,7 +89,9 @@ extension Error {
 			case .Initialization(let r), .Ticket(let r), .Filesystem(let r), .FilesystemPermission(let r),
 				 .DestinationExists(let r), .StorageFull(let r), .Network(let r),
 				 .Transfer(let r), .Permission(let r), .Repository(let r), .Cancelled(let r),
-				 .InvalidInput(let r), .Internal(let r):
+				 .InvalidInput(let r), .InvalidTransition(let r), .SecureStorageLocked(let r),
+				 .SecureStorageMissing(let r), .SecureStorageCorrupted(let r),
+				 .SecureStorageUnavailable(let r), .Internal(let r):
 				return r
 			}
 		}

crates/vnidrop/Cargo.toml

@@ -16,6 +16,7 @@ blake3 = "1.8.3"
 data-encoding = "2.11.0"
 futures = "0.3"
 futures-lite = "2.6.1"
+getrandom = "0.3.4"
 iroh = "1.0.3"
 iroh-blobs = "0.103.0"
 irpc = "0.17.0"
@@ -35,6 +36,20 @@ uniffi = { version = "=0.29.4", features = ["tokio"] }
 uuid = { version = "1.23.3", features = ["v4", "serde"] }
 walkdir = "2.5.0"
 
+[target.'cfg(target_os = "linux")'.dependencies]
+secret-service = { version = "5.1.0", default-features = false, features = ["rt-tokio-crypto-rust"] }
+
+[target.'cfg(any(target_os = "macos", target_os = "ios"))'.dependencies]
+security-framework = { version = "3.7.0", features = ["OSX_10_15"] }
+
+[target.'cfg(target_os = "android")'.dependencies]
+jni = "0.21.1"
+ndk-context = "0.1.1"
+
+[target.'cfg(target_os = "windows")'.dependencies]
+windows-sys = { version = "0.61.2", features = ["Win32_Foundation", "Win32_Security_Cryptography", "Win32_Storage_FileSystem"] }
+
 [dev-dependencies]
 iroh-relay = { version = "1.0.3", features = ["server"] }
+secret-service = { version = "5.1.0", default-features = false, features = ["rt-tokio-crypto-rust"] }
 tempfile = "3.27.0"

crates/vnidrop/src/access_policy.rs

@@ -29,13 +29,6 @@ impl AccessPolicy {
         self.modes.write().await.insert(transfer_id, mode);
     }
 
-    pub(crate) async fn allows_without_approval(&self, transfer_id: u64) -> bool {
-        matches!(
-            self.modes.read().await.get(&transfer_id),
-            Some(TransferAccessMode::Public)
-        )
-    }
-
     pub(crate) async fn remove_transfer(&self, transfer_id: u64) {
         self.modes.write().await.remove(&transfer_id);
         self.approved_sessions

crates/vnidrop/src/api.rs

@@ -10,6 +10,85 @@ use crate::util::{non_empty, now_ms};
 pub(crate) const MAX_CUSTOM_RELAYS: usize = 8;
 pub(crate) const MAX_RELAY_URL_BYTES: usize = 2_048;
 
+/// Versions the additive public domain seam and its two experimental wire protocols.
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize, uniffi::Record)]
+pub struct ExperimentalSavedDeviceCapabilities {
+    pub domain_contract_version: u16,
+    pub relationship_protocol_version: u16,
+    pub targeted_transfer_protocol_version: u16,
+}
+
+#[uniffi::export]
+pub fn experimental_saved_device_capabilities() -> ExperimentalSavedDeviceCapabilities {
+    ExperimentalSavedDeviceCapabilities {
+        domain_contract_version: 1,
+        relationship_protocol_version: 1,
+        targeted_transfer_protocol_version: 1,
+    }
+}
+
+/// A remote VniDrop app-installation identity that completed mutual consent.
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize, uniffi::Record)]
+pub struct SavedDevice {
+    pub endpoint_id: String,
+    pub local_label: Option<String>,
+    pub remote_display_name: Option<String>,
+    pub created_at: i64,
+    pub last_authenticated_at: Option<i64>,
+}
+
+/// Durable consent lifecycle for one remote app-installation identity.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize, uniffi::Enum)]
+pub enum DeviceRelationshipState {
+    PendingOutgoing,
+    PendingIncoming,
+    Saved,
+    Revoked,
+    Blocked,
+}
+
+/// Public relationship state; directional grant material remains core-private.
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize, uniffi::Record)]
+pub struct DeviceRelationship {
+    pub remote_endpoint_id: String,
+    pub state: DeviceRelationshipState,
+    pub generation: u64,
+    pub minimum_protocol_version: u16,
+    pub created_at: i64,
+    pub updated_at: i64,
+}
+
+/// Rust-owned lifecycle for an immutable one-sender, one-receiver transfer.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize, uniffi::Enum)]
+pub enum TargetedTransferState {
+    Preparing,
+    Offering,
+    AwaitingApproval,
+    Approved,
+    Connecting,
+    Transferring,
+    Interrupted,
+    Completed,
+    Declined,
+    Cancelled,
+    Failed,
+    Deleted,
+}
+
+/// Immutable recipient-bound transfer snapshot, separate from an ordinary share.
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize, uniffi::Record)]
+pub struct TargetedTransfer {
+    pub id: String,
+    pub sender_endpoint_id: String,
+    pub receiver_endpoint_id: String,
+    pub manifest_id: String,
+    pub file_count: u64,
+    pub total_size: u64,
+    pub state: TargetedTransferState,
+    pub created_at: i64,
+    pub updated_at: i64,
+}
+
 #[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize, uniffi::Enum)]
 pub enum CoreRelayMode {
     Automatic,
@@ -180,6 +259,8 @@ pub struct CoreLimits {
     pub max_metadata_bytes: u64,
     pub max_events: u64,
     pub max_pending_approvals: u64,
+    /// Incoming pairing offers awaiting the local user's decision.
+    pub max_pending_offers: u64,
     pub max_concurrent_transfers: u64,
     pub event_queue_capacity: u64,
 }
@@ -198,6 +279,9 @@ impl Default for CoreLimits {
             max_events: 500,
             // Bound handshake spam / notification pressure on the sender.
             max_pending_approvals: 64,
+            // A pairing prompt needs the user in front of the device, so this
+            // is far smaller than the handshake queue.
+            max_pending_offers: 16,
             max_concurrent_transfers: 8,
             event_queue_capacity: 1_024,
         }
@@ -215,6 +299,7 @@ impl CoreLimits {
             ("max_metadata_bytes", self.max_metadata_bytes),
             ("max_events", self.max_events),
             ("max_pending_approvals", self.max_pending_approvals),
+            ("max_pending_offers", self.max_pending_offers),
             ("max_concurrent_transfers", self.max_concurrent_transfers),
             ("event_queue_capacity", self.event_queue_capacity),
         ];
@@ -225,6 +310,7 @@ impl CoreLimits {
         }
         for (name, value) in [
             ("max_pending_approvals", self.max_pending_approvals),
+            ("max_pending_offers", self.max_pending_offers),
             ("max_concurrent_transfers", self.max_concurrent_transfers),
             ("event_queue_capacity", self.event_queue_capacity),
         ] {
@@ -452,6 +538,80 @@ pub struct TicketInspection {
     pub metadata: TransferMetadata,
 }
 
+/// A device the user has chosen to remember.
+///
+/// Deliberately carries no grant material: capabilities never cross the UniFFI
+/// boundary, only the fact that one exists (`can_send`).
+#[derive(Debug, Clone, Serialize, Deserialize, uniffi::Record)]
+pub struct ContactSummary {
+    pub endpoint_id: String,
+    /// Set locally by the user. Authoritative for display.
+    pub local_label: Option<String>,
+    /// Last name the device claimed. Untrusted; never promoted to the label.
+    pub remote_display_name: Option<String>,
+    pub last_transfer_at: Option<i64>,
+    pub created_at: i64,
+    /// Whether this device can currently be sent to, i.e. a live grant is held.
+    /// False after the peer revoked, expired, or reinstalled.
+    pub can_send: bool,
+}
+
+/// Outcome of sending straight to a remembered device.
+#[derive(Debug, Clone, Serialize, Deserialize, uniffi::Record)]
+pub struct ContactSendResult {
+    pub share: ShareResult,
+    /// False when the device was not running: the transfer is held here and the
+    /// device collects it the next time it opens VniDrop.
+    pub delivered: bool,
+}
+
+/// A transfer this device is holding until its target comes back online.
+///
+/// Cancelling the underlying transfer withdraws it.
+#[derive(Debug, Clone, Serialize, Deserialize, uniffi::Record)]
+pub struct HeldOfferSummary {
+    pub offer_id: String,
+    pub endpoint_id: String,
+    pub transfer_id: u64,
+    pub transfer_name: String,
+    pub file_count: u64,
+    pub total_bytes: u64,
+    pub created_at: i64,
+}
+
+/// A transfer a paired device is offering.
+///
+/// The ticket is deliberately absent: it is a capability, and it is handed over
+/// only when the user accepts.
+#[derive(Debug, Clone, Serialize, Deserialize, uniffi::Record)]
+pub struct IncomingOffer {
+    pub offer_id: String,
+    pub from_endpoint_id: String,
+    pub sender_display_name: Option<String>,
+    pub transfer_name: String,
+    pub file_count: u64,
+    pub total_bytes: u64,
+    pub received_at: i64,
+}
+
+/// A device offering to be remembered, awaiting the local user's decision.
+#[derive(Debug, Clone, Serialize, Deserialize, uniffi::Record)]
+pub struct PendingPairing {
+    pub endpoint_id: String,
+    pub display_name: Option<String>,
+    pub received_at: i64,
+}
+
+/// How long a grant survives without use, renewed on every accepted proof.
+#[derive(Debug, Clone, Copy, Default, PartialEq, Eq, Serialize, Deserialize, uniffi::Enum)]
+pub enum GrantLifetimeSetting {
+    Days30,
+    #[default]
+    Days90,
+    Days365,
+    Never,
+}
+
 #[derive(Debug, Clone, Serialize, Deserialize, uniffi::Record)]
 pub struct ReceiverRequest {
     pub id: String,

crates/vnidrop/src/approval.rs

@@ -6,7 +6,7 @@ use tokio::sync::{oneshot, Mutex};
 use uuid::Uuid;
 
 use crate::{
-    access_policy::{AccessPolicy, APPROVAL_SESSION_TTL_MS},
+    access_policy::{AccessDecision, AccessPolicy, APPROVAL_SESSION_TTL_MS},
     event_hub::EventHub,
     handshake::{
         DeliveryFailureReceipt, DeliveryReceipt, DeliveryReceiptResponse, HandshakeResponse,
@@ -198,10 +198,15 @@ impl ApprovalService {
             .await
         {
             Ok(true) => {
+                // An existing access session means this endpoint was already
+                // authorised: either the share is public, or the sender pushed
+                // this transfer to them. Prompting again would ask the sender
+                // to approve a transfer they themselves initiated.
                 if self
                     .access_policy
-                    .allows_without_approval(request.transfer_id)
+                    .decide(request.transfer_id, Some(&remote_endpoint_id))
                     .await
+                    == AccessDecision::Allow
                 {
                     self.allow_without_sender_decision(remote_endpoint_id, request)
                         .await

crates/vnidrop/src/contacts.rs

@@ -0,0 +1,627 @@
+//! Storage for device history: contacts, the grants that make them usable, and
+//! the block list.
+//!
+//! Split out of [`crate::repository`] to keep that file focused; the tables are
+//! created as part of the same schema migration and share its pool.
+//!
+//! Grant secrets live here. They are key material and follow the same rule as
+//! tickets: never logged, never emitted in an event, never returned across the
+//! UniFFI boundary.
+
+use anyhow::{Context, Result};
+use sqlx::{Row, SqlitePool};
+
+use crate::grant::{parse_secret, GrantId, HeldGrant, IssuedGrant};
+
+/// How long a dead grant is kept before being swept.
+///
+/// A revoked grant stays as a tombstone so a returning peer is told `Revoked`
+/// rather than `Unknown`; after this long, a peer that has not come back is
+/// unlikely to, and the row is noise.
+pub(crate) const DEAD_GRANT_RETENTION_MS: i64 = 30 * 24 * 60 * 60 * 1_000;
+
+/// A device the user has transferred with and chosen to remember.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub(crate) struct Contact {
+    pub(crate) endpoint_id: String,
+    /// Set by the local user. Never overwritten by a name the remote claims.
+    pub(crate) local_label: Option<String>,
+    /// Last name the remote sent. Untrusted display data.
+    pub(crate) remote_display_name: Option<String>,
+    /// Encoded `EndpointAddr` from the last successful connection, so the peer
+    /// stays dialable in relay profiles without public address lookup.
+    pub(crate) last_known_addr: Option<String>,
+    pub(crate) created_at: i64,
+    pub(crate) last_transfer_at: Option<i64>,
+}
+
+pub(crate) async fn ensure_schema(pool: &SqlitePool) -> Result<()> {
+    sqlx::query(
+        r#"
+        CREATE TABLE IF NOT EXISTS contacts (
+            endpoint_id TEXT PRIMARY KEY,
+            local_label TEXT,
+            remote_display_name TEXT,
+            last_known_addr TEXT,
+            created_at INTEGER NOT NULL,
+            last_transfer_at INTEGER
+        );
+        "#,
+    )
+    .execute(pool)
+    .await?;
+
+    // Authoritative side: only the issuer can validate or revoke these.
+    sqlx::query(
+        r#"
+        CREATE TABLE IF NOT EXISTS grants_issued (
+            grant_id TEXT PRIMARY KEY,
+            grant_secret TEXT NOT NULL,
+            issued_to_endpoint_id TEXT NOT NULL,
+            created_at INTEGER NOT NULL,
+            expires_at INTEGER,
+            revoked_at INTEGER
+        );
+        "#,
+    )
+    .execute(pool)
+    .await?;
+    sqlx::query(
+        "CREATE INDEX IF NOT EXISTS idx_grants_issued_endpoint ON grants_issued(issued_to_endpoint_id);",
+    )
+    .execute(pool)
+    .await?;
+
+    sqlx::query(
+        r#"
+        CREATE TABLE IF NOT EXISTS grants_held (
+            grant_id TEXT PRIMARY KEY,
+            grant_secret TEXT NOT NULL,
+            peer_endpoint_id TEXT NOT NULL,
+            created_at INTEGER NOT NULL,
+            expires_at INTEGER
+        );
+        "#,
+    )
+    .execute(pool)
+    .await?;
+    sqlx::query(
+        "CREATE INDEX IF NOT EXISTS idx_grants_held_endpoint ON grants_held(peer_endpoint_id);",
+    )
+    .execute(pool)
+    .await?;
+
+    sqlx::query(
+        r#"
+        CREATE TABLE IF NOT EXISTS held_offers (
+            offer_id TEXT PRIMARY KEY,
+            endpoint_id TEXT NOT NULL,
+            transfer_id INTEGER NOT NULL,
+            ticket TEXT NOT NULL,
+            transfer_name TEXT NOT NULL,
+            sender_display_name TEXT,
+            file_count INTEGER NOT NULL,
+            total_bytes INTEGER NOT NULL,
+            created_at INTEGER NOT NULL
+        );
+        "#,
+    )
+    .execute(pool)
+    .await?;
+    sqlx::query("CREATE INDEX IF NOT EXISTS idx_held_offers_endpoint ON held_offers(endpoint_id);")
+        .execute(pool)
+        .await?;
+
+    sqlx::query(
+        r#"
+        CREATE TABLE IF NOT EXISTS blocked_endpoints (
+            endpoint_id TEXT PRIMARY KEY,
+            created_at INTEGER NOT NULL
+        );
+        "#,
+    )
+    .execute(pool)
+    .await?;
+
+    Ok(())
+}
+
+/// An offer that could not be delivered because the target was not running.
+///
+/// Held on this device, not a server: the share stays here and the receiver
+/// collects the ticket when its app next comes to the foreground.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub(crate) struct HeldOffer {
+    pub(crate) offer_id: String,
+    pub(crate) endpoint_id: String,
+    pub(crate) transfer_id: u64,
+    pub(crate) ticket: String,
+    pub(crate) transfer_name: String,
+    pub(crate) sender_display_name: Option<String>,
+    pub(crate) file_count: u64,
+    pub(crate) total_bytes: u64,
+    pub(crate) created_at: i64,
+}
+
+/// Contacts, grants, and blocks over the shared repository pool.
+#[derive(Debug, Clone)]
+pub(crate) struct ContactStore {
+    pool: SqlitePool,
+}
+
+impl ContactStore {
+    pub(crate) fn new(pool: SqlitePool) -> Self {
+        Self { pool }
+    }
+
+    // -- contacts ---------------------------------------------------------
+
+    /// Record a contact, or refresh the untrusted display name of an existing
+    /// one. The local label is deliberately left untouched.
+    pub(crate) async fn upsert_contact(
+        &self,
+        endpoint_id: &str,
+        remote_display_name: Option<&str>,
+        now_ms: i64,
+    ) -> Result<()> {
+        sqlx::query(
+            r#"
+            INSERT INTO contacts (endpoint_id, remote_display_name, created_at)
+            VALUES (?1, ?2, ?3)
+            ON CONFLICT(endpoint_id) DO UPDATE SET
+                remote_display_name = COALESCE(excluded.remote_display_name, contacts.remote_display_name)
+            "#,
+        )
+        .bind(endpoint_id)
+        .bind(remote_display_name)
+        .bind(now_ms)
+        .execute(&self.pool)
+        .await?;
+        Ok(())
+    }
+
+    pub(crate) async fn set_contact_label(
+        &self,
+        endpoint_id: &str,
+        label: Option<&str>,
+    ) -> Result<()> {
+        sqlx::query("UPDATE contacts SET local_label = ?2 WHERE endpoint_id = ?1")
+            .bind(endpoint_id)
+            .bind(label)
+            .execute(&self.pool)
+            .await?;
+        Ok(())
+    }
+
+    pub(crate) async fn touch_transfer(&self, endpoint_id: &str, now_ms: i64) -> Result<()> {
+        sqlx::query("UPDATE contacts SET last_transfer_at = ?2 WHERE endpoint_id = ?1")
+            .bind(endpoint_id)
+            .bind(now_ms)
+            .execute(&self.pool)
+            .await?;
+        Ok(())
+    }
+
+    pub(crate) async fn set_last_known_addr(&self, endpoint_id: &str, addr: &str) -> Result<()> {
+        sqlx::query("UPDATE contacts SET last_known_addr = ?2 WHERE endpoint_id = ?1")
+            .bind(endpoint_id)
+            .bind(addr)
+            .execute(&self.pool)
+            .await?;
+        Ok(())
+    }
+
+    pub(crate) async fn list_contacts(&self) -> Result<Vec<Contact>> {
+        let rows = sqlx::query(
+            r#"
+            SELECT endpoint_id, local_label, remote_display_name, last_known_addr,
+                   created_at, last_transfer_at
+            FROM contacts
+            ORDER BY COALESCE(last_transfer_at, created_at) DESC
+            "#,
+        )
+        .fetch_all(&self.pool)
+        .await?;
+        Ok(rows
+            .into_iter()
+            .map(|row| Contact {
+                endpoint_id: row.get(0),
+                local_label: row.get(1),
+                remote_display_name: row.get(2),
+                last_known_addr: row.get(3),
+                created_at: row.get(4),
+                last_transfer_at: row.get(5),
+            })
+            .collect())
+    }
+
+    pub(crate) async fn find_contact(&self, endpoint_id: &str) -> Result<Option<Contact>> {
+        Ok(self
+            .list_contacts()
+            .await?
+            .into_iter()
+            .find(|contact| contact.endpoint_id == endpoint_id))
+    }
+
+    /// Remove a contact and every grant in both directions.
+    ///
+    /// Returns the ids of the grants this device had issued, so the caller can
+    /// send the best-effort revoke notification. Deletion succeeds regardless of
+    /// whether that notification is ever delivered.
+    pub(crate) async fn delete_contact(&self, endpoint_id: &str) -> Result<Vec<GrantId>> {
+        let issued = self.issued_grant_ids_for(endpoint_id).await?;
+        let mut tx = self.pool.begin().await?;
+        sqlx::query("DELETE FROM grants_issued WHERE issued_to_endpoint_id = ?1")
+            .bind(endpoint_id)
+            .execute(&mut *tx)
+            .await?;
+        sqlx::query("DELETE FROM grants_held WHERE peer_endpoint_id = ?1")
+            .bind(endpoint_id)
+            .execute(&mut *tx)
+            .await?;
+        sqlx::query("DELETE FROM contacts WHERE endpoint_id = ?1")
+            .bind(endpoint_id)
+            .execute(&mut *tx)
+            .await?;
+        tx.commit().await?;
+        Ok(issued)
+    }
+
+    /// Wholesale delete, for the same surface that clears transfer history.
+    pub(crate) async fn delete_all_contacts(&self) -> Result<Vec<GrantId>> {
+        let issued = self.all_issued_grant_ids().await?;
+        let mut tx = self.pool.begin().await?;
+        sqlx::query("DELETE FROM grants_issued")
+            .execute(&mut *tx)
+            .await?;
+        sqlx::query("DELETE FROM grants_held")
+            .execute(&mut *tx)
+            .await?;
+        sqlx::query("DELETE FROM contacts")
+            .execute(&mut *tx)
+            .await?;
+        tx.commit().await?;
+        Ok(issued)
+    }
+
+    // -- issued grants ----------------------------------------------------
+
+    pub(crate) async fn insert_issued_grant(&self, grant: &IssuedGrant) -> Result<()> {
+        sqlx::query(
+            r#"
+            INSERT INTO grants_issued
+                (grant_id, grant_secret, issued_to_endpoint_id, created_at, expires_at, revoked_at)
+            VALUES (?1, ?2, ?3, ?4, ?5, NULL)
+            "#,
+        )
+        .bind(grant.grant_id.encode())
+        .bind(grant.secret.encode())
+        .bind(&grant.issued_to_endpoint_id)
+        .bind(grant.created_at)
+        .bind(grant.expires_at)
+        .execute(&self.pool)
+        .await?;
+        Ok(())
+    }
+
+    /// Look up a grant by the id a peer presented.
+    ///
+    /// A row whose secret fails to parse is corrupt storage, not a usable
+    /// grant: surface the error rather than silently refusing the peer, which
+    /// would look like revocation.
+    pub(crate) async fn find_issued_grant(&self, grant_id: GrantId) -> Result<Option<IssuedGrant>> {
+        let row = sqlx::query(
+            r#"
+            SELECT grant_id, grant_secret, issued_to_endpoint_id, created_at, expires_at, revoked_at
+            FROM grants_issued
+            WHERE grant_id = ?1
+            "#,
+        )
+        .bind(grant_id.encode())
+        .fetch_optional(&self.pool)
+        .await?;
+        row.map(row_to_issued_grant).transpose()
+    }
+
+    /// Push the idle deadline forward after an accepted proof.
+    pub(crate) async fn renew_issued_grant(
+        &self,
+        grant_id: GrantId,
+        expires_at: Option<i64>,
+    ) -> Result<()> {
+        sqlx::query("UPDATE grants_issued SET expires_at = ?2 WHERE grant_id = ?1")
+            .bind(grant_id.encode())
+            .bind(expires_at)
+            .execute(&self.pool)
+            .await?;
+        Ok(())
+    }
+
+    /// End the relationship from the issuing side. Tombstoned rather than
+    /// deleted so a later attempt is answered `Revoked` instead of `Unknown`.
+    pub(crate) async fn revoke_issued_grant(&self, grant_id: GrantId, now_ms: i64) -> Result<()> {
+        sqlx::query(
+            "UPDATE grants_issued SET revoked_at = ?2 WHERE grant_id = ?1 AND revoked_at IS NULL",
+        )
+        .bind(grant_id.encode())
+        .bind(now_ms)
+        .execute(&self.pool)
+        .await?;
+        Ok(())
+    }
+
+    pub(crate) async fn revoke_issued_grants_for(
+        &self,
+        endpoint_id: &str,
+        now_ms: i64,
+    ) -> Result<Vec<GrantId>> {
+        let ids = self.issued_grant_ids_for(endpoint_id).await?;
+        sqlx::query(
+            "UPDATE grants_issued SET revoked_at = ?2 WHERE issued_to_endpoint_id = ?1 AND revoked_at IS NULL",
+        )
+        .bind(endpoint_id)
+        .bind(now_ms)
+        .execute(&self.pool)
+        .await?;
+        Ok(ids)
+    }
+
+    async fn issued_grant_ids_for(&self, endpoint_id: &str) -> Result<Vec<GrantId>> {
+        let rows =
+            sqlx::query("SELECT grant_id FROM grants_issued WHERE issued_to_endpoint_id = ?1")
+                .bind(endpoint_id)
+                .fetch_all(&self.pool)
+                .await?;
+        rows.into_iter()
+            .map(|row| GrantId::decode(row.get::<String, _>(0).as_str()))
+            .collect()
+    }
+
+    async fn all_issued_grant_ids(&self) -> Result<Vec<GrantId>> {
+        let rows = sqlx::query("SELECT grant_id FROM grants_issued")
+            .fetch_all(&self.pool)
+            .await?;
+        rows.into_iter()
+            .map(|row| GrantId::decode(row.get::<String, _>(0).as_str()))
+            .collect()
+    }
+
+    // -- held grants ------------------------------------------------------
+
+    pub(crate) async fn insert_held_grant(&self, grant: &HeldGrant) -> Result<()> {
+        sqlx::query(
+            r#"
+            INSERT INTO grants_held
+                (grant_id, grant_secret, peer_endpoint_id, created_at, expires_at)
+            VALUES (?1, ?2, ?3, ?4, ?5)
+            ON CONFLICT(grant_id) DO UPDATE SET
+                grant_secret = excluded.grant_secret,
+                expires_at = excluded.expires_at
+            "#,
+        )
+        .bind(grant.grant_id.encode())
+        .bind(grant.secret.encode())
+        .bind(&grant.peer_endpoint_id)
+        .bind(grant.created_at)
+        .bind(grant.expires_at)
+        .execute(&self.pool)
+        .await?;
+        Ok(())
+    }
+
+    /// The capability to reach `peer_endpoint_id`, if this device holds one.
+    ///
+    /// Newest wins: re-pairing issues a fresh grant, and the old one is dead on
+    /// the issuer's side anyway.
+    pub(crate) async fn held_grant_for(&self, peer_endpoint_id: &str) -> Result<Option<HeldGrant>> {
+        let row = sqlx::query(
+            r#"
+            SELECT grant_id, grant_secret, peer_endpoint_id, created_at, expires_at
+            FROM grants_held
+            WHERE peer_endpoint_id = ?1
+            ORDER BY created_at DESC
+            LIMIT 1
+            "#,
+        )
+        .bind(peer_endpoint_id)
+        .fetch_optional(&self.pool)
+        .await?;
+        row.map(row_to_held_grant).transpose()
+    }
+
+    /// Drop a grant this device holds, after the issuer reported it dead.
+    pub(crate) async fn delete_held_grant(&self, grant_id: GrantId) -> Result<()> {
+        sqlx::query("DELETE FROM grants_held WHERE grant_id = ?1")
+            .bind(grant_id.encode())
+            .execute(&self.pool)
+            .await?;
+        Ok(())
+    }
+
+    // -- block list -------------------------------------------------------
+
+    /// Block an endpoint and revoke anything it still holds, so blocking is not
+    /// merely cosmetic while a live grant remains.
+    pub(crate) async fn block_endpoint(&self, endpoint_id: &str, now_ms: i64) -> Result<()> {
+        self.revoke_issued_grants_for(endpoint_id, now_ms).await?;
+        sqlx::query(
+            "INSERT INTO blocked_endpoints (endpoint_id, created_at) VALUES (?1, ?2)
+             ON CONFLICT(endpoint_id) DO NOTHING",
+        )
+        .bind(endpoint_id)
+        .bind(now_ms)
+        .execute(&self.pool)
+        .await?;
+        Ok(())
+    }
+
+    pub(crate) async fn unblock_endpoint(&self, endpoint_id: &str) -> Result<()> {
+        sqlx::query("DELETE FROM blocked_endpoints WHERE endpoint_id = ?1")
+            .bind(endpoint_id)
+            .execute(&self.pool)
+            .await?;
+        Ok(())
+    }
+
+    pub(crate) async fn is_blocked(&self, endpoint_id: &str) -> Result<bool> {
+        let row =
+            sqlx::query("SELECT EXISTS(SELECT 1 FROM blocked_endpoints WHERE endpoint_id = ?1)")
+                .bind(endpoint_id)
+                .fetch_one(&self.pool)
+                .await?;
+        Ok(row.get::<i64, _>(0) == 1)
+    }
+
+    pub(crate) async fn list_blocked(&self) -> Result<Vec<String>> {
+        let rows =
+            sqlx::query("SELECT endpoint_id FROM blocked_endpoints ORDER BY created_at DESC")
+                .fetch_all(&self.pool)
+                .await?;
+        Ok(rows.into_iter().map(|row| row.get(0)).collect())
+    }
+
+    // -- held offers ------------------------------------------------------
+
+    pub(crate) async fn insert_held_offer(&self, offer: &HeldOffer) -> Result<()> {
+        sqlx::query(
+            r#"
+            INSERT INTO held_offers
+                (offer_id, endpoint_id, transfer_id, ticket, transfer_name,
+                 sender_display_name, file_count, total_bytes, created_at)
+            VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, ?9)
+            "#,
+        )
+        .bind(&offer.offer_id)
+        .bind(&offer.endpoint_id)
+        .bind(offer.transfer_id as i64)
+        .bind(&offer.ticket)
+        .bind(&offer.transfer_name)
+        .bind(offer.sender_display_name.as_deref())
+        .bind(offer.file_count as i64)
+        .bind(offer.total_bytes as i64)
+        .bind(offer.created_at)
+        .execute(&self.pool)
+        .await?;
+        Ok(())
+    }
+
+    /// Offers waiting for one device to come and collect them.
+    pub(crate) async fn held_offers_for(&self, endpoint_id: &str) -> Result<Vec<HeldOffer>> {
+        let rows = sqlx::query(
+            r#"
+            SELECT offer_id, endpoint_id, transfer_id, ticket, transfer_name,
+                   sender_display_name, file_count, total_bytes, created_at
+            FROM held_offers
+            WHERE endpoint_id = ?1
+            ORDER BY created_at ASC
+            "#,
+        )
+        .bind(endpoint_id)
+        .fetch_all(&self.pool)
+        .await?;
+        Ok(rows.into_iter().map(row_to_held_offer).collect())
+    }
+
+    pub(crate) async fn list_held_offers(&self) -> Result<Vec<HeldOffer>> {
+        let rows = sqlx::query(
+            r#"
+            SELECT offer_id, endpoint_id, transfer_id, ticket, transfer_name,
+                   sender_display_name, file_count, total_bytes, created_at
+            FROM held_offers
+            ORDER BY created_at ASC
+            "#,
+        )
+        .fetch_all(&self.pool)
+        .await?;
+        Ok(rows.into_iter().map(row_to_held_offer).collect())
+    }
+
+    /// Consumed once handed over, so a device polling twice is not offered the
+    /// same transfer again.
+    pub(crate) async fn delete_held_offers(&self, offer_ids: &[String]) -> Result<()> {
+        let mut tx = self.pool.begin().await?;
+        for offer_id in offer_ids {
+            sqlx::query("DELETE FROM held_offers WHERE offer_id = ?1")
+                .bind(offer_id)
+                .execute(&mut *tx)
+                .await?;
+        }
+        tx.commit().await?;
+        Ok(())
+    }
+
+    pub(crate) async fn delete_held_offers_for_transfer(&self, transfer_id: u64) -> Result<()> {
+        sqlx::query("DELETE FROM held_offers WHERE transfer_id = ?1")
+            .bind(transfer_id as i64)
+            .execute(&self.pool)
+            .await?;
+        Ok(())
+    }
+
+    // -- maintenance ------------------------------------------------------
+
+    #[cfg(test)]
+    pub(crate) async fn corrupt_secret_for_test(&self, grant_id: GrantId) -> Result<()> {
+        sqlx::query("UPDATE grants_issued SET grant_secret = 'not-hex' WHERE grant_id = ?1")
+            .bind(grant_id.encode())
+            .execute(&self.pool)
+            .await?;
+        Ok(())
+    }
+
+    /// Drop grants that lapsed or were revoked long enough ago that no peer
+    /// still needs to be told. Keeps tombstones bounded.
+    pub(crate) async fn purge_dead_grants(&self, before_ms: i64) -> Result<u64> {
+        let issued = sqlx::query(
+            "DELETE FROM grants_issued
+             WHERE (expires_at IS NOT NULL AND expires_at < ?1)
+                OR (revoked_at IS NOT NULL AND revoked_at < ?1)",
+        )
+        .bind(before_ms)
+        .execute(&self.pool)
+        .await?
+        .rows_affected();
+        Ok(issued)
+    }
+}
+
+fn row_to_held_offer(row: sqlx::sqlite::SqliteRow) -> HeldOffer {
+    HeldOffer {
+        offer_id: row.get(0),
+        endpoint_id: row.get(1),
+        transfer_id: row.get::<i64, _>(2) as u64,
+        ticket: row.get(3),
+        transfer_name: row.get(4),
+        sender_display_name: row.get(5),
+        file_count: row.get::<i64, _>(6) as u64,
+        total_bytes: row.get::<i64, _>(7) as u64,
+        created_at: row.get(8),
+    }
+}
+
+fn row_to_issued_grant(row: sqlx::sqlite::SqliteRow) -> Result<IssuedGrant> {
+    let grant_id = GrantId::decode(row.get::<String, _>(0).as_str())?;
+    let secret = parse_secret(row.get::<String, _>(1).as_str())
+        .context("stored grant secret is unusable")?;
+    Ok(IssuedGrant {
+        grant_id,
+        secret,
+        issued_to_endpoint_id: row.get(2),
+        created_at: row.get(3),
+        expires_at: row.get(4),
+        revoked_at: row.get(5),
+    })
+}
+
+fn row_to_held_grant(row: sqlx::sqlite::SqliteRow) -> Result<HeldGrant> {
+    let grant_id = GrantId::decode(row.get::<String, _>(0).as_str())?;
+    let secret = parse_secret(row.get::<String, _>(1).as_str())
+        .context("stored grant secret is unusable")?;
+    Ok(HeldGrant {
+        grant_id,
+        secret,
+        peer_endpoint_id: row.get(2),
+        created_at: row.get(3),
+        expires_at: row.get(4),
+    })
+}

crates/vnidrop/src/error.rs

@@ -26,15 +26,23 @@ pub enum VnidropError {
     Cancelled { reason: String },
     #[error("invalid input: {reason}")]
     InvalidInput { reason: String },
+    #[error("invalid targeted transfer transition: {reason}")]
+    InvalidTransition { reason: String },
+    #[error("secure storage is locked: {reason}")]
+    SecureStorageLocked { reason: String },
+    #[error("secure storage item is missing: {reason}")]
+    SecureStorageMissing { reason: String },
+    #[error("secure storage item is corrupted: {reason}")]
+    SecureStorageCorrupted { reason: String },
+    #[error("secure storage is unavailable: {reason}")]
+    SecureStorageUnavailable { reason: String },
     #[error("internal error: {reason}")]
     Internal { reason: String },
 }
 
 impl VnidropError {
     pub(crate) fn initialization(error: impl Into<anyhow::Error>) -> Self {
-        Self::Initialization {
-            reason: error.into().to_string(),
-        }
+        Self::from_error(error.into(), |reason| Self::Initialization { reason })
     }
 
     pub(crate) fn ticket(error: impl Into<anyhow::Error>) -> Self {
@@ -93,6 +101,11 @@ impl VnidropError {
             Self::Repository { .. } => "repository",
             Self::Cancelled { .. } => "cancelled",
             Self::InvalidInput { .. } => "invalid_input",
+            Self::InvalidTransition { .. } => "invalid_transition",
+            Self::SecureStorageLocked { .. } => "secure_storage_locked",
+            Self::SecureStorageMissing { .. } => "secure_storage_missing",
+            Self::SecureStorageCorrupted { .. } => "secure_storage_corrupted",
+            Self::SecureStorageUnavailable { .. } => "secure_storage_unavailable",
             Self::Internal { .. } => "internal",
         }
     }
@@ -111,6 +124,11 @@ impl VnidropError {
             | Self::Repository { reason }
             | Self::Cancelled { reason }
             | Self::InvalidInput { reason }
+            | Self::InvalidTransition { reason }
+            | Self::SecureStorageLocked { reason }
+            | Self::SecureStorageMissing { reason }
+            | Self::SecureStorageCorrupted { reason }
+            | Self::SecureStorageUnavailable { reason }
             | Self::Internal { reason } => reason,
         }
     }
@@ -163,6 +181,11 @@ impl VnidropError {
             Self::Repository { .. } => Self::Repository { reason },
             Self::Cancelled { .. } => Self::Cancelled { reason },
             Self::InvalidInput { .. } => Self::InvalidInput { reason },
+            Self::InvalidTransition { .. } => Self::InvalidTransition { reason },
+            Self::SecureStorageLocked { .. } => Self::SecureStorageLocked { reason },
+            Self::SecureStorageMissing { .. } => Self::SecureStorageMissing { reason },
+            Self::SecureStorageCorrupted { .. } => Self::SecureStorageCorrupted { reason },
+            Self::SecureStorageUnavailable { .. } => Self::SecureStorageUnavailable { reason },
             Self::Internal { .. } => Self::Internal { reason },
         }
     }

crates/vnidrop/src/grant.rs

@@ -0,0 +1,364 @@
+//! Grants: the capability a device issues so a known peer may reach it.
+//!
+//! A history entry is not "I remember this endpoint id", it is "this device
+//! issued me a capability". The issuer is the only party that can validate a
+//! grant, which is what makes both consent and revocation enforceable: refusing
+//! to issue leaves the peer with nothing usable, and deleting the issued record
+//! ends the relationship without the peer's cooperation.
+//!
+//! This module is pure: no storage, no network, no clock of its own. Callers
+//! supply `now_ms` so expiry and renewal stay testable.
+
+use std::fmt;
+
+use anyhow::{bail, Context, Result};
+use data_encoding::HEXLOWER;
+use serde::{Deserialize, Serialize};
+
+/// Domain separator for the possession proof. Changing this invalidates every
+/// outstanding grant, so it is versioned rather than edited.
+const PROOF_CONTEXT: &[u8] = b"vnidrop-grant-v1";
+
+const GRANT_ID_LEN: usize = 16;
+const GRANT_SECRET_LEN: usize = 32;
+const CHALLENGE_LEN: usize = 32;
+const PROOF_LEN: usize = 32;
+
+/// Opaque public identifier for a grant. Safe to send in the clear.
+#[derive(Clone, Copy, PartialEq, Eq, Hash, Serialize, Deserialize)]
+pub(crate) struct GrantId([u8; GRANT_ID_LEN]);
+
+impl GrantId {
+    pub(crate) fn generate() -> Self {
+        Self(random_bytes())
+    }
+
+    pub(crate) fn encode(&self) -> String {
+        HEXLOWER.encode(&self.0)
+    }
+
+    pub(crate) fn decode(value: &str) -> Result<Self> {
+        let bytes = HEXLOWER
+            .decode(value.as_bytes())
+            .context("invalid grant id encoding")?;
+        let bytes: [u8; GRANT_ID_LEN] = bytes
+            .try_into()
+            .map_err(|_| anyhow::anyhow!("invalid grant id length"))?;
+        Ok(Self(bytes))
+    }
+}
+
+impl fmt::Debug for GrantId {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        write!(f, "GrantId({})", self.encode())
+    }
+}
+
+/// Key material. Never logged, never emitted in an event, never returned across
+/// the UniFFI boundary.
+#[derive(Clone, PartialEq, Eq)]
+pub(crate) struct GrantSecret([u8; GRANT_SECRET_LEN]);
+
+impl GrantSecret {
+    pub(crate) fn generate() -> Self {
+        Self(random_bytes())
+    }
+
+    pub(crate) fn encode(&self) -> String {
+        HEXLOWER.encode(&self.0)
+    }
+
+    pub(crate) fn decode(value: &str) -> Result<Self> {
+        let bytes = HEXLOWER
+            .decode(value.as_bytes())
+            .context("invalid grant secret encoding")?;
+        let bytes: [u8; GRANT_SECRET_LEN] = bytes
+            .try_into()
+            .map_err(|_| anyhow::anyhow!("invalid grant secret length"))?;
+        Ok(Self(bytes))
+    }
+}
+
+// Redacted on purpose: a secret must not reach a log line through a derived
+// Debug on some enclosing struct.
+impl fmt::Debug for GrantSecret {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.write_str("GrantSecret(redacted)")
+    }
+}
+
+/// Random challenge sent by the issuer to bind a proof to one connection.
+#[derive(Clone, PartialEq, Eq, Serialize, Deserialize)]
+pub(crate) struct Challenge([u8; CHALLENGE_LEN]);
+
+impl Challenge {
+    pub(crate) fn generate() -> Self {
+        Self(random_bytes())
+    }
+
+    #[cfg(test)]
+    pub(crate) fn from_bytes(bytes: [u8; CHALLENGE_LEN]) -> Self {
+        Self(bytes)
+    }
+}
+
+impl fmt::Debug for Challenge {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.write_str("Challenge(..)")
+    }
+}
+
+/// Proof that the sender holds the secret behind `grant_id`.
+#[derive(Clone, PartialEq, Eq, Serialize, Deserialize)]
+pub(crate) struct GrantProof {
+    pub(crate) grant_id: GrantId,
+    mac: [u8; PROOF_LEN],
+}
+
+impl fmt::Debug for GrantProof {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.debug_struct("GrantProof")
+            .field("grant_id", &self.grant_id)
+            .finish_non_exhaustive()
+    }
+}
+
+/// Why a presented proof was not accepted.
+///
+/// `Revoked` is reported to the peer so its client can drop the dead entry.
+/// `Unknown` is deliberately also used for blocked endpoints, so blocking
+/// cannot be detected by probing.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub(crate) enum GrantRejection {
+    Unknown,
+    Revoked,
+    Expired,
+    WrongEndpoint,
+    BadProof,
+}
+
+impl GrantRejection {
+    pub(crate) fn as_str(self) -> &'static str {
+        match self {
+            Self::Unknown => "unknown",
+            Self::Revoked => "revoked",
+            Self::Expired => "expired",
+            Self::WrongEndpoint => "wrong-endpoint",
+            Self::BadProof => "bad-proof",
+        }
+    }
+}
+
+/// A grant as held by the party that issued it. This is the authoritative
+/// record: `grants_held` on the peer is only a copy for display.
+#[derive(Debug, Clone)]
+pub(crate) struct IssuedGrant {
+    pub(crate) grant_id: GrantId,
+    pub(crate) secret: GrantSecret,
+    /// The grant is usable only by this endpoint, so it cannot be lent onward.
+    pub(crate) issued_to_endpoint_id: String,
+    pub(crate) created_at: i64,
+    /// Idle expiry, pushed forward on every accepted proof. `None` never expires.
+    pub(crate) expires_at: Option<i64>,
+    pub(crate) revoked_at: Option<i64>,
+}
+
+impl IssuedGrant {
+    pub(crate) fn mint(
+        issued_to_endpoint_id: String,
+        now_ms: i64,
+        lifetime: GrantLifetime,
+    ) -> Self {
+        Self {
+            grant_id: GrantId::generate(),
+            secret: GrantSecret::generate(),
+            issued_to_endpoint_id,
+            created_at: now_ms,
+            expires_at: lifetime.deadline_from(now_ms),
+            revoked_at: None,
+        }
+    }
+
+    /// Validate a proof presented by `remote_endpoint_id` over this connection's
+    /// challenge. Returns the renewed expiry the caller must persist.
+    ///
+    /// Checks run in a fixed order so a caller cannot learn more from an early
+    /// return than from a late one: revocation and expiry are properties of the
+    /// issuer's own record, and the endpoint binding is checked before the MAC
+    /// so a stolen grant cannot be probed for validity from another device.
+    pub(crate) fn accept(
+        &self,
+        proof: &GrantProof,
+        challenge: &Challenge,
+        issuer_endpoint_id: &str,
+        remote_endpoint_id: &str,
+        now_ms: i64,
+        lifetime: GrantLifetime,
+    ) -> Result<Option<i64>, GrantRejection> {
+        if proof.grant_id != self.grant_id {
+            return Err(GrantRejection::Unknown);
+        }
+        if self.revoked_at.is_some() {
+            return Err(GrantRejection::Revoked);
+        }
+        if self.is_expired(now_ms) {
+            return Err(GrantRejection::Expired);
+        }
+        if remote_endpoint_id != self.issued_to_endpoint_id {
+            return Err(GrantRejection::WrongEndpoint);
+        }
+
+        let expected = compute_proof(
+            &self.secret,
+            challenge,
+            issuer_endpoint_id,
+            remote_endpoint_id,
+        );
+        // Constant-time: blake3::Hash's PartialEq is constant-time by design.
+        if !constant_time_eq(&expected, &proof.mac) {
+            return Err(GrantRejection::BadProof);
+        }
+
+        Ok(lifetime.deadline_from(now_ms))
+    }
+
+    pub(crate) fn is_expired(&self, now_ms: i64) -> bool {
+        self.expires_at
+            .is_some_and(|expires_at| expires_at < now_ms)
+    }
+}
+
+/// A grant as held by the party it was issued to: the capability used to reach
+/// the peer that minted it.
+///
+/// `expires_at` here is advisory only — a copy of what the issuer said at issue
+/// time, useful for showing "expires soon" in the UI. The issuer's record is
+/// authoritative and may have been renewed or revoked since.
+#[derive(Debug, Clone)]
+pub(crate) struct HeldGrant {
+    pub(crate) grant_id: GrantId,
+    pub(crate) secret: GrantSecret,
+    /// The peer that issued this grant, and therefore the only one it works on.
+    pub(crate) peer_endpoint_id: String,
+    pub(crate) created_at: i64,
+    pub(crate) expires_at: Option<i64>,
+}
+
+impl HeldGrant {
+    /// Build the proof to present to the issuing peer.
+    pub(crate) fn prove(&self, challenge: &Challenge, self_endpoint_id: &str) -> GrantProof {
+        prove(
+            self.grant_id,
+            &self.secret,
+            challenge,
+            &self.peer_endpoint_id,
+            self_endpoint_id,
+        )
+    }
+}
+
+/// How long a grant survives without use. Grants expire on idleness rather than
+/// age, so a relationship in regular use never lapses while a forgotten one
+/// cleans itself up.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub(crate) enum GrantLifetime {
+    Days(u32),
+    Never,
+}
+
+impl GrantLifetime {
+    pub(crate) const DEFAULT_DAYS: u32 = 90;
+
+    pub(crate) fn deadline_from(self, now_ms: i64) -> Option<i64> {
+        match self {
+            Self::Never => None,
+            Self::Days(days) => Some(now_ms + i64::from(days) * 24 * 60 * 60 * 1_000),
+        }
+    }
+}
+
+impl Default for GrantLifetime {
+    fn default() -> Self {
+        Self::Days(Self::DEFAULT_DAYS)
+    }
+}
+
+impl From<crate::api::GrantLifetimeSetting> for GrantLifetime {
+    fn from(setting: crate::api::GrantLifetimeSetting) -> Self {
+        match setting {
+            crate::api::GrantLifetimeSetting::Days30 => Self::Days(30),
+            crate::api::GrantLifetimeSetting::Days90 => Self::Days(90),
+            crate::api::GrantLifetimeSetting::Days365 => Self::Days(365),
+            crate::api::GrantLifetimeSetting::Never => Self::Never,
+        }
+    }
+}
+
+/// Build the proof for a grant this device holds.
+pub(crate) fn prove(
+    grant_id: GrantId,
+    secret: &GrantSecret,
+    challenge: &Challenge,
+    issuer_endpoint_id: &str,
+    holder_endpoint_id: &str,
+) -> GrantProof {
+    GrantProof {
+        grant_id,
+        mac: compute_proof(secret, challenge, issuer_endpoint_id, holder_endpoint_id),
+    }
+}
+
+/// Keyed MAC over the challenge and both endpoint identities.
+///
+/// Binding the challenge stops a captured proof being replayed; binding both
+/// endpoint ids stops it being replayed against a different peer. Lengths are
+/// prefixed so two different id pairs cannot produce the same input.
+fn compute_proof(
+    secret: &GrantSecret,
+    challenge: &Challenge,
+    issuer_endpoint_id: &str,
+    holder_endpoint_id: &str,
+) -> [u8; PROOF_LEN] {
+    let mut input = Vec::with_capacity(
+        PROOF_CONTEXT.len()
+            + CHALLENGE_LEN
+            + issuer_endpoint_id.len()
+            + holder_endpoint_id.len()
+            + 16,
+    );
+    input.extend_from_slice(PROOF_CONTEXT);
+    input.extend_from_slice(&challenge.0);
+    push_length_prefixed(&mut input, issuer_endpoint_id.as_bytes());
+    push_length_prefixed(&mut input, holder_endpoint_id.as_bytes());
+    *blake3::keyed_hash(&secret.0, &input).as_bytes()
+}
+
+fn push_length_prefixed(buffer: &mut Vec<u8>, bytes: &[u8]) {
+    buffer.extend_from_slice(&(bytes.len() as u64).to_le_bytes());
+    buffer.extend_from_slice(bytes);
+}
+
+fn constant_time_eq(left: &[u8; PROOF_LEN], right: &[u8; PROOF_LEN]) -> bool {
+    // blake3::Hash compares in constant time; reuse it rather than hand-rolling.
+    blake3::Hash::from_bytes(*left) == blake3::Hash::from_bytes(*right)
+}
+
+/// Cryptographically secure random bytes.
+///
+/// Panics if the OS entropy source fails. That is unrecoverable and must never
+/// degrade into a weak grant, so it is not surfaced as a fallible API.
+fn random_bytes<const N: usize>() -> [u8; N] {
+    let mut bytes = [0u8; N];
+    getrandom::fill(&mut bytes).expect("OS entropy source unavailable");
+    bytes
+}
+
+/// Parse a stored grant secret, rejecting anything malformed rather than
+/// silently producing a grant that can never validate.
+pub(crate) fn parse_secret(value: &str) -> Result<GrantSecret> {
+    let secret = GrantSecret::decode(value)?;
+    if secret.0.iter().all(|byte| *byte == 0) {
+        bail!("refusing an all-zero grant secret");
+    }
+    Ok(secret)
+}

crates/vnidrop/src/lib.rs

@@ -1,24 +1,39 @@
 mod access_policy;
 mod api;
 mod approval;
+mod contacts;
 mod error;
 mod event_hub;
 mod filesystem;
+mod grant;
 mod handshake;
 mod logging;
+mod offer;
+mod offer_inbox;
+mod pairing;
 mod repository;
 mod runtime;
 mod secret;
+#[allow(
+    dead_code,
+    reason = "the private custody seam is activated by platform credential adapters"
+)]
+mod secure_secret;
+mod targeted_transfer;
 mod ticket;
 mod transfer_state;
 mod util;
 
 pub use api::{
-    clear_inactive_transfer_cache, default_core_limits, default_core_network_config, CoreEvent,
-    CoreEventSink, CoreLimits, CoreNetworkConfig, CoreRelayMode, CoreStorageUsage, PublishedOutput,
+    clear_inactive_transfer_cache, default_core_limits, default_core_network_config,
+    experimental_saved_device_capabilities, ContactSendResult, ContactSummary, CoreEvent,
+    CoreEventSink, CoreLimits, CoreNetworkConfig, CoreRelayMode, CoreStorageUsage,
+    DeviceRelationship, DeviceRelationshipState, ExperimentalSavedDeviceCapabilities,
+    GrantLifetimeSetting, HeldOfferSummary, IncomingOffer, PendingPairing, PublishedOutput,
     ReceiveOutputSink, ReceiveOutputSinkV2, ReceivedArtifact, ReceivedLocatorKind, ReceiverRequest,
-    RuntimeStatus, ShareMetadataInput, ShareResult, ShareSource, SourceKind, StoredTransfer,
-    TicketInspection, TransferAccessMode, TransferMetadata,
+    RuntimeStatus, SavedDevice, ShareMetadataInput, ShareResult, ShareSource, SourceKind,
+    StoredTransfer, TargetedTransfer, TargetedTransferState, TicketInspection, TransferAccessMode,
+    TransferMetadata,
 };
 pub use error::VnidropError;
 pub use runtime::VnidropCore;

crates/vnidrop/src/offer.rs

@@ -0,0 +1,335 @@
+//! The contacts protocol: how paired devices reach each other directly.
+//!
+//! Separate ALPN from the transfer handshake because the trust model differs.
+//! `/vnidrop/handshake/2` serves anyone holding a ticket, subject to sender
+//! approval. This one serves nobody without a grant (see [`crate::grant`]), so
+//! an unpaired device cannot even raise a prompt on the far side.
+//!
+//! Every request except grant delivery carries a proof over a challenge this
+//! connection issued, so a captured proof cannot be replayed onto another
+//! connection.
+
+use std::fmt;
+
+use anyhow::Result;
+use iroh::{
+    endpoint::Connection,
+    protocol::{AcceptError, ProtocolHandler},
+    Endpoint, EndpointAddr,
+};
+use irpc::{channel::oneshot, rpc_requests, Client, WithChannels};
+use irpc_iroh::{read_request, IrohLazyRemoteConnection};
+use serde::{Deserialize, Serialize};
+
+use crate::{
+    grant::{Challenge, GrantId, GrantProof},
+    offer_inbox::OfferInbox,
+    pairing::PairingService,
+};
+
+#[derive(Clone)]
+pub(crate) struct OfferService {
+    pairing: PairingService,
+    inbox: OfferInbox,
+    /// This device's endpoint id. Grants we issued are bound to it, so proofs
+    /// must be verified against it rather than against whatever a peer claims.
+    self_endpoint_id: String,
+}
+
+impl fmt::Debug for OfferService {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.write_str("OfferService")
+    }
+}
+
+impl OfferService {
+    pub(crate) const ALPN: &'static [u8] = b"/vnidrop/offer/1";
+
+    pub(crate) fn new(
+        pairing: PairingService,
+        inbox: OfferInbox,
+        self_endpoint_id: String,
+    ) -> Self {
+        Self {
+            pairing,
+            inbox,
+            self_endpoint_id,
+        }
+    }
+
+    pub(crate) fn client(endpoint: Endpoint, addr: EndpointAddr) -> OfferClient {
+        OfferClient {
+            inner: Client::boxed(IrohLazyRemoteConnection::new(
+                endpoint,
+                addr,
+                Self::ALPN.to_vec(),
+            )),
+        }
+    }
+}
+
+impl OfferService {
+    /// Validate the grant, then hand the offer to the local user.
+    ///
+    /// A refusal names the grant failure so the peer can drop a dead entry;
+    /// `Unknown` covers both "never issued" and "blocked", which is what keeps
+    /// blocking undetectable.
+    async fn handle_offer(
+        &self,
+        remote_endpoint_id: &str,
+        challenge: &Challenge,
+        offer: SubmitOffer,
+    ) -> OfferResponse {
+        if let Err(rejection) = self
+            .pairing
+            .verify_and_renew(
+                &offer.proof,
+                challenge,
+                &self.self_endpoint_id,
+                remote_endpoint_id,
+            )
+            .await
+        {
+            return OfferResponse::Refused {
+                reason: rejection.as_str().to_string(),
+            };
+        }
+
+        self.inbox
+            .submit(
+                remote_endpoint_id.to_string(),
+                offer.transfer_name,
+                offer.sender_display_name,
+                offer.file_count,
+                offer.total_bytes,
+                offer.ticket,
+            )
+            .await
+    }
+}
+
+impl OfferService {
+    /// Hand a device the offers this one is holding for it.
+    ///
+    /// Needs no grant proof: iroh has already authenticated the remote endpoint
+    /// key, and the only thing returned is what this device already decided to
+    /// send to precisely that endpoint. A stranger polling gets an empty list.
+    async fn handle_poll(&self, remote_endpoint_id: &str) -> PolledOffers {
+        PolledOffers {
+            offers: self.pairing.collect_held_offers(remote_endpoint_id).await,
+        }
+    }
+}
+
+impl ProtocolHandler for OfferService {
+    /// Accepts inbound connections from paired peers.
+    ///
+    /// The challenge is per connection and never leaves this scope, which is
+    /// what binds a proof to one session: a proof captured from an earlier
+    /// connection cannot be presented on a later one.
+    async fn accept(&self, connection: Connection) -> Result<(), AcceptError> {
+        let remote_endpoint_id = connection.remote_id().to_string();
+        let challenge = Challenge::generate();
+
+        while let Some(message) = read_request::<OfferProtocol>(&connection).await? {
+            match message {
+                OfferMessage::RequestChallenge(message) => {
+                    let WithChannels { tx, .. } = message;
+                    let _ = tx
+                        .send(ChallengeResponse {
+                            challenge: challenge.clone(),
+                        })
+                        .await;
+                }
+                OfferMessage::DeliverGrant(message) => {
+                    let WithChannels { inner, tx, .. } = message;
+                    let response = self
+                        .pairing
+                        .receive_grant(remote_endpoint_id.clone(), inner)
+                        .await;
+                    let _ = tx.send(response).await;
+                }
+                OfferMessage::RevokeGrant(message) => {
+                    let WithChannels { inner, tx, .. } = message;
+                    let response = self
+                        .pairing
+                        .receive_revocation(remote_endpoint_id.clone(), inner)
+                        .await;
+                    let _ = tx.send(response).await;
+                }
+                OfferMessage::PollOffers(message) => {
+                    let WithChannels { tx, .. } = message;
+                    let response = self.handle_poll(&remote_endpoint_id).await;
+                    let _ = tx.send(response).await;
+                }
+                OfferMessage::SubmitOffer(message) => {
+                    let WithChannels { inner, tx, .. } = message;
+                    let response = self
+                        .handle_offer(&remote_endpoint_id, &challenge, inner)
+                        .await;
+                    let _ = tx.send(response).await;
+                }
+            }
+        }
+
+        connection.closed().await;
+        Ok(())
+    }
+}
+
+#[derive(Debug, Clone)]
+pub(crate) struct OfferClient {
+    inner: Client<OfferProtocol>,
+}
+
+impl OfferClient {
+    pub(crate) async fn poll_offers(&self) -> Result<PolledOffers, irpc::Error> {
+        self.inner.rpc(PollOffers).await
+    }
+
+    pub(crate) async fn request_challenge(&self) -> Result<Challenge, irpc::Error> {
+        Ok(self.inner.rpc(RequestChallenge).await?.challenge)
+    }
+
+    pub(crate) async fn submit_offer(
+        &self,
+        offer: SubmitOffer,
+    ) -> Result<OfferResponse, irpc::Error> {
+        self.inner.rpc(offer).await
+    }
+
+    pub(crate) async fn deliver_grant(
+        &self,
+        grant: DeliverGrant,
+    ) -> Result<GrantDeliveryResponse, irpc::Error> {
+        self.inner.rpc(grant).await
+    }
+
+    pub(crate) async fn revoke_grant(
+        &self,
+        revocation: RevokeGrant,
+    ) -> Result<RevocationResponse, irpc::Error> {
+        self.inner.rpc(revocation).await
+    }
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub(crate) struct RequestChallenge;
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub(crate) struct ChallengeResponse {
+    pub(crate) challenge: Challenge,
+}
+
+/// Hand a peer the capability to reach this device.
+///
+/// Carries the secret itself, which is safe only because the iroh connection is
+/// already authenticated and encrypted to the recipient's endpoint key. The
+/// recipient still has to consent before it is stored.
+#[derive(Clone, Serialize, Deserialize)]
+pub(crate) struct DeliverGrant {
+    pub(crate) grant_id: GrantId,
+    /// Hex-encoded grant secret.
+    pub(crate) secret: String,
+    pub(crate) expires_at: Option<i64>,
+    /// Untrusted display data, shown only after the user consents.
+    pub(crate) display_name: Option<String>,
+}
+
+// The secret must not reach a log line through a derived Debug.
+impl fmt::Debug for DeliverGrant {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.debug_struct("DeliverGrant")
+            .field("grant_id", &self.grant_id)
+            .field("display_name", &self.display_name)
+            .finish_non_exhaustive()
+    }
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
+pub(crate) enum GrantDeliveryResponse {
+    /// Held pending the local user's decision. Not yet a contact.
+    AwaitingConsent,
+    /// Stored: the local user had already agreed to remember this device.
+    Stored,
+    Rejected {
+        reason: String,
+    },
+}
+
+/// Tell a peer that a grant it holds is dead, so its entry disappears promptly
+/// rather than at its next attempt. Best effort: revocation is already complete
+/// on the issuing side before this is sent.
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub(crate) struct RevokeGrant {
+    pub(crate) grant_id: GrantId,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
+pub(crate) enum RevocationResponse {
+    Removed,
+    /// No such grant held from this peer. Also returned when the grant belongs
+    /// to someone else, so a stranger cannot probe for grant ids.
+    Unknown,
+}
+
+/// Hand a paired device a ticket for content it may fetch.
+///
+/// The ticket is a capability, so this is sent only over a connection where the
+/// grant proof has already been presented.
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub(crate) struct SubmitOffer {
+    pub(crate) proof: GrantProof,
+    pub(crate) ticket: String,
+    pub(crate) transfer_name: String,
+    pub(crate) sender_display_name: Option<String>,
+    pub(crate) file_count: u64,
+    pub(crate) total_bytes: u64,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
+pub(crate) enum OfferResponse {
+    /// The receiving user agreed. They fetch the content themselves next.
+    Accepted,
+    /// The receiving user said no, or never answered.
+    Declined { reason: String },
+    /// The grant did not validate. Names the reason so a peer holding a dead
+    /// grant can clear it.
+    Refused { reason: String },
+}
+
+/// Ask a device whether it is holding anything for this one.
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub(crate) struct PollOffers;
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub(crate) struct PolledOffers {
+    pub(crate) offers: Vec<PolledOffer>,
+}
+
+/// An offer collected by polling rather than pushed. Carries the ticket because
+/// the sender already decided to send it to this endpoint; the local user still
+/// confirms before anything is fetched.
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub(crate) struct PolledOffer {
+    pub(crate) ticket: String,
+    pub(crate) transfer_name: String,
+    pub(crate) sender_display_name: Option<String>,
+    pub(crate) file_count: u64,
+    pub(crate) total_bytes: u64,
+}
+
+#[rpc_requests(message = OfferMessage)]
+#[derive(Debug, Serialize, Deserialize)]
+enum OfferProtocol {
+    #[rpc(tx=oneshot::Sender<ChallengeResponse>)]
+    RequestChallenge(RequestChallenge),
+    #[rpc(tx=oneshot::Sender<GrantDeliveryResponse>)]
+    DeliverGrant(DeliverGrant),
+    #[rpc(tx=oneshot::Sender<RevocationResponse>)]
+    RevokeGrant(RevokeGrant),
+    #[rpc(tx=oneshot::Sender<OfferResponse>)]
+    SubmitOffer(SubmitOffer),
+    #[rpc(tx=oneshot::Sender<PolledOffers>)]
+    PollOffers(PollOffers),
+}

crates/vnidrop/src/offer_inbox.rs

@@ -0,0 +1,277 @@
+//! Incoming transfer offers from paired devices.
+//!
+//! An offer is only a delivery mechanism for a ticket: it replaces the QR code,
+//! not the transfer. Accepting hands the ticket to the platform layer, which
+//! runs the ordinary receive with its own destination rules.
+//!
+//! Nothing in this inbox is persisted: a prompt belongs to a live connection,
+//! so a restart correctly loses it rather than resurrecting one whose sender is
+//! long gone. Offers the *sender* could not deliver are a different thing and
+//! do persist — see `held_offers` in [`crate::contacts`].
+
+use std::{collections::HashMap, sync::Arc, time::Duration};
+
+use serde_json::json;
+use tokio::sync::{oneshot, Mutex};
+use uuid::Uuid;
+
+use crate::{event_hub::EventHub, offer::OfferResponse, util::now_ms};
+
+/// How long the sender waits for the receiving user to decide.
+const OFFER_WAIT_TIMEOUT: Duration = Duration::from_secs(120);
+
+/// Quiet period after a decline, so a paired device cannot re-prompt on a loop.
+/// A contact is not a stranger, but it is not unlimited either.
+const DECLINE_COOLDOWN_MS: i64 = 60 * 1_000;
+
+#[derive(Debug, Clone)]
+pub(crate) struct PendingOffer {
+    pub(crate) offer_id: String,
+    pub(crate) from_endpoint_id: String,
+    pub(crate) sender_display_name: Option<String>,
+    pub(crate) transfer_name: String,
+    pub(crate) file_count: u64,
+    pub(crate) total_bytes: u64,
+    pub(crate) received_at: i64,
+    /// Released to the caller only once the local user accepts.
+    ticket: String,
+}
+
+struct Waiter {
+    endpoint_id: String,
+    responder: oneshot::Sender<bool>,
+}
+
+#[derive(Clone)]
+pub(crate) struct OfferInbox {
+    event_hub: Arc<EventHub>,
+    pending: Arc<Mutex<HashMap<String, PendingOffer>>>,
+    waiters: Arc<Mutex<HashMap<String, Waiter>>>,
+    /// Endpoint → time before which new offers are refused.
+    cooldowns: Arc<Mutex<HashMap<String, i64>>>,
+    max_pending: usize,
+}
+
+impl OfferInbox {
+    pub(crate) fn new(event_hub: Arc<EventHub>, max_pending: usize) -> Self {
+        Self {
+            event_hub,
+            pending: Arc::new(Mutex::new(HashMap::new())),
+            waiters: Arc::new(Mutex::new(HashMap::new())),
+            cooldowns: Arc::new(Mutex::new(HashMap::new())),
+            max_pending,
+        }
+    }
+
+    /// Surface an offer and block until the local user decides.
+    ///
+    /// The caller has already proven a live grant, so this is a known device;
+    /// the limits here bound nuisance rather than attack.
+    pub(crate) async fn submit(
+        &self,
+        from_endpoint_id: String,
+        transfer_name: String,
+        sender_display_name: Option<String>,
+        file_count: u64,
+        total_bytes: u64,
+        ticket: String,
+    ) -> OfferResponse {
+        let now = now_ms();
+        {
+            let mut cooldowns = self.cooldowns.lock().await;
+            cooldowns.retain(|_, until| *until > now);
+            if cooldowns.contains_key(&from_endpoint_id) {
+                return OfferResponse::Declined {
+                    reason: "declined-recently".to_string(),
+                };
+            }
+        }
+
+        let offer_id = Uuid::new_v4().to_string();
+        let (tx, rx) = oneshot::channel();
+        {
+            let mut pending = self.pending.lock().await;
+            if pending.len() >= self.max_pending {
+                return OfferResponse::Declined {
+                    reason: "too-many-pending-offers".to_string(),
+                };
+            }
+            // One prompt per device at a time: a second offer would stack
+            // notifications for the same sender.
+            if pending
+                .values()
+                .any(|offer| offer.from_endpoint_id == from_endpoint_id)
+            {
+                return OfferResponse::Declined {
+                    reason: "offer-already-pending".to_string(),
+                };
+            }
+            pending.insert(
+                offer_id.clone(),
+                PendingOffer {
+                    offer_id: offer_id.clone(),
+                    from_endpoint_id: from_endpoint_id.clone(),
+                    sender_display_name: sender_display_name.clone(),
+                    transfer_name: transfer_name.clone(),
+                    file_count,
+                    total_bytes,
+                    received_at: now,
+                    ticket,
+                },
+            );
+        }
+        self.waiters.lock().await.insert(
+            offer_id.clone(),
+            Waiter {
+                endpoint_id: from_endpoint_id.clone(),
+                responder: tx,
+            },
+        );
+
+        // The ticket is deliberately absent: an event is a log record, and a
+        // ticket is a capability.
+        self.event_hub.emit_endpoint(
+            "offer",
+            "offer-received",
+            json!({
+                "offer_id": offer_id,
+                "from_endpoint_id": from_endpoint_id,
+                "sender_display_name": sender_display_name,
+                "transfer_name": transfer_name,
+                "file_count": file_count,
+                "total_bytes": total_bytes,
+            }),
+        );
+
+        match tokio::time::timeout(OFFER_WAIT_TIMEOUT, rx).await {
+            Ok(Ok(true)) => OfferResponse::Accepted,
+            Ok(Ok(false)) => OfferResponse::Declined {
+                reason: "receiver-declined".to_string(),
+            },
+            // Dropped responder or timeout: clear the prompt so it cannot
+            // linger after the sender has given up.
+            Ok(Err(_)) | Err(_) => {
+                self.discard(&offer_id).await;
+                OfferResponse::Declined {
+                    reason: "no-response".to_string(),
+                }
+            }
+        }
+    }
+
+    /// Add an offer collected by polling.
+    ///
+    /// Unlike [`Self::submit`] there is no remote waiting on the answer: the
+    /// sender handed the ticket over and moved on, so this returns immediately.
+    pub(crate) async fn enqueue(
+        &self,
+        from_endpoint_id: String,
+        transfer_name: String,
+        sender_display_name: Option<String>,
+        file_count: u64,
+        total_bytes: u64,
+        ticket: String,
+    ) -> bool {
+        let offer_id = uuid::Uuid::new_v4().to_string();
+        {
+            let mut pending = self.pending.lock().await;
+            if pending.len() >= self.max_pending {
+                return false;
+            }
+            if pending
+                .values()
+                .any(|offer| offer.from_endpoint_id == from_endpoint_id)
+            {
+                return false;
+            }
+            pending.insert(
+                offer_id.clone(),
+                PendingOffer {
+                    offer_id: offer_id.clone(),
+                    from_endpoint_id: from_endpoint_id.clone(),
+                    sender_display_name: sender_display_name.clone(),
+                    transfer_name: transfer_name.clone(),
+                    file_count,
+                    total_bytes,
+                    received_at: now_ms(),
+                    ticket,
+                },
+            );
+        }
+        self.event_hub.emit_endpoint(
+            "offer",
+            "offer-collected",
+            json!({
+                "offer_id": offer_id,
+                "from_endpoint_id": from_endpoint_id,
+                "sender_display_name": sender_display_name,
+                "transfer_name": transfer_name,
+                "file_count": file_count,
+                "total_bytes": total_bytes,
+            }),
+        );
+        true
+    }
+
+    pub(crate) async fn list(&self) -> Vec<PendingOffer> {
+        self.pending.lock().await.values().cloned().collect()
+    }
+
+    /// Record the local user's decision.
+    ///
+    /// Returns the ticket on acceptance: it leaves the core at the moment of
+    /// consent and not before, so a declined offer never hands over a
+    /// capability. The caller then runs the ordinary receive with it.
+    pub(crate) async fn respond(&self, offer_id: &str, accepted: bool) -> Option<String> {
+        let offer = self.pending.lock().await.remove(offer_id)?;
+        let waiter = self.waiters.lock().await.remove(offer_id);
+
+        if !accepted {
+            self.cooldowns.lock().await.insert(
+                offer.from_endpoint_id.clone(),
+                now_ms() + DECLINE_COOLDOWN_MS,
+            );
+        }
+        if let Some(waiter) = waiter {
+            let _ = waiter.responder.send(accepted);
+        }
+        self.event_hub.emit_endpoint(
+            "offer",
+            if accepted {
+                "offer-accepted"
+            } else {
+                "offer-declined"
+            },
+            json!({
+                "offer_id": offer_id,
+                "from_endpoint_id": offer.from_endpoint_id,
+            }),
+        );
+
+        accepted.then_some(offer.ticket)
+    }
+
+    /// Drop every prompt from a device, used when it is forgotten or blocked
+    /// while an offer is on screen.
+    pub(crate) async fn discard_from(&self, endpoint_id: &str) {
+        let ids: Vec<String> = {
+            let pending = self.pending.lock().await;
+            pending
+                .values()
+                .filter(|offer| offer.from_endpoint_id == endpoint_id)
+                .map(|offer| offer.offer_id.clone())
+                .collect()
+        };
+        for offer_id in ids {
+            self.discard(&offer_id).await;
+        }
+    }
+
+    async fn discard(&self, offer_id: &str) {
+        self.pending.lock().await.remove(offer_id);
+        if let Some(waiter) = self.waiters.lock().await.remove(offer_id) {
+            let _ = waiter.responder.send(false);
+            let _ = waiter.endpoint_id;
+        }
+    }
+}

crates/vnidrop/src/pairing.rs

@@ -0,0 +1,386 @@
+//! Consent and grant exchange for device history.
+//!
+//! Mirrors [`crate::approval`]: the protocol handler stays thin and the
+//! decisions live here. The rule this module exists to enforce is that a device
+//! is remembered only if *both* sides agree — refusing to issue a grant leaves
+//! the peer with a contact entry that cannot do anything.
+
+use std::{collections::HashMap, sync::Arc, time::Duration};
+
+use serde_json::json;
+use tokio::sync::Mutex;
+
+use crate::{
+    contacts::ContactStore,
+    event_hub::EventHub,
+    grant::{
+        Challenge, GrantLifetime, GrantProof, GrantRejection, GrantSecret, HeldGrant, IssuedGrant,
+    },
+    offer::{DeliverGrant, GrantDeliveryResponse, PolledOffer, RevocationResponse, RevokeGrant},
+    util::now_ms,
+};
+
+/// How long an incoming grant waits for the local user's decision.
+///
+/// Bounded so a peer cannot park entries in memory indefinitely, and short
+/// enough that a stale prompt does not outlive the context the user remembers.
+const CONSENT_WINDOW: Duration = Duration::from_secs(10 * 60);
+
+/// A grant a peer has offered, waiting on the local user.
+///
+/// Not persisted: if the app restarts, the prompt is gone and the peer can
+/// offer again. Persisting would resurrect prompts whose context the user has
+/// long forgotten.
+#[derive(Debug, Clone)]
+pub(crate) struct PendingGrant {
+    pub(crate) peer_endpoint_id: String,
+    pub(crate) display_name: Option<String>,
+    pub(crate) received_at: i64,
+    grant: HeldGrant,
+}
+
+#[derive(Clone)]
+pub(crate) struct PairingService {
+    contacts: ContactStore,
+    event_hub: Arc<EventHub>,
+    /// Keyed by peer endpoint id: one outstanding offer per peer, so a peer
+    /// cannot flood the prompt queue by reconnecting.
+    pending: Arc<Mutex<HashMap<String, PendingGrant>>>,
+    max_pending: usize,
+    max_metadata_bytes: u64,
+    lifetime: Arc<Mutex<GrantLifetime>>,
+}
+
+impl PairingService {
+    pub(crate) fn new(
+        contacts: ContactStore,
+        event_hub: Arc<EventHub>,
+        max_pending: usize,
+        max_metadata_bytes: u64,
+    ) -> Self {
+        Self {
+            contacts,
+            event_hub,
+            pending: Arc::new(Mutex::new(HashMap::new())),
+            max_pending,
+            max_metadata_bytes,
+            lifetime: Arc::new(Mutex::new(GrantLifetime::default())),
+        }
+    }
+
+    pub(crate) async fn set_grant_lifetime(&self, lifetime: GrantLifetime) {
+        *self.lifetime.lock().await = lifetime;
+    }
+
+    pub(crate) async fn grant_lifetime(&self) -> GrantLifetime {
+        *self.lifetime.lock().await
+    }
+
+    // -- inbound ----------------------------------------------------------
+
+    /// A peer offers this device the capability to reach it.
+    ///
+    /// Never stored on arrival: an unsolicited grant would otherwise create a
+    /// contact the local user never agreed to. It waits for consent instead.
+    pub(crate) async fn receive_grant(
+        &self,
+        peer_endpoint_id: String,
+        delivery: DeliverGrant,
+    ) -> GrantDeliveryResponse {
+        if self
+            .contacts
+            .is_blocked(&peer_endpoint_id)
+            .await
+            .unwrap_or(false)
+        {
+            // Indistinguishable from any other refusal: blocking must not be
+            // detectable by probing.
+            return GrantDeliveryResponse::Rejected {
+                reason: "not-accepted".to_string(),
+            };
+        }
+        if delivery
+            .display_name
+            .as_deref()
+            .is_some_and(|name| name.len() as u64 > self.max_metadata_bytes)
+        {
+            return GrantDeliveryResponse::Rejected {
+                reason: "metadata-too-large".to_string(),
+            };
+        }
+        let secret = match GrantSecret::decode(&delivery.secret) {
+            Ok(secret) => secret,
+            Err(_) => {
+                return GrantDeliveryResponse::Rejected {
+                    reason: "malformed-grant".to_string(),
+                }
+            }
+        };
+
+        let now = now_ms();
+        let held = HeldGrant {
+            grant_id: delivery.grant_id,
+            secret,
+            peer_endpoint_id: peer_endpoint_id.clone(),
+            created_at: now,
+            expires_at: delivery.expires_at,
+        };
+
+        // Already a contact: the user agreed to this relationship, so a refreshed
+        // grant (re-pairing, or a renewal after reinstall) replaces the old one
+        // without prompting again.
+        let already_known = self
+            .contacts
+            .find_contact(&peer_endpoint_id)
+            .await
+            .ok()
+            .flatten()
+            .is_some();
+        if already_known {
+            if self.contacts.insert_held_grant(&held).await.is_err() {
+                return GrantDeliveryResponse::Rejected {
+                    reason: "storage-error".to_string(),
+                };
+            }
+            self.emit(
+                "grant-refreshed",
+                json!({ "peer_endpoint_id": peer_endpoint_id }),
+            );
+            return GrantDeliveryResponse::Stored;
+        }
+
+        let mut pending = self.pending.lock().await;
+        self.drop_expired(&mut pending, now);
+        if !pending.contains_key(&peer_endpoint_id) && pending.len() >= self.max_pending {
+            drop(pending);
+            return GrantDeliveryResponse::Rejected {
+                reason: "too-many-pending".to_string(),
+            };
+        }
+        pending.insert(
+            peer_endpoint_id.clone(),
+            PendingGrant {
+                peer_endpoint_id: peer_endpoint_id.clone(),
+                display_name: delivery.display_name.clone(),
+                received_at: now,
+                grant: held,
+            },
+        );
+        drop(pending);
+
+        self.emit(
+            "pairing-requested",
+            json!({
+                "peer_endpoint_id": peer_endpoint_id,
+                "display_name": delivery.display_name,
+            }),
+        );
+        GrantDeliveryResponse::AwaitingConsent
+    }
+
+    /// A peer reports that a grant this device holds is dead.
+    ///
+    /// Only the issuer may retire its own grant, so the held record must name
+    /// this peer. A mismatch answers `Unknown` rather than an error, so a
+    /// stranger cannot probe for grant ids belonging to someone else.
+    pub(crate) async fn receive_revocation(
+        &self,
+        peer_endpoint_id: String,
+        revocation: RevokeGrant,
+    ) -> RevocationResponse {
+        let held = self
+            .contacts
+            .held_grant_for(&peer_endpoint_id)
+            .await
+            .ok()
+            .flatten();
+        let Some(held) = held else {
+            return RevocationResponse::Unknown;
+        };
+        if held.grant_id != revocation.grant_id {
+            return RevocationResponse::Unknown;
+        }
+        if self
+            .contacts
+            .delete_held_grant(revocation.grant_id)
+            .await
+            .is_err()
+        {
+            return RevocationResponse::Unknown;
+        }
+        self.emit(
+            "contact-revoked-by-peer",
+            json!({ "peer_endpoint_id": peer_endpoint_id }),
+        );
+        RevocationResponse::Removed
+    }
+
+    // -- local decisions --------------------------------------------------
+
+    pub(crate) async fn list_pending_grants(&self) -> Vec<PendingGrant> {
+        let mut pending = self.pending.lock().await;
+        self.drop_expired(&mut pending, now_ms());
+        pending.values().cloned().collect()
+    }
+
+    /// Accept a peer's offer to be remembered.
+    ///
+    /// Stores their grant and records the contact. Issuing our own grant in
+    /// return is a separate decision the caller makes, because "I want to reach
+    /// them" and "they may reach me" are independent.
+    pub(crate) async fn accept_pending_grant(
+        &self,
+        peer_endpoint_id: &str,
+    ) -> anyhow::Result<bool> {
+        let pending = {
+            let mut pending = self.pending.lock().await;
+            self.drop_expired(&mut pending, now_ms());
+            pending.remove(peer_endpoint_id)
+        };
+        let Some(pending) = pending else {
+            return Ok(false);
+        };
+
+        self.contacts
+            .upsert_contact(
+                peer_endpoint_id,
+                pending.display_name.as_deref(),
+                pending.received_at,
+            )
+            .await?;
+        self.contacts.insert_held_grant(&pending.grant).await?;
+        self.emit(
+            "contact-added",
+            json!({ "peer_endpoint_id": peer_endpoint_id }),
+        );
+        Ok(true)
+    }
+
+    /// Decline to be reachable through this peer's grant. The grant is dropped
+    /// unstored, so nothing about the peer is retained.
+    pub(crate) async fn decline_pending_grant(&self, peer_endpoint_id: &str) -> bool {
+        let removed = {
+            let mut pending = self.pending.lock().await;
+            pending.remove(peer_endpoint_id).is_some()
+        };
+        if removed {
+            self.emit(
+                "pairing-declined",
+                json!({ "peer_endpoint_id": peer_endpoint_id }),
+            );
+        }
+        removed
+    }
+
+    /// Mint a grant for a peer: our consent to be reached by them.
+    ///
+    /// The caller delivers it over the offer protocol. Persisted before
+    /// delivery so a grant we may already have handed over is never forgotten.
+    pub(crate) async fn issue_grant(&self, peer_endpoint_id: &str) -> anyhow::Result<IssuedGrant> {
+        let lifetime = self.grant_lifetime().await;
+        let grant = IssuedGrant::mint(peer_endpoint_id.to_string(), now_ms(), lifetime);
+        self.contacts.insert_issued_grant(&grant).await?;
+        self.contacts
+            .upsert_contact(peer_endpoint_id, None, now_ms())
+            .await?;
+        self.emit(
+            "grant-issued",
+            json!({ "peer_endpoint_id": peer_endpoint_id }),
+        );
+        Ok(grant)
+    }
+
+    /// Held offers addressed to `endpoint_id`, consumed as they are handed over.
+    ///
+    /// Deleting on delivery is what keeps a device that polls twice from being
+    /// offered the same transfer again.
+    pub(crate) async fn collect_held_offers(&self, endpoint_id: &str) -> Vec<PolledOffer> {
+        if self.contacts.is_blocked(endpoint_id).await.unwrap_or(false) {
+            return Vec::new();
+        }
+        let Ok(held) = self.contacts.held_offers_for(endpoint_id).await else {
+            return Vec::new();
+        };
+        if held.is_empty() {
+            return Vec::new();
+        }
+        let ids: Vec<String> = held.iter().map(|offer| offer.offer_id.clone()).collect();
+        if let Err(error) = self.contacts.delete_held_offers(&ids).await {
+            // Handing the same offer over twice is worse than not handing it
+            // over at all, so a failed consume aborts the delivery.
+            tracing::warn!(%error, "failed to consume held offers");
+            return Vec::new();
+        }
+        self.emit(
+            "held-offers-collected",
+            json!({ "peer_endpoint_id": endpoint_id, "count": held.len() }),
+        );
+        held.into_iter()
+            .map(|offer| PolledOffer {
+                ticket: offer.ticket,
+                transfer_name: offer.transfer_name,
+                sender_display_name: offer.sender_display_name,
+                file_count: offer.file_count,
+                total_bytes: offer.total_bytes,
+            })
+            .collect()
+    }
+
+    /// Validate a proof a peer presented, and push the idle deadline forward.
+    ///
+    /// The grant record is ours: we issued it, so we are the only party that
+    /// can decide it is still alive. A blocked endpoint is answered `Unknown`,
+    /// the same as one we never issued to.
+    pub(crate) async fn verify_and_renew(
+        &self,
+        proof: &GrantProof,
+        challenge: &Challenge,
+        issuer_endpoint_id: &str,
+        remote_endpoint_id: &str,
+    ) -> Result<(), GrantRejection> {
+        if self
+            .contacts
+            .is_blocked(remote_endpoint_id)
+            .await
+            .unwrap_or(false)
+        {
+            return Err(GrantRejection::Unknown);
+        }
+        let grant = self
+            .contacts
+            .find_issued_grant(proof.grant_id)
+            .await
+            .map_err(|_| GrantRejection::Unknown)?
+            .ok_or(GrantRejection::Unknown)?;
+
+        let now = now_ms();
+        let lifetime = self.grant_lifetime().await;
+        let renewed = grant.accept(
+            proof,
+            challenge,
+            issuer_endpoint_id,
+            remote_endpoint_id,
+            now,
+            lifetime,
+        )?;
+        // A failed renewal is not grounds to refuse a peer that just proved
+        // possession; the grant stays valid until its existing deadline.
+        if let Err(error) = self
+            .contacts
+            .renew_issued_grant(proof.grant_id, renewed)
+            .await
+        {
+            tracing::warn!(%error, "failed to renew grant deadline");
+        }
+        Ok(())
+    }
+
+    fn drop_expired(&self, pending: &mut HashMap<String, PendingGrant>, now_ms: i64) {
+        let window = CONSENT_WINDOW.as_millis() as i64;
+        pending.retain(|_, entry| now_ms - entry.received_at < window);
+    }
+
+    fn emit(&self, kind: &str, data: serde_json::Value) {
+        self.event_hub.emit_endpoint("contacts", kind, data);
+    }
+}

crates/vnidrop/src/repository.rs

@@ -16,11 +16,12 @@ use uuid::Uuid;
 use crate::{
     access_policy::mode_from_storage,
     api::{CoreEvent, ReceivedArtifact, ReceivedLocatorKind, ReceiverRequest, StoredTransfer},
+    contacts::ContactStore,
     transfer_state::{ReceiverRequestStatus, TransferDirection, TransferStatus},
     util::now_ms,
 };
 
-const SCHEMA_VERSION: i64 = 7;
+const SCHEMA_VERSION: i64 = 10;
 
 #[derive(Debug, Clone)]
 pub(crate) struct Repository {
@@ -315,12 +316,29 @@ impl Repository {
                 .await?;
         }
 
+        crate::contacts::ensure_schema(&self.pool).await?;
+        crate::secure_secret::ensure_schema(&self.pool).await?;
+
         sqlx::query(&format!("PRAGMA user_version = {SCHEMA_VERSION}"))
             .execute(&self.pool)
             .await?;
         Ok(())
     }
 
+    /// Device history, grants, and the block list. Shares this pool so the
+    /// tables migrate together with the rest of the schema.
+    pub(crate) fn contacts(&self) -> ContactStore {
+        ContactStore::new(self.pool.clone())
+    }
+
+    #[allow(
+        dead_code,
+        reason = "the private custody seam is activated by platform credential adapters"
+    )]
+    pub(crate) fn protected_secrets(&self) -> crate::secure_secret::SecretMetadataStore {
+        crate::secure_secret::SecretMetadataStore::new(self.pool.clone())
+    }
+
     #[cfg(test)]
     pub(crate) async fn schema_version(&self) -> Result<i64> {
         let row = sqlx::query("PRAGMA user_version")

crates/vnidrop/src/runtime/contacts.rs

@@ -0,0 +1,695 @@
+//! Runtime operations for device history: pairing, forgetting, and blocking.
+//!
+//! The protocol side lives in [`crate::offer`] and the decisions in
+//! [`crate::pairing`]; this is where those meet the endpoint and the UniFFI
+//! surface.
+
+use std::{sync::Arc, time::Duration};
+
+use anyhow::{Context, Result};
+use iroh::{EndpointAddr, EndpointId};
+use serde_json::json;
+
+use super::{CoreInner, POLL_MIN_INTERVAL_MS};
+use crate::{
+    api::{
+        ContactSendResult, ContactSummary, GrantLifetimeSetting, HeldOfferSummary, IncomingOffer,
+        PendingPairing, ShareMetadataInput, ShareResult, ShareSource, TransferAccessMode,
+    },
+    contacts::HeldOffer,
+    error::VnidropError,
+    grant::{GrantId, HeldGrant},
+    offer::{
+        DeliverGrant, GrantDeliveryResponse, OfferResponse, OfferService, RevokeGrant, SubmitOffer,
+    },
+    ticket::{encode_persisted_sender_address, parse_persisted_sender_address},
+    transfer_state::{TransferDirection, TransferStatus},
+    util::now_ms,
+};
+
+/// How long to wait for a device to answer before treating it as not running.
+///
+/// Without this an offline peer never fails, it just keeps being retried, and
+/// the offer is never handed to the hold-for-later path.
+const OFFER_CONNECT_TIMEOUT: Duration = Duration::from_secs(15);
+
+/// Whether a device may be polled again yet.
+///
+/// Split out because the surrounding call needs two live nodes to exercise,
+/// while the window itself is worth asserting on its own.
+pub(crate) fn should_poll(last_polled_ms: Option<i64>, now_ms: i64) -> bool {
+    last_polled_ms.is_none_or(|last| now_ms - last >= POLL_MIN_INTERVAL_MS)
+}
+
+impl CoreInner {
+    pub(super) async fn list_contacts(&self) -> Result<Vec<ContactSummary>> {
+        let contacts = self
+            .repository
+            .contacts()
+            .list_contacts()
+            .await
+            .map_err(VnidropError::repository)?;
+        let store = self.repository.contacts();
+        let mut summaries = Vec::with_capacity(contacts.len());
+        for contact in contacts {
+            // "Can I reach them" is exactly "do I hold a live grant", so the two
+            // never drift apart in the UI.
+            let can_send = store
+                .held_grant_for(&contact.endpoint_id)
+                .await
+                .map_err(VnidropError::repository)?
+                .is_some();
+            summaries.push(ContactSummary {
+                endpoint_id: contact.endpoint_id,
+                local_label: contact.local_label,
+                remote_display_name: contact.remote_display_name,
+                last_transfer_at: contact.last_transfer_at,
+                created_at: contact.created_at,
+                can_send,
+            });
+        }
+        Ok(summaries)
+    }
+
+    pub(super) async fn list_pending_pairings(&self) -> Vec<PendingPairing> {
+        self.pairing
+            .list_pending_grants()
+            .await
+            .into_iter()
+            .map(|pending| PendingPairing {
+                endpoint_id: pending.peer_endpoint_id,
+                display_name: pending.display_name,
+                received_at: pending.received_at,
+            })
+            .collect()
+    }
+
+    /// Agree to be remembered by a peer, and hand them the capability to reach
+    /// us.
+    ///
+    /// The grant is persisted before delivery: a grant that may already have
+    /// arrived must never be one we have forgotten issuing, or the peer would
+    /// hold a capability we cannot validate or revoke.
+    pub(super) async fn allow_device_to_reach_me(
+        self: &Arc<Self>,
+        endpoint_id: String,
+        display_name: Option<String>,
+    ) -> Result<()> {
+        self.limits
+            .validate_metadata_text("display name", display_name.as_deref())
+            .map_err(VnidropError::invalid_input)?;
+        if self
+            .repository
+            .contacts()
+            .is_blocked(&endpoint_id)
+            .await
+            .map_err(VnidropError::repository)?
+        {
+            return Err(VnidropError::invalid_input(anyhow::anyhow!(
+                "endpoint is blocked; unblock it before pairing"
+            ))
+            .into());
+        }
+
+        let grant = self
+            .pairing
+            .issue_grant(&endpoint_id)
+            .await
+            .map_err(VnidropError::repository)?;
+
+        let addr = self.contact_addr(&endpoint_id).await?;
+        let client = OfferService::client(self.endpoint.clone(), addr);
+        let response = client
+            .deliver_grant(DeliverGrant {
+                grant_id: grant.grant_id,
+                secret: grant.secret.encode(),
+                expires_at: grant.expires_at,
+                display_name,
+            })
+            .await
+            .context("failed to deliver grant")
+            .map_err(VnidropError::transfer)?;
+
+        match response {
+            GrantDeliveryResponse::AwaitingConsent | GrantDeliveryResponse::Stored => {
+                self.remember_addr(&endpoint_id).await;
+                self.emit_endpoint(
+                    "contacts",
+                    "grant-delivered",
+                    json!({ "peer_endpoint_id": endpoint_id }),
+                );
+                Ok(())
+            }
+            GrantDeliveryResponse::Rejected { reason } => {
+                // The peer would not take it, so the grant we just minted can
+                // never be used. Retire it rather than leaving a live
+                // capability nobody holds.
+                let _ = self
+                    .repository
+                    .contacts()
+                    .revoke_issued_grant(grant.grant_id, now_ms())
+                    .await;
+                Err(
+                    VnidropError::transfer(anyhow::anyhow!("peer refused the pairing: {reason}"))
+                        .into(),
+                )
+            }
+        }
+    }
+
+    /// Share content and push the ticket straight to a paired device.
+    ///
+    /// Two things make this one prompt rather than two: the share is created
+    /// with the ticket never leaving this device except over the authenticated
+    /// offer connection, and the target endpoint is pre-authorised so the
+    /// handshake it runs next does not ask us to approve a transfer we started.
+    pub(super) async fn send_to_contact(
+        self: &Arc<Self>,
+        endpoint_id: String,
+        sources: Vec<ShareSource>,
+        mut metadata: ShareMetadataInput,
+    ) -> Result<ContactSendResult> {
+        let store = self.repository.contacts();
+        let grant = store
+            .held_grant_for(&endpoint_id)
+            .await
+            .map_err(VnidropError::repository)?
+            .ok_or_else(|| {
+                VnidropError::permission(anyhow::anyhow!(
+                    "no live grant for this device; pair with it again"
+                ))
+            })?;
+
+        // Invariant: an offer-created share is never public. The recipient is a
+        // specific device, so serving it to anyone holding the ticket would
+        // widen access beyond what the user asked for.
+        metadata.access_mode = TransferAccessMode::ApprovalRequired;
+        let sender_name = metadata.sender_name.clone();
+        let share = self.share_files(sources, metadata).await?;
+        self.offer_share(endpoint_id, grant, share, sender_name.as_deref())
+            .await
+    }
+
+    /// Offer a share that already exists, so a transfer created for an
+    /// invitation can also be pushed to a remembered device.
+    ///
+    /// The ticket is the one already stored for the transfer: this adds another
+    /// way to deliver it, it does not create a second share of the same files.
+    pub(super) async fn offer_transfer_to_contact(
+        self: &Arc<Self>,
+        transfer_id: u64,
+        endpoint_id: String,
+    ) -> Result<ContactSendResult> {
+        let grant = self
+            .repository
+            .contacts()
+            .held_grant_for(&endpoint_id)
+            .await
+            .map_err(VnidropError::repository)?
+            .ok_or_else(|| {
+                VnidropError::permission(anyhow::anyhow!(
+                    "no live grant for this device; pair with it again"
+                ))
+            })?;
+
+        let stored = self
+            .repository
+            .list_transfers()
+            .await
+            .map_err(VnidropError::repository)?
+            .into_iter()
+            .find(|transfer| transfer.transfer_id == transfer_id)
+            .ok_or_else(|| {
+                VnidropError::invalid_input(anyhow::anyhow!("unknown transfer {transfer_id}"))
+            })?;
+
+        // Only a live share can be offered: a stopped one no longer serves its
+        // content, so handing out its ticket would promise nothing.
+        if stored.direction != TransferDirection::Send.as_str()
+            || stored.status != TransferStatus::Sharing.as_str()
+        {
+            return Err(VnidropError::invalid_input(anyhow::anyhow!(
+                "transfer {transfer_id} is not an active share"
+            ))
+            .into());
+        }
+        let ticket = stored.ticket.clone().ok_or_else(|| {
+            VnidropError::invalid_input(anyhow::anyhow!("transfer {transfer_id} has no invitation"))
+        })?;
+
+        let share = ShareResult {
+            transfer_id,
+            ticket,
+            hash: stored.content_hash.unwrap_or_default(),
+            transfer_name: stored.transfer_name.unwrap_or_default(),
+            file_count: stored.file_count,
+            total_size: stored.total_size,
+        };
+        self.offer_share(endpoint_id, grant, share, None).await
+    }
+
+    /// Deliver an offer for `share`, holding it when the device is not running.
+    async fn offer_share(
+        self: &Arc<Self>,
+        endpoint_id: String,
+        grant: HeldGrant,
+        share: ShareResult,
+        sender_name: Option<&str>,
+    ) -> Result<ContactSendResult> {
+        let store = self.repository.contacts();
+
+        // An unreachable device is the common case on mobile, not an error: the
+        // share stays here and the ticket waits for the peer to come and get it.
+        let outcome = match self
+            .deliver_offer(&endpoint_id, &grant, &share, sender_name)
+            .await
+        {
+            Ok(outcome) => outcome,
+            Err(error) => {
+                self.hold_offer(&endpoint_id, &share, sender_name).await?;
+                tracing::debug!(%error, "offer held for later pickup");
+                return Ok(ContactSendResult {
+                    share,
+                    delivered: false,
+                });
+            }
+        };
+
+        match outcome {
+            OfferResponse::Accepted => {
+                store
+                    .touch_transfer(&endpoint_id, now_ms())
+                    .await
+                    .map_err(VnidropError::repository)?;
+                self.remember_addr(&endpoint_id).await;
+                self.emit_transfer(
+                    share.transfer_id,
+                    "send",
+                    "offer",
+                    "offer-accepted",
+                    json!({ "peer_endpoint_id": endpoint_id }),
+                );
+                Ok(ContactSendResult {
+                    share,
+                    delivered: true,
+                })
+            }
+            OfferResponse::Declined { reason } | OfferResponse::Refused { reason } => {
+                let _ = self.cancel_idle_or_share(share.transfer_id).await;
+                self.emit_transfer(
+                    share.transfer_id,
+                    "send",
+                    "offer",
+                    "offer-refused",
+                    json!({ "peer_endpoint_id": endpoint_id, "reason": reason }),
+                );
+                // A refusal naming a dead grant is the peer telling us to stop
+                // believing we can reach them.
+                if matches!(reason.as_str(), "revoked" | "unknown" | "expired") {
+                    let _ = store.delete_held_grant(grant.grant_id).await;
+                }
+                Err(VnidropError::permission(anyhow::anyhow!(
+                    "device did not accept the transfer: {reason}"
+                ))
+                .into())
+            }
+        }
+    }
+
+    /// Keep an undeliverable offer on this device.
+    ///
+    /// The target is pre-authorised now rather than at pickup: it will dial
+    /// straight back after collecting the ticket, and the session outlives the
+    /// round trip.
+    async fn hold_offer(
+        self: &Arc<Self>,
+        endpoint_id: &str,
+        share: &ShareResult,
+        sender_name: Option<&str>,
+    ) -> Result<()> {
+        self.access_policy
+            .approve_endpoint(share.transfer_id, endpoint_id.to_string())
+            .await;
+        self.repository
+            .contacts()
+            .insert_held_offer(&HeldOffer {
+                offer_id: uuid::Uuid::new_v4().to_string(),
+                endpoint_id: endpoint_id.to_string(),
+                transfer_id: share.transfer_id,
+                ticket: share.ticket.clone(),
+                transfer_name: share.transfer_name.clone(),
+                sender_display_name: sender_name.map(ToOwned::to_owned),
+                file_count: share.file_count,
+                total_bytes: share.total_size,
+                created_at: now_ms(),
+            })
+            .await
+            .map_err(VnidropError::repository)?;
+        self.emit_transfer(
+            share.transfer_id,
+            "send",
+            "offer",
+            "offer-held",
+            json!({ "peer_endpoint_id": endpoint_id }),
+        );
+        Ok(())
+    }
+
+    /// Ask remembered devices whether they are holding anything for this one.
+    ///
+    /// Deliberately only ever called from a foreground transition or an explicit
+    /// user action: polling reveals to every contact that the app was opened,
+    /// which is why it is neither automatic nor backgrounded.
+    pub(super) async fn poll_contacts_for_offers(self: &Arc<Self>) -> Result<u64> {
+        let store = self.repository.contacts();
+        let contacts = store
+            .list_contacts()
+            .await
+            .map_err(VnidropError::repository)?;
+        let now = now_ms();
+        let mut collected = 0u64;
+
+        for contact in contacts {
+            if store
+                .is_blocked(&contact.endpoint_id)
+                .await
+                .unwrap_or(false)
+            {
+                continue;
+            }
+            {
+                // Rate limited per device so repeated app switching does not
+                // turn into a presence beacon.
+                let mut polled = self.last_polled.lock().await;
+                if !should_poll(polled.get(&contact.endpoint_id).copied(), now) {
+                    continue;
+                }
+                polled.insert(contact.endpoint_id.clone(), now);
+            }
+
+            let Ok(addr) = self.contact_addr(&contact.endpoint_id).await else {
+                continue;
+            };
+            let client = OfferService::client(self.endpoint.clone(), addr);
+            let Ok(polled) = client.poll_offers().await else {
+                // Offline is the expected outcome, not a failure worth surfacing.
+                continue;
+            };
+            for offer in polled.offers {
+                let added = self
+                    .offers
+                    .enqueue(
+                        contact.endpoint_id.clone(),
+                        offer.transfer_name,
+                        offer.sender_display_name,
+                        offer.file_count,
+                        offer.total_bytes,
+                        offer.ticket,
+                    )
+                    .await;
+                if added {
+                    collected += 1;
+                }
+            }
+            self.remember_addr(&contact.endpoint_id).await;
+        }
+        Ok(collected)
+    }
+
+    async fn deliver_offer(
+        self: &Arc<Self>,
+        endpoint_id: &str,
+        grant: &HeldGrant,
+        share: &ShareResult,
+        sender_name: Option<&str>,
+    ) -> Result<OfferResponse> {
+        let addr = self.contact_addr(endpoint_id).await?;
+        let client = OfferService::client(self.endpoint.clone(), addr);
+        let challenge = tokio::time::timeout(OFFER_CONNECT_TIMEOUT, client.request_challenge())
+            .await
+            .map_err(|_| VnidropError::transfer(anyhow::anyhow!("device did not answer in time")))?
+            .context("device is not reachable")
+            .map_err(VnidropError::transfer)?;
+
+        // Authorise before offering: the receiver may dial back the instant it
+        // accepts, and an unauthorised endpoint would be refused by the
+        // provider.
+        self.access_policy
+            .approve_endpoint(share.transfer_id, endpoint_id.to_string())
+            .await;
+
+        client
+            .submit_offer(SubmitOffer {
+                proof: grant.prove(&challenge, &self.endpoint.id().to_string()),
+                ticket: share.ticket.clone(),
+                transfer_name: share.transfer_name.clone(),
+                sender_display_name: sender_name.map(ToOwned::to_owned),
+                file_count: share.file_count,
+                total_bytes: share.total_size,
+            })
+            .await
+            .context("failed to deliver the offer")
+            .map_err(VnidropError::transfer)
+            .map_err(Into::into)
+    }
+
+    /// Transfers waiting for their target to come back online.
+    pub(super) async fn list_held_offers(&self) -> Result<Vec<HeldOfferSummary>> {
+        let held = self
+            .repository
+            .contacts()
+            .list_held_offers()
+            .await
+            .map_err(VnidropError::repository)?;
+        Ok(held
+            .into_iter()
+            .map(|offer| HeldOfferSummary {
+                offer_id: offer.offer_id,
+                endpoint_id: offer.endpoint_id,
+                transfer_id: offer.transfer_id,
+                transfer_name: offer.transfer_name,
+                file_count: offer.file_count,
+                total_bytes: offer.total_bytes,
+                created_at: offer.created_at,
+            })
+            .collect())
+    }
+
+    pub(super) async fn list_pending_offers(&self) -> Vec<IncomingOffer> {
+        self.offers
+            .list()
+            .await
+            .into_iter()
+            .map(|offer| IncomingOffer {
+                offer_id: offer.offer_id,
+                from_endpoint_id: offer.from_endpoint_id,
+                sender_display_name: offer.sender_display_name,
+                transfer_name: offer.transfer_name,
+                file_count: offer.file_count,
+                total_bytes: offer.total_bytes,
+                received_at: offer.received_at,
+            })
+            .collect()
+    }
+
+    /// Answer an incoming offer. Returns the ticket when accepted, so the
+    /// platform layer can run the ordinary receive with its own destination.
+    pub(super) async fn respond_to_offer(
+        &self,
+        offer_id: String,
+        accepted: bool,
+    ) -> Option<String> {
+        self.offers.respond(&offer_id, accepted).await
+    }
+
+    pub(super) async fn respond_to_pairing(
+        &self,
+        endpoint_id: String,
+        accepted: bool,
+    ) -> Result<bool> {
+        if accepted {
+            self.pairing
+                .accept_pending_grant(&endpoint_id)
+                .await
+                .map_err(VnidropError::repository)
+                .map_err(Into::into)
+        } else {
+            Ok(self.pairing.decline_pending_grant(&endpoint_id).await)
+        }
+    }
+
+    /// Stop a peer from reaching us and drop the relationship locally.
+    ///
+    /// Revocation completes locally first: the notification is best effort and
+    /// the peer losing access must not depend on being online to hear about it.
+    pub(super) async fn forget_contact(self: &Arc<Self>, endpoint_id: String) -> Result<()> {
+        let store = self.repository.contacts();
+        let revoked = store
+            .delete_contact(&endpoint_id)
+            .await
+            .map_err(VnidropError::repository)?;
+        // A prompt on screen from a device we just forgot would be actionable
+        // with a grant that no longer exists.
+        self.offers.discard_from(&endpoint_id).await;
+        self.emit_endpoint(
+            "contacts",
+            "contact-forgotten",
+            json!({ "peer_endpoint_id": endpoint_id, "revoked": revoked.len() }),
+        );
+        self.notify_revoked(endpoint_id, revoked).await;
+        Ok(())
+    }
+
+    /// Forget every device at once, alongside the existing history-clearing
+    /// actions. Every peer loses access; each is notified best effort.
+    pub(super) async fn forget_all_contacts(self: &Arc<Self>) -> Result<u64> {
+        let store = self.repository.contacts();
+        let contacts = store
+            .list_contacts()
+            .await
+            .map_err(VnidropError::repository)?;
+        let revoked = store
+            .delete_all_contacts()
+            .await
+            .map_err(VnidropError::repository)?;
+        for contact in &contacts {
+            self.offers.discard_from(&contact.endpoint_id).await;
+        }
+        self.emit_endpoint(
+            "contacts",
+            "contacts-cleared",
+            json!({ "contacts": contacts.len(), "revoked": revoked.len() }),
+        );
+        for contact in contacts.iter() {
+            self.notify_revoked(contact.endpoint_id.clone(), revoked.clone())
+                .await;
+        }
+        Ok(revoked.len() as u64)
+    }
+
+    pub(super) async fn block_contact(self: &Arc<Self>, endpoint_id: String) -> Result<()> {
+        let store = self.repository.contacts();
+        let revoked = store
+            .revoke_issued_grants_for(&endpoint_id, now_ms())
+            .await
+            .map_err(VnidropError::repository)?;
+        store
+            .block_endpoint(&endpoint_id, now_ms())
+            .await
+            .map_err(VnidropError::repository)?;
+        store
+            .delete_contact(&endpoint_id)
+            .await
+            .map_err(VnidropError::repository)?;
+        self.offers.discard_from(&endpoint_id).await;
+        self.emit_endpoint(
+            "contacts",
+            "contact-blocked",
+            json!({ "peer_endpoint_id": endpoint_id }),
+        );
+        // A blocked peer is told nothing: silence here is what makes blocking
+        // undetectable, unlike ordinary revocation.
+        let _ = revoked;
+        Ok(())
+    }
+
+    pub(super) async fn unblock_contact(&self, endpoint_id: String) -> Result<()> {
+        self.repository
+            .contacts()
+            .unblock_endpoint(&endpoint_id)
+            .await
+            .map_err(VnidropError::repository)?;
+        Ok(())
+    }
+
+    pub(super) async fn list_blocked_contacts(&self) -> Result<Vec<String>> {
+        self.repository
+            .contacts()
+            .list_blocked()
+            .await
+            .map_err(VnidropError::repository)
+            .map_err(Into::into)
+    }
+
+    pub(super) async fn set_contact_label(
+        &self,
+        endpoint_id: String,
+        label: Option<String>,
+    ) -> Result<()> {
+        self.limits
+            .validate_metadata_text("contact label", label.as_deref())
+            .map_err(VnidropError::invalid_input)?;
+        self.repository
+            .contacts()
+            .set_contact_label(&endpoint_id, label.as_deref())
+            .await
+            .map_err(VnidropError::repository)?;
+        Ok(())
+    }
+
+    pub(super) async fn set_grant_lifetime(&self, setting: GrantLifetimeSetting) {
+        self.pairing.set_grant_lifetime(setting.into()).await;
+    }
+
+    /// Best-effort "your entry is dead" notification, so the peer's list clears
+    /// promptly instead of at its next attempt.
+    async fn notify_revoked(self: &Arc<Self>, endpoint_id: String, revoked: Vec<GrantId>) {
+        if revoked.is_empty() {
+            return;
+        }
+        let Ok(addr) = self.contact_addr(&endpoint_id).await else {
+            return;
+        };
+        let client = OfferService::client(self.endpoint.clone(), addr);
+        for grant_id in revoked {
+            if let Err(error) = client.revoke_grant(RevokeGrant { grant_id }).await {
+                tracing::debug!(%error, "revocation notice undeliverable; peer will learn on next attempt");
+                return;
+            }
+        }
+    }
+
+    /// Where to dial a contact.
+    ///
+    /// Prefers the address cached from the last successful connection, which is
+    /// what keeps contacts usable in relay profiles that do not resolve
+    /// endpoint ids through public discovery.
+    async fn contact_addr(&self, endpoint_id: &str) -> Result<EndpointAddr> {
+        let cached = self
+            .repository
+            .contacts()
+            .find_contact(endpoint_id)
+            .await
+            .ok()
+            .flatten()
+            .and_then(|contact| contact.last_known_addr)
+            .and_then(|encoded| parse_persisted_sender_address(&encoded).ok());
+        if let Some(addr) = cached {
+            return Ok(addr);
+        }
+        let parsed: EndpointId = endpoint_id
+            .parse()
+            .context("contact has an unusable endpoint id")
+            .map_err(VnidropError::invalid_input)?;
+        Ok(EndpointAddr::from(parsed))
+    }
+
+    /// Refresh the cached address after a successful exchange.
+    async fn remember_addr(&self, endpoint_id: &str) {
+        let Ok(parsed) = endpoint_id.parse::<EndpointId>() else {
+            return;
+        };
+        let Some(info) = self.endpoint.remote_info(parsed).await else {
+            return;
+        };
+        let mut addr = EndpointAddr::from(parsed);
+        addr.addrs = info.addrs().map(|entry| entry.addr().clone()).collect();
+        if let Ok(encoded) = encode_persisted_sender_address(&addr) {
+            let _ = self
+                .repository
+                .contacts()
+                .set_last_known_addr(endpoint_id, &encoded)
+                .await;
+        }
+    }
+}

crates/vnidrop/src/runtime/facade.rs

@@ -3,16 +3,18 @@ use std::{future::Future, path::PathBuf, sync::Arc};
 use anyhow::Context;
 use serde_json::json;
 
-use super::CoreInner;
+use super::{CoreInner, IdentityMode};
 use crate::{
     api::{
-        CoreEvent, CoreEventSink, CoreLimits, CoreNetworkConfig, CoreStorageUsage,
+        ContactSendResult, ContactSummary, CoreEvent, CoreEventSink, CoreLimits, CoreNetworkConfig,
+        CoreStorageUsage, GrantLifetimeSetting, HeldOfferSummary, IncomingOffer, PendingPairing,
         ReceiveOutputSink, ReceiveOutputSinkV2, ReceivedArtifact, ReceiverRequest, RuntimeStatus,
         ShareMetadataInput, ShareResult, ShareSource, StoredTransfer, TicketInspection,
         TransferAccessMode,
     },
     error::VnidropError,
     filesystem::platform_path,
+    secure_secret::{lock_profile, platform_secret_store},
     ticket::parse_transfer_ticket_with_limits,
     transfer_state::{TransferDirection, TransferStatus},
 };
@@ -34,6 +36,34 @@ impl VnidropCore {
     fn block_on<F: Future>(&self, future: F) -> F::Output {
         self.runtime.handle().block_on(future)
     }
+
+    fn initialize_with_identity_mode(
+        app_data_dir: String,
+        event_sink: Arc<dyn CoreEventSink>,
+        limits: CoreLimits,
+        network_config: CoreNetworkConfig,
+        identity_mode: IdentityMode,
+    ) -> Result<Arc<Self>, VnidropError> {
+        limits.validate().map_err(VnidropError::initialization)?;
+        let relay_urls = network_config
+            .validated_relay_urls()
+            .map_err(VnidropError::initialization)?;
+        let runtime = tokio::runtime::Builder::new_multi_thread()
+            .enable_all()
+            .thread_name("vnidrop")
+            .build()?;
+        let inner = runtime
+            .block_on(CoreInner::start(
+                PathBuf::from(app_data_dir),
+                event_sink,
+                limits,
+                network_config.mode,
+                relay_urls,
+                identity_mode,
+            ))
+            .map_err(VnidropError::initialization)?;
+        Ok(Arc::new(Self { runtime, inner }))
+    }
 }
 
 #[uniffi::export]
@@ -86,25 +116,39 @@ impl VnidropCore {
         limits: CoreLimits,
         network_config: CoreNetworkConfig,
     ) -> Result<Arc<Self>, VnidropError> {
-        limits.validate().map_err(VnidropError::initialization)?;
-        let relay_urls = network_config
-            .validated_relay_urls()
-            .map_err(VnidropError::initialization)?;
-        let runtime = tokio::runtime::Builder::new_multi_thread()
-            .enable_all()
-            .thread_name("vnidrop")
-            .build()?;
-        let app_data_dir = PathBuf::from(app_data_dir);
-        let inner = runtime
-            .block_on(CoreInner::start(
-                app_data_dir,
-                event_sink,
-                limits,
-                network_config.mode,
-                relay_urls,
-            ))
-            .map_err(VnidropError::initialization)?;
-        Ok(Arc::new(Self { runtime, inner }))
+        Self::initialize_with_identity_mode(
+            app_data_dir,
+            event_sink,
+            limits,
+            network_config,
+            IdentityMode::Legacy,
+        )
+    }
+
+    /// Starts the experimental saved-device core with a platform-protected identity.
+    #[uniffi::constructor]
+    pub fn initialize_with_experimental_saved_devices(
+        app_data_dir: String,
+        event_sink: Arc<dyn CoreEventSink>,
+        limits: CoreLimits,
+        network_config: CoreNetworkConfig,
+    ) -> Result<Arc<Self>, VnidropError> {
+        let app_data_path = PathBuf::from(app_data_dir);
+        std::fs::create_dir_all(&app_data_path).map_err(VnidropError::filesystem)?;
+        let app_data_path =
+            std::fs::canonicalize(app_data_path).map_err(VnidropError::filesystem)?;
+        let profile_lock = lock_profile(&app_data_path)?;
+        let store = platform_secret_store(&app_data_path)?;
+        Self::initialize_with_identity_mode(
+            app_data_path.to_string_lossy().into_owned(),
+            event_sink,
+            limits,
+            network_config,
+            IdentityMode::Protected {
+                store,
+                profile_lock,
+            },
+        )
     }
 
     pub fn status(&self) -> RuntimeStatus {
@@ -271,6 +315,148 @@ impl VnidropCore {
             .map_err(VnidropError::permission)
     }
 
+    /// Devices the user has chosen to remember.
+    pub fn list_contacts(&self) -> Result<Vec<ContactSummary>, VnidropError> {
+        self.block_on(self.inner.list_contacts())
+            .map_err(VnidropError::repository)
+    }
+
+    /// Share content and push it straight to a paired device.
+    ///
+    /// Only the receiving user is prompted: this device authorised the target
+    /// when it created the offer.
+    pub fn send_to_contact(
+        &self,
+        endpoint_id: String,
+        sources: Vec<ShareSource>,
+        metadata: ShareMetadataInput,
+    ) -> Result<ContactSendResult, VnidropError> {
+        self.block_on(self.inner.send_to_contact(endpoint_id, sources, metadata))
+            .map_err(VnidropError::transfer)
+    }
+
+    /// Ask remembered devices whether they are holding transfers for this one.
+    ///
+    /// Call only from a foreground transition or an explicit user action: it
+    /// tells every contact that this device is awake. Returns how many offers
+    /// were collected.
+    pub fn poll_contacts_for_offers(&self) -> Result<u64, VnidropError> {
+        self.block_on(self.inner.poll_contacts_for_offers())
+            .map_err(VnidropError::transfer)
+    }
+
+    /// Offer an existing share to a remembered device.
+    ///
+    /// Another way to deliver the invitation already created for a transfer,
+    /// alongside the QR code — not a second share of the same files.
+    pub fn offer_transfer_to_contact(
+        &self,
+        transfer_id: u64,
+        endpoint_id: String,
+    ) -> Result<ContactSendResult, VnidropError> {
+        self.block_on(
+            self.inner
+                .offer_transfer_to_contact(transfer_id, endpoint_id),
+        )
+        .map_err(VnidropError::transfer)
+    }
+
+    /// Transfers this device is holding for contacts that were not running.
+    pub fn list_held_offers(&self) -> Result<Vec<HeldOfferSummary>, VnidropError> {
+        self.block_on(self.inner.list_held_offers())
+            .map_err(VnidropError::repository)
+    }
+
+    /// Transfers paired devices are offering, awaiting this user's decision.
+    pub fn list_pending_offers(&self) -> Vec<IncomingOffer> {
+        self.block_on(self.inner.list_pending_offers())
+    }
+
+    /// Accept or decline an incoming offer.
+    ///
+    /// Returns the ticket when accepted, which the caller passes to `receive`
+    /// with its own destination. Declining returns none: a refused offer never
+    /// yields a capability.
+    pub fn respond_to_offer(&self, offer_id: String, accepted: bool) -> Option<String> {
+        self.block_on(self.inner.respond_to_offer(offer_id, accepted))
+    }
+
+    /// Devices offering to be remembered, awaiting the local user's decision.
+    pub fn list_pending_pairings(&self) -> Vec<PendingPairing> {
+        self.block_on(self.inner.list_pending_pairings())
+    }
+
+    /// Agree to be reachable by a device, handing it a revocable capability.
+    ///
+    /// Independent of whether that device agrees to be reachable by us: each
+    /// direction is a separate decision.
+    pub fn allow_device_to_reach_me(
+        &self,
+        endpoint_id: String,
+        display_name: Option<String>,
+    ) -> Result<(), VnidropError> {
+        self.block_on(
+            self.inner
+                .allow_device_to_reach_me(endpoint_id, display_name),
+        )
+        .map_err(VnidropError::transfer)
+    }
+
+    /// Accept or decline a device's offer to be remembered. Returns false when
+    /// the offer already lapsed.
+    pub fn respond_to_pairing(
+        &self,
+        endpoint_id: String,
+        accepted: bool,
+    ) -> Result<bool, VnidropError> {
+        self.block_on(self.inner.respond_to_pairing(endpoint_id, accepted))
+            .map_err(VnidropError::repository)
+    }
+
+    /// Forget a device and revoke its access. Takes effect locally at once; the
+    /// peer is notified best effort.
+    pub fn forget_contact(&self, endpoint_id: String) -> Result<(), VnidropError> {
+        self.block_on(self.inner.forget_contact(endpoint_id))
+            .map_err(VnidropError::repository)
+    }
+
+    /// Forget every device at once. Returns how many grants were revoked.
+    pub fn forget_all_contacts(&self) -> Result<u64, VnidropError> {
+        self.block_on(self.inner.forget_all_contacts())
+            .map_err(VnidropError::repository)
+    }
+
+    /// Refuse a device outright. Unlike forgetting, the peer is told nothing.
+    pub fn block_contact(&self, endpoint_id: String) -> Result<(), VnidropError> {
+        self.block_on(self.inner.block_contact(endpoint_id))
+            .map_err(VnidropError::repository)
+    }
+
+    pub fn unblock_contact(&self, endpoint_id: String) -> Result<(), VnidropError> {
+        self.block_on(self.inner.unblock_contact(endpoint_id))
+            .map_err(VnidropError::repository)
+    }
+
+    pub fn list_blocked_contacts(&self) -> Result<Vec<String>, VnidropError> {
+        self.block_on(self.inner.list_blocked_contacts())
+            .map_err(VnidropError::repository)
+    }
+
+    pub fn set_contact_label(
+        &self,
+        endpoint_id: String,
+        label: Option<String>,
+    ) -> Result<(), VnidropError> {
+        self.block_on(self.inner.set_contact_label(endpoint_id, label))
+            .map_err(VnidropError::repository)
+    }
+
+    /// Idle lifetime applied to grants issued from now on. Existing grants keep
+    /// the lifetime they were issued with until they next renew.
+    pub fn set_grant_lifetime(&self, lifetime: GrantLifetimeSetting) {
+        self.block_on(self.inner.set_grant_lifetime(lifetime));
+    }
+
     pub fn list_transfers(&self) -> Result<Vec<StoredTransfer>, VnidropError> {
         self.block_on(self.inner.repository.list_transfers())
             .map_err(VnidropError::repository)

crates/vnidrop/src/runtime/lifecycle.rs

@@ -54,6 +54,13 @@ impl CoreInner {
             drop(active_shares);
             self.unregister_transfer_hashes(transfer_id).await;
             self.access_policy.remove_transfer(transfer_id).await;
+            // An offer waiting for pickup would hand out a ticket for content
+            // this device no longer serves.
+            let _ = self
+                .repository
+                .contacts()
+                .delete_held_offers_for_transfer(transfer_id)
+                .await;
             self.store.tags().delete(share_tag_name(&local_id)).await?;
             self.emit_transfer(transfer_id, "send", "lifecycle", "share-stopped", json!({}));
             return Ok(());
@@ -179,7 +186,7 @@ impl CoreInner {
         Ok(())
     }
 
-    pub(super) async fn shutdown(&self) {
+    pub(crate) async fn shutdown(&self) {
         if self.shutdown_started.swap(true, Ordering::SeqCst) {
             return;
         }

crates/vnidrop/src/runtime/mod.rs

@@ -6,7 +6,9 @@
 //! - [`receive`] — ticket receive, download, export
 //! - [`lifecycle`] — cancel/delete/shutdown/status/access
 //! - [`provider`] — blob provider events and per-connection send progress
+//! - [`contacts`] — device history: pairing, forgetting, blocking
 
+mod contacts;
 mod delivery;
 mod facade;
 mod lifecycle;
@@ -15,6 +17,8 @@ mod receive;
 mod share;
 mod storage;
 
+#[cfg(test)]
+pub(crate) use self::contacts::should_poll;
 pub use facade::VnidropCore;
 #[cfg(test)]
 pub(crate) use provider::{consume_request_updates, RequestStreamOutcome};
@@ -55,14 +59,22 @@ use crate::{
     event_hub::EventHub,
     handshake::HandshakeService,
     logging::init_logging,
+    offer::OfferService,
+    offer_inbox::OfferInbox,
+    pairing::PairingService,
     repository::Repository,
     secret::load_or_create_secret,
+    secure_secret::{start_endpoint_identity, ProfileLock, SecretCustody, SecureSecretStore},
     ticket::ticket_matches_relay_profile,
     transfer_state::{TransferDirection, TransferStatus},
 };
 
 const RELAY_CONNECT_TIMEOUT: Duration = Duration::from_secs(10);
 
+/// Minimum gap between polls of the same device, so switching in and out of the
+/// app does not announce presence to every contact repeatedly.
+pub(super) const POLL_MIN_INTERVAL_MS: i64 = 5 * 60 * 1_000;
+
 #[derive(Debug, Clone, Copy, PartialEq, Eq)]
 pub(crate) enum RelayStatus {
     Disabled,
@@ -88,8 +100,14 @@ pub(super) struct CoreInner {
     pub(super) router: Router,
     pub(super) store: FsStore,
     pub(super) repository: Repository,
+    _secret_custody: Option<SecretCustody>,
+    _profile_lock: Option<ProfileLock>,
     pub(super) event_hub: Arc<EventHub>,
     pub(super) approval: ApprovalService,
+    pub(super) pairing: PairingService,
+    pub(super) offers: OfferInbox,
+    /// Endpoint → last poll time, for the rate limit above.
+    pub(super) last_polled: TokioMutex<HashMap<String, i64>>,
     pub(super) limits: CoreLimits,
     pub(super) relay_mode: CoreRelayMode,
     pub(super) custom_relay_urls: Vec<RelayUrl>,
@@ -115,6 +133,14 @@ pub(super) struct ActiveTransfer {
     pub(super) cancel: oneshot::Sender<()>,
 }
 
+pub(super) enum IdentityMode {
+    Legacy,
+    Protected {
+        store: Arc<dyn SecureSecretStore>,
+        profile_lock: ProfileLock,
+    },
+}
+
 impl CoreInner {
     pub(super) async fn start(
         app_data_dir: PathBuf,
@@ -122,11 +148,26 @@ impl CoreInner {
         limits: CoreLimits,
         relay_mode: CoreRelayMode,
         relay_urls: Vec<RelayUrl>,
+        identity_mode: IdentityMode,
     ) -> Result<Arc<Self>> {
         tokio::fs::create_dir_all(&app_data_dir).await?;
         init_logging(&app_data_dir)?;
-        let secret_key = load_or_create_secret(&app_data_dir).await?;
         let repository = Repository::open(&app_data_dir).await?;
+        let (secret_key, secret_custody, profile_lock) = match identity_mode {
+            IdentityMode::Legacy => (load_or_create_secret(&app_data_dir).await?, None, None),
+            IdentityMode::Protected {
+                store,
+                profile_lock,
+            } => {
+                let (secret_key, custody) = start_endpoint_identity(
+                    repository.protected_secrets(),
+                    store,
+                    &app_data_dir.join("iroh.secret"),
+                )
+                .await?;
+                (secret_key, Some(custody), Some(profile_lock))
+            }
+        };
         let store_root = app_data_dir.join("blobs");
         let mut store_options = FsStoreOptions::new(&store_root);
         store_options.gc = Some(GcConfig {
@@ -321,9 +362,28 @@ impl CoreInner {
             limits.max_metadata_bytes,
         );
         let handshake = HandshakeService::new(approval.clone());
+        let pairing = PairingService::new(
+            repository.contacts(),
+            event_hub.clone(),
+            limits.max_pending_offers as usize,
+            limits.max_metadata_bytes,
+        );
+        // Sweep grants dead long enough that no peer still needs the tombstone.
+        if let Err(error) = repository
+            .contacts()
+            .purge_dead_grants(crate::util::now_ms() - crate::contacts::DEAD_GRANT_RETENTION_MS)
+            .await
+        {
+            tracing::warn!(%error, "failed to sweep dead grants");
+        }
+        let offers = OfferInbox::new(event_hub.clone(), limits.max_pending_offers as usize);
         let router = Router::builder(endpoint.clone())
             .accept(iroh_blobs::ALPN, blobs)
             .accept(HandshakeService::ALPN, handshake)
+            .accept(
+                OfferService::ALPN,
+                OfferService::new(pairing.clone(), offers.clone(), endpoint.id().to_string()),
+            )
             .spawn();
 
         let inner = Arc::new(Self {
@@ -332,8 +392,13 @@ impl CoreInner {
             router,
             store,
             repository,
+            _secret_custody: secret_custody,
+            _profile_lock: profile_lock,
             event_hub,
             approval,
+            pairing,
+            offers,
+            last_polled: TokioMutex::new(HashMap::new()),
             relay_mode,
             custom_relay_urls: relay_urls,
             transfer_slots: Semaphore::new(limits.max_concurrent_transfers as usize),

crates/vnidrop/src/secure_secret.rs

@@ -0,0 +1,750 @@
+use std::{collections::HashSet, fmt, io, path::Path, sync::Arc, time::Duration};
+
+#[cfg(test)]
+use std::{collections::HashMap, sync::Mutex};
+
+use data_encoding::HEXLOWER;
+use iroh::SecretKey;
+use sqlx::{Row, SqlitePool};
+use uuid::Uuid;
+
+use crate::{error::VnidropError, util::now_ms};
+
+#[cfg(any(test, target_os = "android"))]
+pub(crate) mod android;
+#[cfg(any(target_os = "macos", target_os = "ios"))]
+pub(crate) mod apple;
+#[cfg(any(test, target_os = "linux"))]
+pub(crate) mod linux;
+mod platform;
+#[cfg(target_os = "windows")]
+pub(crate) mod windows;
+
+#[cfg(test)]
+pub(crate) use platform::scope_store;
+pub(crate) use platform::{lock_profile, platform_secret_store, ProfileLock};
+
+const SECRET_BYTES: usize = 32;
+const HANDLE_NAMESPACE: &str = "vnidrop";
+const HANDLE_VERSION: &str = "v1";
+
+#[derive(Clone, PartialEq, Eq)]
+pub(crate) struct SecretMaterial(Vec<u8>);
+
+impl SecretMaterial {
+    pub(crate) fn new(bytes: Vec<u8>) -> Result<Self, VnidropError> {
+        if bytes.len() != SECRET_BYTES || bytes.iter().all(|byte| *byte == 0) {
+            return Err(VnidropError::SecureStorageCorrupted {
+                reason: "protected secret has invalid key material".to_string(),
+            });
+        }
+        Ok(Self(bytes))
+    }
+
+    fn endpoint_id(&self) -> String {
+        let bytes: [u8; SECRET_BYTES] = self.0.as_slice().try_into().expect("validated length");
+        SecretKey::from_bytes(&bytes).public().to_string()
+    }
+
+    fn into_secret_key(self) -> SecretKey {
+        let bytes: [u8; SECRET_BYTES] = self.0.try_into().expect("validated length");
+        SecretKey::from_bytes(&bytes)
+    }
+}
+
+impl fmt::Debug for SecretMaterial {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        formatter.write_str("SecretMaterial(redacted)")
+    }
+}
+
+#[derive(Clone, PartialEq, Eq, Hash)]
+pub(crate) struct SecretHandle(String);
+
+impl SecretHandle {
+    fn generate(kind: SecretKind) -> Self {
+        Self(format!(
+            "{HANDLE_NAMESPACE}/{HANDLE_VERSION}/{}/{}",
+            kind.as_str(),
+            Uuid::new_v4()
+        ))
+    }
+
+    pub(crate) fn as_str(&self) -> &str {
+        &self.0
+    }
+}
+
+impl fmt::Debug for SecretHandle {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        formatter
+            .debug_tuple("SecretHandle")
+            .field(&self.0)
+            .finish()
+    }
+}
+
+#[cfg(test)]
+pub(crate) fn secret_handle_for_test(value: String) -> SecretHandle {
+    SecretHandle(value)
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub(crate) enum SecretKind {
+    EndpointIdentity,
+    RelationshipGrant,
+    PairingEligibility,
+}
+
+impl SecretKind {
+    fn as_str(self) -> &'static str {
+        match self {
+            Self::EndpointIdentity => "endpoint-identity",
+            Self::RelationshipGrant => "relationship-grant",
+            Self::PairingEligibility => "pairing-eligibility",
+        }
+    }
+
+    fn parse(value: &str) -> Result<Self, VnidropError> {
+        match value {
+            "endpoint-identity" => Ok(Self::EndpointIdentity),
+            "relationship-grant" => Ok(Self::RelationshipGrant),
+            "pairing-eligibility" => Ok(Self::PairingEligibility),
+            _ => Err(VnidropError::SecureStorageCorrupted {
+                reason: "protected secret has an unknown kind".to_string(),
+            }),
+        }
+    }
+}
+
+#[derive(Debug, thiserror::Error)]
+pub(crate) enum SecureSecretStoreError {
+    #[error("credential store is locked")]
+    Locked,
+    #[error("credential is missing")]
+    Missing,
+    #[error("credential is corrupted")]
+    Corrupted,
+    #[error("credential store is unavailable")]
+    Unavailable,
+}
+
+/// Opaque credential-store boundary implemented by each supported platform.
+///
+/// Implementations must persist material outside ordinary application storage and
+/// must never include material in errors or diagnostics.
+pub(crate) trait SecureSecretStore: Send + Sync {
+    fn put(
+        &self,
+        handle: &SecretHandle,
+        material: SecretMaterial,
+    ) -> Result<(), SecureSecretStoreError>;
+    fn get(&self, handle: &SecretHandle) -> Result<SecretMaterial, SecureSecretStoreError>;
+    fn delete(&self, handle: &SecretHandle) -> Result<(), SecureSecretStoreError>;
+    fn list_handles(&self) -> Result<Vec<SecretHandle>, SecureSecretStoreError>;
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+enum SecretMetadataState {
+    Staged,
+    Active,
+    Disabled,
+}
+
+impl SecretMetadataState {
+    fn as_str(self) -> &'static str {
+        match self {
+            Self::Staged => "staged",
+            Self::Active => "active",
+            Self::Disabled => "disabled",
+        }
+    }
+
+    fn parse(value: &str) -> Result<Self, VnidropError> {
+        match value {
+            "staged" => Ok(Self::Staged),
+            "active" => Ok(Self::Active),
+            "disabled" => Ok(Self::Disabled),
+            _ => Err(VnidropError::SecureStorageCorrupted {
+                reason: "protected secret has an unknown metadata state".to_string(),
+            }),
+        }
+    }
+}
+
+#[derive(Debug, Clone, PartialEq, Eq)]
+struct SecretMetadata {
+    handle: SecretHandle,
+    kind: SecretKind,
+    state: SecretMetadataState,
+    expected_identity: Option<String>,
+}
+
+pub(crate) async fn ensure_schema(pool: &SqlitePool) -> anyhow::Result<()> {
+    sqlx::query(
+        r#"
+        CREATE TABLE IF NOT EXISTS protected_secret_refs (
+            handle TEXT PRIMARY KEY,
+            kind TEXT NOT NULL,
+            state TEXT NOT NULL,
+            expected_identity TEXT,
+            created_at INTEGER NOT NULL,
+            updated_at INTEGER NOT NULL
+        );
+        "#,
+    )
+    .execute(pool)
+    .await?;
+    sqlx::query(
+        r#"
+        CREATE UNIQUE INDEX IF NOT EXISTS protected_secret_one_endpoint_identity
+            ON protected_secret_refs(kind)
+            WHERE kind = 'endpoint-identity' AND state != 'disabled'
+        "#,
+    )
+    .execute(pool)
+    .await?;
+    Ok(())
+}
+
+#[derive(Debug, Clone)]
+pub(crate) struct SecretMetadataStore {
+    pool: SqlitePool,
+}
+
+impl SecretMetadataStore {
+    pub(crate) fn new(pool: SqlitePool) -> Self {
+        Self { pool }
+    }
+
+    async fn stage(
+        &self,
+        handle: &SecretHandle,
+        kind: SecretKind,
+        expected_identity: Option<&str>,
+    ) -> Result<(), VnidropError> {
+        let now = now_ms();
+        sqlx::query(
+            r#"
+            INSERT INTO protected_secret_refs
+                (handle, kind, state, expected_identity, created_at, updated_at)
+            VALUES (?1, ?2, 'staged', ?3, ?4, ?4)
+            "#,
+        )
+        .bind(handle.as_str())
+        .bind(kind.as_str())
+        .bind(expected_identity)
+        .bind(now)
+        .execute(&self.pool)
+        .await
+        .map_err(VnidropError::repository)?;
+        Ok(())
+    }
+
+    async fn activate(&self, handle: &SecretHandle) -> Result<(), VnidropError> {
+        self.set_state(handle, SecretMetadataState::Active).await
+    }
+
+    async fn disable(&self, handle: &SecretHandle) -> Result<(), VnidropError> {
+        self.set_state(handle, SecretMetadataState::Disabled).await
+    }
+
+    async fn set_state(
+        &self,
+        handle: &SecretHandle,
+        state: SecretMetadataState,
+    ) -> Result<(), VnidropError> {
+        sqlx::query(
+            "UPDATE protected_secret_refs SET state = ?2, updated_at = ?3 WHERE handle = ?1",
+        )
+        .bind(handle.as_str())
+        .bind(state.as_str())
+        .bind(now_ms())
+        .execute(&self.pool)
+        .await
+        .map_err(VnidropError::repository)?;
+        Ok(())
+    }
+
+    async fn find(&self, handle: &SecretHandle) -> Result<Option<SecretMetadata>, VnidropError> {
+        let row = sqlx::query(
+            "SELECT handle, kind, state, expected_identity FROM protected_secret_refs WHERE handle = ?1",
+        )
+        .bind(handle.as_str())
+        .fetch_optional(&self.pool)
+        .await
+        .map_err(VnidropError::repository)?;
+        row.map(row_to_metadata).transpose()
+    }
+
+    async fn list(&self) -> Result<Vec<SecretMetadata>, VnidropError> {
+        let rows = sqlx::query(
+            "SELECT handle, kind, state, expected_identity FROM protected_secret_refs ORDER BY handle",
+        )
+        .fetch_all(&self.pool)
+        .await
+        .map_err(VnidropError::repository)?;
+        rows.into_iter().map(row_to_metadata).collect()
+    }
+
+    async fn find_active_kind(
+        &self,
+        kind: SecretKind,
+    ) -> Result<Option<SecretMetadata>, VnidropError> {
+        let row = sqlx::query(
+            r#"
+            SELECT handle, kind, state, expected_identity
+            FROM protected_secret_refs
+            WHERE kind = ?1 AND state = 'active'
+            ORDER BY created_at ASC
+            LIMIT 1
+            "#,
+        )
+        .bind(kind.as_str())
+        .fetch_optional(&self.pool)
+        .await
+        .map_err(VnidropError::repository)?;
+        row.map(row_to_metadata).transpose()
+    }
+
+    async fn contains_kind(&self, kind: SecretKind) -> Result<bool, VnidropError> {
+        let row = sqlx::query("SELECT 1 FROM protected_secret_refs WHERE kind = ?1 LIMIT 1")
+            .bind(kind.as_str())
+            .fetch_optional(&self.pool)
+            .await
+            .map_err(VnidropError::repository)?;
+        Ok(row.is_some())
+    }
+}
+
+fn row_to_metadata(row: sqlx::sqlite::SqliteRow) -> Result<SecretMetadata, VnidropError> {
+    Ok(SecretMetadata {
+        handle: SecretHandle(row.get(0)),
+        kind: SecretKind::parse(row.get::<String, _>(1).as_str())?,
+        state: SecretMetadataState::parse(row.get::<String, _>(2).as_str())?,
+        expected_identity: row.get(3),
+    })
+}
+
+pub(crate) struct SecretCustody {
+    metadata: SecretMetadataStore,
+    store: Arc<dyn SecureSecretStore>,
+    #[cfg(test)]
+    crash_point: Mutex<Option<CustodyCrashPoint>>,
+}
+
+pub(crate) async fn start_endpoint_identity(
+    metadata: SecretMetadataStore,
+    store: Arc<dyn SecureSecretStore>,
+    legacy_path: &Path,
+) -> Result<(SecretKey, SecretCustody), VnidropError> {
+    let (custody, _) = SecretCustody::start(metadata, store).await?;
+    let secret_key = custody
+        .initialize_endpoint_identity(legacy_path)
+        .await?
+        .into_secret_key();
+    Ok((secret_key, custody))
+}
+
+impl SecretCustody {
+    pub(crate) async fn start(
+        metadata: SecretMetadataStore,
+        store: Arc<dyn SecureSecretStore>,
+    ) -> Result<(Self, ReconciliationSummary), VnidropError> {
+        let custody = Self::from_parts(metadata, store);
+        let summary = custody.reconcile().await?;
+        Ok((custody, summary))
+    }
+
+    #[cfg(test)]
+    pub(crate) fn new(metadata: SecretMetadataStore, store: Arc<dyn SecureSecretStore>) -> Self {
+        Self::from_parts(metadata, store)
+    }
+
+    fn from_parts(metadata: SecretMetadataStore, store: Arc<dyn SecureSecretStore>) -> Self {
+        Self {
+            metadata,
+            store,
+            #[cfg(test)]
+            crash_point: Mutex::new(None),
+        }
+    }
+
+    pub(crate) async fn protect(
+        &self,
+        kind: SecretKind,
+        material: SecretMaterial,
+        expected_identity: Option<&str>,
+    ) -> Result<SecretHandle, VnidropError> {
+        validate_material(kind, &material, expected_identity)?;
+        let handle = SecretHandle::generate(kind);
+        self.store
+            .put(&handle, material.clone())
+            .map_err(map_store_error)?;
+        #[cfg(test)]
+        self.maybe_crash(CustodyCrashPoint::StoreWrite)?;
+        let stored = self.store.get(&handle).map_err(map_store_error)?;
+        if stored != material {
+            return Err(VnidropError::SecureStorageCorrupted {
+                reason: "credential store did not preserve protected material".to_string(),
+            });
+        }
+        validate_material(kind, &stored, expected_identity)?;
+        if let Err(error) = self.metadata.stage(&handle, kind, expected_identity).await {
+            self.delete_if_present(&handle)?;
+            return Err(error);
+        }
+        #[cfg(test)]
+        self.maybe_crash(CustodyCrashPoint::MetadataStage)?;
+        self.metadata.activate(&handle).await?;
+        #[cfg(test)]
+        self.maybe_crash(CustodyCrashPoint::MetadataActivation)?;
+        Ok(handle)
+    }
+
+    pub(crate) async fn load(&self, handle: &SecretHandle) -> Result<SecretMaterial, VnidropError> {
+        let metadata = self.metadata.find(handle).await?.ok_or_else(|| {
+            VnidropError::SecureStorageMissing {
+                reason: "protected secret metadata is missing".to_string(),
+            }
+        })?;
+        if metadata.state != SecretMetadataState::Active {
+            return Err(VnidropError::SecureStorageUnavailable {
+                reason: "protected secret is not active".to_string(),
+            });
+        }
+        let material = self.store.get(handle).map_err(map_store_error)?;
+        validate_material(
+            metadata.kind,
+            &material,
+            metadata.expected_identity.as_deref(),
+        )?;
+        Ok(material)
+    }
+
+    pub(crate) async fn migrate_legacy_endpoint_identity(
+        &self,
+        legacy_path: &Path,
+    ) -> Result<SecretHandle, VnidropError> {
+        if let Some(active) = self
+            .metadata
+            .find_active_kind(SecretKind::EndpointIdentity)
+            .await?
+        {
+            let protected = self.load(&active.handle).await?;
+            match read_legacy_endpoint_identity(legacy_path).await {
+                Ok(legacy) => {
+                    if legacy.endpoint_id() != protected.endpoint_id() {
+                        return Err(VnidropError::SecureStorageCorrupted {
+                            reason: "legacy endpoint key does not match protected identity"
+                                .to_string(),
+                        });
+                    }
+                    tokio::fs::remove_file(legacy_path)
+                        .await
+                        .map_err(VnidropError::filesystem)?;
+                }
+                Err(VnidropError::SecureStorageMissing { .. }) => {}
+                Err(error) => return Err(error),
+            }
+            return Ok(active.handle);
+        }
+
+        let legacy = read_legacy_endpoint_identity(legacy_path).await?;
+        let endpoint_id = legacy.endpoint_id();
+        let handle = self
+            .protect(
+                SecretKind::EndpointIdentity,
+                legacy,
+                Some(endpoint_id.as_str()),
+            )
+            .await?;
+        tokio::fs::remove_file(legacy_path)
+            .await
+            .map_err(VnidropError::filesystem)?;
+        Ok(handle)
+    }
+
+    pub(crate) async fn initialize_endpoint_identity(
+        &self,
+        legacy_path: &Path,
+    ) -> Result<SecretMaterial, VnidropError> {
+        if self
+            .metadata
+            .find_active_kind(SecretKind::EndpointIdentity)
+            .await?
+            .is_some()
+        {
+            let handle = self.migrate_legacy_endpoint_identity(legacy_path).await?;
+            return self.load(&handle).await;
+        }
+        if self
+            .metadata
+            .contains_kind(SecretKind::EndpointIdentity)
+            .await?
+        {
+            return Err(VnidropError::SecureStorageUnavailable {
+                reason: "protected endpoint identity is disabled".to_string(),
+            });
+        }
+        match tokio::fs::try_exists(legacy_path).await {
+            Ok(true) => {
+                let handle = self.migrate_legacy_endpoint_identity(legacy_path).await?;
+                self.load(&handle).await
+            }
+            Ok(false) => {
+                let secret = SecretKey::generate();
+                let material = SecretMaterial::new(secret.to_bytes().to_vec())?;
+                let endpoint_id = material.endpoint_id();
+                match self
+                    .protect(
+                        SecretKind::EndpointIdentity,
+                        material,
+                        Some(endpoint_id.as_str()),
+                    )
+                    .await
+                {
+                    Ok(handle) => self.load(&handle).await,
+                    Err(error) => {
+                        let winner = tokio::time::timeout(Duration::from_secs(1), async {
+                            loop {
+                                if let Some(active) = self
+                                    .metadata
+                                    .find_active_kind(SecretKind::EndpointIdentity)
+                                    .await?
+                                {
+                                    return self.load(&active.handle).await;
+                                }
+                                tokio::time::sleep(Duration::from_millis(10)).await;
+                            }
+                        })
+                        .await;
+                        match winner {
+                            Ok(result) => result,
+                            Err(_) => Err(error),
+                        }
+                    }
+                }
+            }
+            Err(error) => Err(VnidropError::filesystem(error)),
+        }
+    }
+
+    pub(crate) async fn reconcile(&self) -> Result<ReconciliationSummary, VnidropError> {
+        let metadata = self.metadata.list().await?;
+        let stored_handles = self.store.list_handles().map_err(map_store_error)?;
+        let known_handles = metadata
+            .iter()
+            .map(|entry| entry.handle.clone())
+            .collect::<HashSet<_>>();
+        let mut summary = ReconciliationSummary::default();
+
+        for entry in metadata {
+            if entry.state == SecretMetadataState::Disabled {
+                self.delete_if_present(&entry.handle)?;
+                continue;
+            }
+            match self.store.get(&entry.handle) {
+                Ok(material) => {
+                    if validate_material(entry.kind, &material, entry.expected_identity.as_deref())
+                        .is_err()
+                    {
+                        self.metadata.disable(&entry.handle).await?;
+                        self.delete_if_present(&entry.handle)?;
+                        summary.disabled += 1;
+                    } else if entry.state == SecretMetadataState::Staged {
+                        self.metadata.activate(&entry.handle).await?;
+                        summary.staged_activated += 1;
+                    }
+                }
+                Err(SecureSecretStoreError::Missing | SecureSecretStoreError::Corrupted) => {
+                    self.metadata.disable(&entry.handle).await?;
+                    self.delete_if_present(&entry.handle)?;
+                    summary.disabled += 1;
+                }
+                Err(error) => return Err(map_store_error(error)),
+            }
+        }
+
+        for handle in stored_handles {
+            if !known_handles.contains(&handle) {
+                self.store.delete(&handle).map_err(map_store_error)?;
+                summary.orphans_deleted += 1;
+            }
+        }
+        Ok(summary)
+    }
+
+    fn delete_if_present(&self, handle: &SecretHandle) -> Result<(), VnidropError> {
+        match self.store.delete(handle) {
+            Ok(()) | Err(SecureSecretStoreError::Missing) => Ok(()),
+            Err(error) => Err(map_store_error(error)),
+        }
+    }
+
+    #[cfg(test)]
+    pub(crate) fn crash_once_at(&self, point: CustodyCrashPoint) {
+        *self.crash_point.lock().unwrap() = Some(point);
+    }
+
+    #[cfg(test)]
+    fn maybe_crash(&self, point: CustodyCrashPoint) -> Result<(), VnidropError> {
+        let mut crash_point = self.crash_point.lock().unwrap();
+        if *crash_point == Some(point) {
+            *crash_point = None;
+            return Err(VnidropError::Internal {
+                reason: format!("simulated custody crash at {point:?}"),
+            });
+        }
+        Ok(())
+    }
+}
+
+async fn read_legacy_endpoint_identity(path: &Path) -> Result<SecretMaterial, VnidropError> {
+    let encoded = match tokio::fs::read_to_string(path).await {
+        Ok(encoded) => encoded,
+        Err(error) if error.kind() == io::ErrorKind::NotFound => {
+            return Err(VnidropError::SecureStorageMissing {
+                reason: "no protected or legacy endpoint identity exists".to_string(),
+            });
+        }
+        Err(error) => return Err(VnidropError::filesystem(error)),
+    };
+    let bytes = HEXLOWER.decode(encoded.trim().as_bytes()).map_err(|_| {
+        VnidropError::SecureStorageCorrupted {
+            reason: "legacy endpoint key encoding is invalid".to_string(),
+        }
+    })?;
+    SecretMaterial::new(bytes)
+}
+
+#[derive(Debug, Clone, Copy, Default, PartialEq, Eq)]
+pub(crate) struct ReconciliationSummary {
+    pub(crate) orphans_deleted: u64,
+    pub(crate) staged_activated: u64,
+    pub(crate) disabled: u64,
+}
+
+#[cfg(test)]
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub(crate) enum CustodyCrashPoint {
+    StoreWrite,
+    MetadataStage,
+    MetadataActivation,
+}
+
+fn validate_material(
+    kind: SecretKind,
+    material: &SecretMaterial,
+    expected_identity: Option<&str>,
+) -> Result<(), VnidropError> {
+    if kind == SecretKind::EndpointIdentity {
+        let expected_identity =
+            expected_identity.ok_or_else(|| VnidropError::SecureStorageCorrupted {
+                reason: "endpoint identity metadata lacks its expected endpoint id".to_string(),
+            })?;
+        if material.endpoint_id() != expected_identity {
+            return Err(VnidropError::SecureStorageCorrupted {
+                reason: "protected endpoint identity does not match its endpoint id".to_string(),
+            });
+        }
+    }
+    Ok(())
+}
+
+fn map_store_error(error: SecureSecretStoreError) -> VnidropError {
+    let reason = error.to_string();
+    match error {
+        SecureSecretStoreError::Locked => VnidropError::SecureStorageLocked { reason },
+        SecureSecretStoreError::Missing => VnidropError::SecureStorageMissing { reason },
+        SecureSecretStoreError::Corrupted => VnidropError::SecureStorageCorrupted { reason },
+        SecureSecretStoreError::Unavailable => VnidropError::SecureStorageUnavailable { reason },
+    }
+}
+
+#[cfg(test)]
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub(crate) enum ReferenceStoreFailure {
+    Locked,
+    Unavailable,
+}
+
+#[cfg(test)]
+#[derive(Default)]
+pub(crate) struct FaultInjectingSecretStore {
+    values: Mutex<HashMap<SecretHandle, SecretMaterial>>,
+    failure: Mutex<Option<ReferenceStoreFailure>>,
+    corrupted: Mutex<Vec<SecretHandle>>,
+}
+
+#[cfg(test)]
+impl FaultInjectingSecretStore {
+    pub(crate) fn fail_with(&self, failure: Option<ReferenceStoreFailure>) {
+        *self.failure.lock().unwrap() = failure;
+    }
+
+    pub(crate) fn remove_for_test(&self, handle: &SecretHandle) {
+        self.values.lock().unwrap().remove(handle);
+    }
+
+    pub(crate) fn corrupt_for_test(&self, handle: &SecretHandle) {
+        self.corrupted.lock().unwrap().push(handle.clone());
+    }
+
+    pub(crate) fn only_handle_for_test(&self) -> SecretHandle {
+        let handles = self
+            .values
+            .lock()
+            .unwrap()
+            .keys()
+            .cloned()
+            .collect::<Vec<_>>();
+        assert_eq!(handles.len(), 1, "expected exactly one protected secret");
+        handles.into_iter().next().unwrap()
+    }
+
+    fn check_available(&self) -> Result<(), SecureSecretStoreError> {
+        match *self.failure.lock().unwrap() {
+            Some(ReferenceStoreFailure::Locked) => Err(SecureSecretStoreError::Locked),
+            Some(ReferenceStoreFailure::Unavailable) => Err(SecureSecretStoreError::Unavailable),
+            None => Ok(()),
+        }
+    }
+}
+
+#[cfg(test)]
+impl SecureSecretStore for FaultInjectingSecretStore {
+    fn put(
+        &self,
+        handle: &SecretHandle,
+        material: SecretMaterial,
+    ) -> Result<(), SecureSecretStoreError> {
+        self.check_available()?;
+        self.values.lock().unwrap().insert(handle.clone(), material);
+        Ok(())
+    }
+
+    fn get(&self, handle: &SecretHandle) -> Result<SecretMaterial, SecureSecretStoreError> {
+        self.check_available()?;
+        if self.corrupted.lock().unwrap().contains(handle) {
+            return Err(SecureSecretStoreError::Corrupted);
+        }
+        self.values
+            .lock()
+            .unwrap()
+            .get(handle)
+            .cloned()
+            .ok_or(SecureSecretStoreError::Missing)
+    }
+
+    fn delete(&self, handle: &SecretHandle) -> Result<(), SecureSecretStoreError> {
+        self.check_available()?;
+        self.values.lock().unwrap().remove(handle);
+        Ok(())
+    }
+
+    fn list_handles(&self) -> Result<Vec<SecretHandle>, SecureSecretStoreError> {
+        self.check_available()?;
+        Ok(self.values.lock().unwrap().keys().cloned().collect())
+    }
+}

crates/vnidrop/src/secure_secret/android.rs

@@ -0,0 +1,318 @@
+use std::{
+    fs::{self, File, OpenOptions},
+    io::{Read, Write},
+    path::{Path, PathBuf},
+    sync::{Arc, Mutex},
+};
+
+use data_encoding::HEXLOWER;
+
+use super::{SecretHandle, SecretMaterial, SecureSecretStore, SecureSecretStoreError};
+
+const RECORD_MAGIC: &[u8; 8] = b"VNDASK01";
+const RECORD_STAGED: u8 = 0;
+const RECORD_SEALED: u8 = 1;
+const RECORD_EXTENSION: &str = "vns";
+const KEY_ALIAS_PREFIX: &str = "vnidrop.secret.v1.";
+
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub(crate) struct AndroidSealedValue {
+    pub(crate) nonce: Vec<u8>,
+    pub(crate) ciphertext: Vec<u8>,
+}
+
+/// Performs AES-GCM operations with a non-exportable key held by Android Keystore.
+///
+/// Implementations create one key per alias, let Keystore generate the encryption
+/// nonce, and never return key material to Rust.
+pub(crate) trait AndroidKeystore: Send + Sync {
+    fn seal(
+        &self,
+        alias: &str,
+        plaintext: &[u8],
+    ) -> Result<AndroidSealedValue, SecureSecretStoreError>;
+    fn open(
+        &self,
+        alias: &str,
+        sealed: &AndroidSealedValue,
+    ) -> Result<Vec<u8>, SecureSecretStoreError>;
+    fn delete(&self, alias: &str) -> Result<(), SecureSecretStoreError>;
+}
+
+/// Android secret-store adapter whose ordinary storage contains authenticated
+/// ciphertext only.
+///
+/// `no_backup_dir` must be the directory returned by Android
+/// `Context.getNoBackupFilesDir()`. The Android host owns acquiring that Context;
+/// secret values never cross that initialization boundary.
+pub(crate) struct AndroidSecureSecretStore {
+    records_dir: PathBuf,
+    keystore: Arc<dyn AndroidKeystore>,
+    mutation_lock: Mutex<()>,
+}
+
+impl AndroidSecureSecretStore {
+    pub(crate) fn new(
+        no_backup_dir: &Path,
+        keystore: Arc<dyn AndroidKeystore>,
+    ) -> Result<Self, SecureSecretStoreError> {
+        if !no_backup_dir.is_absolute() {
+            return Err(SecureSecretStoreError::Unavailable);
+        }
+        let records_dir = no_backup_dir.join("vnidrop-protected-secrets-v1");
+        fs::create_dir_all(&records_dir).map_err(map_io_error)?;
+        set_private_directory_permissions(&records_dir)?;
+        Ok(Self {
+            records_dir,
+            keystore,
+            mutation_lock: Mutex::new(()),
+        })
+    }
+
+    fn record_path(&self, handle: &SecretHandle) -> PathBuf {
+        let encoded = HEXLOWER.encode(handle.as_str().as_bytes());
+        self.records_dir
+            .join(format!("{encoded}.{RECORD_EXTENSION}"))
+    }
+
+    fn alias(handle: &SecretHandle) -> String {
+        let digest = blake3::hash(handle.as_str().as_bytes());
+        format!("{KEY_ALIAS_PREFIX}{}", HEXLOWER.encode(digest.as_bytes()))
+    }
+
+    fn write_record(
+        &self,
+        handle: &SecretHandle,
+        state: u8,
+        sealed: Option<&AndroidSealedValue>,
+    ) -> Result<(), SecureSecretStoreError> {
+        let bytes = encode_record(handle, state, sealed)?;
+        let path = self.record_path(handle);
+        let temporary = path.with_extension(format!("{RECORD_EXTENSION}.tmp"));
+        let mut file = OpenOptions::new()
+            .create(true)
+            .truncate(true)
+            .write(true)
+            .open(&temporary)
+            .map_err(map_io_error)?;
+        set_private_file_permissions(&temporary)?;
+        file.write_all(&bytes).map_err(map_io_error)?;
+        file.sync_all().map_err(map_io_error)?;
+        fs::rename(&temporary, &path).map_err(map_io_error)?;
+        sync_directory(&self.records_dir)?;
+        Ok(())
+    }
+
+    fn read_record(
+        &self,
+        handle: &SecretHandle,
+    ) -> Result<AndroidSealedValue, SecureSecretStoreError> {
+        let mut bytes = Vec::new();
+        File::open(self.record_path(handle))
+            .map_err(map_io_error)?
+            .read_to_end(&mut bytes)
+            .map_err(map_io_error)?;
+        decode_record(&bytes, handle)
+    }
+
+    #[cfg(test)]
+    pub(crate) fn record_path_for_test(&self, handle: &SecretHandle) -> PathBuf {
+        self.record_path(handle)
+    }
+
+    #[cfg(test)]
+    pub(crate) fn stage_for_test(
+        &self,
+        handle: &SecretHandle,
+    ) -> Result<(), SecureSecretStoreError> {
+        self.write_record(handle, RECORD_STAGED, None)
+    }
+}
+
+#[cfg(test)]
+pub(crate) fn secret_handle_for_test(value: &str) -> SecretHandle {
+    SecretHandle(value.to_string())
+}
+
+impl SecureSecretStore for AndroidSecureSecretStore {
+    fn put(
+        &self,
+        handle: &SecretHandle,
+        material: SecretMaterial,
+    ) -> Result<(), SecureSecretStoreError> {
+        let _mutation = self
+            .mutation_lock
+            .lock()
+            .map_err(|_| SecureSecretStoreError::Unavailable)?;
+        let record_exists = match fs::metadata(self.record_path(handle)) {
+            Ok(_) => true,
+            Err(error) if error.kind() == std::io::ErrorKind::NotFound => false,
+            Err(error) => return Err(map_io_error(error)),
+        };
+        if !record_exists {
+            self.write_record(handle, RECORD_STAGED, None)?;
+        }
+        let alias = Self::alias(handle);
+        let sealed = self.keystore.seal(&alias, &material.0)?;
+        if sealed.nonce.is_empty() || sealed.ciphertext.is_empty() {
+            return Err(SecureSecretStoreError::Corrupted);
+        }
+        self.write_record(handle, RECORD_SEALED, Some(&sealed))
+    }
+
+    fn get(&self, handle: &SecretHandle) -> Result<SecretMaterial, SecureSecretStoreError> {
+        let sealed = self.read_record(handle)?;
+        let plaintext = self.keystore.open(&Self::alias(handle), &sealed)?;
+        SecretMaterial::new(plaintext).map_err(|_| SecureSecretStoreError::Corrupted)
+    }
+
+    fn delete(&self, handle: &SecretHandle) -> Result<(), SecureSecretStoreError> {
+        let _mutation = self
+            .mutation_lock
+            .lock()
+            .map_err(|_| SecureSecretStoreError::Unavailable)?;
+        match self.keystore.delete(&Self::alias(handle)) {
+            Ok(()) | Err(SecureSecretStoreError::Missing) => {}
+            Err(error) => return Err(error),
+        }
+        let path = self.record_path(handle);
+        match fs::remove_file(path) {
+            Ok(()) => sync_directory(&self.records_dir)?,
+            Err(error) if error.kind() == std::io::ErrorKind::NotFound => {}
+            Err(error) => return Err(map_io_error(error)),
+        }
+        Ok(())
+    }
+
+    fn list_handles(&self) -> Result<Vec<SecretHandle>, SecureSecretStoreError> {
+        let mut handles = Vec::new();
+        for entry in fs::read_dir(&self.records_dir).map_err(map_io_error)? {
+            let entry = entry.map_err(map_io_error)?;
+            let path = entry.path();
+            if path.extension().and_then(|value| value.to_str()) != Some(RECORD_EXTENSION) {
+                continue;
+            }
+            let stem = path
+                .file_stem()
+                .and_then(|value| value.to_str())
+                .ok_or(SecureSecretStoreError::Corrupted)?;
+            let decoded = HEXLOWER
+                .decode(stem.as_bytes())
+                .map_err(|_| SecureSecretStoreError::Corrupted)?;
+            let handle =
+                String::from_utf8(decoded).map_err(|_| SecureSecretStoreError::Corrupted)?;
+            handles.push(SecretHandle(handle));
+        }
+        handles.sort_by(|left, right| left.as_str().cmp(right.as_str()));
+        Ok(handles)
+    }
+}
+
+fn encode_record(
+    handle: &SecretHandle,
+    state: u8,
+    sealed: Option<&AndroidSealedValue>,
+) -> Result<Vec<u8>, SecureSecretStoreError> {
+    let handle_bytes = handle.as_str().as_bytes();
+    let handle_len =
+        u16::try_from(handle_bytes.len()).map_err(|_| SecureSecretStoreError::Corrupted)?;
+    let (nonce, ciphertext) = match (state, sealed) {
+        (RECORD_STAGED, None) => (&[][..], &[][..]),
+        (RECORD_SEALED, Some(value)) => (value.nonce.as_slice(), value.ciphertext.as_slice()),
+        _ => return Err(SecureSecretStoreError::Corrupted),
+    };
+    let nonce_len = u16::try_from(nonce.len()).map_err(|_| SecureSecretStoreError::Corrupted)?;
+    let ciphertext_len =
+        u32::try_from(ciphertext.len()).map_err(|_| SecureSecretStoreError::Corrupted)?;
+    let mut record = Vec::with_capacity(
+        RECORD_MAGIC.len() + 1 + 2 + 2 + 4 + handle_bytes.len() + nonce.len() + ciphertext.len(),
+    );
+    record.extend_from_slice(RECORD_MAGIC);
+    record.push(state);
+    record.extend_from_slice(&handle_len.to_be_bytes());
+    record.extend_from_slice(&nonce_len.to_be_bytes());
+    record.extend_from_slice(&ciphertext_len.to_be_bytes());
+    record.extend_from_slice(handle_bytes);
+    record.extend_from_slice(nonce);
+    record.extend_from_slice(ciphertext);
+    Ok(record)
+}
+
+fn decode_record(
+    bytes: &[u8],
+    expected_handle: &SecretHandle,
+) -> Result<AndroidSealedValue, SecureSecretStoreError> {
+    const HEADER_LEN: usize = 8 + 1 + 2 + 2 + 4;
+    if bytes.len() < HEADER_LEN || &bytes[..8] != RECORD_MAGIC {
+        return Err(SecureSecretStoreError::Corrupted);
+    }
+    let state = bytes[8];
+    let handle_len = usize::from(u16::from_be_bytes([bytes[9], bytes[10]]));
+    let nonce_len = usize::from(u16::from_be_bytes([bytes[11], bytes[12]]));
+    let ciphertext_len = usize::try_from(u32::from_be_bytes([
+        bytes[13], bytes[14], bytes[15], bytes[16],
+    ]))
+    .map_err(|_| SecureSecretStoreError::Corrupted)?;
+    let expected_len = HEADER_LEN
+        .checked_add(handle_len)
+        .and_then(|value| value.checked_add(nonce_len))
+        .and_then(|value| value.checked_add(ciphertext_len))
+        .ok_or(SecureSecretStoreError::Corrupted)?;
+    if bytes.len() != expected_len || state != RECORD_SEALED {
+        return Err(SecureSecretStoreError::Corrupted);
+    }
+    let handle_end = HEADER_LEN + handle_len;
+    let handle = std::str::from_utf8(&bytes[HEADER_LEN..handle_end])
+        .map_err(|_| SecureSecretStoreError::Corrupted)?;
+    if handle != expected_handle.as_str() {
+        return Err(SecureSecretStoreError::Corrupted);
+    }
+    let nonce_end = handle_end + nonce_len;
+    if nonce_len == 0 || ciphertext_len == 0 {
+        return Err(SecureSecretStoreError::Corrupted);
+    }
+    Ok(AndroidSealedValue {
+        nonce: bytes[handle_end..nonce_end].to_vec(),
+        ciphertext: bytes[nonce_end..].to_vec(),
+    })
+}
+
+fn map_io_error(error: std::io::Error) -> SecureSecretStoreError {
+    match error.kind() {
+        std::io::ErrorKind::NotFound => SecureSecretStoreError::Missing,
+        std::io::ErrorKind::InvalidData => SecureSecretStoreError::Corrupted,
+        _ => SecureSecretStoreError::Unavailable,
+    }
+}
+
+fn sync_directory(path: &Path) -> Result<(), SecureSecretStoreError> {
+    File::open(path)
+        .and_then(|directory| directory.sync_all())
+        .map_err(map_io_error)
+}
+
+#[cfg(unix)]
+fn set_private_directory_permissions(path: &Path) -> Result<(), SecureSecretStoreError> {
+    use std::os::unix::fs::PermissionsExt;
+    fs::set_permissions(path, fs::Permissions::from_mode(0o700)).map_err(map_io_error)
+}
+
+#[cfg(not(unix))]
+fn set_private_directory_permissions(_path: &Path) -> Result<(), SecureSecretStoreError> {
+    Ok(())
+}
+
+#[cfg(unix)]
+fn set_private_file_permissions(path: &Path) -> Result<(), SecureSecretStoreError> {
+    use std::os::unix::fs::PermissionsExt;
+    fs::set_permissions(path, fs::Permissions::from_mode(0o600)).map_err(map_io_error)
+}
+
+#[cfg(not(unix))]
+fn set_private_file_permissions(_path: &Path) -> Result<(), SecureSecretStoreError> {
+    Ok(())
+}
+
+#[cfg(target_os = "android")]
+#[path = "android_native.rs"]
+pub(crate) mod native;

crates/vnidrop/src/secure_secret/android_native.rs

@@ -0,0 +1,494 @@
+use jni::{
+    errors::Error as JniError,
+    objects::{GlobalRef, JByteArray, JObject, JString, JValue},
+    sys::jboolean,
+    JNIEnv, JavaVM,
+};
+use std::{panic::AssertUnwindSafe, sync::Mutex};
+
+use super::*;
+
+const ANDROID_KEYSTORE: &str = "AndroidKeyStore";
+const AES: &str = "AES";
+const TRANSFORMATION: &str = "AES/GCM/NoPadding";
+
+static ANDROID_APPLICATION_CONTEXT: Mutex<Option<GlobalRef>> = Mutex::new(None);
+
+#[unsafe(no_mangle)]
+pub extern "system" fn Java_com_vnidrop_app_core_AndroidCoreRuntime_initialize(
+    mut env: JNIEnv<'_>,
+    _receiver: JObject<'_>,
+    context: JObject<'_>,
+) -> jboolean {
+    std::panic::catch_unwind(AssertUnwindSafe(|| {
+        initialize_android_context(&mut env, context)
+    }))
+    .ok()
+    .and_then(Result::ok)
+    .map_or(0, |()| 1)
+}
+
+fn initialize_android_context(
+    env: &mut JNIEnv<'_>,
+    context: JObject<'_>,
+) -> Result<(), SecureSecretStoreError> {
+    let mut stored = ANDROID_APPLICATION_CONTEXT
+        .lock()
+        .map_err(|_| SecureSecretStoreError::Unavailable)?;
+    if stored.is_some() {
+        return Ok(());
+    }
+    let vm = env
+        .get_java_vm()
+        .map_err(|_| SecureSecretStoreError::Unavailable)?;
+    let context = env
+        .new_global_ref(context)
+        .map_err(|_| SecureSecretStoreError::Unavailable)?;
+    unsafe {
+        ndk_context::initialize_android_context(
+            vm.get_java_vm_pointer().cast(),
+            context.as_obj().as_raw().cast(),
+        );
+    }
+    *stored = Some(context);
+    Ok(())
+}
+
+/// JNI-backed Android Keystore engine. The VM pointer comes from the Android
+/// runtime; no Context or secret bytes are exposed through UniFFI.
+pub(crate) struct AndroidJniKeystore {
+    vm: JavaVM,
+}
+
+impl AndroidJniKeystore {
+    /// Constructs the engine after the Android runtime has initialized
+    /// `ndk-context` with the process Java VM.
+    pub(crate) fn from_android_runtime() -> Result<Self, SecureSecretStoreError> {
+        let context = std::panic::catch_unwind(ndk_context::android_context)
+            .map_err(|_| SecureSecretStoreError::Unavailable)?;
+        let vm = context.vm();
+        if vm.is_null() {
+            return Err(SecureSecretStoreError::Unavailable);
+        }
+        // Android owns the process VM for longer than every core instance.
+        let vm = unsafe { JavaVM::from_raw(vm.cast()) }
+            .map_err(|_| SecureSecretStoreError::Unavailable)?;
+        Ok(Self { vm })
+    }
+
+    fn with_env<T>(
+        &self,
+        operation: impl FnOnce(&mut JNIEnv<'_>) -> Result<T, SecureSecretStoreError>,
+    ) -> Result<T, SecureSecretStoreError> {
+        let mut env = self
+            .vm
+            .attach_current_thread()
+            .map_err(|_| SecureSecretStoreError::Unavailable)?;
+        operation(&mut env)
+    }
+
+    fn no_backup_files_dir(&self) -> Result<PathBuf, SecureSecretStoreError> {
+        self.with_env(|env| {
+            let context = std::panic::catch_unwind(ndk_context::android_context)
+                .map_err(|_| SecureSecretStoreError::Unavailable)?
+                .context();
+            if context.is_null() {
+                return Err(SecureSecretStoreError::Unavailable);
+            }
+            let context = local_ref_from_process_context(env, context.cast())?;
+            let directory = env
+                .call_method(&context, "getNoBackupFilesDir", "()Ljava/io/File;", &[])
+                .map_err(|error| map_jni_error(env, error))?
+                .l()
+                .map_err(|error| map_jni_error(env, error))?;
+            if directory.is_null() {
+                return Err(SecureSecretStoreError::Unavailable);
+            }
+            let path = env
+                .call_method(&directory, "getAbsolutePath", "()Ljava/lang/String;", &[])
+                .map_err(|error| map_jni_error(env, error))?
+                .l()
+                .map_err(|error| map_jni_error(env, error))?;
+            let path = JString::from(path);
+            let path: String = env
+                .get_string(&path)
+                .map_err(|error| map_jni_error(env, error))?
+                .into();
+            Ok(PathBuf::from(path))
+        })
+    }
+}
+
+pub(crate) fn create_store_from_android_runtime(
+) -> Result<Arc<dyn SecureSecretStore>, SecureSecretStoreError> {
+    let keystore = Arc::new(AndroidJniKeystore::from_android_runtime()?);
+    let no_backup_dir = keystore.no_backup_files_dir()?;
+    Ok(Arc::new(AndroidSecureSecretStore::new(
+        &no_backup_dir,
+        keystore,
+    )?))
+}
+
+impl AndroidKeystore for AndroidJniKeystore {
+    fn seal(
+        &self,
+        alias: &str,
+        plaintext: &[u8],
+    ) -> Result<AndroidSealedValue, SecureSecretStoreError> {
+        self.with_env(|env| {
+            let key_store = load_key_store(env)?;
+            let alias_string = env
+                .new_string(alias)
+                .map_err(|error| map_jni_error(env, error))?;
+            let alias_object = JObject::from(alias_string);
+            let contains = env
+                .call_method(
+                    &key_store,
+                    "containsAlias",
+                    "(Ljava/lang/String;)Z",
+                    &[JValue::Object(&alias_object)],
+                )
+                .map_err(|error| map_jni_error(env, error))?
+                .z()
+                .map_err(|error| map_jni_error(env, error))?;
+            if !contains {
+                generate_key(env, alias)?;
+            }
+            let key = get_key(env, &key_store, alias)?;
+            let cipher = cipher_instance(env)?;
+            env.call_method(
+                &cipher,
+                "init",
+                "(ILjava/security/Key;)V",
+                &[JValue::Int(1), JValue::Object(&key)],
+            )
+            .map_err(|error| map_jni_error(env, error))?;
+            let plaintext = env
+                .byte_array_from_slice(plaintext)
+                .map_err(|error| map_jni_error(env, error))?;
+            let plaintext_object = JObject::from(plaintext);
+            let ciphertext = env
+                .call_method(
+                    &cipher,
+                    "doFinal",
+                    "([B)[B",
+                    &[JValue::Object(&plaintext_object)],
+                )
+                .map_err(|error| map_jni_error(env, error))?
+                .l()
+                .map_err(|error| map_jni_error(env, error))?;
+            let nonce = env
+                .call_method(&cipher, "getIV", "()[B", &[])
+                .map_err(|error| map_jni_error(env, error))?
+                .l()
+                .map_err(|error| map_jni_error(env, error))?;
+            Ok(AndroidSealedValue {
+                nonce: env
+                    .convert_byte_array(JByteArray::from(nonce))
+                    .map_err(|error| map_jni_error(env, error))?,
+                ciphertext: env
+                    .convert_byte_array(JByteArray::from(ciphertext))
+                    .map_err(|error| map_jni_error(env, error))?,
+            })
+        })
+    }
+
+    fn open(
+        &self,
+        alias: &str,
+        sealed: &AndroidSealedValue,
+    ) -> Result<Vec<u8>, SecureSecretStoreError> {
+        self.with_env(|env| {
+            let key_store = load_key_store(env)?;
+            let key = get_key(env, &key_store, alias)?;
+            let cipher = cipher_instance(env)?;
+            let nonce = env
+                .byte_array_from_slice(&sealed.nonce)
+                .map_err(|error| map_jni_error(env, error))?;
+            let nonce_object = JObject::from(nonce);
+            let parameters = env
+                .new_object(
+                    "javax/crypto/spec/GCMParameterSpec",
+                    "(I[B)V",
+                    &[JValue::Int(128), JValue::Object(&nonce_object)],
+                )
+                .map_err(|error| map_jni_error(env, error))?;
+            env.call_method(
+                &cipher,
+                "init",
+                "(ILjava/security/Key;Ljava/security/spec/AlgorithmParameterSpec;)V",
+                &[
+                    JValue::Int(2),
+                    JValue::Object(&key),
+                    JValue::Object(&parameters),
+                ],
+            )
+            .map_err(|error| map_jni_error(env, error))?;
+            let ciphertext = env
+                .byte_array_from_slice(&sealed.ciphertext)
+                .map_err(|error| map_jni_error(env, error))?;
+            let ciphertext_object = JObject::from(ciphertext);
+            let plaintext = env
+                .call_method(
+                    &cipher,
+                    "doFinal",
+                    "([B)[B",
+                    &[JValue::Object(&ciphertext_object)],
+                )
+                .map_err(|error| map_jni_error(env, error))?
+                .l()
+                .map_err(|error| map_jni_error(env, error))?;
+            env.convert_byte_array(JByteArray::from(plaintext))
+                .map_err(|error| map_jni_error(env, error))
+        })
+    }
+
+    fn delete(&self, alias: &str) -> Result<(), SecureSecretStoreError> {
+        self.with_env(|env| {
+            let key_store = load_key_store(env)?;
+            let alias = env
+                .new_string(alias)
+                .map_err(|error| map_jni_error(env, error))?;
+            let alias_object = JObject::from(alias);
+            env.call_method(
+                &key_store,
+                "deleteEntry",
+                "(Ljava/lang/String;)V",
+                &[JValue::Object(&alias_object)],
+            )
+            .map_err(|error| map_jni_error(env, error))?;
+            Ok(())
+        })
+    }
+}
+
+fn load_key_store<'local>(
+    env: &mut JNIEnv<'local>,
+) -> Result<JObject<'local>, SecureSecretStoreError> {
+    let provider = env
+        .new_string(ANDROID_KEYSTORE)
+        .map_err(|error| map_jni_error(env, error))?;
+    let provider_object = JObject::from(provider);
+    let key_store = env
+        .call_static_method(
+            "java/security/KeyStore",
+            "getInstance",
+            "(Ljava/lang/String;)Ljava/security/KeyStore;",
+            &[JValue::Object(&provider_object)],
+        )
+        .map_err(|error| map_jni_error(env, error))?
+        .l()
+        .map_err(|error| map_jni_error(env, error))?;
+    env.call_method(
+        &key_store,
+        "load",
+        "(Ljava/security/KeyStore$LoadStoreParameter;)V",
+        &[JValue::Object(&JObject::null())],
+    )
+    .map_err(|error| map_jni_error(env, error))?;
+    Ok(key_store)
+}
+
+fn generate_key(env: &mut JNIEnv<'_>, alias: &str) -> Result<(), SecureSecretStoreError> {
+    let algorithm = env
+        .new_string(AES)
+        .map_err(|error| map_jni_error(env, error))?;
+    let provider = env
+        .new_string(ANDROID_KEYSTORE)
+        .map_err(|error| map_jni_error(env, error))?;
+    let algorithm_object = JObject::from(algorithm);
+    let provider_object = JObject::from(provider);
+    let generator = env
+        .call_static_method(
+            "javax/crypto/KeyGenerator",
+            "getInstance",
+            "(Ljava/lang/String;Ljava/lang/String;)Ljavax/crypto/KeyGenerator;",
+            &[
+                JValue::Object(&algorithm_object),
+                JValue::Object(&provider_object),
+            ],
+        )
+        .map_err(|error| map_jni_error(env, error))?
+        .l()
+        .map_err(|error| map_jni_error(env, error))?;
+    let alias = env
+        .new_string(alias)
+        .map_err(|error| map_jni_error(env, error))?;
+    let alias_object = JObject::from(alias);
+    let builder = env
+        .new_object(
+            "android/security/keystore/KeyGenParameterSpec$Builder",
+            "(Ljava/lang/String;I)V",
+            &[JValue::Object(&alias_object), JValue::Int(3)],
+        )
+        .map_err(|error| map_jni_error(env, error))?;
+    let modes = java_string_array(env, "GCM")?;
+    env.call_method(
+        &builder,
+        "setBlockModes",
+        "([Ljava/lang/String;)Landroid/security/keystore/KeyGenParameterSpec$Builder;",
+        &[JValue::Object(&modes)],
+    )
+    .map_err(|error| map_jni_error(env, error))?;
+    let paddings = java_string_array(env, "NoPadding")?;
+    env.call_method(
+        &builder,
+        "setEncryptionPaddings",
+        "([Ljava/lang/String;)Landroid/security/keystore/KeyGenParameterSpec$Builder;",
+        &[JValue::Object(&paddings)],
+    )
+    .map_err(|error| map_jni_error(env, error))?;
+    env.call_method(
+        &builder,
+        "setKeySize",
+        "(I)Landroid/security/keystore/KeyGenParameterSpec$Builder;",
+        &[JValue::Int(256)],
+    )
+    .map_err(|error| map_jni_error(env, error))?;
+    env.call_method(
+        &builder,
+        "setRandomizedEncryptionRequired",
+        "(Z)Landroid/security/keystore/KeyGenParameterSpec$Builder;",
+        &[JValue::Bool(1)],
+    )
+    .map_err(|error| map_jni_error(env, error))?;
+    let parameters = env
+        .call_method(
+            &builder,
+            "build",
+            "()Landroid/security/keystore/KeyGenParameterSpec;",
+            &[],
+        )
+        .map_err(|error| map_jni_error(env, error))?
+        .l()
+        .map_err(|error| map_jni_error(env, error))?;
+    env.call_method(
+        &generator,
+        "init",
+        "(Ljava/security/spec/AlgorithmParameterSpec;)V",
+        &[JValue::Object(&parameters)],
+    )
+    .map_err(|error| map_jni_error(env, error))?;
+    env.call_method(&generator, "generateKey", "()Ljavax/crypto/SecretKey;", &[])
+        .map_err(|error| map_jni_error(env, error))?;
+    Ok(())
+}
+
+fn get_key<'local>(
+    env: &mut JNIEnv<'local>,
+    key_store: &JObject<'local>,
+    alias: &str,
+) -> Result<JObject<'local>, SecureSecretStoreError> {
+    let alias = env
+        .new_string(alias)
+        .map_err(|error| map_jni_error(env, error))?;
+    let alias_object = JObject::from(alias);
+    let key = env
+        .call_method(
+            key_store,
+            "getKey",
+            "(Ljava/lang/String;[C)Ljava/security/Key;",
+            &[
+                JValue::Object(&alias_object),
+                JValue::Object(&JObject::null()),
+            ],
+        )
+        .map_err(|error| map_jni_error(env, error))?
+        .l()
+        .map_err(|error| map_jni_error(env, error))?;
+    if key.is_null() {
+        return Err(SecureSecretStoreError::Missing);
+    }
+    Ok(key)
+}
+
+fn cipher_instance<'local>(
+    env: &mut JNIEnv<'local>,
+) -> Result<JObject<'local>, SecureSecretStoreError> {
+    let transformation = env
+        .new_string(TRANSFORMATION)
+        .map_err(|error| map_jni_error(env, error))?;
+    let transformation_object = JObject::from(transformation);
+    env.call_static_method(
+        "javax/crypto/Cipher",
+        "getInstance",
+        "(Ljava/lang/String;)Ljavax/crypto/Cipher;",
+        &[JValue::Object(&transformation_object)],
+    )
+    .map_err(|error| map_jni_error(env, error))?
+    .l()
+    .map_err(|error| map_jni_error(env, error))
+}
+
+fn java_string_array<'local>(
+    env: &mut JNIEnv<'local>,
+    value: &str,
+) -> Result<JObject<'local>, SecureSecretStoreError> {
+    let class = env
+        .find_class("java/lang/String")
+        .map_err(|error| map_jni_error(env, error))?;
+    let array = env
+        .new_object_array(1, class, JObject::null())
+        .map_err(|error| map_jni_error(env, error))?;
+    let value = env
+        .new_string(value)
+        .map_err(|error| map_jni_error(env, error))?;
+    env.set_object_array_element(&array, 0, value)
+        .map_err(|error| map_jni_error(env, error))?;
+    Ok(JObject::from(array))
+}
+
+fn map_jni_error(env: &mut JNIEnv<'_>, _error: JniError) -> SecureSecretStoreError {
+    let has_exception = env.exception_check().unwrap_or(false);
+    if !has_exception {
+        return SecureSecretStoreError::Unavailable;
+    }
+    let exception = match env.exception_occurred() {
+        Ok(exception) => exception,
+        Err(_) => return SecureSecretStoreError::Unavailable,
+    };
+    let _ = env.exception_clear();
+    if is_instance_of(
+        env,
+        &exception,
+        "android/security/keystore/UserNotAuthenticatedException",
+    ) {
+        SecureSecretStoreError::Locked
+    } else if is_instance_of(
+        env,
+        &exception,
+        "android/security/keystore/KeyPermanentlyInvalidatedException",
+    ) || is_instance_of(env, &exception, "javax/crypto/AEADBadTagException")
+        || is_instance_of(env, &exception, "javax/crypto/BadPaddingException")
+    {
+        SecureSecretStoreError::Corrupted
+    } else if is_instance_of(env, &exception, "java/security/UnrecoverableKeyException") {
+        SecureSecretStoreError::Missing
+    } else {
+        SecureSecretStoreError::Unavailable
+    }
+}
+
+fn is_instance_of(env: &mut JNIEnv<'_>, object: &JObject<'_>, class: &str) -> bool {
+    env.is_instance_of(object, class).unwrap_or(false)
+}
+
+fn local_ref_from_process_context<'local>(
+    env: &mut JNIEnv<'local>,
+    context: jni::sys::jobject,
+) -> Result<JObject<'local>, SecureSecretStoreError> {
+    let interface = env.get_native_interface();
+    // ndk-context retains a process-wide global Context reference. JNI NewLocalRef
+    // is required before representing it as a frame-bound JObject.
+    let context = unsafe {
+        let new_local_ref = (**interface)
+            .NewLocalRef
+            .ok_or(SecureSecretStoreError::Unavailable)?;
+        new_local_ref(interface, context)
+    };
+    if context.is_null() {
+        return Err(SecureSecretStoreError::Unavailable);
+    }
+    // NewLocalRef created this reference in the currently attached JNI frame.
+    Ok(unsafe { JObject::from_raw(context) })
+}

crates/vnidrop/src/secure_secret/apple.rs

@@ -0,0 +1,207 @@
+use super::{SecretHandle, SecretMaterial, SecureSecretStore, SecureSecretStoreError};
+use security_framework::{
+    access_control::{ProtectionMode, SecAccessControl},
+    item::{ItemClass, ItemSearchOptions, Limit, SearchResult},
+    passwords::{
+        delete_generic_password_options, generic_password, set_generic_password_options,
+        PasswordOptions,
+    },
+};
+use std::sync::Arc;
+
+const SERVICE: &str = "com.vnidrop.secure-secrets.v1";
+const ACCOUNT_ATTRIBUTE: &str = "acct";
+const ERR_SEC_PARAM: i32 = -50;
+const ERR_SEC_AUTH_FAILED: i32 = -25_293;
+const ERR_SEC_NOT_AVAILABLE: i32 = -25_291;
+const ERR_SEC_ITEM_NOT_FOUND: i32 = -25_300;
+const ERR_SEC_INTERACTION_NOT_ALLOWED: i32 = -25_308;
+const ERR_SEC_DECODE: i32 = -26_275;
+const ERR_SEC_MISSING_ENTITLEMENT: i32 = -34_018;
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+enum AppleAccessibility {
+    AfterFirstUnlockThisDeviceOnly,
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub(crate) struct AppleKeychainPolicy {
+    accessibility: AppleAccessibility,
+    synchronizable: bool,
+    data_protection_keychain: bool,
+}
+
+impl Default for AppleKeychainPolicy {
+    fn default() -> Self {
+        Self {
+            accessibility: AppleAccessibility::AfterFirstUnlockThisDeviceOnly,
+            synchronizable: false,
+            data_protection_keychain: true,
+        }
+    }
+}
+
+pub(crate) trait AppleKeychainApi: Send + Sync {
+    fn put(
+        &self,
+        service: &str,
+        account: &str,
+        material: &[u8],
+        policy: AppleKeychainPolicy,
+    ) -> Result<(), i32>;
+    fn get(&self, service: &str, account: &str) -> Result<Vec<u8>, i32>;
+    fn delete(&self, service: &str, account: &str) -> Result<(), i32>;
+    fn list_accounts(&self, service: &str) -> Result<Vec<String>, i32>;
+}
+
+#[derive(Default)]
+struct SystemAppleKeychain;
+
+impl SystemAppleKeychain {
+    fn options(service: &str, account: &str) -> PasswordOptions {
+        let mut options = PasswordOptions::new_generic_password(service, account);
+        options.set_access_synchronized(Some(false));
+        options.use_protected_keychain();
+        options
+    }
+}
+
+impl AppleKeychainApi for SystemAppleKeychain {
+    fn put(
+        &self,
+        service: &str,
+        account: &str,
+        material: &[u8],
+        policy: AppleKeychainPolicy,
+    ) -> Result<(), i32> {
+        debug_assert_eq!(policy, AppleKeychainPolicy::default());
+        let access_control = SecAccessControl::create_with_protection(
+            Some(ProtectionMode::AccessibleAfterFirstUnlockThisDeviceOnly),
+            0,
+        )
+        .map_err(|error| error.code())?;
+        let mut options = Self::options(service, account);
+        options.set_access_control(access_control);
+        set_generic_password_options(material, options).map_err(|error| error.code())
+    }
+
+    fn get(&self, service: &str, account: &str) -> Result<Vec<u8>, i32> {
+        generic_password(Self::options(service, account)).map_err(|error| error.code())
+    }
+
+    fn delete(&self, service: &str, account: &str) -> Result<(), i32> {
+        delete_generic_password_options(Self::options(service, account))
+            .map_err(|error| error.code())
+    }
+
+    fn list_accounts(&self, service: &str) -> Result<Vec<String>, i32> {
+        let mut options = ItemSearchOptions::new();
+        options
+            .class(ItemClass::generic_password())
+            .service(service)
+            .cloud_sync(Some(false))
+            .load_attributes(true)
+            .limit(Limit::All);
+        #[cfg(target_os = "macos")]
+        options.ignore_legacy_keychains();
+
+        let results = match options.search() {
+            Ok(results) => results,
+            Err(error) if error.code() == ERR_SEC_ITEM_NOT_FOUND => return Ok(Vec::new()),
+            Err(error) => return Err(error.code()),
+        };
+        results
+            .into_iter()
+            .map(|result| match result {
+                SearchResult::Dict(_) => result
+                    .simplify_dict()
+                    .and_then(|attributes| attributes.get(ACCOUNT_ATTRIBUTE).cloned())
+                    .ok_or(ERR_SEC_DECODE),
+                _ => Err(ERR_SEC_DECODE),
+            })
+            .collect()
+    }
+}
+
+/// Stores VniDrop's protected material in Apple's device-local data-protection Keychain.
+pub(crate) struct AppleKeychainSecretStore {
+    api: Arc<dyn AppleKeychainApi>,
+}
+
+impl AppleKeychainSecretStore {
+    pub(crate) fn new() -> Self {
+        Self {
+            api: Arc::new(SystemAppleKeychain),
+        }
+    }
+
+    #[cfg(test)]
+    pub(crate) fn with_api(api: impl AppleKeychainApi + 'static) -> Self {
+        Self { api: Arc::new(api) }
+    }
+}
+
+impl SecureSecretStore for AppleKeychainSecretStore {
+    fn put(
+        &self,
+        handle: &SecretHandle,
+        material: SecretMaterial,
+    ) -> Result<(), SecureSecretStoreError> {
+        self.api
+            .put(
+                SERVICE,
+                handle.as_str(),
+                &material.0,
+                AppleKeychainPolicy::default(),
+            )
+            .map_err(map_status)
+    }
+
+    fn get(&self, handle: &SecretHandle) -> Result<SecretMaterial, SecureSecretStoreError> {
+        let material = self.api.get(SERVICE, handle.as_str()).map_err(map_status)?;
+        SecretMaterial::new(material).map_err(|_| SecureSecretStoreError::Corrupted)
+    }
+
+    fn delete(&self, handle: &SecretHandle) -> Result<(), SecureSecretStoreError> {
+        self.api
+            .delete(SERVICE, handle.as_str())
+            .map_err(map_status)
+    }
+
+    fn list_handles(&self) -> Result<Vec<SecretHandle>, SecureSecretStoreError> {
+        self.api
+            .list_accounts(SERVICE)
+            .map(|accounts| accounts.into_iter().map(SecretHandle).collect())
+            .map_err(map_status)
+    }
+}
+
+fn map_status(status: i32) -> SecureSecretStoreError {
+    match status {
+        ERR_SEC_ITEM_NOT_FOUND => SecureSecretStoreError::Missing,
+        ERR_SEC_INTERACTION_NOT_ALLOWED | ERR_SEC_AUTH_FAILED => SecureSecretStoreError::Locked,
+        ERR_SEC_DECODE | ERR_SEC_PARAM => SecureSecretStoreError::Corrupted,
+        ERR_SEC_NOT_AVAILABLE | ERR_SEC_MISSING_ENTITLEMENT => SecureSecretStoreError::Unavailable,
+        _ => SecureSecretStoreError::Unavailable,
+    }
+}
+
+#[cfg(test)]
+pub(crate) fn expected_policy_for_test() -> AppleKeychainPolicy {
+    AppleKeychainPolicy::default()
+}
+
+#[cfg(test)]
+pub(crate) fn service_for_test() -> &'static str {
+    SERVICE
+}
+
+#[cfg(test)]
+pub(crate) fn handle_for_test(value: &str) -> SecretHandle {
+    SecretHandle(value.to_string())
+}
+
+#[cfg(test)]
+pub(crate) fn map_status_for_test(status: i32) -> SecureSecretStoreError {
+    map_status(status)
+}

crates/vnidrop/src/secure_secret/linux.rs

@@ -0,0 +1,181 @@
+use std::{collections::HashMap, sync::Arc};
+
+use secret_service::{blocking::SecretService, EncryptionType, Error};
+
+use super::{
+    SecretHandle, SecretMaterial, SecureSecretStore, SecureSecretStoreError, HANDLE_NAMESPACE,
+    HANDLE_VERSION,
+};
+
+const ATTRIBUTE_APPLICATION: &str = "application";
+const ATTRIBUTE_HANDLE: &str = "vnidrop-handle";
+const APPLICATION_ID: &str = "com.vnidrop.VniDrop";
+const ITEM_LABEL: &str = "VniDrop protected secret";
+
+pub(crate) trait LinuxSecretServiceApi: Send + Sync {
+    fn put(&self, handle: &str, material: &[u8]) -> Result<(), SecureSecretStoreError>;
+    fn get(&self, handle: &str) -> Result<Vec<u8>, SecureSecretStoreError>;
+    fn delete(&self, handle: &str) -> Result<(), SecureSecretStoreError>;
+    fn list_handles(&self) -> Result<Vec<String>, SecureSecretStoreError>;
+}
+
+struct SystemLinuxSecretService;
+
+impl SystemLinuxSecretService {
+    fn connect() -> Result<Self, SecureSecretStoreError> {
+        SecretService::connect(EncryptionType::Dh).map_err(map_error)?;
+        Ok(Self)
+    }
+
+    fn service(&self) -> Result<SecretService<'_>, SecureSecretStoreError> {
+        SecretService::connect(EncryptionType::Dh).map_err(map_error)
+    }
+}
+
+impl LinuxSecretServiceApi for SystemLinuxSecretService {
+    fn put(&self, handle: &str, material: &[u8]) -> Result<(), SecureSecretStoreError> {
+        let service = self.service()?;
+        let collection = service.get_default_collection().map_err(map_error)?;
+        if collection.is_locked().map_err(map_error)? {
+            return Err(SecureSecretStoreError::Locked);
+        }
+        collection
+            .create_item(
+                ITEM_LABEL,
+                HashMap::from([
+                    (ATTRIBUTE_APPLICATION, APPLICATION_ID),
+                    (ATTRIBUTE_HANDLE, handle),
+                ]),
+                material,
+                true,
+                "application/octet-stream",
+            )
+            .map_err(map_error)?;
+        Ok(())
+    }
+
+    fn get(&self, handle: &str) -> Result<Vec<u8>, SecureSecretStoreError> {
+        let service = self.service()?;
+        let result = service
+            .search_items(HashMap::from([
+                (ATTRIBUTE_APPLICATION, APPLICATION_ID),
+                (ATTRIBUTE_HANDLE, handle),
+            ]))
+            .map_err(map_error)?;
+        if !result.locked.is_empty() {
+            return Err(SecureSecretStoreError::Locked);
+        }
+        let mut items = result.unlocked.into_iter();
+        let item = items.next().ok_or(SecureSecretStoreError::Missing)?;
+        if items.next().is_some() {
+            return Err(SecureSecretStoreError::Corrupted);
+        }
+        item.get_secret().map_err(map_error)
+    }
+
+    fn delete(&self, handle: &str) -> Result<(), SecureSecretStoreError> {
+        let service = self.service()?;
+        let result = service
+            .search_items(HashMap::from([
+                (ATTRIBUTE_APPLICATION, APPLICATION_ID),
+                (ATTRIBUTE_HANDLE, handle),
+            ]))
+            .map_err(map_error)?;
+        if !result.locked.is_empty() {
+            return Err(SecureSecretStoreError::Locked);
+        }
+        if result.unlocked.is_empty() {
+            return Err(SecureSecretStoreError::Missing);
+        }
+        for item in result.unlocked {
+            item.delete().map_err(map_error)?;
+        }
+        Ok(())
+    }
+
+    fn list_handles(&self) -> Result<Vec<String>, SecureSecretStoreError> {
+        let service = self.service()?;
+        let result = service
+            .search_items(HashMap::from([(ATTRIBUTE_APPLICATION, APPLICATION_ID)]))
+            .map_err(map_error)?;
+        if !result.locked.is_empty() {
+            return Err(SecureSecretStoreError::Locked);
+        }
+        result
+            .unlocked
+            .into_iter()
+            .map(|item| {
+                item.get_attributes()
+                    .map_err(map_error)?
+                    .remove(ATTRIBUTE_HANDLE)
+                    .ok_or(SecureSecretStoreError::Corrupted)
+            })
+            .collect()
+    }
+}
+
+pub(crate) struct LinuxSecretServiceStore {
+    api: Arc<dyn LinuxSecretServiceApi>,
+}
+
+impl LinuxSecretServiceStore {
+    pub(super) fn connect() -> Result<Self, SecureSecretStoreError> {
+        Ok(Self {
+            api: Arc::new(SystemLinuxSecretService::connect()?),
+        })
+    }
+
+    #[cfg(test)]
+    pub(crate) fn with_api(api: Arc<dyn LinuxSecretServiceApi>) -> Self {
+        Self { api }
+    }
+}
+
+impl SecureSecretStore for LinuxSecretServiceStore {
+    fn put(
+        &self,
+        handle: &SecretHandle,
+        material: SecretMaterial,
+    ) -> Result<(), SecureSecretStoreError> {
+        self.api.put(handle.as_str(), &material.0)
+    }
+
+    fn get(&self, handle: &SecretHandle) -> Result<SecretMaterial, SecureSecretStoreError> {
+        let bytes = self.api.get(handle.as_str())?;
+        SecretMaterial::new(bytes).map_err(|_| SecureSecretStoreError::Corrupted)
+    }
+
+    fn delete(&self, handle: &SecretHandle) -> Result<(), SecureSecretStoreError> {
+        self.api.delete(handle.as_str())
+    }
+
+    fn list_handles(&self) -> Result<Vec<SecretHandle>, SecureSecretStoreError> {
+        let expected_prefix = format!("{HANDLE_NAMESPACE}/{HANDLE_VERSION}/");
+        let mut handles = self
+            .api
+            .list_handles()?
+            .into_iter()
+            .map(|handle| {
+                if handle.starts_with(&expected_prefix) {
+                    Ok(SecretHandle(handle))
+                } else {
+                    Err(SecureSecretStoreError::Corrupted)
+                }
+            })
+            .collect::<Result<Vec<_>, _>>()?;
+        handles.sort_by(|left, right| left.as_str().cmp(right.as_str()));
+        Ok(handles)
+    }
+}
+
+pub(crate) fn map_error(error: Error) -> SecureSecretStoreError {
+    match error {
+        Error::Locked | Error::Prompt => SecureSecretStoreError::Locked,
+        Error::NoResult => SecureSecretStoreError::Missing,
+        Error::Crypto(_) => SecureSecretStoreError::Corrupted,
+        Error::Unavailable | Error::Zvariant(_) | Error::Zbus(_) | Error::ZbusFdo(_) => {
+            SecureSecretStoreError::Unavailable
+        }
+        _ => SecureSecretStoreError::Unavailable,
+    }
+}

crates/vnidrop/src/secure_secret/platform.rs

@@ -0,0 +1,138 @@
+use std::{
+    fs::{File, OpenOptions},
+    path::Path,
+    sync::Arc,
+};
+
+#[cfg(any(target_os = "android", target_os = "windows", target_os = "linux"))]
+use super::map_store_error;
+use super::{
+    SecretHandle, SecretMaterial, SecureSecretStore, SecureSecretStoreError, HANDLE_NAMESPACE,
+    HANDLE_VERSION,
+};
+use crate::error::VnidropError;
+
+struct ScopedSecretStore {
+    inner: Arc<dyn SecureSecretStore>,
+    physical_prefix: String,
+}
+
+pub(crate) struct ProfileLock {
+    _file: File,
+}
+
+pub(crate) fn lock_profile(app_data_dir: &Path) -> Result<ProfileLock, VnidropError> {
+    let file = OpenOptions::new()
+        .create(true)
+        .truncate(false)
+        .read(true)
+        .write(true)
+        .open(app_data_dir.join("protected-secrets.lock"))
+        .map_err(VnidropError::filesystem)?;
+    file.try_lock()
+        .map_err(|_| VnidropError::SecureStorageUnavailable {
+            reason: "another protected core is already using this profile".to_string(),
+        })?;
+    Ok(ProfileLock { _file: file })
+}
+
+impl ScopedSecretStore {
+    fn new(app_data_dir: &Path, inner: Arc<dyn SecureSecretStore>) -> Self {
+        let profile = blake3::hash(app_data_dir.to_string_lossy().as_bytes()).to_hex();
+        Self {
+            inner,
+            physical_prefix: format!("{HANDLE_NAMESPACE}/{HANDLE_VERSION}/scope-{profile}/"),
+        }
+    }
+
+    fn physical_handle(
+        &self,
+        handle: &SecretHandle,
+    ) -> Result<SecretHandle, SecureSecretStoreError> {
+        let logical_prefix = format!("{HANDLE_NAMESPACE}/{HANDLE_VERSION}/");
+        let suffix = handle
+            .as_str()
+            .strip_prefix(&logical_prefix)
+            .ok_or(SecureSecretStoreError::Corrupted)?;
+        Ok(SecretHandle(format!("{}{suffix}", self.physical_prefix)))
+    }
+}
+
+impl SecureSecretStore for ScopedSecretStore {
+    fn put(
+        &self,
+        handle: &SecretHandle,
+        material: SecretMaterial,
+    ) -> Result<(), SecureSecretStoreError> {
+        self.inner.put(&self.physical_handle(handle)?, material)
+    }
+
+    fn get(&self, handle: &SecretHandle) -> Result<SecretMaterial, SecureSecretStoreError> {
+        self.inner.get(&self.physical_handle(handle)?)
+    }
+
+    fn delete(&self, handle: &SecretHandle) -> Result<(), SecureSecretStoreError> {
+        self.inner.delete(&self.physical_handle(handle)?)
+    }
+
+    fn list_handles(&self) -> Result<Vec<SecretHandle>, SecureSecretStoreError> {
+        let handles = self
+            .inner
+            .list_handles()?
+            .into_iter()
+            .filter_map(|handle| {
+                handle
+                    .as_str()
+                    .strip_prefix(&self.physical_prefix)
+                    .map(|suffix| {
+                        SecretHandle(format!("{HANDLE_NAMESPACE}/{HANDLE_VERSION}/{suffix}"))
+                    })
+            })
+            .collect();
+        Ok(handles)
+    }
+}
+
+pub(crate) fn scope_store(
+    app_data_dir: &Path,
+    store: Arc<dyn SecureSecretStore>,
+) -> Arc<dyn SecureSecretStore> {
+    Arc::new(ScopedSecretStore::new(app_data_dir, store))
+}
+
+#[cfg(any(target_os = "macos", target_os = "ios"))]
+pub(crate) fn platform_secret_store(
+    app_data_dir: &Path,
+) -> Result<Arc<dyn SecureSecretStore>, VnidropError> {
+    Ok(scope_store(
+        app_data_dir,
+        Arc::new(super::apple::AppleKeychainSecretStore::new()),
+    ))
+}
+
+#[cfg(target_os = "android")]
+pub(crate) fn platform_secret_store(
+    app_data_dir: &Path,
+) -> Result<Arc<dyn SecureSecretStore>, VnidropError> {
+    super::android::native::create_store_from_android_runtime()
+        .map(|store| scope_store(app_data_dir, store))
+        .map_err(map_store_error)
+}
+
+#[cfg(target_os = "windows")]
+pub(crate) fn platform_secret_store(
+    app_data_dir: &Path,
+) -> Result<Arc<dyn SecureSecretStore>, VnidropError> {
+    super::windows::WindowsDpapiSecretStore::new(app_data_dir.join("protected-secrets-v1"))
+        .map(|store| scope_store(app_data_dir, Arc::new(store)))
+        .map_err(map_store_error)
+}
+
+#[cfg(target_os = "linux")]
+pub(crate) fn platform_secret_store(
+    app_data_dir: &Path,
+) -> Result<Arc<dyn SecureSecretStore>, VnidropError> {
+    super::linux::LinuxSecretServiceStore::connect()
+        .map(|store| scope_store(app_data_dir, Arc::new(store)))
+        .map_err(map_store_error)
+}

crates/vnidrop/src/secure_secret/windows.rs

@@ -0,0 +1,473 @@
+use std::{
+    collections::HashSet,
+    ffi::OsStr,
+    fs::{self, OpenOptions},
+    io::{self, Write},
+    os::windows::ffi::OsStrExt,
+    path::{Path, PathBuf},
+    ptr,
+    sync::Arc,
+};
+
+use data_encoding::HEXLOWER;
+use windows_sys::Win32::{
+    Foundation::{
+        GetLastError, LocalFree, ERROR_ACCESS_DENIED, ERROR_ALREADY_EXISTS,
+        ERROR_CALL_NOT_IMPLEMENTED, ERROR_FILE_EXISTS, ERROR_NOT_SUPPORTED,
+        ERROR_PASSWORD_RESTRICTION,
+    },
+    Security::Cryptography::{
+        CryptProtectData, CryptUnprotectData, CRYPTPROTECT_UI_FORBIDDEN, CRYPT_INTEGER_BLOB,
+    },
+    Storage::FileSystem::{MoveFileExW, MOVEFILE_REPLACE_EXISTING, MOVEFILE_WRITE_THROUGH},
+};
+
+use super::{SecretHandle, SecretMaterial, SecureSecretStore, SecureSecretStoreError};
+
+#[cfg(test)]
+use super::SecretKind;
+
+const ENVELOPE_MAGIC: &[u8; 8] = b"VNIDPAPI";
+const ENVELOPE_VERSION: u8 = 1;
+const FILE_EXTENSION: &str = "dpapi";
+const MAX_ENVELOPE_BYTES: usize = 64 * 1024;
+const DEFAULT_CONTEXT: &[u8] = b"com.vnidrop.secure-secret.dpapi.v1.current-user";
+const PROTECTED_PAYLOAD_MAGIC: &[u8] = b"VNIDROP-SECRET-V1";
+
+/// Current-user DPAPI storage backed by atomically published protected blobs.
+pub(crate) struct WindowsDpapiSecretStore {
+    directory: PathBuf,
+    protector: Arc<DpapiProtector>,
+}
+
+impl WindowsDpapiSecretStore {
+    pub(crate) fn new(directory: impl AsRef<Path>) -> Result<Self, SecureSecretStoreError> {
+        Self::with_protector(directory, Arc::new(DpapiProtector::new()))
+    }
+
+    fn with_protector(
+        directory: impl AsRef<Path>,
+        protector: Arc<DpapiProtector>,
+    ) -> Result<Self, SecureSecretStoreError> {
+        let directory = directory.as_ref().to_path_buf();
+        fs::create_dir_all(&directory).map_err(map_io_error)?;
+        cleanup_interrupted_writes(&directory)?;
+        Ok(Self {
+            directory,
+            protector,
+        })
+    }
+
+    fn path_for(&self, handle: &SecretHandle) -> PathBuf {
+        let digest = blake3::hash(handle.as_str().as_bytes());
+        self.directory.join(format!(
+            "{}.{}",
+            HEXLOWER.encode(digest.as_bytes()),
+            FILE_EXTENSION
+        ))
+    }
+
+    #[cfg(test)]
+    pub(crate) fn with_context_for_test(
+        directory: impl AsRef<Path>,
+        context: &[u8],
+    ) -> Result<Self, SecureSecretStoreError> {
+        Self::with_protector(
+            directory,
+            Arc::new(DpapiProtector::with_context_for_test(context)),
+        )
+    }
+
+    #[cfg(test)]
+    pub(crate) fn path_for_test(&self, handle: &SecretHandle) -> PathBuf {
+        self.path_for(handle)
+    }
+
+    #[cfg(test)]
+    pub(crate) fn relationship_handle_for_test() -> SecretHandle {
+        SecretHandle::generate(SecretKind::RelationshipGrant)
+    }
+}
+
+impl SecureSecretStore for WindowsDpapiSecretStore {
+    fn put(
+        &self,
+        handle: &SecretHandle,
+        material: SecretMaterial,
+    ) -> Result<(), SecureSecretStoreError> {
+        let destination = self.path_for(handle);
+        let replace_existing = match self.get(handle) {
+            Ok(existing) if existing == material => return Ok(()),
+            Ok(_) => true,
+            Err(SecureSecretStoreError::Missing) => false,
+            Err(error) => return Err(error),
+        };
+
+        let ciphertext = self.protector.protect(handle, &material.0)?;
+        let envelope = encode_envelope(handle, &ciphertext)?;
+        let temporary = self.directory.join(format!(
+            "{}.tmp-{}",
+            destination
+                .file_stem()
+                .and_then(OsStr::to_str)
+                .ok_or(SecureSecretStoreError::Unavailable)?,
+            uuid::Uuid::new_v4()
+        ));
+        let mut temporary_guard = TemporaryFile::new(temporary);
+        let mut file = OpenOptions::new()
+            .write(true)
+            .create_new(true)
+            .open(temporary_guard.path())
+            .map_err(map_io_error)?;
+        file.write_all(&envelope).map_err(map_io_error)?;
+        file.sync_all().map_err(map_io_error)?;
+        drop(file);
+
+        match move_write_through(temporary_guard.path(), &destination, replace_existing) {
+            Ok(()) => {
+                temporary_guard.disarm();
+                Ok(())
+            }
+            Err(error)
+                if matches!(
+                    error.raw_os_error().map(|code| code as u32),
+                    Some(ERROR_ALREADY_EXISTS) | Some(ERROR_FILE_EXISTS)
+                ) =>
+            {
+                match self.get(handle) {
+                    Ok(existing) if existing == material => Ok(()),
+                    Ok(_) => {
+                        move_write_through(temporary_guard.path(), &destination, true)
+                            .map_err(map_io_error)?;
+                        temporary_guard.disarm();
+                        Ok(())
+                    }
+                    Err(error) => Err(error),
+                }
+            }
+            Err(error) => Err(map_io_error(error)),
+        }
+    }
+
+    fn get(&self, handle: &SecretHandle) -> Result<SecretMaterial, SecureSecretStoreError> {
+        let envelope = fs::read(self.path_for(handle)).map_err(map_io_error)?;
+        let ciphertext = decode_envelope(&envelope, handle)?;
+        let plaintext = self.protector.unprotect(handle, ciphertext)?;
+        SecretMaterial::new(plaintext).map_err(|_| SecureSecretStoreError::Corrupted)
+    }
+
+    fn delete(&self, handle: &SecretHandle) -> Result<(), SecureSecretStoreError> {
+        fs::remove_file(self.path_for(handle)).map_err(map_io_error)
+    }
+
+    fn list_handles(&self) -> Result<Vec<SecretHandle>, SecureSecretStoreError> {
+        let mut handles = Vec::new();
+        let mut unique = HashSet::new();
+        for entry in fs::read_dir(&self.directory).map_err(map_io_error)? {
+            let entry = entry.map_err(map_io_error)?;
+            let path = entry.path();
+            if path.extension() != Some(OsStr::new(FILE_EXTENSION)) {
+                continue;
+            }
+            let envelope = fs::read(&path).map_err(map_io_error)?;
+            let (handle, _) = decode_envelope_parts(&envelope)?;
+            if self.path_for(&handle) != path || !unique.insert(handle.clone()) {
+                return Err(SecureSecretStoreError::Corrupted);
+            }
+            handles.push(handle);
+        }
+        handles.sort_by(|left, right| left.as_str().cmp(right.as_str()));
+        Ok(handles)
+    }
+}
+
+fn encode_envelope(
+    handle: &SecretHandle,
+    ciphertext: &[u8],
+) -> Result<Vec<u8>, SecureSecretStoreError> {
+    let handle_bytes = handle.as_str().as_bytes();
+    let handle_len =
+        u16::try_from(handle_bytes.len()).map_err(|_| SecureSecretStoreError::Unavailable)?;
+    let ciphertext_len =
+        u32::try_from(ciphertext.len()).map_err(|_| SecureSecretStoreError::Unavailable)?;
+    let capacity = ENVELOPE_MAGIC.len() + 1 + 2 + 4 + handle_bytes.len() + ciphertext.len();
+    if capacity > MAX_ENVELOPE_BYTES {
+        return Err(SecureSecretStoreError::Unavailable);
+    }
+    let mut envelope = Vec::with_capacity(capacity);
+    envelope.extend_from_slice(ENVELOPE_MAGIC);
+    envelope.push(ENVELOPE_VERSION);
+    envelope.extend_from_slice(&handle_len.to_le_bytes());
+    envelope.extend_from_slice(&ciphertext_len.to_le_bytes());
+    envelope.extend_from_slice(handle_bytes);
+    envelope.extend_from_slice(ciphertext);
+    Ok(envelope)
+}
+
+fn decode_envelope<'a>(
+    envelope: &'a [u8],
+    expected_handle: &SecretHandle,
+) -> Result<&'a [u8], SecureSecretStoreError> {
+    let (handle, ciphertext) = decode_envelope_parts(envelope)?;
+    if handle != *expected_handle {
+        return Err(SecureSecretStoreError::Corrupted);
+    }
+    Ok(ciphertext)
+}
+
+fn decode_envelope_parts(envelope: &[u8]) -> Result<(SecretHandle, &[u8]), SecureSecretStoreError> {
+    const HEADER_BYTES: usize = 8 + 1 + 2 + 4;
+    if envelope.len() < HEADER_BYTES
+        || envelope.len() > MAX_ENVELOPE_BYTES
+        || &envelope[..8] != ENVELOPE_MAGIC
+        || envelope[8] != ENVELOPE_VERSION
+    {
+        return Err(SecureSecretStoreError::Corrupted);
+    }
+    let handle_len = usize::from(u16::from_le_bytes([envelope[9], envelope[10]]));
+    let ciphertext_len =
+        u32::from_le_bytes([envelope[11], envelope[12], envelope[13], envelope[14]]) as usize;
+    let handle_end = HEADER_BYTES
+        .checked_add(handle_len)
+        .ok_or(SecureSecretStoreError::Corrupted)?;
+    let envelope_end = handle_end
+        .checked_add(ciphertext_len)
+        .ok_or(SecureSecretStoreError::Corrupted)?;
+    if handle_len == 0 || ciphertext_len == 0 || envelope_end != envelope.len() {
+        return Err(SecureSecretStoreError::Corrupted);
+    }
+    let handle = std::str::from_utf8(&envelope[HEADER_BYTES..handle_end])
+        .map_err(|_| SecureSecretStoreError::Corrupted)?;
+    Ok((
+        SecretHandle(handle.to_owned()),
+        &envelope[handle_end..envelope_end],
+    ))
+}
+
+fn cleanup_interrupted_writes(directory: &Path) -> Result<(), SecureSecretStoreError> {
+    for entry in fs::read_dir(directory).map_err(map_io_error)? {
+        let entry = entry.map_err(map_io_error)?;
+        let name = entry.file_name();
+        if name.to_string_lossy().contains(".tmp-") {
+            fs::remove_file(entry.path()).map_err(map_io_error)?;
+        }
+    }
+    Ok(())
+}
+
+struct TemporaryFile {
+    path: PathBuf,
+    armed: bool,
+}
+
+impl TemporaryFile {
+    fn new(path: PathBuf) -> Self {
+        Self { path, armed: true }
+    }
+
+    fn path(&self) -> &Path {
+        &self.path
+    }
+
+    fn disarm(&mut self) {
+        self.armed = false;
+    }
+}
+
+impl Drop for TemporaryFile {
+    fn drop(&mut self) {
+        if self.armed {
+            let _ = fs::remove_file(&self.path);
+        }
+    }
+}
+
+fn move_write_through(source: &Path, destination: &Path, replace_existing: bool) -> io::Result<()> {
+    let source = wide_path(source);
+    let destination = wide_path(destination);
+    // The files share a directory, so MoveFileEx publishes the fully flushed blob as one rename.
+    let flags = if replace_existing {
+        MOVEFILE_WRITE_THROUGH | MOVEFILE_REPLACE_EXISTING
+    } else {
+        MOVEFILE_WRITE_THROUGH
+    };
+    let moved = unsafe { MoveFileExW(source.as_ptr(), destination.as_ptr(), flags) };
+    if moved == 0 {
+        Err(io::Error::last_os_error())
+    } else {
+        Ok(())
+    }
+}
+
+fn wide_path(path: &Path) -> Vec<u16> {
+    path.as_os_str().encode_wide().chain(Some(0)).collect()
+}
+
+struct DpapiProtector {
+    context: Vec<u8>,
+}
+
+impl DpapiProtector {
+    fn new() -> Self {
+        Self {
+            context: DEFAULT_CONTEXT.to_vec(),
+        }
+    }
+
+    #[cfg(test)]
+    fn with_context_for_test(context: &[u8]) -> Self {
+        Self {
+            context: context.to_vec(),
+        }
+    }
+
+    fn entropy(&self, handle: &SecretHandle) -> [u8; 32] {
+        let mut hasher = blake3::Hasher::new();
+        hasher.update(&self.context);
+        hasher.update(&[0]);
+        hasher.update(handle.as_str().as_bytes());
+        *hasher.finalize().as_bytes()
+    }
+
+    fn protect(
+        &self,
+        handle: &SecretHandle,
+        plaintext: &[u8],
+    ) -> Result<Vec<u8>, SecureSecretStoreError> {
+        let mut payload = encode_protected_payload(plaintext)?;
+        let input = blob(&payload)?;
+        let entropy_bytes = self.entropy(handle);
+        let entropy = blob(&entropy_bytes)?;
+        let mut output = CRYPT_INTEGER_BLOB::default();
+        // Omitting CRYPTPROTECT_LOCAL_MACHINE binds the blob to the current Windows user.
+        let success = unsafe {
+            CryptProtectData(
+                &input,
+                ptr::null(),
+                &entropy,
+                ptr::null(),
+                ptr::null(),
+                CRYPTPROTECT_UI_FORBIDDEN,
+                &mut output,
+            )
+        };
+        let result = if success == 0 {
+            Err(map_dpapi_error(false))
+        } else {
+            copy_and_free(output, false)
+        };
+        payload.fill(0);
+        result
+    }
+
+    fn unprotect(
+        &self,
+        handle: &SecretHandle,
+        ciphertext: &[u8],
+    ) -> Result<Vec<u8>, SecureSecretStoreError> {
+        let input = blob(ciphertext)?;
+        let entropy_bytes = self.entropy(handle);
+        let entropy = blob(&entropy_bytes)?;
+        let mut output = CRYPT_INTEGER_BLOB::default();
+        let success = unsafe {
+            CryptUnprotectData(
+                &input,
+                ptr::null_mut(),
+                &entropy,
+                ptr::null(),
+                ptr::null(),
+                CRYPTPROTECT_UI_FORBIDDEN,
+                &mut output,
+            )
+        };
+        if success == 0 {
+            return Err(map_dpapi_error(true));
+        }
+        let mut payload = copy_and_free(output, true)?;
+        let plaintext = decode_protected_payload(&payload).map(<[u8]>::to_vec);
+        payload.fill(0);
+        plaintext
+    }
+}
+
+fn encode_protected_payload(plaintext: &[u8]) -> Result<Vec<u8>, SecureSecretStoreError> {
+    let length = u32::try_from(plaintext.len()).map_err(|_| SecureSecretStoreError::Unavailable)?;
+    let mut payload = Vec::with_capacity(PROTECTED_PAYLOAD_MAGIC.len() + 4 + plaintext.len() + 32);
+    payload.extend_from_slice(PROTECTED_PAYLOAD_MAGIC);
+    payload.extend_from_slice(&length.to_le_bytes());
+    payload.extend_from_slice(plaintext);
+    let digest = blake3::hash(&payload);
+    payload.extend_from_slice(digest.as_bytes());
+    Ok(payload)
+}
+
+fn decode_protected_payload(payload: &[u8]) -> Result<&[u8], SecureSecretStoreError> {
+    let header_end = PROTECTED_PAYLOAD_MAGIC.len() + 4;
+    if payload.len() < header_end + 32 || !payload.starts_with(PROTECTED_PAYLOAD_MAGIC) {
+        return Err(SecureSecretStoreError::Corrupted);
+    }
+    let length = u32::from_le_bytes(
+        payload[PROTECTED_PAYLOAD_MAGIC.len()..header_end]
+            .try_into()
+            .map_err(|_| SecureSecretStoreError::Corrupted)?,
+    ) as usize;
+    let material_end = header_end
+        .checked_add(length)
+        .ok_or(SecureSecretStoreError::Corrupted)?;
+    if material_end
+        .checked_add(32)
+        .ok_or(SecureSecretStoreError::Corrupted)?
+        != payload.len()
+    {
+        return Err(SecureSecretStoreError::Corrupted);
+    }
+    let expected = blake3::hash(&payload[..material_end]);
+    if expected.as_bytes() != &payload[material_end..] {
+        return Err(SecureSecretStoreError::Corrupted);
+    }
+    Ok(&payload[header_end..material_end])
+}
+
+fn blob(bytes: &[u8]) -> Result<CRYPT_INTEGER_BLOB, SecureSecretStoreError> {
+    Ok(CRYPT_INTEGER_BLOB {
+        cbData: u32::try_from(bytes.len()).map_err(|_| SecureSecretStoreError::Unavailable)?,
+        pbData: bytes.as_ptr().cast_mut(),
+    })
+}
+
+fn copy_and_free(
+    output: CRYPT_INTEGER_BLOB,
+    clear_before_free: bool,
+) -> Result<Vec<u8>, SecureSecretStoreError> {
+    if output.pbData.is_null() || output.cbData == 0 {
+        return Err(SecureSecretStoreError::Corrupted);
+    }
+    let result = unsafe {
+        let bytes = std::slice::from_raw_parts(output.pbData, output.cbData as usize).to_vec();
+        if clear_before_free {
+            ptr::write_bytes(output.pbData, 0, output.cbData as usize);
+        }
+        LocalFree(output.pbData.cast());
+        bytes
+    };
+    Ok(result)
+}
+
+fn map_dpapi_error(unprotecting: bool) -> SecureSecretStoreError {
+    let code = unsafe { GetLastError() };
+    match code {
+        ERROR_ACCESS_DENIED | ERROR_PASSWORD_RESTRICTION => SecureSecretStoreError::Locked,
+        ERROR_NOT_SUPPORTED | ERROR_CALL_NOT_IMPLEMENTED => SecureSecretStoreError::Unavailable,
+        _ if unprotecting => SecureSecretStoreError::Corrupted,
+        _ => SecureSecretStoreError::Unavailable,
+    }
+}
+
+fn map_io_error(error: io::Error) -> SecureSecretStoreError {
+    match error.kind() {
+        io::ErrorKind::NotFound => SecureSecretStoreError::Missing,
+        io::ErrorKind::PermissionDenied => SecureSecretStoreError::Locked,
+        io::ErrorKind::InvalidData => SecureSecretStoreError::Corrupted,
+        _ => SecureSecretStoreError::Unavailable,
+    }
+}

crates/vnidrop/src/targeted_transfer.rs

@@ -0,0 +1,59 @@
+use crate::{api::TargetedTransferState, error::VnidropError};
+
+impl TargetedTransferState {
+    /// Validates a durable state change without exposing foreign state mutation.
+    pub fn validate_transition_to(self, next: Self) -> Result<(), VnidropError> {
+        let allowed = matches!(
+            (self, next),
+            (
+                Self::Preparing,
+                Self::Offering | Self::Cancelled | Self::Failed
+            ) | (
+                Self::Offering,
+                Self::AwaitingApproval | Self::Cancelled | Self::Failed
+            ) | (
+                Self::AwaitingApproval,
+                Self::Approved | Self::Declined | Self::Cancelled | Self::Failed
+            ) | (
+                Self::Approved,
+                Self::Connecting | Self::Cancelled | Self::Failed
+            ) | (
+                Self::Connecting,
+                Self::Transferring | Self::Interrupted | Self::Cancelled | Self::Failed
+            ) | (
+                Self::Transferring,
+                Self::Completed | Self::Interrupted | Self::Cancelled | Self::Failed
+            ) | (
+                Self::Interrupted,
+                Self::Connecting | Self::Cancelled | Self::Failed | Self::Deleted
+            ) | (
+                Self::Completed | Self::Declined | Self::Cancelled | Self::Failed,
+                Self::Deleted
+            )
+        );
+        if allowed {
+            Ok(())
+        } else {
+            Err(VnidropError::InvalidTransition {
+                reason: format!("{} -> {}", self.as_str(), next.as_str()),
+            })
+        }
+    }
+
+    const fn as_str(self) -> &'static str {
+        match self {
+            Self::Preparing => "preparing",
+            Self::Offering => "offering",
+            Self::AwaitingApproval => "awaiting_approval",
+            Self::Approved => "approved",
+            Self::Connecting => "connecting",
+            Self::Transferring => "transferring",
+            Self::Interrupted => "interrupted",
+            Self::Completed => "completed",
+            Self::Declined => "declined",
+            Self::Cancelled => "cancelled",
+            Self::Failed => "failed",
+            Self::Deleted => "deleted",
+        }
+    }
+}

crates/vnidrop/src/tests.rs

@@ -1,9 +1,15 @@
 #[path = "tests/access_policy.rs"]
 mod access_policy_tests;
+#[path = "tests/contact_polling.rs"]
+mod contact_polling_tests;
+#[path = "tests/contacts.rs"]
+mod contacts_tests;
 #[path = "tests/error.rs"]
 mod error_tests;
 #[path = "tests/filesystem.rs"]
 mod filesystem_tests;
+#[path = "tests/grant.rs"]
+mod grant_tests;
 #[path = "tests/handshake.rs"]
 mod handshake_tests;
 #[path = "tests/limits.rs"]
@@ -16,6 +22,18 @@ mod repository_tests;
 mod runtime_tests;
 #[path = "tests/secret.rs"]
 mod secret_tests;
+#[path = "tests/secure_secret_android.rs"]
+mod secure_secret_android_tests;
+#[cfg(any(target_os = "macos", target_os = "ios"))]
+#[path = "tests/secure_secret_apple.rs"]
+mod secure_secret_apple_tests;
+#[path = "tests/secure_secret_linux.rs"]
+mod secure_secret_linux_tests;
+#[path = "tests/secure_secret.rs"]
+mod secure_secret_tests;
+#[cfg(target_os = "windows")]
+#[path = "tests/secure_secret_windows.rs"]
+mod secure_secret_windows_tests;
 #[path = "tests/ticket.rs"]
 mod ticket_tests;
 #[path = "tests/transfer_state.rs"]

crates/vnidrop/src/tests/contact_polling.rs

@@ -0,0 +1,30 @@
+use crate::runtime::should_poll;
+
+const MINUTE_MS: i64 = 60 * 1_000;
+const NOW: i64 = 1_700_000_000_000;
+
+#[test]
+fn a_device_never_polled_is_polled() {
+    assert!(should_poll(None, NOW));
+}
+
+#[test]
+fn a_device_polled_recently_is_skipped() {
+    // Switching in and out of the app must not re-announce presence.
+    assert!(!should_poll(Some(NOW), NOW));
+    assert!(!should_poll(Some(NOW - MINUTE_MS), NOW));
+    assert!(!should_poll(Some(NOW - 4 * MINUTE_MS), NOW));
+}
+
+#[test]
+fn a_device_polled_before_the_window_is_polled_again() {
+    assert!(should_poll(Some(NOW - 5 * MINUTE_MS), NOW));
+    assert!(should_poll(Some(NOW - 60 * MINUTE_MS), NOW));
+}
+
+/// A clock that jumped backwards must not lock polling out forever.
+#[test]
+fn a_future_timestamp_is_treated_as_recent_rather_than_permanent() {
+    assert!(!should_poll(Some(NOW + MINUTE_MS), NOW));
+    assert!(should_poll(Some(NOW + MINUTE_MS), NOW + 6 * MINUTE_MS));
+}

crates/vnidrop/src/tests/contacts.rs

@@ -0,0 +1,386 @@
+use crate::{
+    contacts::ContactStore,
+    grant::{Challenge, GrantId, GrantLifetime, GrantRejection, HeldGrant, IssuedGrant},
+    repository::Repository,
+};
+
+const PEER: &str = "peer-endpoint";
+const SELF_ID: &str = "self-endpoint";
+const NOW: i64 = 1_700_000_000_000;
+const DAY_MS: i64 = 24 * 60 * 60 * 1_000;
+
+async fn store(temp: &tempfile::TempDir) -> (Repository, ContactStore) {
+    let repository = Repository::open(temp.path()).await.unwrap();
+    let contacts = repository.contacts();
+    (repository, contacts)
+}
+
+async fn contact_with_issued_grant(contacts: &ContactStore) -> IssuedGrant {
+    contacts
+        .upsert_contact(PEER, Some("Peer Laptop"), NOW)
+        .await
+        .unwrap();
+    let grant = IssuedGrant::mint(PEER.to_string(), NOW, GrantLifetime::default());
+    contacts.insert_issued_grant(&grant).await.unwrap();
+    grant
+}
+
+#[tokio::test]
+async fn contacts_and_grants_survive_reopening_the_same_data_dir() {
+    let temp = tempfile::tempdir().unwrap();
+    let minted = {
+        let (repository, contacts) = store(&temp).await;
+        let grant = contact_with_issued_grant(&contacts).await;
+        contacts
+            .insert_held_grant(&HeldGrant {
+                grant_id: GrantId::generate(),
+                secret: grant.secret.clone(),
+                peer_endpoint_id: PEER.to_string(),
+                created_at: NOW,
+                expires_at: Some(NOW + 90 * DAY_MS),
+            })
+            .await
+            .unwrap();
+        drop(repository);
+        grant
+    };
+
+    let (_repository, contacts) = store(&temp).await;
+
+    let reloaded = contacts
+        .find_issued_grant(minted.grant_id)
+        .await
+        .unwrap()
+        .expect("issued grant persisted");
+    assert_eq!(reloaded.secret, minted.secret);
+    assert_eq!(reloaded.issued_to_endpoint_id, PEER);
+    assert!(contacts.held_grant_for(PEER).await.unwrap().is_some());
+    assert_eq!(contacts.list_contacts().await.unwrap().len(), 1);
+}
+
+#[tokio::test]
+async fn a_persisted_grant_still_validates_a_proof() {
+    let temp = tempfile::tempdir().unwrap();
+    let (_repository, contacts) = store(&temp).await;
+    let minted = contact_with_issued_grant(&contacts).await;
+
+    // The round trip through hex storage must not disturb the secret.
+    let reloaded = contacts
+        .find_issued_grant(minted.grant_id)
+        .await
+        .unwrap()
+        .expect("issued grant persisted");
+    let challenge = Challenge::generate();
+    let held = HeldGrant {
+        grant_id: minted.grant_id,
+        secret: minted.secret.clone(),
+        peer_endpoint_id: SELF_ID.to_string(),
+        created_at: NOW,
+        expires_at: None,
+    };
+
+    let outcome = reloaded.accept(
+        &held.prove(&challenge, PEER),
+        &challenge,
+        SELF_ID,
+        PEER,
+        NOW,
+        GrantLifetime::default(),
+    );
+
+    assert!(outcome.is_ok(), "expected acceptance, got {outcome:?}");
+}
+
+#[tokio::test]
+async fn renewal_is_persisted() {
+    let temp = tempfile::tempdir().unwrap();
+    let (_repository, contacts) = store(&temp).await;
+    let minted = contact_with_issued_grant(&contacts).await;
+    let renewed_to = Some(NOW + 120 * DAY_MS);
+
+    contacts
+        .renew_issued_grant(minted.grant_id, renewed_to)
+        .await
+        .unwrap();
+
+    let reloaded = contacts
+        .find_issued_grant(minted.grant_id)
+        .await
+        .unwrap()
+        .expect("issued grant persisted");
+    assert_eq!(reloaded.expires_at, renewed_to);
+}
+
+#[tokio::test]
+async fn revocation_is_tombstoned_so_the_peer_learns_it_was_revoked() {
+    let temp = tempfile::tempdir().unwrap();
+    let (_repository, contacts) = store(&temp).await;
+    let minted = contact_with_issued_grant(&contacts).await;
+
+    contacts
+        .revoke_issued_grant(minted.grant_id, NOW)
+        .await
+        .unwrap();
+
+    let reloaded = contacts
+        .find_issued_grant(minted.grant_id)
+        .await
+        .unwrap()
+        .expect("a revoked grant is kept as a tombstone, not deleted");
+    assert_eq!(reloaded.revoked_at, Some(NOW));
+
+    // A tombstone answers Revoked, never Unknown: the peer needs to know to
+    // drop the entry rather than retry forever.
+    let challenge = Challenge::generate();
+    let held = HeldGrant {
+        grant_id: minted.grant_id,
+        secret: minted.secret.clone(),
+        peer_endpoint_id: SELF_ID.to_string(),
+        created_at: NOW,
+        expires_at: None,
+    };
+    assert_eq!(
+        reloaded.accept(
+            &held.prove(&challenge, PEER),
+            &challenge,
+            SELF_ID,
+            PEER,
+            NOW,
+            GrantLifetime::default(),
+        ),
+        Err(GrantRejection::Revoked)
+    );
+}
+
+#[tokio::test]
+async fn deleting_a_contact_removes_both_directions_and_reports_issued_grants() {
+    let temp = tempfile::tempdir().unwrap();
+    let (_repository, contacts) = store(&temp).await;
+    let minted = contact_with_issued_grant(&contacts).await;
+    let held_id = GrantId::generate();
+    contacts
+        .insert_held_grant(&HeldGrant {
+            grant_id: held_id,
+            secret: minted.secret.clone(),
+            peer_endpoint_id: PEER.to_string(),
+            created_at: NOW,
+            expires_at: None,
+        })
+        .await
+        .unwrap();
+
+    let to_notify = contacts.delete_contact(PEER).await.unwrap();
+
+    assert_eq!(to_notify, vec![minted.grant_id]);
+    assert!(contacts.list_contacts().await.unwrap().is_empty());
+    assert!(contacts
+        .find_issued_grant(minted.grant_id)
+        .await
+        .unwrap()
+        .is_none());
+    assert!(contacts.held_grant_for(PEER).await.unwrap().is_none());
+}
+
+#[tokio::test]
+async fn deleting_all_contacts_clears_every_grant() {
+    let temp = tempfile::tempdir().unwrap();
+    let (_repository, contacts) = store(&temp).await;
+    contact_with_issued_grant(&contacts).await;
+    contacts
+        .upsert_contact("other-peer", None, NOW)
+        .await
+        .unwrap();
+    let other = IssuedGrant::mint("other-peer".to_string(), NOW, GrantLifetime::default());
+    contacts.insert_issued_grant(&other).await.unwrap();
+
+    let to_notify = contacts.delete_all_contacts().await.unwrap();
+
+    assert_eq!(to_notify.len(), 2);
+    assert!(contacts.list_contacts().await.unwrap().is_empty());
+}
+
+#[tokio::test]
+async fn a_local_label_is_never_overwritten_by_a_name_the_remote_claims() {
+    let temp = tempfile::tempdir().unwrap();
+    let (_repository, contacts) = store(&temp).await;
+    contacts
+        .upsert_contact(PEER, Some("Original"), NOW)
+        .await
+        .unwrap();
+    contacts
+        .set_contact_label(PEER, Some("My Laptop"))
+        .await
+        .unwrap();
+
+    contacts
+        .upsert_contact(PEER, Some("Totally Not Evil"), NOW + 1)
+        .await
+        .unwrap();
+
+    let contact = contacts.find_contact(PEER).await.unwrap().expect("contact");
+    assert_eq!(contact.local_label.as_deref(), Some("My Laptop"));
+    assert_eq!(
+        contact.remote_display_name.as_deref(),
+        Some("Totally Not Evil"),
+        "the claimed name is still recorded, just not promoted to the label"
+    );
+}
+
+#[tokio::test]
+async fn upsert_keeps_the_original_creation_time_and_records_activity() {
+    let temp = tempfile::tempdir().unwrap();
+    let (_repository, contacts) = store(&temp).await;
+    contacts.upsert_contact(PEER, None, NOW).await.unwrap();
+
+    contacts
+        .upsert_contact(PEER, None, NOW + 5 * DAY_MS)
+        .await
+        .unwrap();
+    contacts
+        .touch_transfer(PEER, NOW + 6 * DAY_MS)
+        .await
+        .unwrap();
+
+    let contact = contacts.find_contact(PEER).await.unwrap().expect("contact");
+    assert_eq!(contact.created_at, NOW);
+    assert_eq!(contact.last_transfer_at, Some(NOW + 6 * DAY_MS));
+}
+
+#[tokio::test]
+async fn the_last_known_address_is_remembered_for_later_dialing() {
+    let temp = tempfile::tempdir().unwrap();
+    let (_repository, contacts) = store(&temp).await;
+    contacts.upsert_contact(PEER, None, NOW).await.unwrap();
+
+    contacts
+        .set_last_known_addr(PEER, "vndaddr1:encoded")
+        .await
+        .unwrap();
+
+    let contact = contacts.find_contact(PEER).await.unwrap().expect("contact");
+    assert_eq!(contact.last_known_addr.as_deref(), Some("vndaddr1:encoded"));
+}
+
+#[tokio::test]
+async fn blocking_revokes_outstanding_grants_so_it_is_not_merely_cosmetic() {
+    let temp = tempfile::tempdir().unwrap();
+    let (_repository, contacts) = store(&temp).await;
+    let minted = contact_with_issued_grant(&contacts).await;
+
+    contacts.block_endpoint(PEER, NOW).await.unwrap();
+
+    assert!(contacts.is_blocked(PEER).await.unwrap());
+    let reloaded = contacts
+        .find_issued_grant(minted.grant_id)
+        .await
+        .unwrap()
+        .expect("grant kept as tombstone");
+    assert_eq!(reloaded.revoked_at, Some(NOW));
+}
+
+#[tokio::test]
+async fn unblocking_does_not_restore_the_revoked_grant() {
+    let temp = tempfile::tempdir().unwrap();
+    let (_repository, contacts) = store(&temp).await;
+    let minted = contact_with_issued_grant(&contacts).await;
+    contacts.block_endpoint(PEER, NOW).await.unwrap();
+
+    contacts.unblock_endpoint(PEER).await.unwrap();
+
+    assert!(!contacts.is_blocked(PEER).await.unwrap());
+    let reloaded = contacts
+        .find_issued_grant(minted.grant_id)
+        .await
+        .unwrap()
+        .expect("grant kept as tombstone");
+    assert!(
+        reloaded.revoked_at.is_some(),
+        "unblocking must not silently hand back access; the peer has to pair again"
+    );
+}
+
+#[tokio::test]
+async fn newest_held_grant_wins_after_re_pairing() {
+    let temp = tempfile::tempdir().unwrap();
+    let (_repository, contacts) = store(&temp).await;
+    let older = HeldGrant {
+        grant_id: GrantId::generate(),
+        secret: IssuedGrant::mint(PEER.to_string(), NOW, GrantLifetime::default()).secret,
+        peer_endpoint_id: PEER.to_string(),
+        created_at: NOW,
+        expires_at: None,
+    };
+    let newer = HeldGrant {
+        grant_id: GrantId::generate(),
+        secret: IssuedGrant::mint(PEER.to_string(), NOW, GrantLifetime::default()).secret,
+        peer_endpoint_id: PEER.to_string(),
+        created_at: NOW + DAY_MS,
+        expires_at: None,
+    };
+    contacts.insert_held_grant(&older).await.unwrap();
+    contacts.insert_held_grant(&newer).await.unwrap();
+
+    let selected = contacts.held_grant_for(PEER).await.unwrap().expect("grant");
+
+    assert_eq!(selected.grant_id, newer.grant_id);
+}
+
+#[tokio::test]
+async fn a_held_grant_is_dropped_once_the_issuer_reports_it_dead() {
+    let temp = tempfile::tempdir().unwrap();
+    let (_repository, contacts) = store(&temp).await;
+    let held = HeldGrant {
+        grant_id: GrantId::generate(),
+        secret: IssuedGrant::mint(PEER.to_string(), NOW, GrantLifetime::default()).secret,
+        peer_endpoint_id: PEER.to_string(),
+        created_at: NOW,
+        expires_at: None,
+    };
+    contacts.insert_held_grant(&held).await.unwrap();
+
+    contacts.delete_held_grant(held.grant_id).await.unwrap();
+
+    assert!(contacts.held_grant_for(PEER).await.unwrap().is_none());
+}
+
+#[tokio::test]
+async fn purging_drops_lapsed_and_revoked_grants_but_keeps_live_ones() {
+    let temp = tempfile::tempdir().unwrap();
+    let (_repository, contacts) = store(&temp).await;
+    let live = contact_with_issued_grant(&contacts).await;
+    let lapsed = IssuedGrant::mint(
+        "stale-peer".to_string(),
+        NOW - 400 * DAY_MS,
+        GrantLifetime::Days(1),
+    );
+    contacts.insert_issued_grant(&lapsed).await.unwrap();
+
+    let purged = contacts.purge_dead_grants(NOW).await.unwrap();
+
+    assert_eq!(purged, 1);
+    assert!(contacts
+        .find_issued_grant(live.grant_id)
+        .await
+        .unwrap()
+        .is_some());
+    assert!(contacts
+        .find_issued_grant(lapsed.grant_id)
+        .await
+        .unwrap()
+        .is_none());
+}
+
+#[tokio::test]
+async fn a_corrupt_stored_secret_is_an_error_not_a_silent_refusal() {
+    let temp = tempfile::tempdir().unwrap();
+    let (_repository, contacts) = store(&temp).await;
+    let minted = contact_with_issued_grant(&contacts).await;
+    contacts
+        .corrupt_secret_for_test(minted.grant_id)
+        .await
+        .unwrap();
+
+    // Refusing the peer here would be indistinguishable from revocation, so the
+    // corruption has to surface instead.
+    assert!(contacts.find_issued_grant(minted.grant_id).await.is_err());
+}

crates/vnidrop/src/tests/error.rs

@@ -44,6 +44,22 @@ fn transfer_boundary_preserves_typed_errors_through_context() {
     assert_eq!(classified.code(), "network");
 }
 
+#[test]
+fn initialization_boundary_preserves_secure_storage_failures() {
+    let error = anyhow::Error::new(VnidropError::SecureStorageLocked {
+        reason: "credential store is locked".to_string(),
+    })
+    .context("endpoint identity could not be loaded");
+
+    let classified = VnidropError::initialization(error);
+
+    assert!(matches!(
+        classified,
+        VnidropError::SecureStorageLocked { ref reason }
+            if reason == "endpoint identity could not be loaded"
+    ));
+}
+
 #[test]
 fn transfer_boundary_classifies_database_failures() {
     let transfer = VnidropError::transfer(sqlx::Error::RowNotFound);

crates/vnidrop/src/tests/grant.rs

@@ -0,0 +1,226 @@
+use crate::grant::{
+    parse_secret, prove, Challenge, GrantId, GrantLifetime, GrantRejection, GrantSecret,
+    IssuedGrant,
+};
+
+const ISSUER: &str = "issuer-endpoint";
+const HOLDER: &str = "holder-endpoint";
+const DAY_MS: i64 = 24 * 60 * 60 * 1_000;
+
+fn issued(now_ms: i64) -> IssuedGrant {
+    IssuedGrant::mint(HOLDER.to_string(), now_ms, GrantLifetime::default())
+}
+
+fn accept_with(
+    grant: &IssuedGrant,
+    challenge: &Challenge,
+    remote_endpoint_id: &str,
+    now_ms: i64,
+) -> Result<Option<i64>, GrantRejection> {
+    let proof = prove(
+        grant.grant_id,
+        &grant.secret,
+        challenge,
+        ISSUER,
+        remote_endpoint_id,
+    );
+    grant.accept(
+        &proof,
+        challenge,
+        ISSUER,
+        remote_endpoint_id,
+        now_ms,
+        GrantLifetime::default(),
+    )
+}
+
+#[test]
+fn accepts_a_valid_proof_and_returns_the_renewed_deadline() {
+    let now = 1_700_000_000_000;
+    let grant = issued(now);
+    let challenge = Challenge::generate();
+
+    let renewed = accept_with(&grant, &challenge, HOLDER, now + DAY_MS).expect("proof accepted");
+
+    assert_eq!(renewed, Some(now + DAY_MS + 90 * DAY_MS));
+}
+
+#[test]
+fn renewal_extends_past_the_original_expiry() {
+    let now = 1_700_000_000_000;
+    let grant = issued(now);
+    let original = grant.expires_at.expect("default lifetime expires");
+
+    // Used one day before lapsing: the new deadline must be later than the old.
+    let use_at = original - DAY_MS;
+    let renewed = accept_with(&grant, &Challenge::generate(), HOLDER, use_at)
+        .expect("proof accepted")
+        .expect("renewed deadline");
+
+    assert!(renewed > original);
+}
+
+#[test]
+fn rejects_a_proof_bound_to_a_different_challenge() {
+    let now = 1_700_000_000_000;
+    let grant = issued(now);
+    let captured = Challenge::from_bytes([7u8; 32]);
+    let proof = prove(grant.grant_id, &grant.secret, &captured, ISSUER, HOLDER);
+
+    // Replaying a captured proof against a fresh challenge must fail.
+    let outcome = grant.accept(
+        &proof,
+        &Challenge::from_bytes([9u8; 32]),
+        ISSUER,
+        HOLDER,
+        now,
+        GrantLifetime::default(),
+    );
+
+    assert_eq!(outcome, Err(GrantRejection::BadProof));
+}
+
+#[test]
+fn rejects_a_proof_from_an_endpoint_the_grant_was_not_issued_to() {
+    let now = 1_700_000_000_000;
+    let grant = issued(now);
+
+    let outcome = accept_with(&grant, &Challenge::generate(), "someone-else", now);
+
+    assert_eq!(outcome, Err(GrantRejection::WrongEndpoint));
+}
+
+#[test]
+fn rejects_a_proof_replayed_against_a_different_issuer() {
+    let now = 1_700_000_000_000;
+    let grant = issued(now);
+    let challenge = Challenge::generate();
+    let proof = prove(
+        grant.grant_id,
+        &grant.secret,
+        &challenge,
+        "other-issuer",
+        HOLDER,
+    );
+
+    let outcome = grant.accept(
+        &proof,
+        &challenge,
+        ISSUER,
+        HOLDER,
+        now,
+        GrantLifetime::default(),
+    );
+
+    assert_eq!(outcome, Err(GrantRejection::BadProof));
+}
+
+#[test]
+fn rejects_a_revoked_grant_distinguishably() {
+    let now = 1_700_000_000_000;
+    let mut grant = issued(now);
+    grant.revoked_at = Some(now);
+
+    // Revocation is reported as such so the peer can drop the dead entry.
+    assert_eq!(
+        accept_with(&grant, &Challenge::generate(), HOLDER, now),
+        Err(GrantRejection::Revoked)
+    );
+}
+
+#[test]
+fn rejects_an_idle_grant_after_its_deadline() {
+    let now = 1_700_000_000_000;
+    let grant = issued(now);
+    let expires_at = grant.expires_at.expect("default lifetime expires");
+
+    assert_eq!(
+        accept_with(&grant, &Challenge::generate(), HOLDER, expires_at),
+        Ok(Some(expires_at + 90 * DAY_MS)),
+        "a grant is still usable on its deadline"
+    );
+    assert_eq!(
+        accept_with(&grant, &Challenge::generate(), HOLDER, expires_at + 1),
+        Err(GrantRejection::Expired)
+    );
+}
+
+#[test]
+fn rejects_a_proof_for_a_different_grant_id() {
+    let now = 1_700_000_000_000;
+    let grant = issued(now);
+    let other = issued(now);
+    let challenge = Challenge::generate();
+    let proof = prove(other.grant_id, &other.secret, &challenge, ISSUER, HOLDER);
+
+    let outcome = grant.accept(
+        &proof,
+        &challenge,
+        ISSUER,
+        HOLDER,
+        now,
+        GrantLifetime::default(),
+    );
+
+    assert_eq!(outcome, Err(GrantRejection::Unknown));
+}
+
+#[test]
+fn never_lifetime_produces_no_deadline() {
+    let now = 1_700_000_000_000;
+    let grant = IssuedGrant::mint(HOLDER.to_string(), now, GrantLifetime::Never);
+    assert_eq!(grant.expires_at, None);
+
+    let challenge = Challenge::generate();
+    let proof = prove(grant.grant_id, &grant.secret, &challenge, ISSUER, HOLDER);
+    let renewed = grant
+        .accept(
+            &proof,
+            &challenge,
+            ISSUER,
+            HOLDER,
+            now + 10_000 * DAY_MS,
+            GrantLifetime::Never,
+        )
+        .expect("proof accepted");
+
+    assert_eq!(renewed, None);
+}
+
+#[test]
+fn grant_ids_and_secrets_round_trip_through_storage_encoding() {
+    let id = GrantId::generate();
+    assert_eq!(GrantId::decode(&id.encode()).expect("decodes"), id);
+
+    let secret = GrantSecret::generate();
+    assert_eq!(parse_secret(&secret.encode()).expect("decodes"), secret);
+}
+
+#[test]
+fn rejects_malformed_or_degenerate_stored_secrets() {
+    assert!(parse_secret("not-hex").is_err());
+    assert!(parse_secret("aabb").is_err(), "wrong length");
+    assert!(
+        parse_secret(&"00".repeat(32)).is_err(),
+        "an all-zero secret means corrupt storage, not a usable grant"
+    );
+}
+
+#[test]
+fn secrets_are_redacted_in_debug_output() {
+    let secret = GrantSecret::generate();
+    let rendered = format!("{secret:?}");
+
+    assert!(!rendered.contains(&secret.encode()));
+    assert_eq!(rendered, "GrantSecret(redacted)");
+}
+
+#[test]
+fn generated_grants_are_unique() {
+    let now = 1_700_000_000_000;
+    let first = issued(now);
+    let second = issued(now);
+
+    assert_ne!(first.grant_id, second.grant_id);
+    assert_ne!(first.secret, second.secret);
+}

crates/vnidrop/src/tests/repository.rs

@@ -66,7 +66,7 @@ async fn received_artifacts_survive_history_deletion() {
 async fn persists_transfers_and_events_across_reopen() {
     let temp = tempfile::tempdir().unwrap();
     let repository = Repository::open(temp.path()).await.unwrap();
-    assert_eq!(repository.schema_version().await.unwrap(), 7);
+    assert_eq!(repository.schema_version().await.unwrap(), 10);
     repository
         .insert_transfer(transfer(
             7,
@@ -645,7 +645,7 @@ async fn migrates_schema_v2_identity_without_losing_transfer() {
     pool.close().await;
 
     let repository = Repository::open(temp.path()).await.unwrap();
-    assert_eq!(repository.schema_version().await.unwrap(), 7);
+    assert_eq!(repository.schema_version().await.unwrap(), 10);
     let stored = repository.list_transfers().await.unwrap().remove(0);
     assert_eq!(stored.transfer_id, 7);
     assert_eq!(stored.local_id, "legacy-7-send");

crates/vnidrop/src/tests/runtime.rs

@@ -10,9 +10,10 @@ use iroh_blobs::{
 
 use crate::{
     repository::{PendingDeliveryReceiptInsert, Repository, TransferUpsert},
-    runtime::{consume_request_updates, RequestStreamOutcome},
+    runtime::{consume_request_updates, CoreInner, IdentityMode, RequestStreamOutcome},
+    secure_secret::{lock_profile, FaultInjectingSecretStore},
     transfer_state::{TransferDirection, TransferStatus},
-    CoreEvent, CoreEventSink, VnidropCore, VnidropError,
+    CoreEvent, CoreEventSink, CoreLimits, CoreRelayMode, VnidropCore, VnidropError,
 };
 
 struct TestSink;
@@ -65,6 +66,46 @@ fn initializes_and_reports_endpoint() {
     core.shutdown();
 }
 
+#[tokio::test]
+async fn protected_runtime_restart_preserves_identity_without_plaintext_fallback() {
+    let temp = tempfile::tempdir().unwrap();
+    let store = Arc::new(FaultInjectingSecretStore::default());
+    let first = CoreInner::start(
+        temp.path().to_path_buf(),
+        Arc::new(TestSink),
+        CoreLimits::default(),
+        CoreRelayMode::LocalOnly,
+        Vec::new(),
+        IdentityMode::Protected {
+            store: store.clone(),
+            profile_lock: lock_profile(temp.path()).unwrap(),
+        },
+    )
+    .await
+    .unwrap();
+    let endpoint_id = first.endpoint.id();
+    first.shutdown().await;
+    drop(first);
+
+    let restarted = CoreInner::start(
+        temp.path().to_path_buf(),
+        Arc::new(TestSink),
+        CoreLimits::default(),
+        CoreRelayMode::LocalOnly,
+        Vec::new(),
+        IdentityMode::Protected {
+            store,
+            profile_lock: lock_profile(temp.path()).unwrap(),
+        },
+    )
+    .await
+    .unwrap();
+
+    assert_eq!(restarted.endpoint.id(), endpoint_id);
+    assert!(!temp.path().join("iroh.secret").exists());
+    restarted.shutdown().await;
+}
+
 #[test]
 fn invalid_receive_ticket_is_typed_and_persisted_as_event() {
     let temp = tempfile::tempdir().unwrap();

crates/vnidrop/src/tests/secure_secret.rs

@@ -0,0 +1,396 @@
+use std::{
+    io::{self, Write},
+    sync::{Arc, Mutex},
+};
+
+use data_encoding::HEXLOWER;
+use iroh::SecretKey;
+
+use crate::{
+    repository::Repository,
+    secure_secret::{
+        lock_profile, scope_store, CustodyCrashPoint, FaultInjectingSecretStore,
+        ReferenceStoreFailure, SecretCustody, SecretKind, SecretMaterial, SecureSecretStore,
+    },
+    VnidropError,
+};
+
+#[derive(Clone, Default)]
+struct CapturedOutput(Arc<Mutex<Vec<u8>>>);
+
+struct CapturedWriter(CapturedOutput);
+
+impl Write for CapturedWriter {
+    fn write(&mut self, bytes: &[u8]) -> io::Result<usize> {
+        self.0 .0.lock().unwrap().extend_from_slice(bytes);
+        Ok(bytes.len())
+    }
+
+    fn flush(&mut self) -> io::Result<()> {
+        Ok(())
+    }
+}
+
+#[test]
+fn a_profile_allows_only_one_protected_core_mutator() {
+    let temp = tempfile::tempdir().unwrap();
+    let first = lock_profile(temp.path()).unwrap();
+
+    assert!(matches!(
+        lock_profile(temp.path()),
+        Err(VnidropError::SecureStorageUnavailable { .. })
+    ));
+
+    drop(first);
+    assert!(lock_profile(temp.path()).is_ok());
+}
+
+#[tokio::test]
+async fn reconciliation_is_scoped_to_one_application_profile() {
+    let root = tempfile::tempdir().unwrap();
+    let first_dir = root.path().join("first");
+    let second_dir = root.path().join("second");
+    std::fs::create_dir_all(&first_dir).unwrap();
+    std::fs::create_dir_all(&second_dir).unwrap();
+    let shared_platform_store = Arc::new(FaultInjectingSecretStore::default());
+    let first_store = scope_store(&first_dir, shared_platform_store.clone());
+    let second_store = scope_store(&second_dir, shared_platform_store);
+    let first_repository = Repository::open(&first_dir).await.unwrap();
+    let second_repository = Repository::open(&second_dir).await.unwrap();
+    let first = SecretCustody::new(first_repository.protected_secrets(), first_store.clone());
+    let second = SecretCustody::new(second_repository.protected_secrets(), second_store.clone());
+    let first_handle = first
+        .protect(
+            SecretKind::RelationshipGrant,
+            SecretMaterial::new(vec![0x31; 32]).unwrap(),
+            None,
+        )
+        .await
+        .unwrap();
+    let second_handle = second
+        .protect(
+            SecretKind::RelationshipGrant,
+            SecretMaterial::new(vec![0x42; 32]).unwrap(),
+            None,
+        )
+        .await
+        .unwrap();
+
+    drop(first);
+    let (restarted, summary) =
+        SecretCustody::start(first_repository.protected_secrets(), first_store)
+            .await
+            .unwrap();
+
+    assert_eq!(summary.orphans_deleted, 0);
+    assert_eq!(
+        restarted.load(&first_handle).await.unwrap(),
+        SecretMaterial::new(vec![0x31; 32]).unwrap()
+    );
+    assert_eq!(
+        second.load(&second_handle).await.unwrap(),
+        SecretMaterial::new(vec![0x42; 32]).unwrap()
+    );
+}
+
+#[tokio::test]
+async fn custody_maps_reference_store_failures_to_typed_core_errors() {
+    let temp = tempfile::tempdir().unwrap();
+    let repository = Repository::open(temp.path()).await.unwrap();
+    let store = Arc::new(FaultInjectingSecretStore::default());
+    let custody = SecretCustody::new(repository.protected_secrets(), store.clone());
+    let secret = SecretMaterial::new(vec![0x5a; 32]).unwrap();
+    let handle = custody
+        .protect(SecretKind::RelationshipGrant, secret.clone(), None)
+        .await
+        .unwrap();
+
+    assert_eq!(custody.load(&handle).await.unwrap(), secret);
+
+    store.fail_with(Some(ReferenceStoreFailure::Locked));
+    assert!(matches!(
+        custody.load(&handle).await,
+        Err(VnidropError::SecureStorageLocked { .. })
+    ));
+
+    store.fail_with(Some(ReferenceStoreFailure::Unavailable));
+    assert!(matches!(
+        custody.load(&handle).await,
+        Err(VnidropError::SecureStorageUnavailable { .. })
+    ));
+
+    store.fail_with(None);
+    store.remove_for_test(&handle);
+    assert!(matches!(
+        custody.load(&handle).await,
+        Err(VnidropError::SecureStorageMissing { .. })
+    ));
+
+    let corrupted_handle = custody
+        .protect(SecretKind::RelationshipGrant, secret, None)
+        .await
+        .unwrap();
+    store.corrupt_for_test(&corrupted_handle);
+    assert!(matches!(
+        custody.load(&corrupted_handle).await,
+        Err(VnidropError::SecureStorageCorrupted { .. })
+    ));
+}
+
+#[tokio::test]
+async fn reconciliation_repairs_staged_metadata_and_disables_unusable_secrets() {
+    let temp = tempfile::tempdir().unwrap();
+    let mut repository = Repository::open(temp.path()).await.unwrap();
+    let store = Arc::new(FaultInjectingSecretStore::default());
+    let custody = SecretCustody::new(repository.protected_secrets(), store.clone());
+
+    custody.crash_once_at(CustodyCrashPoint::StoreWrite);
+    assert!(custody
+        .protect(
+            SecretKind::PairingEligibility,
+            SecretMaterial::new(vec![0x11; 32]).unwrap(),
+            None,
+        )
+        .await
+        .is_err());
+    drop(custody);
+    drop(repository);
+    repository = Repository::open(temp.path()).await.unwrap();
+    let (custody, summary) = SecretCustody::start(repository.protected_secrets(), store.clone())
+        .await
+        .unwrap();
+    assert_eq!(summary.orphans_deleted, 1);
+    assert_eq!(summary.staged_activated, 0);
+
+    custody.crash_once_at(CustodyCrashPoint::MetadataStage);
+    assert!(custody
+        .protect(
+            SecretKind::PairingEligibility,
+            SecretMaterial::new(vec![0x22; 32]).unwrap(),
+            None,
+        )
+        .await
+        .is_err());
+    let staged_handle = store.only_handle_for_test();
+    drop(custody);
+    drop(repository);
+    repository = Repository::open(temp.path()).await.unwrap();
+    let (custody, summary) = SecretCustody::start(repository.protected_secrets(), store.clone())
+        .await
+        .unwrap();
+    assert_eq!(summary.staged_activated, 1);
+    assert_eq!(
+        custody.load(&staged_handle).await.unwrap(),
+        SecretMaterial::new(vec![0x22; 32]).unwrap()
+    );
+
+    store.remove_for_test(&staged_handle);
+    drop(custody);
+    drop(repository);
+    repository = Repository::open(temp.path()).await.unwrap();
+    let (custody, summary) = SecretCustody::start(repository.protected_secrets(), store.clone())
+        .await
+        .unwrap();
+    assert_eq!(summary.disabled, 1);
+    assert!(matches!(
+        custody.load(&staged_handle).await,
+        Err(VnidropError::SecureStorageUnavailable { .. })
+    ));
+
+    let corrupted = custody
+        .protect(
+            SecretKind::RelationshipGrant,
+            SecretMaterial::new(vec![0x33; 32]).unwrap(),
+            None,
+        )
+        .await
+        .unwrap();
+    store.corrupt_for_test(&corrupted);
+    drop(custody);
+    drop(repository);
+    let repository = Repository::open(temp.path()).await.unwrap();
+    let (custody, summary) = SecretCustody::start(repository.protected_secrets(), store.clone())
+        .await
+        .unwrap();
+    assert_eq!(summary.disabled, 1);
+    assert!(matches!(
+        custody.load(&corrupted).await,
+        Err(VnidropError::SecureStorageUnavailable { .. })
+    ));
+}
+
+#[tokio::test]
+async fn endpoint_migration_preserves_identity_across_crash_and_rejects_replacement() {
+    let temp = tempfile::tempdir().unwrap();
+    let legacy_path = temp.path().join("iroh.secret");
+    let original = SecretKey::generate();
+    std::fs::write(&legacy_path, HEXLOWER.encode(&original.to_bytes())).unwrap();
+    let repository = Repository::open(temp.path()).await.unwrap();
+    let store = Arc::new(FaultInjectingSecretStore::default());
+    let custody = SecretCustody::new(repository.protected_secrets(), store.clone());
+
+    custody.crash_once_at(CustodyCrashPoint::MetadataActivation);
+    assert!(custody
+        .migrate_legacy_endpoint_identity(&legacy_path)
+        .await
+        .is_err());
+    assert!(
+        legacy_path.exists(),
+        "legacy key must survive before activation"
+    );
+
+    drop(custody);
+    drop(repository);
+    let repository = Repository::open(temp.path()).await.unwrap();
+    let (custody, summary) = SecretCustody::start(repository.protected_secrets(), store.clone())
+        .await
+        .unwrap();
+    assert_eq!(summary.staged_activated, 0);
+    let handle = custody
+        .migrate_legacy_endpoint_identity(&legacy_path)
+        .await
+        .unwrap();
+    assert!(!legacy_path.exists());
+    assert_eq!(
+        custody.load(&handle).await.unwrap(),
+        SecretMaterial::new(original.to_bytes().to_vec()).unwrap()
+    );
+
+    let replacement = SecretKey::generate();
+    std::fs::write(&legacy_path, HEXLOWER.encode(&replacement.to_bytes())).unwrap();
+    assert!(matches!(
+        custody.migrate_legacy_endpoint_identity(&legacy_path).await,
+        Err(VnidropError::SecureStorageCorrupted { .. })
+    ));
+    assert!(legacy_path.exists());
+    assert_eq!(
+        custody.load(&handle).await.unwrap(),
+        SecretMaterial::new(original.to_bytes().to_vec()).unwrap()
+    );
+
+    let missing = temp.path().join("missing.secret");
+    let empty_store = Arc::new(FaultInjectingSecretStore::default());
+    let other_dir = temp.path().join("other");
+    std::fs::create_dir(&other_dir).unwrap();
+    let other_repository = Repository::open(&other_dir).await.unwrap();
+    let empty_custody = SecretCustody::new(other_repository.protected_secrets(), empty_store);
+    assert!(matches!(
+        empty_custody
+            .migrate_legacy_endpoint_identity(&missing)
+            .await,
+        Err(VnidropError::SecureStorageMissing { .. })
+    ));
+}
+
+#[tokio::test]
+async fn first_install_identity_is_protected_once_and_never_silently_replaced() {
+    let temp = tempfile::tempdir().unwrap();
+    let legacy_path = temp.path().join("iroh.secret");
+    let repository = Repository::open(temp.path()).await.unwrap();
+    let store = Arc::new(FaultInjectingSecretStore::default());
+    let (custody, _) = SecretCustody::start(repository.protected_secrets(), store.clone())
+        .await
+        .unwrap();
+
+    let original = custody
+        .initialize_endpoint_identity(&legacy_path)
+        .await
+        .unwrap();
+    assert!(!legacy_path.exists());
+    let handle = store.only_handle_for_test();
+    drop(custody);
+    drop(repository);
+
+    let repository = Repository::open(temp.path()).await.unwrap();
+    let (custody, _) = SecretCustody::start(repository.protected_secrets(), store.clone())
+        .await
+        .unwrap();
+    assert_eq!(
+        custody
+            .initialize_endpoint_identity(&legacy_path)
+            .await
+            .unwrap(),
+        original
+    );
+
+    store.remove_for_test(&handle);
+    drop(custody);
+    drop(repository);
+    let repository = Repository::open(temp.path()).await.unwrap();
+    let (custody, summary) = SecretCustody::start(repository.protected_secrets(), store.clone())
+        .await
+        .unwrap();
+    assert_eq!(summary.disabled, 1);
+    assert!(matches!(
+        custody.initialize_endpoint_identity(&legacy_path).await,
+        Err(VnidropError::SecureStorageUnavailable { .. })
+    ));
+    assert!(store.list_handles().unwrap().is_empty());
+}
+
+#[tokio::test]
+async fn concurrent_first_starts_converge_on_one_protected_endpoint_identity() {
+    let temp = tempfile::tempdir().unwrap();
+    let legacy_path = temp.path().join("iroh.secret");
+    let repository = Repository::open(temp.path()).await.unwrap();
+    let store = Arc::new(FaultInjectingSecretStore::default());
+    let first = SecretCustody::new(repository.protected_secrets(), store.clone());
+    let second = SecretCustody::new(repository.protected_secrets(), store.clone());
+
+    let (first_identity, second_identity) = tokio::join!(
+        first.initialize_endpoint_identity(&legacy_path),
+        second.initialize_endpoint_identity(&legacy_path),
+    );
+
+    assert_eq!(first_identity.unwrap(), second_identity.unwrap());
+    assert_eq!(store.list_handles().unwrap().len(), 1);
+}
+
+#[tokio::test]
+async fn protected_material_is_absent_from_database_and_diagnostics() {
+    let temp = tempfile::tempdir().unwrap();
+    let repository = Repository::open(temp.path()).await.unwrap();
+    let store = Arc::new(FaultInjectingSecretStore::default());
+    let custody = SecretCustody::new(repository.protected_secrets(), store.clone());
+    let raw = (0u8..32).map(|value| value + 1).collect::<Vec<_>>();
+    let encoded = HEXLOWER.encode(&raw);
+    let material = SecretMaterial::new(raw.clone()).unwrap();
+
+    let handle = custody
+        .protect(SecretKind::RelationshipGrant, material.clone(), None)
+        .await
+        .unwrap();
+
+    assert!(handle
+        .as_str()
+        .starts_with("vnidrop/v1/relationship-grant/"));
+    assert_eq!(format!("{material:?}"), "SecretMaterial(redacted)");
+    store.corrupt_for_test(&handle);
+    let error = custody.load(&handle).await.unwrap_err().to_string();
+    assert!(!error.contains(&encoded));
+
+    let captured = CapturedOutput::default();
+    let writer_output = captured.clone();
+    let subscriber = tracing_subscriber::fmt()
+        .without_time()
+        .with_writer(move || CapturedWriter(writer_output.clone()))
+        .finish();
+    let _subscriber = tracing::subscriber::set_default(subscriber);
+    tracing::info!(material = ?material, error, "custody diagnostic");
+    let diagnostics = String::from_utf8(captured.0.lock().unwrap().clone()).unwrap();
+    assert!(!diagnostics.contains(&encoded));
+
+    assert!(repository.list_events(None, 500).await.unwrap().is_empty());
+
+    let mut persisted = Vec::new();
+    for entry in std::fs::read_dir(temp.path()).unwrap() {
+        let path = entry.unwrap().path();
+        if path.is_file() {
+            persisted.extend(std::fs::read(path).unwrap());
+        }
+    }
+    assert!(!persisted.windows(raw.len()).any(|window| window == raw));
+    assert!(!persisted
+        .windows(encoded.len())
+        .any(|window| window == encoded.as_bytes()));
+}

crates/vnidrop/src/tests/secure_secret_android.rs

@@ -0,0 +1,180 @@
+use std::{
+    collections::HashMap,
+    fs,
+    sync::{Arc, Mutex},
+};
+
+use tempfile::TempDir;
+
+use crate::secure_secret::{
+    android::{
+        secret_handle_for_test, AndroidKeystore, AndroidSealedValue, AndroidSecureSecretStore,
+    },
+    SecretHandle, SecretMaterial, SecureSecretStore, SecureSecretStoreError,
+};
+
+const TEST_SECRET_BYTES: usize = 32;
+
+#[derive(Default)]
+struct FakeKeystore {
+    keys: Mutex<HashMap<String, u8>>,
+    seal_failure: Mutex<Option<SecureSecretStoreError>>,
+    delete_failure: Mutex<Option<SecureSecretStoreError>>,
+}
+
+impl AndroidKeystore for FakeKeystore {
+    fn seal(
+        &self,
+        alias: &str,
+        plaintext: &[u8],
+    ) -> Result<AndroidSealedValue, SecureSecretStoreError> {
+        if let Some(error) = self.seal_failure.lock().unwrap().take() {
+            return Err(error);
+        }
+        let mask = 0xa7;
+        self.keys.lock().unwrap().insert(alias.to_string(), mask);
+        Ok(AndroidSealedValue {
+            nonce: vec![4; 12],
+            ciphertext: plaintext.iter().map(|byte| byte ^ mask).collect(),
+        })
+    }
+
+    fn open(
+        &self,
+        alias: &str,
+        sealed: &AndroidSealedValue,
+    ) -> Result<Vec<u8>, SecureSecretStoreError> {
+        let mask = *self
+            .keys
+            .lock()
+            .unwrap()
+            .get(alias)
+            .ok_or(SecureSecretStoreError::Missing)?;
+        Ok(sealed.ciphertext.iter().map(|byte| byte ^ mask).collect())
+    }
+
+    fn delete(&self, alias: &str) -> Result<(), SecureSecretStoreError> {
+        if let Some(error) = self.delete_failure.lock().unwrap().take() {
+            return Err(error);
+        }
+        self.keys.lock().unwrap().remove(alias);
+        Ok(())
+    }
+}
+
+fn fixture() -> (TempDir, AndroidSecureSecretStore, Arc<FakeKeystore>) {
+    let directory = TempDir::new().unwrap();
+    let keystore = Arc::new(FakeKeystore::default());
+    let store = AndroidSecureSecretStore::new(directory.path(), keystore.clone()).unwrap();
+    (directory, store, keystore)
+}
+
+fn handle() -> SecretHandle {
+    secret_handle_for_test("vnidrop/v1/endpoint-identity/test")
+}
+
+#[test]
+fn adapter_round_trips_lists_and_deletes_without_plaintext_persistence() {
+    let (directory, store, keystore) = fixture();
+    let handle = handle();
+    let plaintext = vec![0x5a; TEST_SECRET_BYTES];
+    let material = SecretMaterial::new(plaintext.clone()).unwrap();
+
+    store.put(&handle, material.clone()).unwrap();
+
+    let persisted = fs::read(store.record_path_for_test(&handle)).unwrap();
+    assert!(!persisted
+        .windows(plaintext.len())
+        .any(|window| window == plaintext));
+
+    drop(store);
+    let restarted = AndroidSecureSecretStore::new(directory.path(), keystore).unwrap();
+    assert_eq!(restarted.list_handles().unwrap(), vec![handle.clone()]);
+    assert_eq!(restarted.get(&handle).unwrap(), material);
+
+    restarted.delete(&handle).unwrap();
+    assert!(restarted.list_handles().unwrap().is_empty());
+    assert!(matches!(
+        restarted.get(&handle),
+        Err(SecureSecretStoreError::Missing)
+    ));
+}
+
+#[test]
+fn staged_crash_record_remains_discoverable_and_fails_closed() {
+    let (_directory, store, _keystore) = fixture();
+    let handle = handle();
+    store.stage_for_test(&handle).unwrap();
+
+    assert_eq!(store.list_handles().unwrap(), vec![handle.clone()]);
+    assert!(matches!(
+        store.get(&handle),
+        Err(SecureSecretStoreError::Corrupted)
+    ));
+    store.delete(&handle).unwrap();
+    assert!(store.list_handles().unwrap().is_empty());
+}
+
+#[test]
+fn tampering_and_missing_keystore_keys_are_distinct_failures() {
+    let (_directory, store, keystore) = fixture();
+    let handle = handle();
+    store
+        .put(
+            &handle,
+            SecretMaterial::new(vec![9; TEST_SECRET_BYTES]).unwrap(),
+        )
+        .unwrap();
+
+    keystore.keys.lock().unwrap().clear();
+    assert!(matches!(
+        store.get(&handle),
+        Err(SecureSecretStoreError::Missing)
+    ));
+
+    fs::write(store.record_path_for_test(&handle), b"tampered").unwrap();
+    assert!(matches!(
+        store.get(&handle),
+        Err(SecureSecretStoreError::Corrupted)
+    ));
+}
+
+#[test]
+fn failed_key_deletion_retains_the_record_for_safe_retry() {
+    let (_directory, store, keystore) = fixture();
+    let handle = handle();
+    store
+        .put(
+            &handle,
+            SecretMaterial::new(vec![7; TEST_SECRET_BYTES]).unwrap(),
+        )
+        .unwrap();
+    *keystore.delete_failure.lock().unwrap() = Some(SecureSecretStoreError::Locked);
+
+    assert!(matches!(
+        store.delete(&handle),
+        Err(SecureSecretStoreError::Locked)
+    ));
+    assert_eq!(store.list_handles().unwrap(), vec![handle.clone()]);
+
+    store.delete(&handle).unwrap();
+    assert!(store.list_handles().unwrap().is_empty());
+}
+
+#[test]
+fn failed_replacement_keeps_the_previous_secret_readable() {
+    let (_directory, store, keystore) = fixture();
+    let handle = handle();
+    let original = SecretMaterial::new(vec![3; TEST_SECRET_BYTES]).unwrap();
+    store.put(&handle, original.clone()).unwrap();
+    *keystore.seal_failure.lock().unwrap() = Some(SecureSecretStoreError::Locked);
+
+    assert!(matches!(
+        store.put(
+            &handle,
+            SecretMaterial::new(vec![8; TEST_SECRET_BYTES]).unwrap()
+        ),
+        Err(SecureSecretStoreError::Locked)
+    ));
+    assert_eq!(store.get(&handle).unwrap(), original);
+}

crates/vnidrop/src/tests/secure_secret_apple.rs

@@ -0,0 +1,188 @@
+use std::{
+    collections::HashMap,
+    sync::{Arc, Mutex},
+};
+
+use crate::secure_secret::{
+    apple::{
+        expected_policy_for_test, handle_for_test, map_status_for_test, service_for_test,
+        AppleKeychainApi, AppleKeychainPolicy, AppleKeychainSecretStore,
+    },
+    SecretMaterial, SecureSecretStore, SecureSecretStoreError,
+};
+
+const ERR_SEC_AUTH_FAILED: i32 = -25_293;
+const ERR_SEC_NOT_AVAILABLE: i32 = -25_291;
+const ERR_SEC_ITEM_NOT_FOUND: i32 = -25_300;
+const ERR_SEC_INTERACTION_NOT_ALLOWED: i32 = -25_308;
+const ERR_SEC_DECODE: i32 = -26_275;
+
+#[derive(Clone, Default)]
+struct RecordingKeychain {
+    state: Arc<Mutex<RecordingState>>,
+}
+
+#[derive(Default)]
+struct RecordingState {
+    entries: HashMap<(String, String), Vec<u8>>,
+    last_policy: Option<AppleKeychainPolicy>,
+}
+
+impl AppleKeychainApi for RecordingKeychain {
+    fn put(
+        &self,
+        service: &str,
+        account: &str,
+        material: &[u8],
+        policy: AppleKeychainPolicy,
+    ) -> Result<(), i32> {
+        let mut state = self.state.lock().unwrap();
+        state.last_policy = Some(policy);
+        state.entries.insert(
+            (service.to_string(), account.to_string()),
+            material.to_vec(),
+        );
+        Ok(())
+    }
+
+    fn get(&self, service: &str, account: &str) -> Result<Vec<u8>, i32> {
+        self.state
+            .lock()
+            .unwrap()
+            .entries
+            .get(&(service.to_string(), account.to_string()))
+            .cloned()
+            .ok_or(ERR_SEC_ITEM_NOT_FOUND)
+    }
+
+    fn delete(&self, service: &str, account: &str) -> Result<(), i32> {
+        self.state
+            .lock()
+            .unwrap()
+            .entries
+            .remove(&(service.to_string(), account.to_string()))
+            .map(|_| ())
+            .ok_or(ERR_SEC_ITEM_NOT_FOUND)
+    }
+
+    fn list_accounts(&self, service: &str) -> Result<Vec<String>, i32> {
+        Ok(self
+            .state
+            .lock()
+            .unwrap()
+            .entries
+            .keys()
+            .filter(|(entry_service, _)| entry_service == service)
+            .map(|(_, account)| account.clone())
+            .collect())
+    }
+}
+
+#[test]
+fn adapter_creates_replaces_reads_lists_and_deletes_only_its_service() {
+    let api = RecordingKeychain::default();
+    api.state.lock().unwrap().entries.insert(
+        ("com.example.unrelated".to_string(), "leave-me".to_string()),
+        vec![0x77; 32],
+    );
+    let store = AppleKeychainSecretStore::with_api(api.clone());
+    let owned = handle_for_test("vnidrop/v1/endpoint-identity/apple-test");
+
+    store
+        .put(&owned, SecretMaterial::new(vec![0x31; 32]).unwrap())
+        .unwrap();
+    drop(store);
+
+    let reopened_store = AppleKeychainSecretStore::with_api(api.clone());
+    assert_eq!(
+        reopened_store.get(&owned).unwrap(),
+        SecretMaterial::new(vec![0x31; 32]).unwrap()
+    );
+    reopened_store
+        .put(&owned, SecretMaterial::new(vec![0x42; 32]).unwrap())
+        .unwrap();
+
+    assert_eq!(
+        reopened_store.get(&owned).unwrap(),
+        SecretMaterial::new(vec![0x42; 32]).unwrap()
+    );
+    assert_eq!(reopened_store.list_handles().unwrap(), vec![owned.clone()]);
+    reopened_store.delete(&owned).unwrap();
+    assert!(matches!(
+        reopened_store.get(&owned),
+        Err(SecureSecretStoreError::Missing)
+    ));
+    assert!(api
+        .state
+        .lock()
+        .unwrap()
+        .entries
+        .contains_key(&("com.example.unrelated".to_string(), "leave-me".to_string())));
+}
+
+#[test]
+fn adapter_always_requests_device_local_non_synchronizing_protection() {
+    let api = RecordingKeychain::default();
+    let store = AppleKeychainSecretStore::with_api(api.clone());
+
+    store
+        .put(
+            &handle_for_test("vnidrop/v1/relationship-grant/apple-policy"),
+            SecretMaterial::new(vec![0x51; 32]).unwrap(),
+        )
+        .unwrap();
+
+    assert_eq!(
+        api.state.lock().unwrap().last_policy,
+        Some(expected_policy_for_test())
+    );
+}
+
+#[test]
+fn apple_statuses_map_to_fail_closed_contract_outcomes() {
+    assert!(matches!(
+        map_status_for_test(ERR_SEC_INTERACTION_NOT_ALLOWED),
+        SecureSecretStoreError::Locked
+    ));
+    assert!(matches!(
+        map_status_for_test(ERR_SEC_AUTH_FAILED),
+        SecureSecretStoreError::Locked
+    ));
+    assert!(matches!(
+        map_status_for_test(ERR_SEC_ITEM_NOT_FOUND),
+        SecureSecretStoreError::Missing
+    ));
+    assert!(matches!(
+        map_status_for_test(ERR_SEC_DECODE),
+        SecureSecretStoreError::Corrupted
+    ));
+    assert!(matches!(
+        map_status_for_test(ERR_SEC_NOT_AVAILABLE),
+        SecureSecretStoreError::Unavailable
+    ));
+    assert!(matches!(
+        map_status_for_test(-1),
+        SecureSecretStoreError::Unavailable
+    ));
+}
+
+#[test]
+fn malformed_keychain_values_are_corrupted_without_diagnostic_disclosure() {
+    let api = RecordingKeychain::default();
+    let secret = vec![0x6d; 31];
+    api.state.lock().unwrap().entries.insert(
+        (
+            service_for_test().to_string(),
+            "vnidrop/v1/pairing-eligibility/corrupt".to_string(),
+        ),
+        secret.clone(),
+    );
+    let store = AppleKeychainSecretStore::with_api(api);
+
+    let error = store
+        .get(&handle_for_test("vnidrop/v1/pairing-eligibility/corrupt"))
+        .unwrap_err();
+
+    assert!(matches!(&error, SecureSecretStoreError::Corrupted));
+    assert!(!format!("{error:?}").contains(&data_encoding::HEXLOWER.encode(&secret)));
+}

crates/vnidrop/src/tests/secure_secret_linux.rs

@@ -0,0 +1,169 @@
+use std::{
+    collections::HashMap,
+    sync::{Arc, Mutex},
+};
+
+use secret_service::Error;
+
+use crate::{
+    repository::Repository,
+    secure_secret::{
+        linux::{map_error, LinuxSecretServiceApi, LinuxSecretServiceStore},
+        SecretCustody, SecretHandle, SecretKind, SecretMaterial, SecureSecretStore,
+        SecureSecretStoreError,
+    },
+    VnidropError,
+};
+
+#[derive(Default)]
+struct RecordingSecretService {
+    values: Mutex<HashMap<String, Vec<u8>>>,
+    failure: Mutex<Option<SecureSecretStoreError>>,
+}
+
+impl RecordingSecretService {
+    fn failure(&self) -> Result<(), SecureSecretStoreError> {
+        match &*self.failure.lock().unwrap() {
+            Some(SecureSecretStoreError::Locked) => Err(SecureSecretStoreError::Locked),
+            Some(SecureSecretStoreError::Missing) => Err(SecureSecretStoreError::Missing),
+            Some(SecureSecretStoreError::Corrupted) => Err(SecureSecretStoreError::Corrupted),
+            Some(SecureSecretStoreError::Unavailable) => Err(SecureSecretStoreError::Unavailable),
+            None => Ok(()),
+        }
+    }
+}
+
+impl LinuxSecretServiceApi for RecordingSecretService {
+    fn put(&self, handle: &str, material: &[u8]) -> Result<(), SecureSecretStoreError> {
+        self.failure()?;
+        self.values
+            .lock()
+            .unwrap()
+            .insert(handle.to_string(), material.to_vec());
+        Ok(())
+    }
+
+    fn get(&self, handle: &str) -> Result<Vec<u8>, SecureSecretStoreError> {
+        self.failure()?;
+        self.values
+            .lock()
+            .unwrap()
+            .get(handle)
+            .cloned()
+            .ok_or(SecureSecretStoreError::Missing)
+    }
+
+    fn delete(&self, handle: &str) -> Result<(), SecureSecretStoreError> {
+        self.failure()?;
+        self.values
+            .lock()
+            .unwrap()
+            .remove(handle)
+            .map(|_| ())
+            .ok_or(SecureSecretStoreError::Missing)
+    }
+
+    fn list_handles(&self) -> Result<Vec<String>, SecureSecretStoreError> {
+        self.failure()?;
+        Ok(self.values.lock().unwrap().keys().cloned().collect())
+    }
+}
+
+fn handle(suffix: &str) -> SecretHandle {
+    crate::secure_secret::secret_handle_for_test(format!("vnidrop/v1/relationship-grant/{suffix}"))
+}
+
+#[test]
+fn adapter_survives_restart_and_deletes_only_the_selected_item() {
+    let api = Arc::new(RecordingSecretService::default());
+    let first = handle("first");
+    let second = handle("second");
+    let material = SecretMaterial::new(vec![0x5a; 32]).unwrap();
+    let store = LinuxSecretServiceStore::with_api(api.clone());
+    store.put(&first, material.clone()).unwrap();
+    store
+        .put(&second, SecretMaterial::new(vec![0x6b; 32]).unwrap())
+        .unwrap();
+
+    let restarted = LinuxSecretServiceStore::with_api(api);
+    assert_eq!(restarted.get(&first).unwrap(), material);
+    assert_eq!(
+        restarted.list_handles().unwrap(),
+        vec![first.clone(), second]
+    );
+    restarted.delete(&first).unwrap();
+    assert!(matches!(
+        restarted.get(&first),
+        Err(SecureSecretStoreError::Missing)
+    ));
+}
+
+#[tokio::test]
+async fn transient_backend_failures_do_not_delete_protected_metadata_or_material() {
+    let temp = tempfile::tempdir().unwrap();
+    let repository = Repository::open(temp.path()).await.unwrap();
+    let api = Arc::new(RecordingSecretService::default());
+    let store = Arc::new(LinuxSecretServiceStore::with_api(api.clone()));
+    let custody = SecretCustody::new(repository.protected_secrets(), store.clone());
+    let protected = custody
+        .protect(
+            SecretKind::RelationshipGrant,
+            SecretMaterial::new(vec![0x7c; 32]).unwrap(),
+            None,
+        )
+        .await
+        .unwrap();
+
+    *api.failure.lock().unwrap() = Some(SecureSecretStoreError::Unavailable);
+    drop(custody);
+    assert!(matches!(
+        SecretCustody::start(repository.protected_secrets(), store.clone()).await,
+        Err(VnidropError::SecureStorageUnavailable { .. })
+    ));
+
+    *api.failure.lock().unwrap() = None;
+    let (restarted, _) = SecretCustody::start(repository.protected_secrets(), store)
+        .await
+        .unwrap();
+    assert_eq!(
+        restarted.load(&protected).await.unwrap(),
+        SecretMaterial::new(vec![0x7c; 32]).unwrap()
+    );
+}
+
+#[test]
+fn failures_are_typed_and_secret_material_is_redacted() {
+    let api = Arc::new(RecordingSecretService::default());
+    let store = LinuxSecretServiceStore::with_api(api.clone());
+    let secret = SecretMaterial::new(vec![0x7c; 32]).unwrap();
+    assert_eq!(format!("{secret:?}"), "SecretMaterial(redacted)");
+
+    for failure in [
+        SecureSecretStoreError::Locked,
+        SecureSecretStoreError::Unavailable,
+        SecureSecretStoreError::Corrupted,
+    ] {
+        *api.failure.lock().unwrap() = Some(failure);
+        assert!(store.get(&handle("failure")).is_err());
+    }
+}
+
+#[test]
+fn secret_service_errors_map_without_exposing_details() {
+    assert!(matches!(
+        map_error(Error::Locked),
+        SecureSecretStoreError::Locked
+    ));
+    assert!(matches!(
+        map_error(Error::NoResult),
+        SecureSecretStoreError::Missing
+    ));
+    assert!(matches!(
+        map_error(Error::Crypto("distinctive-secret")),
+        SecureSecretStoreError::Corrupted
+    ));
+    assert!(matches!(
+        map_error(Error::Unavailable),
+        SecureSecretStoreError::Unavailable
+    ));
+}

crates/vnidrop/src/tests/secure_secret_windows.rs

@@ -0,0 +1,186 @@
+use std::{fs, sync::Arc};
+
+use data_encoding::HEXLOWER;
+use iroh::SecretKey;
+
+use crate::{
+    repository::Repository,
+    secure_secret::{
+        windows::WindowsDpapiSecretStore, CustodyCrashPoint, SecretCustody, SecretMaterial,
+        SecureSecretStore, SecureSecretStoreError,
+    },
+    VnidropError,
+};
+
+fn handle() -> crate::secure_secret::SecretHandle {
+    WindowsDpapiSecretStore::relationship_handle_for_test()
+}
+
+fn material(seed: u8) -> SecretMaterial {
+    SecretMaterial::new(vec![seed; 32]).unwrap()
+}
+
+#[test]
+fn round_trip_survives_adapter_restart_and_never_persists_plaintext() {
+    let directory = tempfile::tempdir().unwrap();
+    let handle = handle();
+    let secret = material(0xa7);
+
+    WindowsDpapiSecretStore::new(directory.path())
+        .unwrap()
+        .put(&handle, secret.clone())
+        .unwrap();
+
+    let restarted = WindowsDpapiSecretStore::new(directory.path()).unwrap();
+    assert_eq!(restarted.get(&handle).unwrap(), secret);
+    assert_eq!(restarted.list_handles().unwrap(), vec![handle]);
+
+    for entry in fs::read_dir(directory.path()).unwrap() {
+        let bytes = fs::read(entry.unwrap().path()).unwrap();
+        assert!(!bytes.windows(32).any(|window| window == [0xa7; 32]));
+    }
+}
+
+#[test]
+fn delete_removes_only_the_selected_protected_value() {
+    let directory = tempfile::tempdir().unwrap();
+    let store = WindowsDpapiSecretStore::new(directory.path()).unwrap();
+    let retained = handle();
+    let removed = handle();
+    store.put(&retained, material(1)).unwrap();
+    store.put(&removed, material(2)).unwrap();
+
+    store.delete(&removed).unwrap();
+
+    assert!(matches!(
+        store.get(&removed),
+        Err(SecureSecretStoreError::Missing)
+    ));
+    assert_eq!(store.get(&retained).unwrap(), material(1));
+    assert_eq!(store.list_handles().unwrap(), vec![retained]);
+}
+
+#[test]
+fn repeated_put_is_idempotent_and_atomically_updates_changed_material() {
+    let directory = tempfile::tempdir().unwrap();
+    let store = WindowsDpapiSecretStore::new(directory.path()).unwrap();
+    let handle = handle();
+
+    store.put(&handle, material(6)).unwrap();
+    let first_blob = fs::read(store.path_for_test(&handle)).unwrap();
+    store.put(&handle, material(6)).unwrap();
+    assert_eq!(fs::read(store.path_for_test(&handle)).unwrap(), first_blob);
+
+    store.put(&handle, material(7)).unwrap();
+    assert_eq!(store.get(&handle).unwrap(), material(7));
+    assert!(!fs::read(store.path_for_test(&handle))
+        .unwrap()
+        .windows(32)
+        .any(|window| window == [7; 32]));
+}
+
+#[test]
+fn missing_corrupt_and_wrong_context_values_fail_closed() {
+    let directory = tempfile::tempdir().unwrap();
+    let handle = handle();
+    let store = WindowsDpapiSecretStore::new(directory.path()).unwrap();
+    assert!(matches!(
+        store.get(&handle),
+        Err(SecureSecretStoreError::Missing)
+    ));
+
+    store.put(&handle, material(3)).unwrap();
+    fs::write(store.path_for_test(&handle), b"not a protected envelope").unwrap();
+    assert!(matches!(
+        store.get(&handle),
+        Err(SecureSecretStoreError::Corrupted)
+    ));
+
+    let isolated = tempfile::tempdir().unwrap();
+    let original =
+        WindowsDpapiSecretStore::with_context_for_test(isolated.path(), b"first-context").unwrap();
+    original.put(&handle, material(4)).unwrap();
+    let wrong_context =
+        WindowsDpapiSecretStore::with_context_for_test(isolated.path(), b"second-context").unwrap();
+    assert!(matches!(
+        wrong_context.get(&handle),
+        Err(SecureSecretStoreError::Corrupted)
+    ));
+}
+
+#[test]
+fn interrupted_replacement_preserves_the_previous_value() {
+    let directory = tempfile::tempdir().unwrap();
+    let handle = handle();
+    let store = WindowsDpapiSecretStore::new(directory.path()).unwrap();
+    store.put(&handle, material(5)).unwrap();
+    let temporary = directory.path().join("interrupted.tmp-123");
+    fs::write(&temporary, b"incomplete protected replacement").unwrap();
+
+    let restarted = WindowsDpapiSecretStore::new(directory.path()).unwrap();
+
+    assert!(!temporary.exists());
+    assert_eq!(restarted.get(&handle).unwrap(), material(5));
+}
+
+#[test]
+fn unusable_backing_path_is_reported_as_unavailable() {
+    let directory = tempfile::tempdir().unwrap();
+    let file = directory.path().join("not-a-directory");
+    fs::write(&file, b"occupied").unwrap();
+
+    assert!(matches!(
+        WindowsDpapiSecretStore::new(&file),
+        Err(SecureSecretStoreError::Unavailable)
+    ));
+}
+
+#[tokio::test]
+async fn endpoint_migration_survives_activation_crash_without_changing_identity() {
+    let directory = tempfile::tempdir().unwrap();
+    let app_data = directory.path().join("app-data");
+    fs::create_dir(&app_data).unwrap();
+    let legacy = app_data.join("iroh.secret");
+    let original = SecretKey::generate();
+    fs::write(&legacy, HEXLOWER.encode(&original.to_bytes())).unwrap();
+
+    let repository = Repository::open(&app_data).await.unwrap();
+    let protected_directory = app_data.join("protected-secrets");
+    let store = Arc::new(WindowsDpapiSecretStore::new(&protected_directory).unwrap());
+    let custody = SecretCustody::new(repository.protected_secrets(), store);
+    custody.crash_once_at(CustodyCrashPoint::MetadataActivation);
+    assert!(custody
+        .migrate_legacy_endpoint_identity(&legacy)
+        .await
+        .is_err());
+    assert!(legacy.exists());
+    drop(custody);
+    drop(repository);
+
+    let repository = Repository::open(&app_data).await.unwrap();
+    let restarted_store = Arc::new(WindowsDpapiSecretStore::new(&protected_directory).unwrap());
+    let (custody, _) = SecretCustody::start(repository.protected_secrets(), restarted_store)
+        .await
+        .unwrap();
+    let handle = custody
+        .migrate_legacy_endpoint_identity(&legacy)
+        .await
+        .unwrap();
+    assert!(!legacy.exists());
+    assert_eq!(
+        custody.load(&handle).await.unwrap(),
+        SecretMaterial::new(original.to_bytes().to_vec()).unwrap()
+    );
+
+    let replacement = SecretKey::generate();
+    fs::write(&legacy, HEXLOWER.encode(&replacement.to_bytes())).unwrap();
+    assert!(matches!(
+        custody.migrate_legacy_endpoint_identity(&legacy).await,
+        Err(VnidropError::SecureStorageCorrupted { .. })
+    ));
+    assert!(legacy.exists());
+    assert_eq!(
+        custody.load(&handle).await.unwrap(),
+        SecretMaterial::new(original.to_bytes().to_vec()).unwrap()
+    );
+}

crates/vnidrop/tests/experimental_domain.rs

@@ -0,0 +1,141 @@
+mod support;
+
+use support::TestNode;
+use vnidrop::{
+    experimental_saved_device_capabilities, DeviceRelationship, DeviceRelationshipState,
+    ExperimentalSavedDeviceCapabilities, SavedDevice, ShareMetadataInput, ShareSource, SourceKind,
+    TargetedTransfer, TargetedTransferState, TransferAccessMode, VnidropError,
+};
+
+#[test]
+fn saved_device_protocols_are_explicitly_experimental_and_versioned() {
+    assert_eq!(
+        experimental_saved_device_capabilities(),
+        ExperimentalSavedDeviceCapabilities {
+            domain_contract_version: 1,
+            relationship_protocol_version: 1,
+            targeted_transfer_protocol_version: 1,
+        }
+    );
+}
+
+#[test]
+fn saved_devices_relationships_and_targeted_transfers_are_distinct_contracts() {
+    let device = SavedDevice {
+        endpoint_id: "receiver-endpoint".to_string(),
+        local_label: Some("Kitchen tablet".to_string()),
+        remote_display_name: Some("Tablet".to_string()),
+        created_at: 1_000,
+        last_authenticated_at: Some(2_000),
+    };
+    let relationship = DeviceRelationship {
+        remote_endpoint_id: device.endpoint_id.clone(),
+        state: DeviceRelationshipState::Saved,
+        generation: 4,
+        minimum_protocol_version: 1,
+        created_at: 1_000,
+        updated_at: 2_000,
+    };
+    let transfer = TargetedTransfer {
+        id: "targeted-transfer-id".to_string(),
+        sender_endpoint_id: "sender-endpoint".to_string(),
+        receiver_endpoint_id: device.endpoint_id.clone(),
+        manifest_id: "immutable-manifest-id".to_string(),
+        file_count: 2,
+        total_size: 42,
+        state: TargetedTransferState::AwaitingApproval,
+        created_at: 3_000,
+        updated_at: 3_000,
+    };
+
+    assert_eq!(relationship.remote_endpoint_id, device.endpoint_id);
+    assert_eq!(relationship.state, DeviceRelationshipState::Saved);
+    assert_eq!(
+        transfer.receiver_endpoint_id,
+        relationship.remote_endpoint_id
+    );
+    assert_eq!(transfer.state, TargetedTransferState::AwaitingApproval);
+}
+
+#[test]
+fn targeted_transfer_transitions_are_validated_by_the_domain() {
+    use TargetedTransferState as State;
+
+    let valid = [
+        (State::Preparing, State::Offering),
+        (State::Offering, State::AwaitingApproval),
+        (State::AwaitingApproval, State::Approved),
+        (State::AwaitingApproval, State::Declined),
+        (State::Approved, State::Connecting),
+        (State::Connecting, State::Transferring),
+        (State::Connecting, State::Interrupted),
+        (State::Transferring, State::Completed),
+        (State::Transferring, State::Interrupted),
+        (State::Interrupted, State::Connecting),
+        (State::Completed, State::Deleted),
+        (State::Declined, State::Deleted),
+        (State::Cancelled, State::Deleted),
+        (State::Failed, State::Deleted),
+    ];
+    for (current, next) in valid {
+        current
+            .validate_transition_to(next)
+            .unwrap_or_else(|error| panic!("{current:?} -> {next:?} failed: {error}"));
+    }
+
+    let error = State::Completed
+        .validate_transition_to(State::Transferring)
+        .unwrap_err();
+    assert!(matches!(error, VnidropError::InvalidTransition { .. }));
+    assert_eq!(
+        error.to_string(),
+        "invalid targeted transfer transition: completed -> transferring"
+    );
+}
+
+#[test]
+fn experimental_domain_seam_does_not_change_multi_receiver_shares() {
+    let source_dir = tempfile::tempdir().unwrap();
+    let first_output = tempfile::tempdir().unwrap();
+    let second_output = tempfile::tempdir().unwrap();
+    let source_path = source_dir.path().join("shared.txt");
+    std::fs::write(&source_path, b"shared with both receivers").unwrap();
+    let sender = TestNode::new();
+    let first_receiver = TestNode::new();
+    let second_receiver = TestNode::new();
+    let share = sender
+        .core
+        .share_files(
+            vec![ShareSource {
+                kind: SourceKind::Path,
+                value: source_path.to_string_lossy().into_owned(),
+                display_name: Some("shared.txt".to_string()),
+                is_directory: false,
+            }],
+            ShareMetadataInput {
+                transfer_id: 90_001,
+                transfer_name: Some("Existing share".to_string()),
+                sender_name: Some("Sender".to_string()),
+                access_mode: TransferAccessMode::Public,
+            },
+        )
+        .unwrap();
+
+    for (receiver, output) in [
+        (&first_receiver, first_output.path()),
+        (&second_receiver, second_output.path()),
+    ] {
+        receiver
+            .core
+            .receive(
+                share.ticket.clone(),
+                output.to_string_lossy().into_owned(),
+                Some("Receiver".to_string()),
+            )
+            .unwrap();
+        assert_eq!(
+            std::fs::read(output.join("shared.txt")).unwrap(),
+            b"shared with both receivers"
+        );
+    }
+}

crates/vnidrop/tests/offer.rs

@@ -0,0 +1,651 @@
+//! Send-to-contact offers between two real nodes.
+
+mod support;
+
+use std::{
+    path::Path,
+    sync::Arc,
+    time::{Duration, Instant},
+};
+
+use support::{RecordingSink, TestNode};
+use vnidrop::{
+    ContactSendResult, IncomingOffer, ShareMetadataInput, ShareSource, SourceKind,
+    TransferAccessMode, VnidropCore, VnidropError,
+};
+
+fn endpoint_id(node: &TestNode) -> String {
+    node.core.status().endpoint_id
+}
+
+/// Establish a one-way relationship: `issuer` becomes reachable by `holder`.
+fn pair(issuer: &TestNode, holder: &TestNode) {
+    let issuer_id = endpoint_id(issuer);
+    issuer
+        .core
+        .allow_device_to_reach_me(endpoint_id(holder), Some("Issuer".to_string()))
+        .expect("grant delivered");
+
+    let started = Instant::now();
+    while !holder
+        .core
+        .list_pending_pairings()
+        .iter()
+        .any(|pending| pending.endpoint_id == issuer_id)
+    {
+        assert!(
+            started.elapsed() < Duration::from_secs(10),
+            "pairing offer never surfaced"
+        );
+        std::thread::sleep(Duration::from_millis(25));
+    }
+    holder
+        .core
+        .respond_to_pairing(issuer_id, true)
+        .expect("consent recorded");
+}
+
+fn sources(path: &Path) -> Vec<ShareSource> {
+    vec![ShareSource {
+        kind: SourceKind::Path,
+        value: path.to_string_lossy().to_string(),
+        display_name: Some("shared.txt".to_string()),
+        is_directory: false,
+    }]
+}
+
+fn metadata(transfer_id: u64) -> ShareMetadataInput {
+    ShareMetadataInput {
+        transfer_id,
+        transfer_name: Some("shared.txt".to_string()),
+        sender_name: Some("Sender".to_string()),
+        access_mode: TransferAccessMode::ApprovalRequired,
+    }
+}
+
+/// Send in the background: the call blocks until the receiver decides.
+fn send_in_background(
+    core: Arc<VnidropCore>,
+    to: String,
+    path: &Path,
+    transfer_id: u64,
+) -> std::thread::JoinHandle<Result<ContactSendResult, VnidropError>> {
+    let sources = sources(path);
+    std::thread::spawn(move || core.send_to_contact(to, sources, metadata(transfer_id)))
+}
+
+fn wait_for_offer(core: &VnidropCore) -> IncomingOffer {
+    let started = Instant::now();
+    loop {
+        if let Some(offer) = core.list_pending_offers().into_iter().next() {
+            return offer;
+        }
+        assert!(
+            started.elapsed() < Duration::from_secs(10),
+            "offer never surfaced on the receiver"
+        );
+        std::thread::sleep(Duration::from_millis(25));
+    }
+}
+
+/// The whole point: the receiver is asked exactly once, the sender not at all.
+#[test]
+fn an_accepted_offer_transfers_without_prompting_the_sender() {
+    let source_dir = tempfile::tempdir().unwrap();
+    let source_path = source_dir.path().join("shared.txt");
+    std::fs::write(&source_path, b"offered content").unwrap();
+    let output_dir = tempfile::tempdir().unwrap();
+
+    let sender = TestNode::new();
+    let receiver = TestNode::new();
+    // The sender must be able to reach the receiver, so the receiver issues.
+    pair(&receiver, &sender);
+
+    let handle = send_in_background(
+        sender.core.arc(),
+        endpoint_id(&receiver),
+        &source_path,
+        4_001,
+    );
+
+    let offer = wait_for_offer(&receiver.core);
+    assert_eq!(offer.from_endpoint_id, endpoint_id(&sender));
+    assert_eq!(offer.transfer_name, "shared.txt");
+    assert_eq!(offer.file_count, 1);
+    assert_eq!(offer.sender_display_name.as_deref(), Some("Sender"));
+
+    let ticket = receiver
+        .core
+        .respond_to_offer(offer.offer_id, true)
+        .expect("accepting yields the ticket");
+    let share = handle.join().unwrap().expect("offer accepted");
+
+    receiver
+        .core
+        .receive(
+            ticket,
+            output_dir.path().to_string_lossy().to_string(),
+            Some("Receiver".to_string()),
+        )
+        .expect("receive completes");
+
+    assert_eq!(
+        std::fs::read(output_dir.path().join("shared.txt")).unwrap(),
+        b"offered content"
+    );
+
+    // The sender was never asked: the only receiver request on its side was
+    // recorded as already approved.
+    let requests = sender
+        .core
+        .list_receiver_requests(share.share.transfer_id)
+        .unwrap();
+    assert_eq!(requests.len(), 1);
+    assert!(
+        matches!(requests[0].status.as_str(), "accepted" | "completed"),
+        "sender should not have been prompted, got status {}",
+        requests[0].status
+    );
+    assert!(requests[0].reason.is_none());
+}
+
+/// Declining yields no ticket and stops the share.
+#[test]
+fn a_declined_offer_yields_no_ticket() {
+    let source_dir = tempfile::tempdir().unwrap();
+    let source_path = source_dir.path().join("shared.txt");
+    std::fs::write(&source_path, b"offered content").unwrap();
+
+    let sender = TestNode::new();
+    let receiver = TestNode::new();
+    pair(&receiver, &sender);
+
+    let handle = send_in_background(
+        sender.core.arc(),
+        endpoint_id(&receiver),
+        &source_path,
+        4_002,
+    );
+    let offer = wait_for_offer(&receiver.core);
+
+    assert!(
+        receiver
+            .core
+            .respond_to_offer(offer.offer_id, false)
+            .is_none(),
+        "a declined offer must not hand over a ticket"
+    );
+
+    let outcome = handle.join().unwrap();
+    assert!(outcome.is_err(), "sender should see the refusal");
+    assert!(receiver.core.list_pending_offers().is_empty());
+}
+
+/// A device with no grant cannot offer at all.
+#[test]
+fn sending_without_a_grant_is_refused_locally() {
+    let source_dir = tempfile::tempdir().unwrap();
+    let source_path = source_dir.path().join("shared.txt");
+    std::fs::write(&source_path, b"content").unwrap();
+
+    let sender = TestNode::new();
+    let receiver = TestNode::new();
+
+    let outcome = sender.core.send_to_contact(
+        endpoint_id(&receiver),
+        sources(&source_path),
+        metadata(4_003),
+    );
+
+    assert!(outcome.is_err(), "no grant means nothing to send with");
+    assert!(receiver.core.list_pending_offers().is_empty());
+}
+
+/// After the peer revokes, the offer is refused and the dead grant is dropped.
+#[test]
+fn a_revoked_grant_cannot_be_used_to_offer() {
+    let source_dir = tempfile::tempdir().unwrap();
+    let source_path = source_dir.path().join("shared.txt");
+    std::fs::write(&source_path, b"content").unwrap();
+
+    let sender = TestNode::new();
+    let receiver = TestNode::new();
+    pair(&receiver, &sender);
+    // The receiver decides it no longer wants to hear from the sender.
+    receiver
+        .core
+        .forget_contact(endpoint_id(&sender))
+        .expect("forgotten");
+
+    let outcome = sender.core.send_to_contact(
+        endpoint_id(&receiver),
+        sources(&source_path),
+        metadata(4_004),
+    );
+
+    assert!(outcome.is_err());
+    assert!(receiver.core.list_pending_offers().is_empty());
+    let contacts = sender.core.list_contacts().unwrap();
+    assert!(
+        contacts.iter().all(|contact| !contact.can_send),
+        "a refusal naming a dead grant must clear the sender's belief it can reach them"
+    );
+}
+
+/// An offer-created share is never public, whatever the caller asked for.
+#[test]
+fn an_offer_share_is_never_public() {
+    let source_dir = tempfile::tempdir().unwrap();
+    let source_path = source_dir.path().join("shared.txt");
+    std::fs::write(&source_path, b"content").unwrap();
+
+    let sender = TestNode::new();
+    let receiver = TestNode::new();
+    pair(&receiver, &sender);
+
+    let core = sender.core.arc();
+    let to = endpoint_id(&receiver);
+    let sources = sources(&source_path);
+    let handle = std::thread::spawn(move || {
+        core.send_to_contact(
+            to,
+            sources,
+            ShareMetadataInput {
+                transfer_id: 4_005,
+                transfer_name: Some("shared.txt".to_string()),
+                sender_name: None,
+                // Deliberately asking for the wider mode.
+                access_mode: TransferAccessMode::Public,
+            },
+        )
+    });
+
+    let offer = wait_for_offer(&receiver.core);
+    receiver.core.respond_to_offer(offer.offer_id, true);
+    let share = handle.join().unwrap().expect("offer accepted");
+
+    let stored = sender
+        .core
+        .list_transfers()
+        .unwrap()
+        .into_iter()
+        .find(|transfer| transfer.transfer_id == share.share.transfer_id)
+        .expect("share recorded");
+    assert_eq!(stored.access_mode, TransferAccessMode::ApprovalRequired);
+}
+
+/// A second offer while one is on screen is refused rather than stacked.
+#[test]
+fn only_one_offer_per_device_is_pending_at_a_time() {
+    let source_dir = tempfile::tempdir().unwrap();
+    let source_path = source_dir.path().join("shared.txt");
+    std::fs::write(&source_path, b"content").unwrap();
+
+    let sender = TestNode::new();
+    let receiver = TestNode::new();
+    pair(&receiver, &sender);
+
+    let first = send_in_background(
+        sender.core.arc(),
+        endpoint_id(&receiver),
+        &source_path,
+        4_006,
+    );
+    wait_for_offer(&receiver.core);
+
+    let second = sender.core.send_to_contact(
+        endpoint_id(&receiver),
+        sources(&source_path),
+        metadata(4_007),
+    );
+    assert!(second.is_err(), "a second prompt must not stack");
+    assert_eq!(receiver.core.list_pending_offers().len(), 1);
+
+    let offer = receiver.core.list_pending_offers().remove(0);
+    receiver.core.respond_to_offer(offer.offer_id, false);
+    let _ = first.join().unwrap();
+}
+
+/// Forgetting a device clears any prompt it left on screen, which would
+/// otherwise be actionable with a grant that no longer exists.
+#[test]
+fn forgetting_a_device_clears_its_pending_offer() {
+    let source_dir = tempfile::tempdir().unwrap();
+    let source_path = source_dir.path().join("shared.txt");
+    std::fs::write(&source_path, b"content").unwrap();
+
+    let sender = TestNode::new();
+    let receiver = TestNode::new();
+    pair(&receiver, &sender);
+
+    let handle = send_in_background(
+        sender.core.arc(),
+        endpoint_id(&receiver),
+        &source_path,
+        4_008,
+    );
+    wait_for_offer(&receiver.core);
+
+    receiver
+        .core
+        .forget_contact(endpoint_id(&sender))
+        .expect("forgotten");
+
+    assert!(receiver.core.list_pending_offers().is_empty());
+    assert!(handle.join().unwrap().is_err());
+}
+
+/// The ordinary QR path still prompts the sender: pre-authorisation applies
+/// only to transfers the sender pushed.
+#[test]
+fn an_ordinary_ticket_receive_still_prompts_the_sender() {
+    let source_dir = tempfile::tempdir().unwrap();
+    let source_path = source_dir.path().join("shared.txt");
+    std::fs::write(&source_path, b"content").unwrap();
+    let output_dir = tempfile::tempdir().unwrap();
+
+    let sender_dir = tempfile::tempdir().unwrap();
+    let sink = Arc::new(RecordingSink::default());
+    let sender = support::CoreGuard::start(sender_dir.path(), sink);
+    let receiver = TestNode::new();
+
+    let share = sender
+        .share_files(sources(&source_path), metadata(4_009))
+        .expect("shared");
+
+    let core = receiver.core.arc();
+    let ticket = share.ticket.clone();
+    let output = output_dir.path().to_string_lossy().to_string();
+    let handle =
+        std::thread::spawn(move || core.receive(ticket, output, Some("Receiver".to_string())));
+
+    let request = support::wait_for_receiver_request(&sender, share.transfer_id);
+    assert_eq!(
+        request.status, "requested",
+        "an unsolicited ticket receive must still ask the sender"
+    );
+    sender
+        .respond_receiver_request(request.id, true, None)
+        .unwrap();
+    handle.join().unwrap().expect("receive completes");
+}
+
+// MARK: - Held offers and the foreground pull
+
+/// Restartable node, for simulating a device that was not running.
+struct RestartableNode {
+    dir: tempfile::TempDir,
+    core: Option<support::CoreGuard>,
+}
+
+impl RestartableNode {
+    fn new() -> Self {
+        let dir = tempfile::tempdir().unwrap();
+        let core = support::CoreGuard::start(dir.path(), Arc::new(RecordingSink::default()));
+        Self {
+            dir,
+            core: Some(core),
+        }
+    }
+
+    fn core(&self) -> &VnidropCore {
+        self.core.as_ref().expect("node is running")
+    }
+
+    fn stop(&mut self) {
+        if let Some(core) = self.core.take() {
+            core.shutdown();
+        }
+    }
+
+    fn start(&mut self) {
+        self.core = Some(support::CoreGuard::start(
+            self.dir.path(),
+            Arc::new(RecordingSink::default()),
+        ));
+    }
+}
+
+/// Pair so `sender` may reach the restartable node.
+fn pair_with_restartable(sender: &TestNode, receiver: &RestartableNode) {
+    let receiver_id = receiver.core().status().endpoint_id;
+    receiver
+        .core()
+        .allow_device_to_reach_me(endpoint_id(sender), Some("Receiver".to_string()))
+        .expect("grant delivered");
+
+    let started = Instant::now();
+    while !sender
+        .core
+        .list_pending_pairings()
+        .iter()
+        .any(|pending| pending.endpoint_id == receiver_id)
+    {
+        assert!(
+            started.elapsed() < Duration::from_secs(10),
+            "pairing offer never surfaced"
+        );
+        std::thread::sleep(Duration::from_millis(25));
+    }
+    sender
+        .core
+        .respond_to_pairing(receiver_id, true)
+        .expect("consent recorded");
+}
+
+/// The whole point of §11: a closed app is not an error, it is a delay.
+#[test]
+fn an_offer_to_a_device_that_is_not_running_is_held_and_collected_later() {
+    let source_dir = tempfile::tempdir().unwrap();
+    let source_path = source_dir.path().join("shared.txt");
+    std::fs::write(&source_path, b"held content").unwrap();
+    let output_dir = tempfile::tempdir().unwrap();
+
+    let sender = TestNode::new();
+    let mut receiver = RestartableNode::new();
+    pair_with_restartable(&sender, &receiver);
+    let receiver_id = receiver.core().status().endpoint_id;
+
+    receiver.stop();
+
+    let outcome = sender
+        .core
+        .send_to_contact(receiver_id, sources(&source_path), metadata(5_001))
+        .expect("an unreachable device is not a failure");
+    assert!(
+        !outcome.delivered,
+        "nothing was delivered, the offer is waiting"
+    );
+    let held = sender.core.list_held_offers().unwrap();
+    assert_eq!(held.len(), 1);
+    assert_eq!(held[0].transfer_id, outcome.share.transfer_id);
+
+    receiver.start();
+    let collected = receiver
+        .core()
+        .poll_contacts_for_offers()
+        .expect("poll succeeds");
+
+    assert_eq!(collected, 1);
+    let offer = receiver.core().list_pending_offers().remove(0);
+    assert_eq!(offer.transfer_name, "shared.txt");
+
+    let ticket = receiver
+        .core()
+        .respond_to_offer(offer.offer_id, true)
+        .expect("accepting yields the ticket");
+    receiver
+        .core()
+        .receive(
+            ticket,
+            output_dir.path().to_string_lossy().to_string(),
+            Some("Receiver".to_string()),
+        )
+        .expect("receive completes");
+
+    assert_eq!(
+        std::fs::read(output_dir.path().join("shared.txt")).unwrap(),
+        b"held content"
+    );
+    assert!(
+        sender.core.list_held_offers().unwrap().is_empty(),
+        "a collected offer is no longer held"
+    );
+}
+
+/// Collected offers are consumed, so a second pull does not re-deliver them.
+#[test]
+fn polling_twice_does_not_collect_the_same_offer_again() {
+    let source_dir = tempfile::tempdir().unwrap();
+    let source_path = source_dir.path().join("shared.txt");
+    std::fs::write(&source_path, b"content").unwrap();
+
+    let sender = TestNode::new();
+    let mut receiver = RestartableNode::new();
+    pair_with_restartable(&sender, &receiver);
+    let receiver_id = receiver.core().status().endpoint_id;
+    receiver.stop();
+    sender
+        .core
+        .send_to_contact(receiver_id, sources(&source_path), metadata(5_002))
+        .unwrap();
+
+    // A fresh core each time, so the per-device poll rate limit does not mask
+    // the consume-on-delivery behaviour being asserted here.
+    receiver.start();
+    assert_eq!(receiver.core().poll_contacts_for_offers().unwrap(), 1);
+    receiver.stop();
+    receiver.start();
+    assert_eq!(
+        receiver.core().poll_contacts_for_offers().unwrap(),
+        0,
+        "the offer was already handed over"
+    );
+}
+
+/// Cancelling the transfer withdraws the ticket that was waiting for pickup.
+#[test]
+fn cancelling_a_transfer_withdraws_its_held_offer() {
+    let source_dir = tempfile::tempdir().unwrap();
+    let source_path = source_dir.path().join("shared.txt");
+    std::fs::write(&source_path, b"content").unwrap();
+
+    let sender = TestNode::new();
+    let mut receiver = RestartableNode::new();
+    pair_with_restartable(&sender, &receiver);
+    let receiver_id = receiver.core().status().endpoint_id;
+    receiver.stop();
+    let outcome = sender
+        .core
+        .send_to_contact(receiver_id, sources(&source_path), metadata(5_004))
+        .unwrap();
+    assert_eq!(sender.core.list_held_offers().unwrap().len(), 1);
+
+    sender
+        .core
+        .cancel_transfer(outcome.share.transfer_id)
+        .unwrap();
+
+    assert!(sender.core.list_held_offers().unwrap().is_empty());
+    receiver.start();
+    assert_eq!(receiver.core().poll_contacts_for_offers().unwrap(), 0);
+}
+
+/// A device with no relationship learns nothing by polling.
+#[test]
+fn polling_a_device_that_holds_nothing_for_you_returns_nothing() {
+    let sender = TestNode::new();
+    let receiver = TestNode::new();
+    pair(&receiver, &sender);
+
+    assert_eq!(receiver.core.poll_contacts_for_offers().unwrap(), 0);
+    assert!(receiver.core.list_pending_offers().is_empty());
+}
+
+/// A transfer created for an invitation can also be pushed to a device: the
+/// same ticket, another way to deliver it.
+#[test]
+fn an_existing_share_can_be_offered_to_a_contact() {
+    let source_dir = tempfile::tempdir().unwrap();
+    let source_path = source_dir.path().join("shared.txt");
+    std::fs::write(&source_path, b"existing share").unwrap();
+    let output_dir = tempfile::tempdir().unwrap();
+
+    let sender = TestNode::new();
+    let receiver = TestNode::new();
+    pair(&receiver, &sender);
+
+    // An ordinary share, as if the user had created it for a QR code.
+    let share = sender
+        .core
+        .share_files(sources(&source_path), metadata(6_001))
+        .expect("shared");
+
+    let core = sender.core.arc();
+    let to = endpoint_id(&receiver);
+    let handle = std::thread::spawn(move || core.offer_transfer_to_contact(share.transfer_id, to));
+
+    let offer = wait_for_offer(&receiver.core);
+    let ticket = receiver
+        .core
+        .respond_to_offer(offer.offer_id, true)
+        .expect("accepting yields the ticket");
+    let outcome = handle.join().unwrap().expect("offer accepted");
+
+    assert!(outcome.delivered);
+    assert_eq!(
+        outcome.share.transfer_id, share.transfer_id,
+        "offering reuses the existing transfer rather than creating another"
+    );
+    assert_eq!(ticket, share.ticket, "the invitation is the stored one");
+
+    receiver
+        .core
+        .receive(
+            ticket,
+            output_dir.path().to_string_lossy().to_string(),
+            Some("Receiver".to_string()),
+        )
+        .expect("receive completes");
+    assert_eq!(
+        std::fs::read(output_dir.path().join("shared.txt")).unwrap(),
+        b"existing share"
+    );
+}
+
+/// A stopped share serves nothing, so its ticket must not be handed out.
+#[test]
+fn a_stopped_share_cannot_be_offered() {
+    let source_dir = tempfile::tempdir().unwrap();
+    let source_path = source_dir.path().join("shared.txt");
+    std::fs::write(&source_path, b"content").unwrap();
+
+    let sender = TestNode::new();
+    let receiver = TestNode::new();
+    pair(&receiver, &sender);
+    let share = sender
+        .core
+        .share_files(sources(&source_path), metadata(6_002))
+        .expect("shared");
+    sender.core.cancel_transfer(share.transfer_id).unwrap();
+
+    let outcome = sender
+        .core
+        .offer_transfer_to_contact(share.transfer_id, endpoint_id(&receiver));
+
+    assert!(outcome.is_err());
+    assert!(receiver.core.list_pending_offers().is_empty());
+}
+
+/// Offering an unknown transfer is rejected rather than silently doing nothing.
+#[test]
+fn offering_an_unknown_transfer_is_rejected() {
+    let sender = TestNode::new();
+    let receiver = TestNode::new();
+    pair(&receiver, &sender);
+
+    assert!(sender
+        .core
+        .offer_transfer_to_contact(9_999, endpoint_id(&receiver))
+        .is_err());
+}

crates/vnidrop/tests/pairing.rs

@@ -0,0 +1,252 @@
+//! Device history pairing over the offer ALPN, between two real nodes.
+
+mod support;
+
+use std::time::{Duration, Instant};
+
+use support::TestNode;
+use vnidrop::VnidropCore;
+
+fn endpoint_id(node: &TestNode) -> String {
+    node.core.status().endpoint_id
+}
+
+/// The pairing prompt arrives asynchronously on the peer's side.
+fn wait_for_pending_pairing(core: &VnidropCore, from_endpoint: &str) {
+    let started = Instant::now();
+    loop {
+        if core
+            .list_pending_pairings()
+            .iter()
+            .any(|pending| pending.endpoint_id == from_endpoint)
+        {
+            return;
+        }
+        assert!(
+            started.elapsed() < Duration::from_secs(10),
+            "pairing offer from {from_endpoint} never surfaced"
+        );
+        std::thread::sleep(Duration::from_millis(25));
+    }
+}
+
+/// Alice agrees to be reachable by Bob; Bob consents; Bob can now reach Alice.
+#[test]
+fn a_delivered_grant_becomes_a_contact_only_after_the_peer_consents() {
+    let alice = TestNode::new();
+    let bob = TestNode::new();
+    let bob_id = endpoint_id(&bob);
+    let alice_id = endpoint_id(&alice);
+
+    alice
+        .core
+        .allow_device_to_reach_me(bob_id.clone(), Some("Alice Laptop".to_string()))
+        .expect("grant delivered");
+
+    // Delivery alone must not create a contact: Bob has not agreed yet.
+    wait_for_pending_pairing(&bob.core, &alice_id);
+    assert!(
+        bob.core.list_contacts().unwrap().is_empty(),
+        "an undelivered-consent grant must not appear as a contact"
+    );
+
+    assert!(bob
+        .core
+        .respond_to_pairing(alice_id.clone(), true)
+        .expect("consent recorded"));
+
+    let contacts = bob.core.list_contacts().unwrap();
+    assert_eq!(contacts.len(), 1);
+    assert_eq!(contacts[0].endpoint_id, alice_id);
+    assert!(
+        contacts[0].can_send,
+        "holding a live grant is what makes a contact reachable"
+    );
+    assert!(bob.core.list_pending_pairings().is_empty());
+}
+
+/// Declining leaves nothing behind: no contact, no stored capability.
+#[test]
+fn declining_a_pairing_stores_nothing() {
+    let alice = TestNode::new();
+    let bob = TestNode::new();
+    let alice_id = endpoint_id(&alice);
+
+    alice
+        .core
+        .allow_device_to_reach_me(endpoint_id(&bob), None)
+        .expect("grant delivered");
+    wait_for_pending_pairing(&bob.core, &alice_id);
+
+    assert!(bob
+        .core
+        .respond_to_pairing(alice_id.clone(), false)
+        .unwrap());
+
+    assert!(bob.core.list_contacts().unwrap().is_empty());
+    assert!(bob.core.list_pending_pairings().is_empty());
+    assert!(
+        !bob.core.respond_to_pairing(alice_id, true).unwrap(),
+        "a declined offer cannot be accepted afterwards"
+    );
+}
+
+/// The pairing is directional: Alice issuing to Bob does not let Alice reach Bob.
+#[test]
+fn each_direction_is_a_separate_decision() {
+    let alice = TestNode::new();
+    let bob = TestNode::new();
+    let alice_id = endpoint_id(&alice);
+    let bob_id = endpoint_id(&bob);
+
+    alice
+        .core
+        .allow_device_to_reach_me(bob_id.clone(), None)
+        .expect("grant delivered");
+    wait_for_pending_pairing(&bob.core, &alice_id);
+    bob.core.respond_to_pairing(alice_id.clone(), true).unwrap();
+
+    // Alice recorded Bob as a contact when she issued, but she holds no grant
+    // from him, so she cannot reach him.
+    let alice_contacts = alice.core.list_contacts().unwrap();
+    assert_eq!(alice_contacts.len(), 1);
+    assert_eq!(alice_contacts[0].endpoint_id, bob_id);
+    assert!(
+        !alice_contacts[0].can_send,
+        "issuing a grant does not grant the issuer anything in return"
+    );
+}
+
+/// Revoking kills the peer's entry without their cooperation, and tells them.
+#[test]
+fn forgetting_a_contact_revokes_the_peers_access() {
+    let alice = TestNode::new();
+    let bob = TestNode::new();
+    let alice_id = endpoint_id(&alice);
+    let bob_id = endpoint_id(&bob);
+
+    alice
+        .core
+        .allow_device_to_reach_me(bob_id.clone(), None)
+        .expect("grant delivered");
+    wait_for_pending_pairing(&bob.core, &alice_id);
+    bob.core.respond_to_pairing(alice_id.clone(), true).unwrap();
+    assert!(bob.core.list_contacts().unwrap()[0].can_send);
+
+    alice.core.forget_contact(bob_id).expect("forgotten");
+
+    // Best-effort notification: Bob is online, so his dead entry should clear
+    // promptly rather than at his next attempt.
+    let started = Instant::now();
+    loop {
+        let contacts = bob.core.list_contacts().unwrap();
+        let cleared = contacts.first().is_none_or(|contact| !contact.can_send);
+        if cleared {
+            break;
+        }
+        assert!(
+            started.elapsed() < Duration::from_secs(10),
+            "revocation notice never reached the peer"
+        );
+        std::thread::sleep(Duration::from_millis(25));
+    }
+    assert!(alice.core.list_contacts().unwrap().is_empty());
+}
+
+/// A blocked device is refused, and cannot tell blocking from any other refusal.
+#[test]
+fn a_blocked_device_cannot_pair() {
+    let alice = TestNode::new();
+    let bob = TestNode::new();
+    let bob_id = endpoint_id(&bob);
+
+    bob.core
+        .block_contact(endpoint_id(&alice))
+        .expect("blocked");
+
+    let outcome = alice.core.allow_device_to_reach_me(bob_id, None);
+
+    assert!(outcome.is_err(), "a blocked peer must refuse the grant");
+    assert!(bob.core.list_pending_pairings().is_empty());
+    assert!(bob.core.list_contacts().unwrap().is_empty());
+}
+
+/// Blocking locally also prevents pairing outward, so the block is symmetric
+/// from the user's point of view.
+#[test]
+fn blocking_prevents_issuing_a_grant_to_that_device() {
+    let alice = TestNode::new();
+    let bob = TestNode::new();
+    let bob_id = endpoint_id(&bob);
+
+    alice.core.block_contact(bob_id.clone()).expect("blocked");
+
+    let outcome = alice.core.allow_device_to_reach_me(bob_id.clone(), None);
+    assert!(outcome.is_err());
+
+    alice
+        .core
+        .unblock_contact(bob_id.clone())
+        .expect("unblocked");
+    assert!(alice.core.list_blocked_contacts().unwrap().is_empty());
+}
+
+/// Re-pairing an existing contact refreshes the grant without a second prompt.
+#[test]
+fn re_pairing_a_known_contact_does_not_prompt_again() {
+    let alice = TestNode::new();
+    let bob = TestNode::new();
+    let alice_id = endpoint_id(&alice);
+    let bob_id = endpoint_id(&bob);
+
+    alice
+        .core
+        .allow_device_to_reach_me(bob_id.clone(), None)
+        .unwrap();
+    wait_for_pending_pairing(&bob.core, &alice_id);
+    bob.core.respond_to_pairing(alice_id.clone(), true).unwrap();
+
+    alice
+        .core
+        .allow_device_to_reach_me(bob_id, None)
+        .expect("re-issued");
+
+    assert!(
+        bob.core.list_pending_pairings().is_empty(),
+        "an established contact must not raise a fresh consent prompt"
+    );
+    assert_eq!(bob.core.list_contacts().unwrap().len(), 1);
+}
+
+/// The user's own label survives whatever the remote later calls itself.
+#[test]
+fn a_local_label_survives_a_remote_rename() {
+    let alice = TestNode::new();
+    let bob = TestNode::new();
+    let alice_id = endpoint_id(&alice);
+    let bob_id = endpoint_id(&bob);
+
+    alice
+        .core
+        .allow_device_to_reach_me(bob_id.clone(), Some("Alice Laptop".to_string()))
+        .unwrap();
+    wait_for_pending_pairing(&bob.core, &alice_id);
+    bob.core.respond_to_pairing(alice_id.clone(), true).unwrap();
+    bob.core
+        .set_contact_label(alice_id.clone(), Some("Work Mac".to_string()))
+        .unwrap();
+
+    alice
+        .core
+        .allow_device_to_reach_me(bob_id, Some("Totally Not Evil".to_string()))
+        .unwrap();
+
+    let contact = bob
+        .core
+        .list_contacts()
+        .unwrap()
+        .into_iter()
+        .find(|contact| contact.endpoint_id == alice_id)
+        .expect("contact");
+    assert_eq!(contact.local_label.as_deref(), Some("Work Mac"));
+}

localization/strings.json

@@ -4617,6 +4617,713 @@
         "nl": "App-versie",
         "ru": "Версия приложения"
       }
+    },
+    "contacts_title": {
+      "context": "Devices screen: title of the list of remembered devices.",
+      "translations": {
+        "en": "Devices",
+        "fr": "Appareils",
+        "es": "Dispositivos",
+        "it": "Dispositivi",
+        "de": "Geräte",
+        "pt": "Dispositivos",
+        "pl": "Urządzenia",
+        "nl": "Apparaten",
+        "ru": "Устройства"
+      }
+    },
+    "contacts_subtitle": {
+      "context": "Devices screen: one-line explanation under the title.",
+      "translations": {
+        "en": "Devices you have transferred with can receive files without a new invitation.",
+        "fr": "Les appareils avec lesquels vous avez déjà échangé peuvent recevoir des fichiers sans nouvelle invitation.",
+        "es": "Los dispositivos con los que ya has compartido pueden recibir archivos sin una nueva invitación.",
+        "it": "I dispositivi con cui hai già scambiato file possono riceverne altri senza un nuovo invito.",
+        "de": "Geräte, mit denen Sie bereits Dateien ausgetauscht haben, können ohne neue Einladung Dateien empfangen.",
+        "pt": "Os dispositivos com os quais já transferiu podem receber ficheiros sem um novo convite.",
+        "pl": "Urządzenia, z którymi już przesyłano pliki, mogą je odbierać bez nowego zaproszenia.",
+        "nl": "Apparaten waarmee je al hebt overgedragen, kunnen bestanden ontvangen zonder nieuwe uitnodiging.",
+        "ru": "Устройства, с которыми вы уже обменивались файлами, могут получать их без нового приглашения."
+      }
+    },
+    "contacts_empty_title": {
+      "context": "Devices screen: empty-state title when no device has been remembered yet.",
+      "translations": {
+        "en": "No remembered devices",
+        "fr": "Aucun appareil enregistré",
+        "es": "Ningún dispositivo guardado",
+        "it": "Nessun dispositivo memorizzato",
+        "de": "Keine gespeicherten Geräte",
+        "pt": "Nenhum dispositivo guardado",
+        "pl": "Brak zapamiętanych urządzeń",
+        "nl": "Geen onthouden apparaten",
+        "ru": "Нет сохранённых устройств"
+      }
+    },
+    "contacts_empty_body": {
+      "context": "Devices screen: empty-state explanation of how a device gets remembered.",
+      "translations": {
+        "en": "After a transfer, both devices can choose to remember each other.",
+        "fr": "Après un transfert, les deux appareils peuvent choisir de se mémoriser mutuellement.",
+        "es": "Tras una transferencia, ambos dispositivos pueden elegir recordarse mutuamente.",
+        "it": "Dopo un trasferimento, entrambi i dispositivi possono scegliere di ricordarsi a vicenda.",
+        "de": "Nach einer Übertragung können beide Geräte einander speichern.",
+        "pt": "Após uma transferência, ambos os dispositivos podem optar por lembrar-se um do outro.",
+        "pl": "Po przesłaniu plików oba urządzenia mogą zapamiętać się nawzajem.",
+        "nl": "Na een overdracht kunnen beide apparaten elkaar onthouden.",
+        "ru": "После передачи оба устройства могут запомнить друг друга."
+      }
+    },
+    "contacts_unreachable": {
+      "context": "Devices screen: badge on a device that can no longer be sent to.",
+      "translations": {
+        "en": "Needs pairing again",
+        "fr": "Nouvel appairage nécessaire",
+        "es": "Requiere emparejar de nuevo",
+        "it": "Richiede un nuovo abbinamento",
+        "de": "Muss erneut gekoppelt werden",
+        "pt": "É preciso emparelhar novamente",
+        "pl": "Wymaga ponownego sparowania",
+        "nl": "Opnieuw koppelen vereist",
+        "ru": "Требуется повторное сопряжение"
+      }
+    },
+    "contacts_unreachable_body": {
+      "context": "Device detail: explains why a remembered device can no longer be reached.",
+      "translations": {
+        "en": "This device withdrew access, or reinstalled VniDrop. Transfer to it once more to remember it again.",
+        "fr": "Cet appareil a retiré l’accès ou a réinstallé VniDrop. Effectuez un nouveau transfert pour le mémoriser à nouveau.",
+        "es": "Este dispositivo retiró el acceso o reinstaló VniDrop. Realiza otra transferencia para volver a recordarlo.",
+        "it": "Questo dispositivo ha revocato l’accesso o ha reinstallato VniDrop. Effettua un altro trasferimento per memorizzarlo di nuovo.",
+        "de": "Dieses Gerät hat den Zugriff entzogen oder VniDrop neu installiert. Übertragen Sie erneut, um es wieder zu speichern.",
+        "pt": "Este dispositivo retirou o acesso ou reinstalou o VniDrop. Faça outra transferência para o voltar a guardar.",
+        "pl": "To urządzenie cofnęło dostęp lub ponownie zainstalowało VniDrop. Wykonaj kolejne przesłanie, aby zapamiętać je ponownie.",
+        "nl": "Dit apparaat heeft de toegang ingetrokken of VniDrop opnieuw geïnstalleerd. Draag opnieuw over om het weer te onthouden.",
+        "ru": "Это устройство отозвало доступ или переустановило VniDrop. Выполните новую передачу, чтобы снова его запомнить."
+      }
+    },
+    "contacts_name_field": {
+      "context": "Device detail: text field label for the name the local user gives a device.",
+      "translations": {
+        "en": "Name on this device",
+        "fr": "Nom sur cet appareil",
+        "es": "Nombre en este dispositivo",
+        "it": "Nome su questo dispositivo",
+        "de": "Name auf diesem Gerät",
+        "pt": "Nome neste dispositivo",
+        "pl": "Nazwa na tym urządzeniu",
+        "nl": "Naam op dit apparaat",
+        "ru": "Имя на этом устройстве"
+      }
+    },
+    "contacts_name_hint": {
+      "context": "Device detail: note that the local name is never changed by the other device.",
+      "translations": {
+        "en": "Only you see this name. The other device can never change it.",
+        "fr": "Vous seul voyez ce nom. L’autre appareil ne peut jamais le modifier.",
+        "es": "Solo tú ves este nombre. El otro dispositivo nunca puede cambiarlo.",
+        "it": "Solo tu vedi questo nome. L’altro dispositivo non può mai modificarlo.",
+        "de": "Nur Sie sehen diesen Namen. Das andere Gerät kann ihn nie ändern.",
+        "pt": "Só você vê este nome. O outro dispositivo nunca o pode alterar.",
+        "pl": "Tylko Ty widzisz tę nazwę. Drugie urządzenie nigdy jej nie zmieni.",
+        "nl": "Alleen jij ziet deze naam. Het andere apparaat kan die nooit wijzigen.",
+        "ru": "Это имя видите только вы. Другое устройство не может его изменить."
+      }
+    },
+    "contacts_forget": {
+      "context": "Device detail: button that removes a device and revokes its access.",
+      "translations": {
+        "en": "Forget device",
+        "fr": "Oublier l’appareil",
+        "es": "Olvidar dispositivo",
+        "it": "Dimentica dispositivo",
+        "de": "Gerät entfernen",
+        "pt": "Esquecer dispositivo",
+        "pl": "Zapomnij urządzenie",
+        "nl": "Apparaat vergeten",
+        "ru": "Забыть устройство"
+      }
+    },
+    "contacts_forget_body": {
+      "context": "Device detail: confirmation explaining what forgetting a device does.",
+      "translations": {
+        "en": "This device will no longer be able to send you files without a new invitation. Files already received are kept.",
+        "fr": "Cet appareil ne pourra plus vous envoyer de fichiers sans nouvelle invitation. Les fichiers déjà reçus sont conservés.",
+        "es": "Este dispositivo ya no podrá enviarte archivos sin una nueva invitación. Los archivos ya recibidos se conservan.",
+        "it": "Questo dispositivo non potrà più inviarti file senza un nuovo invito. I file già ricevuti vengono conservati.",
+        "de": "Dieses Gerät kann Ihnen ohne neue Einladung keine Dateien mehr senden. Bereits empfangene Dateien bleiben erhalten.",
+        "pt": "Este dispositivo deixará de lhe poder enviar ficheiros sem um novo convite. Os ficheiros já recebidos são mantidos.",
+        "pl": "To urządzenie nie będzie mogło wysyłać Ci plików bez nowego zaproszenia. Już odebrane pliki pozostaną.",
+        "nl": "Dit apparaat kan je zonder nieuwe uitnodiging geen bestanden meer sturen. Reeds ontvangen bestanden blijven behouden.",
+        "ru": "Это устройство больше не сможет отправлять вам файлы без нового приглашения. Уже полученные файлы сохранятся."
+      }
+    },
+    "contacts_forget_all": {
+      "context": "Devices screen: button that forgets every remembered device at once.",
+      "translations": {
+        "en": "Forget all devices",
+        "fr": "Oublier tous les appareils",
+        "es": "Olvidar todos los dispositivos",
+        "it": "Dimentica tutti i dispositivi",
+        "de": "Alle Geräte entfernen",
+        "pt": "Esquecer todos os dispositivos",
+        "pl": "Zapomnij wszystkie urządzenia",
+        "nl": "Alle apparaten vergeten",
+        "ru": "Забыть все устройства"
+      }
+    },
+    "contacts_block": {
+      "context": "Device detail: button that blocks a device outright.",
+      "translations": {
+        "en": "Block device",
+        "fr": "Bloquer l’appareil",
+        "es": "Bloquear dispositivo",
+        "it": "Blocca dispositivo",
+        "de": "Gerät blockieren",
+        "pt": "Bloquear dispositivo",
+        "pl": "Zablokuj urządzenie",
+        "nl": "Apparaat blokkeren",
+        "ru": "Заблокировать устройство"
+      }
+    },
+    "contacts_blocked_title": {
+      "context": "Devices screen: section listing blocked devices.",
+      "translations": {
+        "en": "Blocked devices",
+        "fr": "Appareils bloqués",
+        "es": "Dispositivos bloqueados",
+        "it": "Dispositivi bloccati",
+        "de": "Blockierte Geräte",
+        "pt": "Dispositivos bloqueados",
+        "pl": "Zablokowane urządzenia",
+        "nl": "Geblokkeerde apparaten",
+        "ru": "Заблокированные устройства"
+      }
+    },
+    "contacts_unblock": {
+      "context": "Devices screen: button that removes a device from the block list.",
+      "translations": {
+        "en": "Unblock",
+        "fr": "Débloquer",
+        "es": "Desbloquear",
+        "it": "Sblocca",
+        "de": "Freigeben",
+        "pt": "Desbloquear",
+        "pl": "Odblokuj",
+        "nl": "Deblokkeren",
+        "ru": "Разблокировать"
+      }
+    },
+    "contacts_unblock_hint": {
+      "context": "Devices screen: note that unblocking does not restore the previous access.",
+      "translations": {
+        "en": "Unblocking does not restore access. The device has to be paired again.",
+        "fr": "Le déblocage ne rétablit pas l’accès. L’appareil doit être appairé à nouveau.",
+        "es": "Desbloquear no restaura el acceso. Hay que emparejar el dispositivo de nuevo.",
+        "it": "Sbloccare non ripristina l’accesso. Il dispositivo deve essere abbinato di nuovo.",
+        "de": "Die Freigabe stellt den Zugriff nicht wieder her. Das Gerät muss erneut gekoppelt werden.",
+        "pt": "Desbloquear não restaura o acesso. O dispositivo tem de ser emparelhado novamente.",
+        "pl": "Odblokowanie nie przywraca dostępu. Urządzenie trzeba sparować ponownie.",
+        "nl": "Deblokkeren herstelt de toegang niet. Het apparaat moet opnieuw worden gekoppeld.",
+        "ru": "Разблокировка не восстанавливает доступ. Устройство нужно сопрячь заново."
+      }
+    },
+    "contacts_send_to": {
+      "context": "Device detail: button that starts choosing files to send to this device.",
+      "translations": {
+        "en": "Send files",
+        "fr": "Envoyer des fichiers",
+        "es": "Enviar archivos",
+        "it": "Invia file",
+        "de": "Dateien senden",
+        "pt": "Enviar ficheiros",
+        "pl": "Wyślij pliki",
+        "nl": "Bestanden sturen",
+        "ru": "Отправить файлы"
+      }
+    },
+    "contacts_last_transfer": {
+      "context": "Devices screen: subtitle showing when the last transfer with a device happened. {date} = formatted date.",
+      "args": [
+        {
+          "name": "date",
+          "type": "string"
+        }
+      ],
+      "translations": {
+        "en": "Last transfer {date}",
+        "fr": "Dernier transfert {date}",
+        "es": "Última transferencia {date}",
+        "it": "Ultimo trasferimento {date}",
+        "de": "Letzte Übertragung {date}",
+        "pt": "Última transferência {date}",
+        "pl": "Ostatnie przesłanie {date}",
+        "nl": "Laatste overdracht {date}",
+        "ru": "Последняя передача {date}"
+      }
+    },
+    "pairing_request_title": {
+      "context": "Pairing prompt: title asking whether to remember a device that offered to be reachable.",
+      "translations": {
+        "en": "Remember this device?",
+        "fr": "Mémoriser cet appareil ?",
+        "es": "¿Recordar este dispositivo?",
+        "it": "Ricordare questo dispositivo?",
+        "de": "Dieses Gerät speichern?",
+        "pt": "Lembrar este dispositivo?",
+        "pl": "Zapamiętać to urządzenie?",
+        "nl": "Dit apparaat onthouden?",
+        "ru": "Запомнить это устройство?"
+      }
+    },
+    "pairing_request_body": {
+      "context": "Pairing prompt: explains what remembering a device allows. {device} = peer display name.",
+      "args": [
+        {
+          "name": "device",
+          "type": "string"
+        }
+      ],
+      "translations": {
+        "en": "{device} offered to let you send it files without a new invitation.",
+        "fr": "{device} propose de recevoir vos fichiers sans nouvelle invitation.",
+        "es": "{device} te ofrece enviarle archivos sin una nueva invitación.",
+        "it": "{device} ti consente di inviargli file senza un nuovo invito.",
+        "de": "{device} bietet an, Dateien ohne neue Einladung von Ihnen zu empfangen.",
+        "pt": "{device} ofereceu-se para receber ficheiros seus sem um novo convite.",
+        "pl": "{device} umożliwia wysyłanie plików bez nowego zaproszenia.",
+        "nl": "{device} biedt aan bestanden van je te ontvangen zonder nieuwe uitnodiging.",
+        "ru": "{device} разрешает отправлять файлы без нового приглашения."
+      }
+    },
+    "pairing_accept": {
+      "context": "Pairing prompt: button that remembers the device.",
+      "translations": {
+        "en": "Remember",
+        "fr": "Mémoriser",
+        "es": "Recordar",
+        "it": "Ricorda",
+        "de": "Speichern",
+        "pt": "Lembrar",
+        "pl": "Zapamiętaj",
+        "nl": "Onthouden",
+        "ru": "Запомнить"
+      }
+    },
+    "pairing_decline": {
+      "context": "Pairing prompt: button that declines to remember the device.",
+      "translations": {
+        "en": "Not now",
+        "fr": "Pas maintenant",
+        "es": "Ahora no",
+        "it": "Non ora",
+        "de": "Jetzt nicht",
+        "pt": "Agora não",
+        "pl": "Nie teraz",
+        "nl": "Niet nu",
+        "ru": "Не сейчас"
+      }
+    },
+    "pairing_allow_title": {
+      "context": "Post-transfer prompt: asks whether the other device may send files later without an invitation.",
+      "translations": {
+        "en": "Let this device send to you?",
+        "fr": "Autoriser cet appareil à vous envoyer des fichiers ?",
+        "es": "¿Permitir que este dispositivo te envíe archivos?",
+        "it": "Consentire a questo dispositivo di inviarti file?",
+        "de": "Diesem Gerät erlauben, Ihnen Dateien zu senden?",
+        "pt": "Permitir que este dispositivo lhe envie ficheiros?",
+        "pl": "Zezwolić temu urządzeniu na wysyłanie plików?",
+        "nl": "Dit apparaat toestaan je bestanden te sturen?",
+        "ru": "Разрешить этому устройству отправлять вам файлы?"
+      }
+    },
+    "pairing_allow_body": {
+      "context": "Post-transfer prompt: explains that the permission is revocable at any time.",
+      "translations": {
+        "en": "You will still confirm every transfer, and you can withdraw this at any time.",
+        "fr": "Vous confirmerez toujours chaque transfert et pourrez révoquer cette autorisation à tout moment.",
+        "es": "Seguirás confirmando cada transferencia y podrás retirar este permiso cuando quieras.",
+        "it": "Confermerai comunque ogni trasferimento e potrai revocare questa autorizzazione in qualsiasi momento.",
+        "de": "Sie bestätigen weiterhin jede Übertragung und können dies jederzeit widerrufen.",
+        "pt": "Continuará a confirmar cada transferência e pode retirar esta permissão a qualquer momento.",
+        "pl": "Nadal będziesz potwierdzać każde przesłanie i możesz w każdej chwili cofnąć zgodę.",
+        "nl": "Je bevestigt nog steeds elke overdracht en kunt dit altijd intrekken.",
+        "ru": "Вы по-прежнему будете подтверждать каждую передачу и сможете отозвать разрешение в любой момент."
+      }
+    },
+    "pairing_allow_confirm": {
+      "context": "Post-transfer prompt: button granting the other device permission to send later.",
+      "translations": {
+        "en": "Allow",
+        "fr": "Autoriser",
+        "es": "Permitir",
+        "it": "Consenti",
+        "de": "Erlauben",
+        "pt": "Permitir",
+        "pl": "Zezwól",
+        "nl": "Toestaan",
+        "ru": "Разрешить"
+      }
+    },
+    "offer_title": {
+      "context": "Offer prompt: title when a remembered device wants to send files.",
+      "translations": {
+        "en": "Incoming transfer",
+        "fr": "Transfert entrant",
+        "es": "Transferencia entrante",
+        "it": "Trasferimento in arrivo",
+        "de": "Eingehende Übertragung",
+        "pt": "Transferência recebida",
+        "pl": "Przychodzące przesłanie",
+        "nl": "Inkomende overdracht",
+        "ru": "Входящая передача"
+      }
+    },
+    "offer_body": {
+      "context": "Offer prompt: names the sender and what they want to send. {device} = sender, {transferName} = transfer title.",
+      "args": [
+        {
+          "name": "device",
+          "type": "string"
+        },
+        {
+          "name": "transferName",
+          "type": "string"
+        }
+      ],
+      "translations": {
+        "en": "{device} wants to send you “{transferName}”.",
+        "fr": "{device} souhaite vous envoyer « {transferName} ».",
+        "es": "{device} quiere enviarte «{transferName}».",
+        "it": "{device} vuole inviarti «{transferName}».",
+        "de": "{device} möchte Ihnen „{transferName}“ senden.",
+        "pt": "{device} quer enviar-lhe “{transferName}”.",
+        "pl": "{device} chce wysłać Ci „{transferName}”.",
+        "nl": "{device} wil je “{transferName}” sturen.",
+        "ru": "{device} хочет отправить вам «{transferName}»."
+      }
+    },
+    "offer_accept": {
+      "context": "Offer prompt: button that accepts the transfer and starts receiving.",
+      "translations": {
+        "en": "Receive",
+        "fr": "Recevoir",
+        "es": "Recibir",
+        "it": "Ricevi",
+        "de": "Empfangen",
+        "pt": "Receber",
+        "pl": "Odbierz",
+        "nl": "Ontvangen",
+        "ru": "Получить"
+      }
+    },
+    "offer_decline": {
+      "context": "Offer prompt: button that declines the incoming transfer.",
+      "translations": {
+        "en": "Decline",
+        "fr": "Refuser",
+        "es": "Rechazar",
+        "it": "Rifiuta",
+        "de": "Ablehnen",
+        "pt": "Recusar",
+        "pl": "Odrzuć",
+        "nl": "Weigeren",
+        "ru": "Отклонить"
+      }
+    },
+    "contacts_grant_lifetime_title": {
+      "context": "Devices settings: how long a remembered device stays reachable while unused.",
+      "translations": {
+        "en": "Forget unused devices after",
+        "fr": "Oublier les appareils inutilisés après",
+        "es": "Olvidar dispositivos sin usar tras",
+        "it": "Dimentica i dispositivi inutilizzati dopo",
+        "de": "Ungenutzte Geräte entfernen nach",
+        "pt": "Esquecer dispositivos não usados após",
+        "pl": "Zapomnij nieużywane urządzenia po",
+        "nl": "Ongebruikte apparaten vergeten na",
+        "ru": "Забывать неиспользуемые устройства через"
+      }
+    },
+    "contacts_grant_lifetime_hint": {
+      "context": "Devices settings: clarifies that the countdown restarts on each transfer.",
+      "translations": {
+        "en": "The countdown restarts every time you transfer with the device.",
+        "fr": "Le décompte redémarre à chaque transfert avec l’appareil.",
+        "es": "La cuenta atrás se reinicia cada vez que transfieres con el dispositivo.",
+        "it": "Il conteggio riparte a ogni trasferimento con il dispositivo.",
+        "de": "Die Frist beginnt bei jeder Übertragung mit dem Gerät neu.",
+        "pt": "A contagem reinicia sempre que transfere com o dispositivo.",
+        "pl": "Odliczanie zaczyna się od nowa przy każdym przesłaniu.",
+        "nl": "De teller start opnieuw bij elke overdracht met het apparaat.",
+        "ru": "Отсчёт начинается заново при каждой передаче с устройством."
+      }
+    },
+    "contacts_grant_lifetime_never": {
+      "context": "Devices settings: option to never forget an unused device.",
+      "translations": {
+        "en": "Never",
+        "fr": "Jamais",
+        "es": "Nunca",
+        "it": "Mai",
+        "de": "Nie",
+        "pt": "Nunca",
+        "pl": "Nigdy",
+        "nl": "Nooit",
+        "ru": "Никогда"
+      }
+    },
+    "contacts_grant_lifetime_days": {
+      "context": "Devices settings: option label for a number of days. {count} = days.",
+      "args": [
+        {
+          "name": "count",
+          "type": "int"
+        }
+      ],
+      "plural": {
+        "en": {
+          "one": "{count} day",
+          "other": "{count} days"
+        },
+        "fr": {
+          "one": "{count} jour",
+          "other": "{count} jours"
+        },
+        "es": {
+          "one": "{count} día",
+          "other": "{count} días"
+        },
+        "it": {
+          "one": "{count} giorno",
+          "other": "{count} giorni"
+        },
+        "de": {
+          "one": "{count} Tag",
+          "other": "{count} Tage"
+        },
+        "pt": {
+          "one": "{count} dia",
+          "other": "{count} dias"
+        },
+        "pl": {
+          "one": "{count} dzień",
+          "few": "{count} dni",
+          "many": "{count} dni",
+          "other": "{count} dnia"
+        },
+        "nl": {
+          "one": "{count} dag",
+          "other": "{count} dagen"
+        },
+        "ru": {
+          "one": "{count} день",
+          "few": "{count} дня",
+          "many": "{count} дней",
+          "other": "{count} дня"
+        }
+      }
+    },
+    "contacts_check_on_open": {
+      "context": "Devices settings: toggle to check remembered devices for waiting transfers when the app opens.",
+      "translations": {
+        "en": "Check for waiting transfers",
+        "fr": "Rechercher les transferts en attente",
+        "es": "Buscar transferencias en espera",
+        "it": "Cerca trasferimenti in attesa",
+        "de": "Nach wartenden Übertragungen suchen",
+        "pt": "Procurar transferências em espera",
+        "pl": "Sprawdzaj oczekujące przesyłki",
+        "nl": "Controleren op wachtende overdrachten",
+        "ru": "Проверять ожидающие передачи"
+      }
+    },
+    "contacts_check_on_open_hint": {
+      "context": "Devices settings: warns that checking reveals to remembered devices when the app is opened.",
+      "translations": {
+        "en": "When you open VniDrop, your remembered devices are asked whether they have anything for you. This tells them when you opened the app.",
+        "fr": "À l’ouverture de VniDrop, vos appareils enregistrés sont interrogés pour savoir s’ils ont quelque chose pour vous. Cela leur indique quand vous ouvrez l’application.",
+        "es": "Al abrir VniDrop, se pregunta a tus dispositivos guardados si tienen algo para ti. Esto les indica cuándo abriste la aplicación.",
+        "it": "All’apertura di VniDrop, ai dispositivi memorizzati viene chiesto se hanno qualcosa per te. Questo rivela loro quando apri l’app.",
+        "de": "Beim Öffnen von VniDrop werden Ihre gespeicherten Geräte gefragt, ob sie etwas für Sie haben. Dadurch erfahren sie, wann Sie die App geöffnet haben.",
+        "pt": "Ao abrir o VniDrop, os dispositivos guardados são questionados se têm algo para si. Isto revela-lhes quando abriu a aplicação.",
+        "pl": "Po otwarciu VniDrop zapamiętane urządzenia są pytane, czy mają coś dla Ciebie. Dzięki temu wiedzą, kiedy otwierasz aplikację.",
+        "nl": "Bij het openen van VniDrop wordt aan je onthouden apparaten gevraagd of ze iets voor je hebben. Zij weten daardoor wanneer je de app opende.",
+        "ru": "При открытии VniDrop сохранённые устройства опрашиваются, есть ли у них что-то для вас. Так они узнают, когда вы открыли приложение."
+      }
+    },
+    "contacts_check_now": {
+      "context": "Devices screen: button that checks remembered devices for waiting transfers right now.",
+      "translations": {
+        "en": "Check now",
+        "fr": "Vérifier maintenant",
+        "es": "Comprobar ahora",
+        "it": "Controlla ora",
+        "de": "Jetzt prüfen",
+        "pt": "Verificar agora",
+        "pl": "Sprawdź teraz",
+        "nl": "Nu controleren",
+        "ru": "Проверить сейчас"
+      }
+    },
+    "contacts_check_none": {
+      "context": "Devices screen: result message when no device had anything waiting.",
+      "translations": {
+        "en": "Nothing waiting",
+        "fr": "Rien en attente",
+        "es": "Nada en espera",
+        "it": "Nulla in attesa",
+        "de": "Nichts wartet",
+        "pt": "Nada em espera",
+        "pl": "Nic nie czeka",
+        "nl": "Niets in de wacht",
+        "ru": "Ничего не ожидает"
+      }
+    },
+    "contacts_offer_held": {
+      "context": "Shown after sending to a device that was not running: the transfer waits for it to open the app.",
+      "translations": {
+        "en": "That device is not open. The transfer will be delivered the next time it opens VniDrop.",
+        "fr": "Cet appareil n’est pas ouvert. Le transfert sera remis à sa prochaine ouverture de VniDrop.",
+        "es": "Ese dispositivo no está abierto. La transferencia se entregará la próxima vez que abra VniDrop.",
+        "it": "Quel dispositivo non è aperto. Il trasferimento verrà consegnato alla prossima apertura di VniDrop.",
+        "de": "Dieses Gerät ist nicht geöffnet. Die Übertragung wird beim nächsten Öffnen von VniDrop zugestellt.",
+        "pt": "Esse dispositivo não está aberto. A transferência será entregue da próxima vez que abrir o VniDrop.",
+        "pl": "To urządzenie nie jest otwarte. Przesyłka zostanie dostarczona przy następnym uruchomieniu VniDrop.",
+        "nl": "Dat apparaat is niet geopend. De overdracht wordt bezorgd zodra het VniDrop weer opent.",
+        "ru": "Это устройство не открыто. Передача будет доставлена при следующем запуске VniDrop."
+      }
+    },
+    "contacts_waiting_title": {
+      "context": "Devices screen: section listing transfers waiting for their target device to come online.",
+      "translations": {
+        "en": "Waiting to be delivered",
+        "fr": "En attente de remise",
+        "es": "Pendientes de entrega",
+        "it": "In attesa di consegna",
+        "de": "Wartet auf Zustellung",
+        "pt": "A aguardar entrega",
+        "pl": "Oczekuje na dostarczenie",
+        "nl": "Wacht op bezorging",
+        "ru": "Ожидает доставки"
+      }
+    },
+    "contacts_waiting_hint": {
+      "context": "Devices screen: explains that a waiting transfer is withdrawn by cancelling it.",
+      "translations": {
+        "en": "Cancel the transfer to withdraw it.",
+        "fr": "Annulez le transfert pour le retirer.",
+        "es": "Cancela la transferencia para retirarla.",
+        "it": "Annulla il trasferimento per ritirarlo.",
+        "de": "Brechen Sie die Übertragung ab, um sie zurückzuziehen.",
+        "pt": "Cancele a transferência para a retirar.",
+        "pl": "Anuluj przesyłkę, aby ją wycofać.",
+        "nl": "Annuleer de overdracht om die in te trekken.",
+        "ru": "Отмените передачу, чтобы отозвать её."
+      }
+    },
+    "contacts_send_to_device": {
+      "context": "Transfer share panel: action that sends this transfer straight to a remembered device.",
+      "translations": {
+        "en": "Send to a device",
+        "fr": "Envoyer à un appareil",
+        "es": "Enviar a un dispositivo",
+        "it": "Invia a un dispositivo",
+        "de": "An ein Gerät senden",
+        "pt": "Enviar para um dispositivo",
+        "pl": "Wyślij do urządzenia",
+        "nl": "Naar een apparaat sturen",
+        "ru": "Отправить на устройство"
+      }
+    },
+    "contacts_pick_device_title": {
+      "context": "Device picker sheet: title when choosing which remembered device to send a transfer to.",
+      "translations": {
+        "en": "Choose a device",
+        "fr": "Choisir un appareil",
+        "es": "Elegir un dispositivo",
+        "it": "Scegli un dispositivo",
+        "de": "Gerät auswählen",
+        "pt": "Escolher um dispositivo",
+        "pl": "Wybierz urządzenie",
+        "nl": "Kies een apparaat",
+        "ru": "Выберите устройство"
+      }
+    },
+    "contacts_pick_device_empty": {
+      "context": "Device picker sheet: shown when no remembered device can currently be sent to.",
+      "translations": {
+        "en": "No device can be reached right now. Remembered devices appear here after a transfer.",
+        "fr": "Aucun appareil n’est joignable pour le moment. Les appareils enregistrés apparaissent ici après un transfert.",
+        "es": "Ningún dispositivo está disponible ahora. Los dispositivos guardados aparecen aquí tras una transferencia.",
+        "it": "Nessun dispositivo è raggiungibile ora. I dispositivi memorizzati compaiono qui dopo un trasferimento.",
+        "de": "Derzeit ist kein Gerät erreichbar. Gespeicherte Geräte erscheinen hier nach einer Übertragung.",
+        "pt": "Nenhum dispositivo está acessível agora. Os dispositivos guardados aparecem aqui após uma transferência.",
+        "pl": "Żadne urządzenie nie jest teraz dostępne. Zapamiętane urządzenia pojawią się tu po przesłaniu.",
+        "nl": "Er is nu geen apparaat bereikbaar. Onthouden apparaten verschijnen hier na een overdracht.",
+        "ru": "Сейчас ни одно устройство недоступно. Сохранённые устройства появятся здесь после передачи."
+      }
+    },
+    "contacts_sent_to_device": {
+      "context": "Confirmation after a transfer was accepted by the device it was sent to. {device} = device name.",
+      "args": [
+        {
+          "name": "device",
+          "type": "string"
+        }
+      ],
+      "translations": {
+        "en": "{device} accepted the transfer",
+        "fr": "{device} a accepté le transfert",
+        "es": "{device} aceptó la transferencia",
+        "it": "{device} ha accettato il trasferimento",
+        "de": "{device} hat die Übertragung angenommen",
+        "pt": "{device} aceitou a transferência",
+        "pl": "{device} zaakceptowało przesyłkę",
+        "nl": "{device} heeft de overdracht geaccepteerd",
+        "ru": "{device} принял передачу"
+      }
+    },
+    "contacts_declined_by_device": {
+      "context": "Shown when the person on the other device declined an offered transfer. {device} = device name.",
+      "args": [
+        {
+          "name": "device",
+          "type": "string"
+        }
+      ],
+      "translations": {
+        "en": "{device} declined the transfer",
+        "fr": "{device} a refusé le transfert",
+        "es": "{device} rechazó la transferencia",
+        "it": "{device} ha rifiutato il trasferimento",
+        "de": "{device} hat die Übertragung abgelehnt",
+        "pt": "{device} recusou a transferência",
+        "pl": "{device} odrzuciło przesyłkę",
+        "nl": "{device} heeft de overdracht geweigerd",
+        "ru": "{device} отклонил передачу"
+      }
+    },
+    "contacts_no_answer": {
+      "context": "Shown when an offered transfer got no answer on the other device before timing out. {device} = device name.",
+      "args": [
+        {
+          "name": "device",
+          "type": "string"
+        }
+      ],
+      "translations": {
+        "en": "{device} did not answer",
+        "fr": "{device} n’a pas répondu",
+        "es": "{device} no respondió",
+        "it": "{device} non ha risposto",
+        "de": "{device} hat nicht geantwortet",
+        "pt": "{device} não respondeu",
+        "pl": "{device} nie odpowiedziało",
+        "nl": "{device} heeft niet geantwoord",
+        "ru": "{device} не ответил"
+      }
     }
   }
 }

shared/src/androidMain/kotlin/com/vnidrop/app/core/AndroidCoreRuntime.kt

@@ -0,0 +1,17 @@
+package com.vnidrop.app.core
+
+import android.content.Context
+
+internal object AndroidCoreRuntime {
+	init {
+		System.loadLibrary("vnidrop")
+	}
+
+	external fun initialize(context: Context): Boolean
+}
+
+fun initializeAndroidCoreRuntime(context: Context) {
+	check(AndroidCoreRuntime.initialize(context.applicationContext)) {
+		"The protected VniDrop runtime could not initialize"
+	}
+}

shared/src/commonMain/composeResources/values-de/strings.xml

@@ -306,8 +306,56 @@
     <string name="transfer_share_title">Teilen</string>
     <string name="value_unavailable">Nicht verfügbar</string>
     <string name="version_title">App-Version</string>
+    <string name="contacts_title">Geräte</string>
+    <string name="contacts_subtitle">Geräte, mit denen Sie bereits Dateien ausgetauscht haben, können ohne neue Einladung Dateien empfangen.</string>
+    <string name="contacts_empty_title">Keine gespeicherten Geräte</string>
+    <string name="contacts_empty_body">Nach einer Übertragung können beide Geräte einander speichern.</string>
+    <string name="contacts_unreachable">Muss erneut gekoppelt werden</string>
+    <string name="contacts_unreachable_body">Dieses Gerät hat den Zugriff entzogen oder VniDrop neu installiert. Übertragen Sie erneut, um es wieder zu speichern.</string>
+    <string name="contacts_name_field">Name auf diesem Gerät</string>
+    <string name="contacts_name_hint">Nur Sie sehen diesen Namen. Das andere Gerät kann ihn nie ändern.</string>
+    <string name="contacts_forget">Gerät entfernen</string>
+    <string name="contacts_forget_body">Dieses Gerät kann Ihnen ohne neue Einladung keine Dateien mehr senden. Bereits empfangene Dateien bleiben erhalten.</string>
+    <string name="contacts_forget_all">Alle Geräte entfernen</string>
+    <string name="contacts_block">Gerät blockieren</string>
+    <string name="contacts_blocked_title">Blockierte Geräte</string>
+    <string name="contacts_unblock">Freigeben</string>
+    <string name="contacts_unblock_hint">Die Freigabe stellt den Zugriff nicht wieder her. Das Gerät muss erneut gekoppelt werden.</string>
+    <string name="contacts_send_to">Dateien senden</string>
+    <string name="contacts_last_transfer">Letzte Übertragung %1$s</string>
+    <string name="pairing_request_title">Dieses Gerät speichern?</string>
+    <string name="pairing_request_body">%1$s bietet an, Dateien ohne neue Einladung von Ihnen zu empfangen.</string>
+    <string name="pairing_accept">Speichern</string>
+    <string name="pairing_decline">Jetzt nicht</string>
+    <string name="pairing_allow_title">Diesem Gerät erlauben, Ihnen Dateien zu senden?</string>
+    <string name="pairing_allow_body">Sie bestätigen weiterhin jede Übertragung und können dies jederzeit widerrufen.</string>
+    <string name="pairing_allow_confirm">Erlauben</string>
+    <string name="offer_title">Eingehende Übertragung</string>
+    <string name="offer_body">%1$s möchte Ihnen „%2$s“ senden.</string>
+    <string name="offer_accept">Empfangen</string>
+    <string name="offer_decline">Ablehnen</string>
+    <string name="contacts_grant_lifetime_title">Ungenutzte Geräte entfernen nach</string>
+    <string name="contacts_grant_lifetime_hint">Die Frist beginnt bei jeder Übertragung mit dem Gerät neu.</string>
+    <string name="contacts_grant_lifetime_never">Nie</string>
+    <string name="contacts_check_on_open">Nach wartenden Übertragungen suchen</string>
+    <string name="contacts_check_on_open_hint">Beim Öffnen von VniDrop werden Ihre gespeicherten Geräte gefragt, ob sie etwas für Sie haben. Dadurch erfahren sie, wann Sie die App geöffnet haben.</string>
+    <string name="contacts_check_now">Jetzt prüfen</string>
+    <string name="contacts_check_none">Nichts wartet</string>
+    <string name="contacts_offer_held">Dieses Gerät ist nicht geöffnet. Die Übertragung wird beim nächsten Öffnen von VniDrop zugestellt.</string>
+    <string name="contacts_waiting_title">Wartet auf Zustellung</string>
+    <string name="contacts_waiting_hint">Brechen Sie die Übertragung ab, um sie zurückzuziehen.</string>
+    <string name="contacts_send_to_device">An ein Gerät senden</string>
+    <string name="contacts_pick_device_title">Gerät auswählen</string>
+    <string name="contacts_pick_device_empty">Derzeit ist kein Gerät erreichbar. Gespeicherte Geräte erscheinen hier nach einer Übertragung.</string>
+    <string name="contacts_sent_to_device">%1$s hat die Übertragung angenommen</string>
+    <string name="contacts_declined_by_device">%1$s hat die Übertragung abgelehnt</string>
+    <string name="contacts_no_answer">%1$s hat nicht geantwortet</string>
     <plurals name="transfer_file_count">
         <item quantity="one">%1$d Datei</item>
         <item quantity="other">%1$d Dateien</item>
     </plurals>
+    <plurals name="contacts_grant_lifetime_days">
+        <item quantity="one">%1$d Tag</item>
+        <item quantity="other">%1$d Tage</item>
+    </plurals>
 </resources>

shared/src/commonMain/composeResources/values-es/strings.xml

@@ -306,8 +306,56 @@
     <string name="transfer_share_title">Compartir</string>
     <string name="value_unavailable">No disponible</string>
     <string name="version_title">Versión de la app</string>
+    <string name="contacts_title">Dispositivos</string>
+    <string name="contacts_subtitle">Los dispositivos con los que ya has compartido pueden recibir archivos sin una nueva invitación.</string>
+    <string name="contacts_empty_title">Ningún dispositivo guardado</string>
+    <string name="contacts_empty_body">Tras una transferencia, ambos dispositivos pueden elegir recordarse mutuamente.</string>
+    <string name="contacts_unreachable">Requiere emparejar de nuevo</string>
+    <string name="contacts_unreachable_body">Este dispositivo retiró el acceso o reinstaló VniDrop. Realiza otra transferencia para volver a recordarlo.</string>
+    <string name="contacts_name_field">Nombre en este dispositivo</string>
+    <string name="contacts_name_hint">Solo tú ves este nombre. El otro dispositivo nunca puede cambiarlo.</string>
+    <string name="contacts_forget">Olvidar dispositivo</string>
+    <string name="contacts_forget_body">Este dispositivo ya no podrá enviarte archivos sin una nueva invitación. Los archivos ya recibidos se conservan.</string>
+    <string name="contacts_forget_all">Olvidar todos los dispositivos</string>
+    <string name="contacts_block">Bloquear dispositivo</string>
+    <string name="contacts_blocked_title">Dispositivos bloqueados</string>
+    <string name="contacts_unblock">Desbloquear</string>
+    <string name="contacts_unblock_hint">Desbloquear no restaura el acceso. Hay que emparejar el dispositivo de nuevo.</string>
+    <string name="contacts_send_to">Enviar archivos</string>
+    <string name="contacts_last_transfer">Última transferencia %1$s</string>
+    <string name="pairing_request_title">¿Recordar este dispositivo?</string>
+    <string name="pairing_request_body">%1$s te ofrece enviarle archivos sin una nueva invitación.</string>
+    <string name="pairing_accept">Recordar</string>
+    <string name="pairing_decline">Ahora no</string>
+    <string name="pairing_allow_title">¿Permitir que este dispositivo te envíe archivos?</string>
+    <string name="pairing_allow_body">Seguirás confirmando cada transferencia y podrás retirar este permiso cuando quieras.</string>
+    <string name="pairing_allow_confirm">Permitir</string>
+    <string name="offer_title">Transferencia entrante</string>
+    <string name="offer_body">%1$s quiere enviarte «%2$s».</string>
+    <string name="offer_accept">Recibir</string>
+    <string name="offer_decline">Rechazar</string>
+    <string name="contacts_grant_lifetime_title">Olvidar dispositivos sin usar tras</string>
+    <string name="contacts_grant_lifetime_hint">La cuenta atrás se reinicia cada vez que transfieres con el dispositivo.</string>
+    <string name="contacts_grant_lifetime_never">Nunca</string>
+    <string name="contacts_check_on_open">Buscar transferencias en espera</string>
+    <string name="contacts_check_on_open_hint">Al abrir VniDrop, se pregunta a tus dispositivos guardados si tienen algo para ti. Esto les indica cuándo abriste la aplicación.</string>
+    <string name="contacts_check_now">Comprobar ahora</string>
+    <string name="contacts_check_none">Nada en espera</string>
+    <string name="contacts_offer_held">Ese dispositivo no está abierto. La transferencia se entregará la próxima vez que abra VniDrop.</string>
+    <string name="contacts_waiting_title">Pendientes de entrega</string>
+    <string name="contacts_waiting_hint">Cancela la transferencia para retirarla.</string>
+    <string name="contacts_send_to_device">Enviar a un dispositivo</string>
+    <string name="contacts_pick_device_title">Elegir un dispositivo</string>
+    <string name="contacts_pick_device_empty">Ningún dispositivo está disponible ahora. Los dispositivos guardados aparecen aquí tras una transferencia.</string>
+    <string name="contacts_sent_to_device">%1$s aceptó la transferencia</string>
+    <string name="contacts_declined_by_device">%1$s rechazó la transferencia</string>
+    <string name="contacts_no_answer">%1$s no respondió</string>
     <plurals name="transfer_file_count">
         <item quantity="one">%1$d archivo</item>
         <item quantity="other">%1$d archivos</item>
     </plurals>
+    <plurals name="contacts_grant_lifetime_days">
+        <item quantity="one">%1$d día</item>
+        <item quantity="other">%1$d días</item>
+    </plurals>
 </resources>

shared/src/commonMain/composeResources/values-fr/strings.xml

@@ -306,8 +306,56 @@
     <string name="transfer_share_title">Partager</string>
     <string name="value_unavailable">Non disponible</string>
     <string name="version_title">Version de l’app</string>
+    <string name="contacts_title">Appareils</string>
+    <string name="contacts_subtitle">Les appareils avec lesquels vous avez déjà échangé peuvent recevoir des fichiers sans nouvelle invitation.</string>
+    <string name="contacts_empty_title">Aucun appareil enregistré</string>
+    <string name="contacts_empty_body">Après un transfert, les deux appareils peuvent choisir de se mémoriser mutuellement.</string>
+    <string name="contacts_unreachable">Nouvel appairage nécessaire</string>
+    <string name="contacts_unreachable_body">Cet appareil a retiré l’accès ou a réinstallé VniDrop. Effectuez un nouveau transfert pour le mémoriser à nouveau.</string>
+    <string name="contacts_name_field">Nom sur cet appareil</string>
+    <string name="contacts_name_hint">Vous seul voyez ce nom. L’autre appareil ne peut jamais le modifier.</string>
+    <string name="contacts_forget">Oublier l’appareil</string>
+    <string name="contacts_forget_body">Cet appareil ne pourra plus vous envoyer de fichiers sans nouvelle invitation. Les fichiers déjà reçus sont conservés.</string>
+    <string name="contacts_forget_all">Oublier tous les appareils</string>
+    <string name="contacts_block">Bloquer l’appareil</string>
+    <string name="contacts_blocked_title">Appareils bloqués</string>
+    <string name="contacts_unblock">Débloquer</string>
+    <string name="contacts_unblock_hint">Le déblocage ne rétablit pas l’accès. L’appareil doit être appairé à nouveau.</string>
+    <string name="contacts_send_to">Envoyer des fichiers</string>
+    <string name="contacts_last_transfer">Dernier transfert %1$s</string>
+    <string name="pairing_request_title">Mémoriser cet appareil ?</string>
+    <string name="pairing_request_body">%1$s propose de recevoir vos fichiers sans nouvelle invitation.</string>
+    <string name="pairing_accept">Mémoriser</string>
+    <string name="pairing_decline">Pas maintenant</string>
+    <string name="pairing_allow_title">Autoriser cet appareil à vous envoyer des fichiers ?</string>
+    <string name="pairing_allow_body">Vous confirmerez toujours chaque transfert et pourrez révoquer cette autorisation à tout moment.</string>
+    <string name="pairing_allow_confirm">Autoriser</string>
+    <string name="offer_title">Transfert entrant</string>
+    <string name="offer_body">%1$s souhaite vous envoyer « %2$s ».</string>
+    <string name="offer_accept">Recevoir</string>
+    <string name="offer_decline">Refuser</string>
+    <string name="contacts_grant_lifetime_title">Oublier les appareils inutilisés après</string>
+    <string name="contacts_grant_lifetime_hint">Le décompte redémarre à chaque transfert avec l’appareil.</string>
+    <string name="contacts_grant_lifetime_never">Jamais</string>
+    <string name="contacts_check_on_open">Rechercher les transferts en attente</string>
+    <string name="contacts_check_on_open_hint">À l’ouverture de VniDrop, vos appareils enregistrés sont interrogés pour savoir s’ils ont quelque chose pour vous. Cela leur indique quand vous ouvrez l’application.</string>
+    <string name="contacts_check_now">Vérifier maintenant</string>
+    <string name="contacts_check_none">Rien en attente</string>
+    <string name="contacts_offer_held">Cet appareil n’est pas ouvert. Le transfert sera remis à sa prochaine ouverture de VniDrop.</string>
+    <string name="contacts_waiting_title">En attente de remise</string>
+    <string name="contacts_waiting_hint">Annulez le transfert pour le retirer.</string>
+    <string name="contacts_send_to_device">Envoyer à un appareil</string>
+    <string name="contacts_pick_device_title">Choisir un appareil</string>
+    <string name="contacts_pick_device_empty">Aucun appareil n’est joignable pour le moment. Les appareils enregistrés apparaissent ici après un transfert.</string>
+    <string name="contacts_sent_to_device">%1$s a accepté le transfert</string>
+    <string name="contacts_declined_by_device">%1$s a refusé le transfert</string>
+    <string name="contacts_no_answer">%1$s n’a pas répondu</string>
     <plurals name="transfer_file_count">
         <item quantity="one">%1$d fichier</item>
         <item quantity="other">%1$d fichiers</item>
     </plurals>
+    <plurals name="contacts_grant_lifetime_days">
+        <item quantity="one">%1$d jour</item>
+        <item quantity="other">%1$d jours</item>
+    </plurals>
 </resources>