Merge pull request 'feat(events): the app's event screens — M13 (Phase 16b cutover, 4 of 6)' (#46) from edge into main

Reviewed-on: #46
Reviewed-by: Colby Whitlock <whitlocktech@gmail.com>

.gitattributes

@@ -17,3 +17,6 @@ gradlew text eol=lf
 *.png binary
 *.webp binary
 *.ico binary
+# Bundled type families (res/font). `text=auto` already detects these as binary,
+# but a font is too easy to corrupt silently to leave to a heuristic.
+*.ttf binary

.gitea/workflows/pr-checks.yml

@@ -1,5 +1,5 @@
-# Gate every pull request into `main` on lint + unit tests + a debug build, so a
-# broken build can't reach the deployable branch. Debug builds are auto-signed,
+# Gate every pull request into `main` or `edge` on lint + unit tests + a debug
+# build, so a broken build can't reach the deployable branch. Debug builds are auto-signed,
 # so this gate needs no secrets. The signed *release* APK + Gitea release come
 # later (release.yml, M6). See docs/android/PLAN.md §12.
 #
@@ -18,9 +18,14 @@
 
 name: PR Checks
 
+# `edge` is here because a workstream that lands ten phase PRs onto it before one
+# cutover PR into `main` otherwise gets NO CI at all until the cutover — which is
+# exactly what happened to all nine M12 phase PRs, and would have happened again
+# to engagement Phase 8 (ENGAGEMENT.md §7.1 Q8). A phase should fail on its own
+# PR, not inside the cutover window with a whole workstream's diff to bisect.
 on:
   pull_request:
-    branches: [main]
+    branches: [main, edge]
 
 concurrency:
   group: pr-checks-${{ github.ref }}

README.md

@@ -48,10 +48,15 @@ any shard's website — there is no compiled-in API host.
 
 ## CI
 
-`.gitea/workflows/pr-checks.yml` gates PRs into `main` with `./gradlew lint test assembleDebug` on the
-org's self-hosted runner (JDK 17 + Android SDK). Debug builds are auto-signed, so the gate needs no
-secrets. **This pipeline is verified green end-to-end on the runner** (M0). A signed **release** APK
-attached to a Gitea release comes at M6.
+`.gitea/workflows/pr-checks.yml` gates PRs into `main` **and `edge`** with
+`./gradlew lint test assembleDebug` on the org's self-hosted runner (JDK 17 + Android SDK). Debug
+builds are auto-signed, so the gate needs no secrets. **This pipeline is verified green end-to-end on
+the runner** (M0). A signed **release** APK attached to a Gitea release comes at M6.
+
+**`edge` is in the trigger deliberately**: a workstream that lands its phases on a working branch
+before one cutover PR into `main` otherwise gets no CI at all until the cutover — which is what
+happened to all nine M12 phase PRs (`docs/website/ENGAGEMENT.md` §7.1 Q8). `sonarqube.yml` is
+unaffected: it is a push-on-`main` analysis, not a PR gate.
 
 The workflow carries a few runner-specific accommodations (each explained in comments in the file),
 because this self-hosted runner differs from a stock GitHub runner:

app/licenses/EBGaramond-OFL.txt

@@ -0,0 +1,93 @@
+Copyright 2017 The EB Garamond Project Authors (https://github.com/octaviopardo/EBGaramond12)
+
+This Font Software is licensed under the SIL Open Font License, Version 1.1.
+This license is copied below, and is also available with a FAQ at:
+https://openfontlicense.org
+
+
+-----------------------------------------------------------
+SIL OPEN FONT LICENSE Version 1.1 - 26 February 2007
+-----------------------------------------------------------
+
+PREAMBLE
+The goals of the Open Font License (OFL) are to stimulate worldwide
+development of collaborative font projects, to support the font creation
+efforts of academic and linguistic communities, and to provide a free and
+open framework in which fonts may be shared and improved in partnership
+with others.
+
+The OFL allows the licensed fonts to be used, studied, modified and
+redistributed freely as long as they are not sold by themselves. The
+fonts, including any derivative works, can be bundled, embedded, 
+redistributed and/or sold with any software provided that any reserved
+names are not used by derivative works. The fonts and derivatives,
+however, cannot be released under any other type of license. The
+requirement for fonts to remain under this license does not apply
+to any document created using the fonts or their derivatives.
+
+DEFINITIONS
+"Font Software" refers to the set of files released by the Copyright
+Holder(s) under this license and clearly marked as such. This may
+include source files, build scripts and documentation.
+
+"Reserved Font Name" refers to any names specified as such after the
+copyright statement(s).
+
+"Original Version" refers to the collection of Font Software components as
+distributed by the Copyright Holder(s).
+
+"Modified Version" refers to any derivative made by adding to, deleting,
+or substituting -- in part or in whole -- any of the components of the
+Original Version, by changing formats or by porting the Font Software to a
+new environment.
+
+"Author" refers to any designer, engineer, programmer, technical
+writer or other person who contributed to the Font Software.
+
+PERMISSION & CONDITIONS
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of the Font Software, to use, study, copy, merge, embed, modify,
+redistribute, and sell modified and unmodified copies of the Font
+Software, subject to the following conditions:
+
+1) Neither the Font Software nor any of its individual components,
+in Original or Modified Versions, may be sold by itself.
+
+2) Original or Modified Versions of the Font Software may be bundled,
+redistributed and/or sold with any software, provided that each copy
+contains the above copyright notice and this license. These can be
+included either as stand-alone text files, human-readable headers or
+in the appropriate machine-readable metadata fields within text or
+binary files as long as those fields can be easily viewed by the user.
+
+3) No Modified Version of the Font Software may use the Reserved Font
+Name(s) unless explicit written permission is granted by the corresponding
+Copyright Holder. This restriction only applies to the primary font name as
+presented to the users.
+
+4) The name(s) of the Copyright Holder(s) or the Author(s) of the Font
+Software shall not be used to promote, endorse or advertise any
+Modified Version, except to acknowledge the contribution(s) of the
+Copyright Holder(s) and the Author(s) or with their explicit written
+permission.
+
+5) The Font Software, modified or unmodified, in part or in whole,
+must be distributed entirely under this license, and must not be
+distributed under any other license. The requirement for fonts to
+remain under this license does not apply to any document created
+using the Font Software.
+
+TERMINATION
+This license becomes null and void if any of the above conditions are
+not met.
+
+DISCLAIMER
+THE FONT SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT
+OF COPYRIGHT, PATENT, TRADEMARK, OR OTHER RIGHT. IN NO EVENT SHALL THE
+COPYRIGHT HOLDER BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
+INCLUDING ANY GENERAL, SPECIAL, INDIRECT, INCIDENTAL, OR CONSEQUENTIAL
+DAMAGES, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+FROM, OUT OF THE USE OR INABILITY TO USE THE FONT SOFTWARE OR FROM
+OTHER DEALINGS IN THE FONT SOFTWARE.

app/licenses/IMFellEnglish-OFL.txt

@@ -0,0 +1,93 @@
+Copyright (c) 2010, Igino Marini (mail@iginomarini.com)
+
+This Font Software is licensed under the SIL Open Font License, Version 1.1.
+This license is copied below, and is also available with a FAQ at:
+http://scripts.sil.org/OFL
+
+
+-----------------------------------------------------------
+SIL OPEN FONT LICENSE Version 1.1 - 26 February 2007
+-----------------------------------------------------------
+
+PREAMBLE
+The goals of the Open Font License (OFL) are to stimulate worldwide
+development of collaborative font projects, to support the font creation
+efforts of academic and linguistic communities, and to provide a free and
+open framework in which fonts may be shared and improved in partnership
+with others.
+
+The OFL allows the licensed fonts to be used, studied, modified and
+redistributed freely as long as they are not sold by themselves. The
+fonts, including any derivative works, can be bundled, embedded, 
+redistributed and/or sold with any software provided that any reserved
+names are not used by derivative works. The fonts and derivatives,
+however, cannot be released under any other type of license. The
+requirement for fonts to remain under this license does not apply
+to any document created using the fonts or their derivatives.
+
+DEFINITIONS
+"Font Software" refers to the set of files released by the Copyright
+Holder(s) under this license and clearly marked as such. This may
+include source files, build scripts and documentation.
+
+"Reserved Font Name" refers to any names specified as such after the
+copyright statement(s).
+
+"Original Version" refers to the collection of Font Software components as
+distributed by the Copyright Holder(s).
+
+"Modified Version" refers to any derivative made by adding to, deleting,
+or substituting -- in part or in whole -- any of the components of the
+Original Version, by changing formats or by porting the Font Software to a
+new environment.
+
+"Author" refers to any designer, engineer, programmer, technical
+writer or other person who contributed to the Font Software.
+
+PERMISSION & CONDITIONS
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of the Font Software, to use, study, copy, merge, embed, modify,
+redistribute, and sell modified and unmodified copies of the Font
+Software, subject to the following conditions:
+
+1) Neither the Font Software nor any of its individual components,
+in Original or Modified Versions, may be sold by itself.
+
+2) Original or Modified Versions of the Font Software may be bundled,
+redistributed and/or sold with any software, provided that each copy
+contains the above copyright notice and this license. These can be
+included either as stand-alone text files, human-readable headers or
+in the appropriate machine-readable metadata fields within text or
+binary files as long as those fields can be easily viewed by the user.
+
+3) No Modified Version of the Font Software may use the Reserved Font
+Name(s) unless explicit written permission is granted by the corresponding
+Copyright Holder. This restriction only applies to the primary font name as
+presented to the users.
+
+4) The name(s) of the Copyright Holder(s) or the Author(s) of the Font
+Software shall not be used to promote, endorse or advertise any
+Modified Version, except to acknowledge the contribution(s) of the
+Copyright Holder(s) and the Author(s) or with their explicit written
+permission.
+
+5) The Font Software, modified or unmodified, in part or in whole,
+must be distributed entirely under this license, and must not be
+distributed under any other license. The requirement for fonts to
+remain under this license does not apply to any document created
+using the Font Software.
+
+TERMINATION
+This license becomes null and void if any of the above conditions are
+not met.
+
+DISCLAIMER
+THE FONT SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT
+OF COPYRIGHT, PATENT, TRADEMARK, OR OTHER RIGHT. IN NO EVENT SHALL THE
+COPYRIGHT HOLDER BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
+INCLUDING ANY GENERAL, SPECIAL, INDIRECT, INCIDENTAL, OR CONSEQUENTIAL
+DAMAGES, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+FROM, OUT OF THE USE OR INABILITY TO USE THE FONT SOFTWARE OR FROM
+OTHER DEALINGS IN THE FONT SOFTWARE.

app/licenses/Inter-OFL.txt

@@ -0,0 +1,93 @@
+Copyright 2020 The Inter Project Authors (https://github.com/rsms/inter)
+
+This Font Software is licensed under the SIL Open Font License, Version 1.1.
+This license is copied below, and is also available with a FAQ at:
+https://scripts.sil.org/OFL
+
+
+-----------------------------------------------------------
+SIL OPEN FONT LICENSE Version 1.1 - 26 February 2007
+-----------------------------------------------------------
+
+PREAMBLE
+The goals of the Open Font License (OFL) are to stimulate worldwide
+development of collaborative font projects, to support the font creation
+efforts of academic and linguistic communities, and to provide a free and
+open framework in which fonts may be shared and improved in partnership
+with others.
+
+The OFL allows the licensed fonts to be used, studied, modified and
+redistributed freely as long as they are not sold by themselves. The
+fonts, including any derivative works, can be bundled, embedded, 
+redistributed and/or sold with any software provided that any reserved
+names are not used by derivative works. The fonts and derivatives,
+however, cannot be released under any other type of license. The
+requirement for fonts to remain under this license does not apply
+to any document created using the fonts or their derivatives.
+
+DEFINITIONS
+"Font Software" refers to the set of files released by the Copyright
+Holder(s) under this license and clearly marked as such. This may
+include source files, build scripts and documentation.
+
+"Reserved Font Name" refers to any names specified as such after the
+copyright statement(s).
+
+"Original Version" refers to the collection of Font Software components as
+distributed by the Copyright Holder(s).
+
+"Modified Version" refers to any derivative made by adding to, deleting,
+or substituting -- in part or in whole -- any of the components of the
+Original Version, by changing formats or by porting the Font Software to a
+new environment.
+
+"Author" refers to any designer, engineer, programmer, technical
+writer or other person who contributed to the Font Software.
+
+PERMISSION & CONDITIONS
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of the Font Software, to use, study, copy, merge, embed, modify,
+redistribute, and sell modified and unmodified copies of the Font
+Software, subject to the following conditions:
+
+1) Neither the Font Software nor any of its individual components,
+in Original or Modified Versions, may be sold by itself.
+
+2) Original or Modified Versions of the Font Software may be bundled,
+redistributed and/or sold with any software, provided that each copy
+contains the above copyright notice and this license. These can be
+included either as stand-alone text files, human-readable headers or
+in the appropriate machine-readable metadata fields within text or
+binary files as long as those fields can be easily viewed by the user.
+
+3) No Modified Version of the Font Software may use the Reserved Font
+Name(s) unless explicit written permission is granted by the corresponding
+Copyright Holder. This restriction only applies to the primary font name as
+presented to the users.
+
+4) The name(s) of the Copyright Holder(s) or the Author(s) of the Font
+Software shall not be used to promote, endorse or advertise any
+Modified Version, except to acknowledge the contribution(s) of the
+Copyright Holder(s) and the Author(s) or with their explicit written
+permission.
+
+5) The Font Software, modified or unmodified, in part or in whole,
+must be distributed entirely under this license, and must not be
+distributed under any other license. The requirement for fonts to
+remain under this license does not apply to any document created
+using the Font Software.
+
+TERMINATION
+This license becomes null and void if any of the above conditions are
+not met.
+
+DISCLAIMER
+THE FONT SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT
+OF COPYRIGHT, PATENT, TRADEMARK, OR OTHER RIGHT. IN NO EVENT SHALL THE
+COPYRIGHT HOLDER BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
+INCLUDING ANY GENERAL, SPECIAL, INDIRECT, INCIDENTAL, OR CONSEQUENTIAL
+DAMAGES, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+FROM, OUT OF THE USE OR INABILITY TO USE THE FONT SOFTWARE OR FROM
+OTHER DEALINGS IN THE FONT SOFTWARE.

app/licenses/Merriweather-OFL.txt

@@ -0,0 +1,93 @@
+Copyright 2020 The Merriweather Project Authors (https://github.com/EbenSorkin/Merriweather4) with Reserved Font Name "Merriweather".
+
+This Font Software is licensed under the SIL Open Font License, Version 1.1.
+This license is copied below, and is also available with a FAQ at:
+https://openfontlicense.org
+
+
+-----------------------------------------------------------
+SIL OPEN FONT LICENSE Version 1.1 - 26 February 2007
+-----------------------------------------------------------
+
+PREAMBLE
+The goals of the Open Font License (OFL) are to stimulate worldwide
+development of collaborative font projects, to support the font creation
+efforts of academic and linguistic communities, and to provide a free and
+open framework in which fonts may be shared and improved in partnership
+with others.
+
+The OFL allows the licensed fonts to be used, studied, modified and
+redistributed freely as long as they are not sold by themselves. The
+fonts, including any derivative works, can be bundled, embedded, 
+redistributed and/or sold with any software provided that any reserved
+names are not used by derivative works. The fonts and derivatives,
+however, cannot be released under any other type of license. The
+requirement for fonts to remain under this license does not apply
+to any document created using the fonts or their derivatives.
+
+DEFINITIONS
+"Font Software" refers to the set of files released by the Copyright
+Holder(s) under this license and clearly marked as such. This may
+include source files, build scripts and documentation.
+
+"Reserved Font Name" refers to any names specified as such after the
+copyright statement(s).
+
+"Original Version" refers to the collection of Font Software components as
+distributed by the Copyright Holder(s).
+
+"Modified Version" refers to any derivative made by adding to, deleting,
+or substituting -- in part or in whole -- any of the components of the
+Original Version, by changing formats or by porting the Font Software to a
+new environment.
+
+"Author" refers to any designer, engineer, programmer, technical
+writer or other person who contributed to the Font Software.
+
+PERMISSION & CONDITIONS
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of the Font Software, to use, study, copy, merge, embed, modify,
+redistribute, and sell modified and unmodified copies of the Font
+Software, subject to the following conditions:
+
+1) Neither the Font Software nor any of its individual components,
+in Original or Modified Versions, may be sold by itself.
+
+2) Original or Modified Versions of the Font Software may be bundled,
+redistributed and/or sold with any software, provided that each copy
+contains the above copyright notice and this license. These can be
+included either as stand-alone text files, human-readable headers or
+in the appropriate machine-readable metadata fields within text or
+binary files as long as those fields can be easily viewed by the user.
+
+3) No Modified Version of the Font Software may use the Reserved Font
+Name(s) unless explicit written permission is granted by the corresponding
+Copyright Holder. This restriction only applies to the primary font name as
+presented to the users.
+
+4) The name(s) of the Copyright Holder(s) or the Author(s) of the Font
+Software shall not be used to promote, endorse or advertise any
+Modified Version, except to acknowledge the contribution(s) of the
+Copyright Holder(s) and the Author(s) or with their explicit written
+permission.
+
+5) The Font Software, modified or unmodified, in part or in whole,
+must be distributed entirely under this license, and must not be
+distributed under any other license. The requirement for fonts to
+remain under this license does not apply to any document created
+using the Font Software.
+
+TERMINATION
+This license becomes null and void if any of the above conditions are
+not met.
+
+DISCLAIMER
+THE FONT SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT
+OF COPYRIGHT, PATENT, TRADEMARK, OR OTHER RIGHT. IN NO EVENT SHALL THE
+COPYRIGHT HOLDER BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
+INCLUDING ANY GENERAL, SPECIAL, INDIRECT, INCIDENTAL, OR CONSEQUENTIAL
+DAMAGES, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+FROM, OUT OF THE USE OR INABILITY TO USE THE FONT SOFTWARE OR FROM
+OTHER DEALINGS IN THE FONT SOFTWARE.

app/licenses/PlayfairDisplay-OFL.txt

@@ -0,0 +1,93 @@
+Copyright 2017 The Playfair Display Project Authors (https://github.com/clauseggers/Playfair-Display), with Reserved Font Name "Playfair Display"
+
+This Font Software is licensed under the SIL Open Font License, Version 1.1.
+This license is copied below, and is also available with a FAQ at:
+http://scripts.sil.org/OFL
+
+
+-----------------------------------------------------------
+SIL OPEN FONT LICENSE Version 1.1 - 26 February 2007
+-----------------------------------------------------------
+
+PREAMBLE
+The goals of the Open Font License (OFL) are to stimulate worldwide
+development of collaborative font projects, to support the font creation
+efforts of academic and linguistic communities, and to provide a free and
+open framework in which fonts may be shared and improved in partnership
+with others.
+
+The OFL allows the licensed fonts to be used, studied, modified and
+redistributed freely as long as they are not sold by themselves. The
+fonts, including any derivative works, can be bundled, embedded, 
+redistributed and/or sold with any software provided that any reserved
+names are not used by derivative works. The fonts and derivatives,
+however, cannot be released under any other type of license. The
+requirement for fonts to remain under this license does not apply
+to any document created using the fonts or their derivatives.
+
+DEFINITIONS
+"Font Software" refers to the set of files released by the Copyright
+Holder(s) under this license and clearly marked as such. This may
+include source files, build scripts and documentation.
+
+"Reserved Font Name" refers to any names specified as such after the
+copyright statement(s).
+
+"Original Version" refers to the collection of Font Software components as
+distributed by the Copyright Holder(s).
+
+"Modified Version" refers to any derivative made by adding to, deleting,
+or substituting -- in part or in whole -- any of the components of the
+Original Version, by changing formats or by porting the Font Software to a
+new environment.
+
+"Author" refers to any designer, engineer, programmer, technical
+writer or other person who contributed to the Font Software.
+
+PERMISSION & CONDITIONS
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of the Font Software, to use, study, copy, merge, embed, modify,
+redistribute, and sell modified and unmodified copies of the Font
+Software, subject to the following conditions:
+
+1) Neither the Font Software nor any of its individual components,
+in Original or Modified Versions, may be sold by itself.
+
+2) Original or Modified Versions of the Font Software may be bundled,
+redistributed and/or sold with any software, provided that each copy
+contains the above copyright notice and this license. These can be
+included either as stand-alone text files, human-readable headers or
+in the appropriate machine-readable metadata fields within text or
+binary files as long as those fields can be easily viewed by the user.
+
+3) No Modified Version of the Font Software may use the Reserved Font
+Name(s) unless explicit written permission is granted by the corresponding
+Copyright Holder. This restriction only applies to the primary font name as
+presented to the users.
+
+4) The name(s) of the Copyright Holder(s) or the Author(s) of the Font
+Software shall not be used to promote, endorse or advertise any
+Modified Version, except to acknowledge the contribution(s) of the
+Copyright Holder(s) and the Author(s) or with their explicit written
+permission.
+
+5) The Font Software, modified or unmodified, in part or in whole,
+must be distributed entirely under this license, and must not be
+distributed under any other license. The requirement for fonts to
+remain under this license does not apply to any document created
+using the Font Software.
+
+TERMINATION
+This license becomes null and void if any of the above conditions are
+not met.
+
+DISCLAIMER
+THE FONT SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT
+OF COPYRIGHT, PATENT, TRADEMARK, OR OTHER RIGHT. IN NO EVENT SHALL THE
+COPYRIGHT HOLDER BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
+INCLUDING ANY GENERAL, SPECIAL, INDIRECT, INCIDENTAL, OR CONSEQUENTIAL
+DAMAGES, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+FROM, OUT OF THE USE OR INABILITY TO USE THE FONT SOFTWARE OR FROM
+OTHER DEALINGS IN THE FONT SOFTWARE.

app/licenses/SourceSans3-OFL.txt

@@ -0,0 +1,93 @@
+Copyright 2010-2020 Adobe (http://www.adobe.com/), with Reserved Font Name 'Source'. All Rights Reserved. Source is a trademark of Adobe in the United States and/or other countries.
+
+This Font Software is licensed under the SIL Open Font License, Version 1.1.
+
+This license is copied below, and is also available with a FAQ at: http://scripts.sil.org/OFL
+
+
+-----------------------------------------------------------
+SIL OPEN FONT LICENSE Version 1.1 - 26 February 2007
+-----------------------------------------------------------
+
+PREAMBLE
+The goals of the Open Font License (OFL) are to stimulate worldwide
+development of collaborative font projects, to support the font creation
+efforts of academic and linguistic communities, and to provide a free and
+open framework in which fonts may be shared and improved in partnership
+with others.
+
+The OFL allows the licensed fonts to be used, studied, modified and
+redistributed freely as long as they are not sold by themselves. The
+fonts, including any derivative works, can be bundled, embedded, 
+redistributed and/or sold with any software provided that any reserved
+names are not used by derivative works. The fonts and derivatives,
+however, cannot be released under any other type of license. The
+requirement for fonts to remain under this license does not apply
+to any document created using the fonts or their derivatives.
+
+DEFINITIONS
+"Font Software" refers to the set of files released by the Copyright
+Holder(s) under this license and clearly marked as such. This may
+include source files, build scripts and documentation.
+
+"Reserved Font Name" refers to any names specified as such after the
+copyright statement(s).
+
+"Original Version" refers to the collection of Font Software components as
+distributed by the Copyright Holder(s).
+
+"Modified Version" refers to any derivative made by adding to, deleting,
+or substituting -- in part or in whole -- any of the components of the
+Original Version, by changing formats or by porting the Font Software to a
+new environment.
+
+"Author" refers to any designer, engineer, programmer, technical
+writer or other person who contributed to the Font Software.
+
+PERMISSION & CONDITIONS
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of the Font Software, to use, study, copy, merge, embed, modify,
+redistribute, and sell modified and unmodified copies of the Font
+Software, subject to the following conditions:
+
+1) Neither the Font Software nor any of its individual components,
+in Original or Modified Versions, may be sold by itself.
+
+2) Original or Modified Versions of the Font Software may be bundled,
+redistributed and/or sold with any software, provided that each copy
+contains the above copyright notice and this license. These can be
+included either as stand-alone text files, human-readable headers or
+in the appropriate machine-readable metadata fields within text or
+binary files as long as those fields can be easily viewed by the user.
+
+3) No Modified Version of the Font Software may use the Reserved Font
+Name(s) unless explicit written permission is granted by the corresponding
+Copyright Holder. This restriction only applies to the primary font name as
+presented to the users.
+
+4) The name(s) of the Copyright Holder(s) or the Author(s) of the Font
+Software shall not be used to promote, endorse or advertise any
+Modified Version, except to acknowledge the contribution(s) of the
+Copyright Holder(s) and the Author(s) or with their explicit written
+permission.
+
+5) The Font Software, modified or unmodified, in part or in whole,
+must be distributed entirely under this license, and must not be
+distributed under any other license. The requirement for fonts to
+remain under this license does not apply to any document created
+using the Font Software.
+
+TERMINATION
+This license becomes null and void if any of the above conditions are
+not met.
+
+DISCLAIMER
+THE FONT SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT
+OF COPYRIGHT, PATENT, TRADEMARK, OR OTHER RIGHT. IN NO EVENT SHALL THE
+COPYRIGHT HOLDER BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
+INCLUDING ANY GENERAL, SPECIAL, INDIRECT, INCIDENTAL, OR CONSEQUENTIAL
+DAMAGES, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+FROM, OUT OF THE USE OR INABILITY TO USE THE FONT SOFTWARE OR FROM
+OTHER DEALINGS IN THE FONT SOFTWARE.

app/licenses/WorkSans-OFL.txt

@@ -0,0 +1,93 @@
+Copyright 2019 The Work Sans Project Authors (https://github.com/weiweihuanghuang/Work-Sans)
+
+This Font Software is licensed under the SIL Open Font License, Version 1.1.
+This license is copied below, and is also available with a FAQ at:
+http://scripts.sil.org/OFL
+
+
+-----------------------------------------------------------
+SIL OPEN FONT LICENSE Version 1.1 - 26 February 2007
+-----------------------------------------------------------
+
+PREAMBLE
+The goals of the Open Font License (OFL) are to stimulate worldwide
+development of collaborative font projects, to support the font creation
+efforts of academic and linguistic communities, and to provide a free and
+open framework in which fonts may be shared and improved in partnership
+with others.
+
+The OFL allows the licensed fonts to be used, studied, modified and
+redistributed freely as long as they are not sold by themselves. The
+fonts, including any derivative works, can be bundled, embedded, 
+redistributed and/or sold with any software provided that any reserved
+names are not used by derivative works. The fonts and derivatives,
+however, cannot be released under any other type of license. The
+requirement for fonts to remain under this license does not apply
+to any document created using the fonts or their derivatives.
+
+DEFINITIONS
+"Font Software" refers to the set of files released by the Copyright
+Holder(s) under this license and clearly marked as such. This may
+include source files, build scripts and documentation.
+
+"Reserved Font Name" refers to any names specified as such after the
+copyright statement(s).
+
+"Original Version" refers to the collection of Font Software components as
+distributed by the Copyright Holder(s).
+
+"Modified Version" refers to any derivative made by adding to, deleting,
+or substituting -- in part or in whole -- any of the components of the
+Original Version, by changing formats or by porting the Font Software to a
+new environment.
+
+"Author" refers to any designer, engineer, programmer, technical
+writer or other person who contributed to the Font Software.
+
+PERMISSION & CONDITIONS
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of the Font Software, to use, study, copy, merge, embed, modify,
+redistribute, and sell modified and unmodified copies of the Font
+Software, subject to the following conditions:
+
+1) Neither the Font Software nor any of its individual components,
+in Original or Modified Versions, may be sold by itself.
+
+2) Original or Modified Versions of the Font Software may be bundled,
+redistributed and/or sold with any software, provided that each copy
+contains the above copyright notice and this license. These can be
+included either as stand-alone text files, human-readable headers or
+in the appropriate machine-readable metadata fields within text or
+binary files as long as those fields can be easily viewed by the user.
+
+3) No Modified Version of the Font Software may use the Reserved Font
+Name(s) unless explicit written permission is granted by the corresponding
+Copyright Holder. This restriction only applies to the primary font name as
+presented to the users.
+
+4) The name(s) of the Copyright Holder(s) or the Author(s) of the Font
+Software shall not be used to promote, endorse or advertise any
+Modified Version, except to acknowledge the contribution(s) of the
+Copyright Holder(s) and the Author(s) or with their explicit written
+permission.
+
+5) The Font Software, modified or unmodified, in part or in whole,
+must be distributed entirely under this license, and must not be
+distributed under any other license. The requirement for fonts to
+remain under this license does not apply to any document created
+using the Font Software.
+
+TERMINATION
+This license becomes null and void if any of the above conditions are
+not met.
+
+DISCLAIMER
+THE FONT SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT
+OF COPYRIGHT, PATENT, TRADEMARK, OR OTHER RIGHT. IN NO EVENT SHALL THE
+COPYRIGHT HOLDER BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
+INCLUDING ANY GENERAL, SPECIAL, INDIRECT, INCIDENTAL, OR CONSEQUENTIAL
+DAMAGES, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+FROM, OUT OF THE USE OR INABILITY TO USE THE FONT SOFTWARE OR FROM
+OTHER DEALINGS IN THE FONT SOFTWARE.

app/src/main/java/com/runicgateway/app/MainActivity.kt

@@ -58,9 +58,16 @@ class MainActivity : ComponentActivity() {
     // consumed once by RunicApp which navigates to the stream's screen.
     private var pendingStream by mutableStateOf<String?>(null)
 
+    // The tickle's other half: an opaque ref, carried since M7 and read since
+    // ENGAGEMENT.md phase 8, where a `notification:<id>` ref means the engine wrote
+    // an inbox row and the tap should land there. Never rendered — it is a hint that
+    // something exists, and the app pulls the real item over the authenticated API.
+    private var pendingRef by mutableStateOf<String?>(null)
+
     override fun onCreate(savedInstanceState: Bundle?) {
         super.onCreate(savedInstanceState)
         pendingStream = intent?.getStringExtra(PushNotifier.EXTRA_STREAM)
+        pendingRef = intent?.getStringExtra(PushNotifier.EXTRA_REF)
         handleSsoCallback(intent)
         // Dark-only app (M5): force light system-bar icons over the transparent bars so
         // they stay legible on the deep blue-black surfaces regardless of system theme.
@@ -96,10 +103,14 @@ class MainActivity : ComponentActivity() {
                                 ConnectScreen(onConnected = appViewModel::onConnected)
                             is AppState.Ready ->
                                 RunicApp(
-                                    brand = s.appearance.brand,
+                                    appearance = s.appearance,
                                     onChangeServer = appViewModel::changeServer,
                                     deepLinkStream = pendingStream,
-                                    onDeepLinkConsumed = { pendingStream = null },
+                                    deepLinkRef = pendingRef,
+                                    onDeepLinkConsumed = {
+                                        pendingStream = null
+                                        pendingRef = null
+                                    },
                                 )
                         }
                     }
@@ -116,7 +127,13 @@ class MainActivity : ComponentActivity() {
     override fun onNewIntent(intent: Intent) {
         super.onNewIntent(intent)
         setIntent(intent)
-        intent.getStringExtra(PushNotifier.EXTRA_STREAM)?.let { pendingStream = it }
+        intent.getStringExtra(PushNotifier.EXTRA_STREAM)?.let {
+            pendingStream = it
+            // Cleared alongside, not conditionally: a tickle with no ref arriving
+            // after one with a ref must not inherit the earlier ref and land on the
+            // inbox instead of its own screen.
+            pendingRef = intent.getStringExtra(PushNotifier.EXTRA_REF)
+        }
         handleSsoCallback(intent)
     }
 

app/src/main/java/com/runicgateway/app/core/inbox/DataStoreInboxCache.kt

@@ -0,0 +1,74 @@
+/*
+ * SPDX-License-Identifier: GPL-3.0-or-later
+ */
+package com.runicgateway.app.core.inbox
+
+import android.content.Context
+import androidx.datastore.core.DataStore
+import androidx.datastore.preferences.core.Preferences
+import androidx.datastore.preferences.core.edit
+import androidx.datastore.preferences.core.stringPreferencesKey
+import androidx.datastore.preferences.preferencesDataStore
+import com.runicgateway.app.data.api.dto.NotificationItemDto
+import dagger.hilt.android.qualifiers.ApplicationContext
+import kotlinx.coroutines.flow.first
+import kotlinx.serialization.Serializable
+import kotlinx.serialization.json.Json
+import javax.inject.Inject
+import javax.inject.Singleton
+
+private val Context.inboxDataStore: DataStore<Preferences> by preferencesDataStore(name = "inbox")
+
+/**
+ * [InboxCache] over the same plain DataStore the push state uses. Not secret —
+ * tokens stay in the encrypted store — but an inbox body is a person's own
+ * notifications, which is why the snapshot is owner-scoped and cleared on
+ * sign-out rather than left lying about.
+ */
+@Singleton
+class DataStoreInboxCache @Inject constructor(
+    @param:ApplicationContext private val context: Context,
+    private val json: Json,
+) : InboxCache {
+
+    private val store = context.inboxDataStore
+
+    override suspend fun read(owner: String): InboxCache.Snapshot? {
+        val raw = store.data.first()[KEY_SNAPSHOT] ?: return null
+        val stored = try {
+            json.decodeFromString(Stored.serializer(), raw)
+        } catch (_: Exception) {
+            // A snapshot this build can't parse is a snapshot from an older one;
+            // dropping it silently is right — it will be rewritten on the next pull.
+            return null
+        }
+        if (stored.owner != owner) return null
+        return InboxCache.Snapshot(items = stored.items, unread = stored.unread, savedAt = stored.savedAt)
+    }
+
+    override suspend fun write(owner: String, items: List<NotificationItemDto>, unread: Int) {
+        val payload = Stored(
+            owner = owner,
+            items = items.take(InboxCache.MAX_ITEMS),
+            unread = unread,
+            savedAt = System.currentTimeMillis(),
+        )
+        store.edit { it[KEY_SNAPSHOT] = json.encodeToString(Stored.serializer(), payload) }
+    }
+
+    override suspend fun clear() {
+        store.edit { it.remove(KEY_SNAPSHOT) }
+    }
+
+    @Serializable
+    private data class Stored(
+        val owner: String,
+        val items: List<NotificationItemDto>,
+        val unread: Int,
+        val savedAt: Long,
+    )
+
+    private companion object {
+        val KEY_SNAPSHOT = stringPreferencesKey("snapshot")
+    }
+}

app/src/main/java/com/runicgateway/app/core/inbox/InboxCache.kt

@@ -0,0 +1,65 @@
+/*
+ * SPDX-License-Identifier: GPL-3.0-or-later
+ */
+package com.runicgateway.app.core.inbox
+
+import com.runicgateway.app.data.api.dto.NotificationItemDto
+
+/**
+ * The inbox's offline snapshot (ENGAGEMENT.md phase 8).
+ *
+ * **PLAN.md §7 decided the app ships no Room cache, and that decision stands** —
+ * this is its one named exception, settled with the org lead 2026-08-31. The
+ * inbox is a short, read-only, newest-first list with a server-side cursor and no
+ * joins, so what "works offline" needs is the newest page and the badge, not a
+ * database: one JSON blob in the DataStore the push code already uses. Nothing
+ * here is a source of truth — a successful pull always replaces it, and the
+ * screen says out loud when it is showing this instead.
+ *
+ * **The [owner] key is the security property, not a convenience.** A snapshot is
+ * written under the base URL *and* the account id that produced it and is only
+ * ever handed back to that exact pair, so a cache cannot survive into another
+ * account or another shard — including the sign-out paths that never reach
+ * [clear] at all (a dead refresh token, a server switch). Clearing on logout is
+ * the tidy-up; this is what makes it safe.
+ *
+ * An interface for the same reason [com.runicgateway.app.core.auth.TokenStore] is
+ * one: the storage needs a `Context` and the view models that use it should be
+ * testable without one.
+ */
+interface InboxCache {
+
+    /**
+     * What was cached for [owner], or null when nothing was — including when the
+     * stored snapshot belongs to a different account or shard, which is the same
+     * answer on purpose.
+     */
+    suspend fun read(owner: String): Snapshot?
+
+    /**
+     * Replace the snapshot with the newest page.
+     *
+     * Only the FIRST page is ever cached, capped at [MAX_ITEMS]: an offline inbox
+     * is there so the last things you were told are still readable on a train, not
+     * so the whole history is. Later pages come from the server or not at all.
+     */
+    suspend fun write(owner: String, items: List<NotificationItemDto>, unread: Int)
+
+    /** Forget everything. Called on sign-out, alongside the push deregistration. */
+    suspend fun clear()
+
+    /** What the screen renders from while offline, with the time it was captured. */
+    data class Snapshot(
+        val items: List<NotificationItemDto>,
+        val unread: Int,
+        val savedAt: Long,
+    )
+
+    companion object {
+        /** The server's own default page size — caching more than it sends is pointless. */
+        const val MAX_ITEMS = 30
+
+        /** The (shard, account) a snapshot belongs to. */
+        fun ownerKey(baseUrl: String?, userId: Long): String = "${baseUrl.orEmpty()}|$userId"
+    }
+}

app/src/main/java/com/runicgateway/app/core/time/Instants.kt

@@ -0,0 +1,41 @@
+/*
+ * SPDX-License-Identifier: GPL-3.0-or-later
+ */
+package com.runicgateway.app.core.time
+
+import java.time.Instant
+import java.time.LocalDateTime
+import java.time.ZoneId
+
+/**
+ * Parse a timestamp off the wire, in either shape the backend sends.
+ *
+ * **Which one arrives is not the app's to decide.** Express serializes a `Date`
+ * to ISO-8601 with a `Z`, but these values start life as MariaDB `DATETIME`
+ * columns, and one read back as a string reaches the wire as
+ * `2026-08-31 07:13:50` with no zone at all. A zoneless stamp is read as **UTC**,
+ * because that is what the server stores — reading it as local time would
+ * silently shift every timestamp by the device's offset, which is a bug that
+ * looks right on the machine it was written on.
+ *
+ * Anything unparseable answers null, and every caller is expected to render
+ * *something* without it: a notification with an odd date is still worth reading,
+ * and an event with one is still worth listing.
+ *
+ * Lives here rather than beside either caller because the trap is the wire's, not
+ * one screen's — the inbox found it (ENGAGEMENT.md phase 8) and the event screens
+ * inherit it (EVENTS.md §I).
+ */
+fun parseWireInstant(raw: String?): Instant? {
+    val text = raw?.trim().orEmpty()
+    if (text.isEmpty()) return null
+    return try {
+        Instant.parse(text)
+    } catch (_: Exception) {
+        try {
+            LocalDateTime.parse(text.replace(' ', 'T')).atZone(ZoneId.of("UTC")).toInstant()
+        } catch (_: Exception) {
+            null
+        }
+    }
+}

app/src/main/java/com/runicgateway/app/data/api/EventsApi.kt

@@ -0,0 +1,84 @@
+/*
+ * SPDX-License-Identifier: GPL-3.0-or-later
+ */
+package com.runicgateway.app.data.api
+
+import com.runicgateway.app.data.api.dto.EventCalendarDto
+import com.runicgateway.app.data.api.dto.EventHistoryDto
+import com.runicgateway.app.data.api.dto.EventSeriesResponse
+import com.runicgateway.app.data.api.dto.PublicEventResponse
+import retrofit2.http.GET
+import retrofit2.http.Path
+import retrofit2.http.Query
+
+/**
+ * The event surface (PLAN.md §9 M13, `docs/website/EVENTS.md` § API surface).
+ *
+ * **These are CORE routes, not a module's**, which is why they live here rather
+ * than beside the shard reads in [PublicApi]: they exist on a backend
+ * with no game module installed at all, and they are gated by core's own `events`
+ * capability rather than by a module's. Nothing here is under `/shard`.
+ *
+ * The three public reads and the one player read share an interface for the same
+ * reason the website mounts them in one feature: the history row's whole purpose
+ * is to link back to the public page. The player call carries a bearer through
+ * [com.runicgateway.app.core.net.AuthInterceptor] like every other authenticated
+ * call; there is one Retrofit.
+ */
+interface EventsApi {
+
+    /**
+     * The public calendar. Defaults to now through 31 days out when neither end
+     * is named; the window may span at most 92 days and the server 400s past it.
+     *
+     * Rehearsals and unlisted events are absent — that filtering is in SQL, not
+     * in the answer, so there is nothing here to re-check.
+     */
+    @GET("api/v1/public/events")
+    suspend fun getCalendar(
+        @Query("from") from: String? = null,
+        @Query("to") to: String? = null,
+        @Query("seriesId") seriesId: Long? = null,
+    ): EventCalendarDto
+
+    /**
+     * One event.
+     *
+     * **[run] selects which occurrence the results table is about**, and is what
+     * an announcement's link carries: the page lives at the definition's slug, so
+     * a weekly event has one address that survives a retitle, while every
+     * `event.` trigger is about one occurrence. A run belonging to some other
+     * event is ignored rather than refused, so a stale link in a months-old mail
+     * still opens the page it was about.
+     *
+     * A draft, an archived definition and an unlisted one all answer 404,
+     * indistinguishable from a slug that never existed.
+     */
+    @GET("api/v1/public/events/{slug}")
+    suspend fun getEvent(
+        @Path("slug") slug: String,
+        @Query("run") run: String? = null,
+    ): PublicEventResponse
+
+    /**
+     * One arc. A series with no listed events answers 404 rather than an empty
+     * page — an arc is a label on its definitions, so a page for an empty one
+     * would publish that an operator has named something they have not announced.
+     */
+    @GET("api/v1/public/events/series/{slug}")
+    suspend fun getSeries(@Path("slug") slug: String): EventSeriesResponse
+
+    /**
+     * The caller's own participation history. Self-scoped on the session's user
+     * id server-side; there is deliberately no id parameter here, because there
+     * is none on the route.
+     *
+     * [before] is a participation row id, not an offset — the list gains rows at
+     * the top as the reader attends things.
+     */
+    @GET("api/v1/player/events/history")
+    suspend fun getHistory(
+        @Query("limit") limit: Int? = null,
+        @Query("before") before: Long? = null,
+    ): EventHistoryDto
+}

app/src/main/java/com/runicgateway/app/data/api/NotificationsApi.kt

@@ -3,8 +3,13 @@
  */
 package com.runicgateway.app.data.api
 
+import com.runicgateway.app.data.api.dto.NotificationChannelPrefsDto
+import com.runicgateway.app.data.api.dto.NotificationChannelPrefsUpdateDto
+import com.runicgateway.app.data.api.dto.NotificationInboxDto
+import com.runicgateway.app.data.api.dto.NotificationReadResultDto
 import com.runicgateway.app.data.api.dto.NotificationStreamsDto
 import com.runicgateway.app.data.api.dto.NotificationSubscriptionsDto
+import com.runicgateway.app.data.api.dto.NotificationUnreadDto
 import com.runicgateway.app.data.api.dto.PushDeviceDto
 import com.runicgateway.app.data.api.dto.RegisterDeviceRequest
 import retrofit2.http.Body
@@ -13,10 +18,13 @@ import retrofit2.http.GET
 import retrofit2.http.POST
 import retrofit2.http.PUT
 import retrofit2.http.Path
+import retrofit2.http.Query
 
 /**
- * The opt-in push surface under `/auth/me` (PLAN.md §11, M7 Part 2): device
- * (endpoint) registration and per-user stream subscriptions. Every call rides the
+ * The notification surface under `/auth/me` (PLAN.md §11): device (endpoint)
+ * registration, per-user stream subscriptions, the per-channel preferences that
+ * supersede them (ENGAGEMENT.md phase 3), and the in-app **inbox** — the first
+ * of these that carries content rather than a preference (phase 7/8). Every call rides the
  * main client, so [com.runicgateway.app.core.net.AuthInterceptor] attaches the
  * bearer and [com.runicgateway.app.core.net.TokenAuthenticator] refreshes on 401 —
  * registration only ever succeeds while signed in.
@@ -40,4 +48,41 @@ interface NotificationsApi {
 
     @PUT("api/v1/auth/me/notifications/subscriptions")
     suspend fun putSubscriptions(@Body body: NotificationSubscriptionsDto): NotificationSubscriptionsDto
+
+    // ── Per-channel preferences (ENGAGEMENT.md phase 3) ────────────────────
+    //
+    // The superset of the two calls above: `notification_subscriptions` is now
+    // the push projection of this table and the server fans every write to
+    // either one into the other, so the two cannot disagree.
+
+    @GET("api/v1/auth/me/notifications/channels")
+    suspend fun channelPrefs(): NotificationChannelPrefsDto
+
+    /** SPARSE — send only the pairs that changed; everything unnamed is untouched. */
+    @PUT("api/v1/auth/me/notifications/channels")
+    suspend fun putChannelPrefs(
+        @Body body: NotificationChannelPrefsUpdateDto,
+    ): NotificationChannelPrefsDto
+
+    // ── The inbox (ENGAGEMENT.md phase 7/8) ────────────────────────────────
+    //
+    // Keyset-paged on `before`, never an offset. There is no way to name another
+    // user on any of these: the caller is the only account they can read or write.
+
+    @GET("api/v1/auth/me/notifications")
+    suspend fun inbox(
+        @Query("limit") limit: Int? = null,
+        @Query("before") before: Long? = null,
+        @Query("unread") unread: Boolean? = null,
+    ): NotificationInboxDto
+
+    @GET("api/v1/auth/me/notifications/unread-count")
+    suspend fun unreadCount(): NotificationUnreadDto
+
+    /** Idempotent; 404 both for a missing item and for another account's. */
+    @POST("api/v1/auth/me/notifications/{id}/read")
+    suspend fun markRead(@Path("id") id: Long): NotificationReadResultDto
+
+    @POST("api/v1/auth/me/notifications/read-all")
+    suspend fun markAllRead(): NotificationReadResultDto
 }

app/src/main/java/com/runicgateway/app/data/api/PublicApi.kt

@@ -18,6 +18,7 @@ import com.runicgateway.app.data.api.dto.HouseDto
 import com.runicgateway.app.data.api.dto.MarketMetaDto
 import com.runicgateway.app.data.api.dto.MarketPageDto
 import com.runicgateway.app.data.api.dto.MarketVendorDto
+import com.runicgateway.app.data.api.dto.ModulesDto
 import com.runicgateway.app.data.api.dto.OnlineStaffDto
 import com.runicgateway.app.data.api.dto.PageDto
 import com.runicgateway.app.data.api.dto.PointsBoardDto
@@ -67,6 +68,18 @@ interface PublicApi {
     @GET("api/v1/public/settings")
     suspend fun getSettings(): SettingsDto
 
+    /**
+     * Which modules this backend is serving, and the capabilities each declares
+     * (§5, M13). Read together with the `version` block's own `capabilities` —
+     * core's list and a module's are separate lists on purpose.
+     *
+     * This is what lets the app tell a module that is **not installed** from a
+     * lookup that failed: `/public/shard/features` 404s in both cases, and only
+     * this call distinguishes them.
+     */
+    @GET("api/v1/public/modules")
+    suspend fun getModules(): ModulesDto
+
     // ── News & content ───────────────────────────────────────────────────
     @GET("api/v1/public/posts/{category}")
     suspend fun getPosts(@Path("category") category: String): List<PostDto>

app/src/main/java/com/runicgateway/app/data/api/dto/EventsDto.kt

@@ -0,0 +1,212 @@
+/*
+ * SPDX-License-Identifier: GPL-3.0-or-later
+ */
+package com.runicgateway.app.data.api.dto
+
+import kotlinx.serialization.Serializable
+
+/**
+ * Wire shapes for the public event surface (`docs/website/EVENTS.md` §I, events
+ * Phase 14a; the app's half is M13). Field names match
+ * `server/src/model/events/eventPublic.model.js` exactly.
+ *
+ * **That model is a PROJECTION, and these DTOs must not out-grow it.** Nothing on
+ * the server side is spread into a public entry — a field reaches one because a
+ * line put it there — so three things are absent from every shape below and each
+ * absence is a decision core made: the **spec** (phases, steps, actions and their
+ * params are the operator's plan for changing a live world; a visitor gets the
+ * phase LABEL while a run is live and nothing else), **health, cleanup, claims
+ * and errors** (facts about the deployment's plumbing, not about the event), and
+ * **`member_key`** (module-opaque, so core cannot say what publishing one would
+ * disclose). Adding a field here that the server does not send would decode to a
+ * default and render as a fact.
+ *
+ * Every DTO ignores unknown keys (NetworkModule's lenient Json), so an additive
+ * backend field is safe.
+ */
+
+/**
+ * One calendar entry. [kind] is `run` or `projected` and the two are drawn
+ * differently on purpose.
+ *
+ * A **run** is a materialised occurrence: a row exists, it can be cancelled, and
+ * what it says is committed to. A **projected** entry is arithmetic past the
+ * materialisation horizon — a forecast with nothing behind it — so the screen
+ * labels it rather than drawing it as a booking. [adjusted] and [shiftMinutes]
+ * only ever arrive on a projection, and say a DST shift moved it.
+ *
+ * [scheduledFor] is a UTC instant and [timezone] is the EVENT's own zone, never
+ * the reader's. See [com.runicgateway.app.ui.events.eventTime].
+ */
+@Serializable
+data class EventCalendarEntryDto(
+    val kind: String = "run",
+    val title: String = "",
+    val slug: String = "",
+    val seriesName: String? = null,
+    val seriesSlug: String? = null,
+    val scheduledFor: String = "",
+    val timezone: String? = null,
+    val status: String = "scheduled",
+    val live: Boolean = false,
+    val adjusted: Boolean = false,
+    val shiftMinutes: Int = 0,
+) {
+    /** True for a forecast the server has committed nothing to. */
+    val isProjected: Boolean get() = kind == "projected"
+}
+
+/** `GET /public/events` — the calendar for a window, ascending by instant. */
+@Serializable
+data class EventCalendarDto(
+    val entries: List<EventCalendarEntryDto> = emptyList(),
+    /** True when the server capped the answer; the screen says so rather than lying by omission. */
+    val truncated: Boolean = false,
+)
+
+/**
+ * One occurrence on an event's page.
+ *
+ * [phase] is the label of the phase a live run is in, resolved from the version
+ * that run PINNED — so an edit since does not relabel a run in flight. It is null
+ * on anything that is not live, which is why the screen only ever shows it there.
+ */
+@Serializable
+data class EventOccurrenceDto(
+    val runId: Long = 0,
+    val scheduledFor: String = "",
+    val timezone: String? = null,
+    val startedAt: String? = null,
+    val endedAt: String? = null,
+    val status: String = "scheduled",
+    val live: Boolean = false,
+    val scope: String? = null,
+    val phase: String? = null,
+    val resultsPublishedAt: String? = null,
+)
+
+/**
+ * One row of a published results table.
+ *
+ * [name] is whatever the module put in its participation `meta`, and there is
+ * genuinely nothing else to render when it is absent: core has no name for a
+ * character and the member key is not published, so the screen says "Unnamed"
+ * rather than inventing one.
+ *
+ * **[score] is fractional, and it has to be.** `event_run_participants.score` is
+ * `DECIMAL(18,4)`, and a module scoring by distance, time or a weighted tally
+ * writes a fraction — the live walk found `318.5` in the first row it read.
+ * Declaring it `Long` does not merely round: kotlinx REFUSES the body, the whole
+ * response fails to decode, and the screen reports a server error for a `200`.
+ * See [com.runicgateway.app.ui.events.scoreText] for how it is rendered.
+ */
+@Serializable
+data class EventParticipantDto(
+    val name: String? = null,
+    val score: Double = 0.0,
+    val rank: Int? = null,
+)
+
+/** The results table for ONE occurrence, present only once it has been published. */
+@Serializable
+data class EventResultsDto(
+    val runId: Long = 0,
+    val scheduledFor: String = "",
+    val publishedAt: String? = null,
+    val participants: List<EventParticipantDto> = emptyList(),
+)
+
+/** The arc an event belongs to, as its own page names it. */
+@Serializable
+data class EventSeriesRefDto(
+    val name: String = "",
+    val slug: String = "",
+)
+
+/** `GET /public/events/:slug` — the event. */
+@Serializable
+data class PublicEventDto(
+    val title: String = "",
+    val slug: String = "",
+    val summary: String? = null,
+    /** Sanitized HTML, written the way a wiki page and a forum post are. */
+    val body: String? = null,
+    val imageUrl: String? = null,
+    val timezone: String? = null,
+    val series: EventSeriesRefDto? = null,
+    val live: Boolean = false,
+    val current: EventOccurrenceDto? = null,
+    /**
+     * The next occurrence — **narrower than the first of [upcoming]**, and the
+     * server decides which. A cancelled occurrence still appears under what is
+     * coming, because "next Friday is off" is what somebody checking a calendar
+     * came to find out; it is not what "next" means.
+     */
+    val next: EventOccurrenceDto? = null,
+    val upcoming: List<EventOccurrenceDto> = emptyList(),
+    val past: List<EventOccurrenceDto> = emptyList(),
+    val results: EventResultsDto? = null,
+)
+
+/** The envelope `GET /public/events/:slug` answers with. */
+@Serializable
+data class PublicEventResponse(val event: PublicEventDto = PublicEventDto())
+
+/** One event as an arc lists it — the editor's order, so no dates. */
+@Serializable
+data class EventSeriesEntryDto(
+    val title: String = "",
+    val slug: String = "",
+    val summary: String? = null,
+    val imageUrl: String? = null,
+)
+
+/** `GET /public/events/series/:slug` — one arc and the listed events in it. */
+@Serializable
+data class EventSeriesDto(
+    val name: String = "",
+    val slug: String = "",
+    val description: String? = null,
+    val events: List<EventSeriesEntryDto> = emptyList(),
+)
+
+/** The envelope `GET /public/events/series/:slug` answers with. */
+@Serializable
+data class EventSeriesResponse(val series: EventSeriesDto = EventSeriesDto())
+
+/**
+ * One row of the caller's own participation history.
+ *
+ * [rank] is null until `core.results.publish` ran for that occurrence, and that
+ * is a real state rather than an error — the screen says "not published" rather
+ * than rendering a dash that reads as a bug.
+ *
+ * [id] is the participation row's own id and is what the keyset page walks back
+ * on: the list gains a row every time the reader attends something, so an offset
+ * would skip and repeat.
+ */
+@Serializable
+data class EventHistoryEntryDto(
+    val id: Long = 0,
+    val runId: Long = 0,
+    val title: String = "",
+    val slug: String = "",
+    val seriesName: String? = null,
+    val seriesSlug: String? = null,
+    val scheduledFor: String = "",
+    val startedAt: String? = null,
+    val endedAt: String? = null,
+    val timezone: String? = null,
+    val status: String = "scheduled",
+    val joinedAt: String? = null,
+    // Fractional, for the reason [EventParticipantDto.score] gives.
+    val score: Double = 0.0,
+    val rank: Int? = null,
+    val resultsPublishedAt: String? = null,
+)
+
+/** `GET /player/events/history` — self-scoped, one page. */
+@Serializable
+data class EventHistoryDto(
+    val entries: List<EventHistoryEntryDto> = emptyList(),
+)

app/src/main/java/com/runicgateway/app/data/api/dto/NotificationsDto.kt

@@ -72,3 +72,139 @@ data class NotificationStreamsDto(
 data class NotificationSubscriptionsDto(
     val streams: List<String>,
 )
+
+// ── The in-app channel (ENGAGEMENT.md phase 7/8) ───────────────────────────
+//
+// The inbox is the first notification surface that carries CONTENT. Everything
+// above is a preference or a content-free tickle; these four shapes are the
+// items themselves, pulled over the authenticated API after a tickle wakes the
+// app. The wire names come from `userNotifications.db.js`'s `toItem`.
+
+/**
+ * One inbox item. [read] is the flag and [readAt] the stamp, sent side by side so
+ * a client renders one without parsing the other.
+ *
+ * [url] is where the item points on the site (rendered from the template's
+ * `email.button` block) and is **null on most items** — an inbox row is complete
+ * on its own. [triggerId] is the event that produced it, in §7.2's ONE namespace,
+ * so it is the same vocabulary a push tickle's `stream` speaks.
+ */
+@Serializable
+data class NotificationItemDto(
+    val id: Long = 0,
+    val triggerId: String = "",
+    val title: String = "",
+    val body: String? = null,
+    val url: String? = null,
+    val read: Boolean = false,
+    val readAt: String? = null,
+    val createdAt: String? = null,
+)
+
+/**
+ * `GET /auth/me/notifications` — one page, newest first.
+ *
+ * Keyset-paged: the next page is `?before=<the last item's id>`, not an offset,
+ * because the list gains rows at the top while it is being read. [hasMore] comes
+ * from the server's take+1, so "is there another page" costs no second query.
+ * [unread] counts the WHOLE inbox, not the page — it rides along so a screen
+ * rendering both a badge and a list from one response cannot show the two
+ * disagreeing.
+ */
+@Serializable
+data class NotificationInboxDto(
+    val items: List<NotificationItemDto> = emptyList(),
+    val hasMore: Boolean = false,
+    val unread: Int = 0,
+)
+
+/** `GET /auth/me/notifications/unread-count` — the badge, on its own. */
+@Serializable
+data class NotificationUnreadDto(
+    val unread: Int = 0,
+)
+
+/**
+ * What both mark-read routes answer with. [unread] is the count AFTER the write,
+ * so the badge follows from the response rather than from a second call.
+ */
+@Serializable
+data class NotificationReadResultDto(
+    val ok: Boolean = false,
+    val changed: Int = 0,
+    val unread: Int = 0,
+)
+
+// ── Per-channel preferences (ENGAGEMENT.md phase 3) ────────────────────────
+
+/**
+ * One delivery channel from the registry. [modes] is what this channel accepts —
+ * `["off","instant"]` for push and in-app, `["off","instant","digest"]` for email
+ * — and the UI renders its control from THIS, never from a hardcoded set, so a
+ * channel added server-side arrives without an app release.
+ *
+ * [carriesContent] is the tickle invariant stated on the wire: push is `false`,
+ * which is why a push item's title never leaves the server.
+ */
+@Serializable
+data class NotificationChannelDto(
+    val id: String = "",
+    val label: String = "",
+    val carriesContent: Boolean = false,
+    val defaultMode: String = "off",
+    val supportsDigest: Boolean = false,
+    val modes: List<String> = emptyList(),
+)
+
+/**
+ * One subscribable id, from `GET /auth/me/notifications/channels`. The list is the
+ * UNION of push streams and event triggers in one namespace (§7.2), so an id may
+ * be a stream, a trigger, or both.
+ *
+ * [channels] is which channels apply to THIS id — a trigger-only id carries no
+ * `push` because nothing is registered to push it — and [modes] is the EFFECTIVE
+ * mode per channel: where the user has expressed nothing the server has already
+ * substituted that channel's default, and the client must not re-implement the
+ * defaulting.
+ */
+@Serializable
+data class NotificationChannelItemDto(
+    val id: String = "",
+    val label: String = "",
+    val description: String = "",
+    val personal: Boolean = false,
+    val requiresLinkedAccount: Boolean = false,
+    val ceiling: String? = null,
+    val channels: List<String> = emptyList(),
+    val modes: Map<String, String> = emptyMap(),
+)
+
+/** `GET · PUT /auth/me/notifications/channels` — the whole stored truth. */
+@Serializable
+data class NotificationChannelPrefsDto(
+    val channels: List<NotificationChannelDto> = emptyList(),
+    val items: List<NotificationChannelItemDto> = emptyList(),
+)
+
+/** One (id, channel) → mode pair of a sparse update. */
+@Serializable
+data class NotificationChannelPrefDto(
+    val id: String,
+    val channel: String,
+    val mode: String,
+)
+
+/**
+ * `PUT /auth/me/notifications/channels` body — a SPARSE update: only the pairs
+ * named are written and every other pair is left alone, so one toggle saves
+ * without the screen holding the whole table.
+ *
+ * [prefs] has no default for the same reason [NotificationSubscriptionsDto.streams]
+ * has none — kotlinx omits a property equal to its default, and the validator
+ * requires the field. Unlike that DTO there is no empty-set case to get wrong
+ * here: `off` is a mode, never an omission.
+ */
+@Serializable
+data class NotificationChannelPrefsUpdateDto(
+    val prefs: List<NotificationChannelPrefDto>,
+)

app/src/main/java/com/runicgateway/app/data/api/dto/PublicDto.kt

@@ -20,6 +20,47 @@ data class VersionDto(
     val service: String = "",
     val api: String = "",
     val server: String = "",
+    /**
+     * What CORE serves beyond the baseline every backend has (events Phase 14a;
+     * `MODULE_API.md` §2.9). Opaque strings, the same word a module uses on
+     * `GET /public/modules` so a client feature-detects one way, and a **separate
+     * list** because core is not a module.
+     *
+     * **The value is in what is absent**, which is why the default is empty
+     * rather than something meaningful: a backend released before a capability
+     * existed omits the key entirely, and that is how the app tells an older site
+     * from one that simply has nothing to show. An unknown string is absent, and
+     * no route may be inferred from one.
+     */
+    val capabilities: List<String> = emptyList(),
+)
+
+/**
+ * One installed, **started** module on `GET /public/modules`.
+ *
+ * A module that is disabled or failed to load is absent rather than listed with a
+ * state — its routes and its nav are absent too, so a client renders a site
+ * without that capability rather than one advertising a capability that 503s.
+ */
+@Serializable
+data class InstalledModuleDto(
+    val id: String = "",
+    val name: String = "",
+    val version: String = "",
+    val capabilities: List<String> = emptyList(),
+)
+
+/**
+ * `GET /public/modules` — what this backend is serving beyond core.
+ *
+ * Database-free and never gated by site mode, so the app can feature-detect
+ * during maintenance. A **500** is the one answer that is not an answer: core
+ * refuses to return `[]` for a list read before its loader ran, because a caller
+ * cannot tell an empty list from a mis-ordered boot.
+ */
+@Serializable
+data class ModulesDto(
+    val modules: List<InstalledModuleDto> = emptyList(),
 )
 
 /** `GET /public/status` — site mode + version for the first-run probe (§3). */

app/src/main/java/com/runicgateway/app/data/repository/AuthRepository.kt

@@ -6,6 +6,7 @@ package com.runicgateway.app.data.repository
 import com.runicgateway.app.core.auth.DeviceNameProvider
 import com.runicgateway.app.core.auth.SessionManager
 import com.runicgateway.app.core.auth.TrustTokenStore
+import com.runicgateway.app.core.inbox.InboxCache
 import com.runicgateway.app.core.push.PushManager
 import com.runicgateway.app.data.api.AuthApi
 import com.runicgateway.app.data.api.SsoApi
@@ -35,6 +36,7 @@ class AuthRepository @Inject constructor(
     private val ssoApi: SsoApi,
     private val sessionManager: SessionManager,
     private val pushManager: PushManager,
+    private val inboxCache: InboxCache,
     private val trustTokenStore: TrustTokenStore,
     private val deviceNameProvider: DeviceNameProvider,
     private val json: Json,
@@ -183,6 +185,18 @@ class AuthRepository @Inject constructor(
         } catch (_: Exception) {
             // Ignore — local session teardown proceeds regardless.
         }
+        // Drop the cached inbox with it: those are one person's notifications, and
+        // they have finished with this device. This is the tidy-up, not the
+        // safeguard — InboxCache scopes every snapshot to (base URL, user id), so
+        // the paths that never reach here (a dead refresh, a server switch) cannot
+        // surface one account's items under another's session either.
+        try {
+            inboxCache.clear()
+        } catch (e: CancellationException) {
+            throw e
+        } catch (_: Exception) {
+            // Ignore — same reason.
+        }
         val refreshToken = sessionManager.currentRefreshToken()
         try {
             authApi.logout(MobileLogoutRequest(refreshToken = refreshToken, all = allDevices))

app/src/main/java/com/runicgateway/app/data/repository/ConnectionRepository.kt

@@ -29,6 +29,7 @@ class ConnectionRepository @Inject constructor(
     private val sessionManager: SessionManager,
     private val trustTokenStore: TrustTokenStore,
     private val shardFeaturesRepository: ShardFeaturesRepository,
+    private val siteCapabilitiesRepository: SiteCapabilitiesRepository,
     private val pushManager: com.runicgateway.app.core.push.PushManager,
     private val config: com.runicgateway.app.core.AppConfig,
 ) {
@@ -116,6 +117,10 @@ class ConnectionRepository @Inject constructor(
         // a switch between two signed-out hosts changes no session, so nothing else
         // invalidates the cache and the new shard would inherit the old one's menu.
         shardFeaturesRepository.invalidate()
+        // Same argument, one layer up: what the OLD host served says nothing about
+        // the new one, and a stale "this backend has no game module" would hide the
+        // new host's shard rows until its first successful read.
+        siteCapabilitiesRepository.invalidate()
         prefs.clear()
         baseUrlHolder.set(null)
     }

app/src/main/java/com/runicgateway/app/data/repository/EventsRepository.kt

@@ -0,0 +1,61 @@
+/*
+ * SPDX-License-Identifier: GPL-3.0-or-later
+ */
+package com.runicgateway.app.data.repository
+
+import com.runicgateway.app.core.result.ApiResult
+import com.runicgateway.app.core.result.map
+import com.runicgateway.app.core.result.safeApiCall
+import com.runicgateway.app.data.api.EventsApi
+import com.runicgateway.app.data.api.dto.EventCalendarDto
+import com.runicgateway.app.data.api.dto.EventHistoryEntryDto
+import com.runicgateway.app.data.api.dto.EventSeriesDto
+import com.runicgateway.app.data.api.dto.PublicEventDto
+import javax.inject.Inject
+import javax.inject.Singleton
+
+/**
+ * The event calendar, event pages, arcs and the caller's own participation
+ * history (PLAN.md §6.1, §9 M13).
+ *
+ * The two single-object reads unwrap their envelope here rather than in a view
+ * model, so a screen never holds a `…Response` whose only job was to carry one
+ * field. The calendar and the history keep theirs: `truncated` is a fact about
+ * the answer that the screen renders, and the history's page is a list the pager
+ * appends to.
+ */
+@Singleton
+class EventsRepository @Inject constructor(
+    private val api: EventsApi,
+) {
+    /** The public calendar. Both ends optional; the server's default window is 31 days. */
+    suspend fun calendar(
+        from: String? = null,
+        to: String? = null,
+        seriesId: Long? = null,
+    ): ApiResult<EventCalendarDto> = safeApiCall { api.getCalendar(from, to, seriesId) }
+
+    /**
+     * One event, optionally about one occurrence.
+     *
+     * [run] is passed through untouched — including a run that belongs to some
+     * other event, which the server ignores rather than refusing. Filtering it
+     * here would turn a stale link into a dead end instead of a page about the
+     * thing the link was about.
+     */
+    suspend fun event(slug: String, run: String? = null): ApiResult<PublicEventDto> =
+        safeApiCall { api.getEvent(slug, run?.takeIf { it.isNotBlank() }) }.map { it.event }
+
+    /** One arc. A series with nothing listed in it answers 404, not an empty page. */
+    suspend fun series(slug: String): ApiResult<EventSeriesDto> =
+        safeApiCall { api.getSeries(slug) }.map { it.series }
+
+    /**
+     * One page of the caller's own participation history, newest first.
+     *
+     * [before] is the id of the last row already shown — a keyset page, not an
+     * offset, because the list gains rows at the top as the reader attends things.
+     */
+    suspend fun history(limit: Int, before: Long? = null): ApiResult<List<EventHistoryEntryDto>> =
+        safeApiCall { api.getHistory(limit, before) }.map { it.entries }
+}

app/src/main/java/com/runicgateway/app/data/repository/NotificationsRepository.kt

@@ -6,16 +6,23 @@ package com.runicgateway.app.data.repository
 import com.runicgateway.app.core.result.ApiResult
 import com.runicgateway.app.core.result.safeApiCall
 import com.runicgateway.app.data.api.NotificationsApi
+import com.runicgateway.app.data.api.dto.NotificationChannelPrefDto
+import com.runicgateway.app.data.api.dto.NotificationChannelPrefsDto
+import com.runicgateway.app.data.api.dto.NotificationChannelPrefsUpdateDto
+import com.runicgateway.app.data.api.dto.NotificationInboxDto
+import com.runicgateway.app.data.api.dto.NotificationReadResultDto
 import com.runicgateway.app.data.api.dto.NotificationStreamsDto
 import com.runicgateway.app.data.api.dto.NotificationSubscriptionsDto
+import com.runicgateway.app.data.api.dto.NotificationUnreadDto
 import com.runicgateway.app.data.api.dto.PushDeviceDto
 import com.runicgateway.app.data.api.dto.RegisterDeviceRequest
 import javax.inject.Inject
 import javax.inject.Singleton
 
 /**
- * Device registration + per-user stream subscriptions over the opt-in push surface
- * (PLAN.md §11, M7 Part 2). Every call returns a typed [ApiResult] so the screen
+ * Device registration, stream subscriptions, per-channel preferences and the
+ * in-app inbox — the whole `/auth/me` notification surface (PLAN.md §11,
+ * ENGAGEMENT.md phases 3 and 7/8). Every call returns a typed [ApiResult] so the screen
  * and the [com.runicgateway.app.core.push.PushManager] degrade gracefully — a `400`
  * (endpoint off the shard's allow-set) or a down backend never throws (§7).
  */
@@ -37,4 +44,33 @@ class NotificationsRepository @Inject constructor(
 
     suspend fun setSubscriptions(streams: List<String>): ApiResult<NotificationSubscriptionsDto> =
         safeApiCall { api.putSubscriptions(NotificationSubscriptionsDto(streams)) }
+
+    // ── Per-channel preferences (phase 3) ──────────────────────────────────
+
+    suspend fun channelPrefs(): ApiResult<NotificationChannelPrefsDto> =
+        safeApiCall { api.channelPrefs() }
+
+    /**
+     * Write ONE (id, channel) → mode pair. The endpoint is sparse, so a screen
+     * saving a single toggle sends a single row and cannot disturb the others —
+     * including the ones it does not render.
+     */
+    suspend fun setChannelMode(id: String, channel: String, mode: String): ApiResult<NotificationChannelPrefsDto> =
+        safeApiCall {
+            api.putChannelPrefs(
+                NotificationChannelPrefsUpdateDto(listOf(NotificationChannelPrefDto(id, channel, mode))),
+            )
+        }
+
+    // ── The inbox (phase 7/8) ──────────────────────────────────────────────
+
+    /** One page, newest first. [before] is the previous page's last id, never an offset. */
+    suspend fun inbox(before: Long? = null, unreadOnly: Boolean = false): ApiResult<NotificationInboxDto> =
+        safeApiCall { api.inbox(before = before, unread = if (unreadOnly) true else null) }
+
+    suspend fun unreadCount(): ApiResult<NotificationUnreadDto> = safeApiCall { api.unreadCount() }
+
+    suspend fun markRead(id: Long): ApiResult<NotificationReadResultDto> = safeApiCall { api.markRead(id) }
+
+    suspend fun markAllRead(): ApiResult<NotificationReadResultDto> = safeApiCall { api.markAllRead() }
 }

app/src/main/java/com/runicgateway/app/data/repository/SiteCapabilitiesRepository.kt

@@ -0,0 +1,164 @@
+/*
+ * SPDX-License-Identifier: GPL-3.0-or-later
+ */
+package com.runicgateway.app.data.repository
+
+import com.runicgateway.app.core.result.ApiResult
+import com.runicgateway.app.core.result.safeApiCall
+import com.runicgateway.app.data.api.PublicApi
+import kotlinx.coroutines.flow.MutableStateFlow
+import kotlinx.coroutines.flow.StateFlow
+import kotlinx.coroutines.flow.asStateFlow
+import kotlinx.coroutines.sync.Mutex
+import kotlinx.coroutines.sync.withLock
+import javax.inject.Inject
+import javax.inject.Singleton
+
+/**
+ * What this BACKEND serves — core's own capabilities and every started module's
+ * (PLAN.md §5, §9 M13; `docs/website/MODULE_API.md` §2.9).
+ *
+ * ## Why this exists at all, and why it is not [ShardFeaturesRepository]
+ *
+ * The two answer different questions and neither can answer the other's:
+ *
+ *  - **Capability — is this module installed at all?** Per HOST. It changes when
+ *    an operator installs or removes a module, so it is resolved beside the
+ *    appearance and invalidated on a server switch.
+ *  - **Feature — does this shard publish this surface to this viewer?** Per
+ *    VIEWER. It changes on sign-in, which is why it is resolved on every session
+ *    change.
+ *
+ * Without the first, the app cannot tell a module that is **not installed** from
+ * a lookup that failed: `GET /public/shard/features` 404s in both cases, and
+ * [ShardFeaturesRepository] maps every failure to "unknown", which [canSee]
+ * treats as visible. On a site running a different game that renders every shard
+ * row in the drawer and every one of them 404s when tapped.
+ *
+ * ## Absence of an answer is not an answer of absence
+ *
+ * The distinction this class exists to make, and the reason [SiteCapabilities]
+ * carries no "unknown" member of its own — the *absence of the whole value* is
+ * the unknown state:
+ *
+ *  - a **successful** read that does not name a capability is an answer, and
+ *    [canUse] hides what needs it;
+ *  - a **failed** read keeps the last answer this host gave, because a moment
+ *    with no connectivity is not an uninstall;
+ *  - a host that has **never** answered leaves the value null, and [canUse]
+ *    passes — the drawer renders as it did before this existed rather than
+ *    flickering its rows in on every cold start.
+ *
+ * The last one is deliberately the same fail-open direction [canSee] takes, for
+ * the same reason: the server gates every call regardless, so the cost of
+ * guessing wrong is a link that briefly 404s.
+ */
+@Singleton
+class SiteCapabilitiesRepository @Inject constructor(
+    private val api: PublicApi,
+) {
+    private val _capabilities = MutableStateFlow<SiteCapabilities?>(null)
+
+    /** The current answer, or `null` while this host has never given one. */
+    val capabilities: StateFlow<SiteCapabilities?> = _capabilities.asStateFlow()
+
+    // Serializes concurrent refreshes: the shell refreshes on resume and the
+    // connect flow refreshes on first load, and two overlapping reads would race
+    // to publish.
+    private val mutex = Mutex()
+
+    /**
+     * Re-resolve what this backend serves.
+     *
+     * **Two calls, and one failing is not the same as both failing.** Core's list
+     * and a module's are separate lists (§2.9), so they are merged from separate
+     * reads and each is kept only if it answered. A backend released before
+     * events omits `capabilities` from its `version` block entirely, which is an
+     * answer — the empty list — and not a failure.
+     */
+    suspend fun refresh() = mutex.withLock {
+        val status = safeApiCall { api.getStatus() }
+        val modules = safeApiCall { api.getModules() }
+
+        // Neither call answered: keep whatever this host said last, which for a
+        // host that has never answered is still null.
+        if (status !is ApiResult.Ok && modules !is ApiResult.Ok) return@withLock
+
+        val previous = _capabilities.value
+        val core = (status as? ApiResult.Ok)?.data?.version?.capabilities?.toSet()
+            ?: previous?.core
+            ?: emptySet()
+        val installed = (modules as? ApiResult.Ok)?.data?.modules
+            ?.flatMap { it.capabilities }
+            ?.toSet()
+            ?: previous?.modules
+            ?: emptySet()
+
+        _capabilities.value = SiteCapabilities(core = core, modules = installed)
+    }
+
+    /**
+     * Drop the answer. Called on a Settings → Server switch: capabilities belong
+     * to the host that reported them, and the new host must not inherit them —
+     * a switch between two signed-out hosts changes no session, so nothing else
+     * would invalidate this.
+     */
+    fun invalidate() {
+        _capabilities.value = null
+    }
+}
+
+/**
+ * What one backend serves, as two lists rather than one.
+ *
+ * They are kept apart because core is not a module: merging them would leave the
+ * app unable to tell *"this backend has events"* from *"a module called core
+ * happens to be installed"*, which is exactly the distinction
+ * `GET /public/modules` exists to make. [canUse] looks in both, because a menu
+ * entry does not care which half serves it — but the halves stay separable, so a
+ * future caller that does care still can.
+ */
+data class SiteCapabilities(
+    /** Core's own, from the `version` block. Empty on a backend that predates them. */
+    val core: Set<String>,
+    /** Every started module's, flattened. Two modules may declare the same string. */
+    val modules: Set<String>,
+) {
+    /** True when either half names [capability]. */
+    operator fun contains(capability: String): Boolean =
+        capability in core || capability in modules
+}
+
+/**
+ * True when [capability] may be relied on — **or when this host has not answered
+ * yet**.
+ *
+ * The null case is the fail-open one and it is not the same as the empty one: a
+ * [SiteCapabilities] that names nothing is a backend that told us it serves
+ * nothing extra, and that hides. See the class doc above.
+ *
+ * `null` [capability] means the caller declared none, which always passes.
+ */
+fun canUse(capabilities: SiteCapabilities?, capability: String?): Boolean =
+    capability == null || capabilities == null || capability in capabilities
+
+/**
+ * The capability strings the app gates on.
+ *
+ * **Deliberately few.** `module-uo` declares eight, and gating each shard row on
+ * its own would be a second, worse copy of what the per-viewer feature flags
+ * already decide — and one that drifts, because a capability is opaque to core
+ * and nothing checks the two agree. One string answers the only question a
+ * capability can: is the module there.
+ */
+object Capability {
+    /**
+     * A game module serving a live shard. Declared by `module-uo`; a different
+     * game's module that serves the same surfaces would declare it too, which is
+     * the point of an opaque string.
+     */
+    const val SHARD = "shard"
+
+    /** Core's event system (events Phase 14a). Never a module's. */
+    const val EVENTS = "events"
+}

app/src/main/java/com/runicgateway/app/di/NetworkModule.kt

@@ -15,6 +15,7 @@ import com.runicgateway.app.core.net.TokenAuthenticator
 import com.runicgateway.app.core.net.UserAgentInterceptor
 import com.runicgateway.app.data.api.AuthApi
 import com.runicgateway.app.data.api.AuthRefreshApi
+import com.runicgateway.app.data.api.EventsApi
 import com.runicgateway.app.data.api.MeApi
 import com.runicgateway.app.data.api.AdminApi
 import com.runicgateway.app.data.api.NotificationsApi
@@ -122,6 +123,15 @@ object NetworkModule {
     fun providePlayerShardApi(retrofit: Retrofit): PlayerShardApi =
         retrofit.create(PlayerShardApi::class.java)
 
+    /**
+     * The event surface (§9 M13). Three public reads and one bearer-authed player
+     * read on one interface — they are all CORE routes, so none of them is a
+     * module path and none is under `/shard`.
+     */
+    @Provides
+    @Singleton
+    fun provideEventsApi(retrofit: Retrofit): EventsApi = retrofit.create(EventsApi::class.java)
+
     /** Opt-in push devices + subscriptions (§11, M7) — bearer-authed on the main client. */
     @Provides
     @Singleton

app/src/main/java/com/runicgateway/app/di/StorageModule.kt

@@ -11,13 +11,16 @@ import com.runicgateway.app.core.auth.TokenStore
 import com.runicgateway.app.core.auth.TrustTokenStore
 import com.runicgateway.app.core.auth.sso.EncryptedPendingSsoStore
 import com.runicgateway.app.core.auth.sso.PendingSsoStore
+import com.runicgateway.app.core.inbox.DataStoreInboxCache
+import com.runicgateway.app.core.inbox.InboxCache
 import dagger.Binds
 import dagger.Module
 import dagger.hilt.InstallIn
 import dagger.hilt.components.SingletonComponent
 import javax.inject.Singleton
 
-/** Binds the at-rest stores to their EncryptedSharedPreferences impls (§4.3). */
+/** Binds the at-rest stores to their implementations — EncryptedSharedPreferences
+ *  for anything secret (§4.3), plain DataStore for the inbox snapshot. */
 @Module
 @InstallIn(SingletonComponent::class)
 abstract class StorageModule {
@@ -38,4 +41,9 @@ abstract class StorageModule {
     @Binds
     @Singleton
     abstract fun bindDeviceNameProvider(impl: BuildDeviceNameProvider): DeviceNameProvider
+
+    /** The inbox's offline snapshot — plain DataStore, not encrypted (ENGAGEMENT.md phase 8). */
+    @Binds
+    @Singleton
+    abstract fun bindInboxCache(impl: DataStoreInboxCache): InboxCache
 }

app/src/main/java/com/runicgateway/app/ui/AppViewModel.kt

@@ -11,6 +11,7 @@ import com.runicgateway.app.core.result.ApiResult
 import com.runicgateway.app.data.appearance.SiteAppearance
 import com.runicgateway.app.data.repository.ConnectionRepository
 import com.runicgateway.app.data.repository.SettingsRepository
+import com.runicgateway.app.data.repository.SiteCapabilitiesRepository
 import dagger.hilt.android.lifecycle.HiltViewModel
 import kotlinx.coroutines.flow.MutableStateFlow
 import kotlinx.coroutines.flow.StateFlow
@@ -29,6 +30,7 @@ class AppViewModel @Inject constructor(
     private val settingsRepository: SettingsRepository,
     private val baseUrlHolder: BaseUrlHolder,
     private val pushManager: PushManager,
+    private val siteCapabilitiesRepository: SiteCapabilitiesRepository,
 ) : ViewModel() {
 
     sealed interface AppState {
@@ -76,6 +78,12 @@ class AppViewModel @Inject constructor(
     fun refreshAppearance() {
         if (_state.value !is AppState.Ready) return
         viewModelScope.launch {
+            // What the backend SERVES is a per-host fact and refreshes on the same
+            // clock as the appearance: an operator who installs a module while the
+            // app is backgrounded should see its rows on the next resume. Done
+            // before the early return below, because a failed settings read is no
+            // reason to skip it — they are separate calls to separate routes.
+            siteCapabilitiesRepository.refresh()
             val settings = (settingsRepository.getSettings() as? ApiResult.Ok)?.data ?: return@launch
             pushManager.setNtfyUrl(settings.push.ntfyUrl)
             // changeServer() may have raced us back to the connect screen while the
@@ -100,6 +108,7 @@ class AppViewModel @Inject constructor(
      * or sign-in. Returns [SiteAppearance.NONE] if settings couldn't be loaded.
      */
     private suspend fun loadAppearance(): SiteAppearance {
+        siteCapabilitiesRepository.refresh()
         val settings = (settingsRepository.getSettings() as? ApiResult.Ok)?.data
         pushManager.setNtfyUrl(settings?.push?.ntfyUrl)
         return SiteAppearance.from(settings)

app/src/main/java/com/runicgateway/app/ui/RunicApp.kt

@@ -7,10 +7,12 @@ import androidx.compose.foundation.layout.Column
 import androidx.compose.foundation.layout.Spacer
 import androidx.compose.foundation.layout.height
 import androidx.compose.foundation.layout.padding
+import androidx.compose.foundation.layout.size
 import androidx.compose.foundation.rememberScrollState
 import androidx.compose.foundation.verticalScroll
 import androidx.compose.material.icons.Icons
 import androidx.compose.material.icons.automirrored.filled.ArrowBack
+import androidx.compose.material.icons.automirrored.filled.ExitToApp
 import androidx.compose.material.icons.filled.Menu
 import androidx.compose.material3.DrawerValue
 import androidx.compose.material3.ExperimentalMaterial3Api
@@ -21,6 +23,7 @@ import androidx.compose.material3.MaterialTheme
 import androidx.compose.material3.ModalDrawerSheet
 import androidx.compose.material3.ModalNavigationDrawer
 import androidx.compose.material3.NavigationDrawerItem
+import androidx.compose.material3.NavigationDrawerItemColors
 import androidx.compose.material3.NavigationDrawerItemDefaults
 import androidx.compose.material3.Scaffold
 import androidx.compose.material3.Text
@@ -32,7 +35,10 @@ import androidx.compose.runtime.LaunchedEffect
 import androidx.compose.runtime.getValue
 import androidx.compose.runtime.rememberCoroutineScope
 import androidx.compose.ui.Modifier
+import androidx.compose.ui.platform.LocalContext
 import androidx.compose.ui.res.stringResource
+import androidx.compose.ui.semantics.contentDescription
+import androidx.compose.ui.semantics.semantics
 import androidx.compose.ui.text.style.TextOverflow
 import androidx.compose.ui.unit.dp
 import androidx.compose.ui.unit.sp
@@ -48,24 +54,36 @@ import androidx.navigation.compose.rememberNavController
 import androidx.navigation.navArgument
 import com.runicgateway.app.R
 import com.runicgateway.app.core.auth.Session
+import com.runicgateway.app.core.web.WebHandoff
 import com.runicgateway.app.data.api.dto.BrandDto
+import com.runicgateway.app.data.appearance.SiteAppearance
 import com.runicgateway.app.ui.auth.AccountScreen
 import com.runicgateway.app.ui.auth.LoginScreen
 import com.runicgateway.app.ui.auth.RecoveryCodesScreen
 import com.runicgateway.app.ui.auth.TrustedDevicesScreen
 import com.runicgateway.app.ui.auth.roleLabelRes
+import com.runicgateway.app.ui.components.BrandLogo
 import com.runicgateway.app.ui.contact.ContactScreen
+import com.runicgateway.app.ui.events.EventScreen
+import com.runicgateway.app.ui.events.EventSeriesScreen
+import com.runicgateway.app.ui.events.EventsScreen
+import com.runicgateway.app.ui.events.MyEventsScreen
 import com.runicgateway.app.ui.home.HomeScreen
 import com.runicgateway.app.ui.navigation.APP_MENU
+import com.runicgateway.app.ui.navigation.NavNode
 import com.runicgateway.app.ui.navigation.Routes
-import com.runicgateway.app.ui.navigation.visibleEntries
+import com.runicgateway.app.ui.navigation.buildNavTree
+import com.runicgateway.app.ui.navigation.isEntryVisible
+import com.runicgateway.app.ui.navigation.pruneNav
 import com.runicgateway.app.ui.news.NewsScreen
 import com.runicgateway.app.ui.news.PostScreen
 import com.runicgateway.app.ui.admin.AdminContentScreen
 import com.runicgateway.app.ui.admin.AdminDashboardScreen
 import com.runicgateway.app.ui.admin.AdminModerationScreen
 import com.runicgateway.app.ui.admin.AdminSupportScreen
-import com.runicgateway.app.ui.notifications.NotificationsScreen
+import com.runicgateway.app.ui.notifications.InboxBadgeViewModel
+import com.runicgateway.app.ui.notifications.InboxScreen
+import com.runicgateway.app.ui.notifications.NotificationSettingsScreen
 import com.runicgateway.app.ui.page.PageScreen
 import com.runicgateway.app.ui.player.CharacterSheetScreen
 import com.runicgateway.app.ui.player.CharactersScreen
@@ -84,6 +102,7 @@ import com.runicgateway.app.ui.shard.MarketVendorScreen
 import com.runicgateway.app.ui.shard.RulesScreen
 import com.runicgateway.app.ui.shard.ShardBoard
 import com.runicgateway.app.ui.shard.ShardScreen
+import com.runicgateway.app.ui.theme.LocalShardStructure
 import com.runicgateway.app.ui.wiki.WikiPageScreen
 import com.runicgateway.app.ui.wiki.WikiScreen
 import kotlinx.coroutines.launch
@@ -95,6 +114,10 @@ private val TOP_LEVEL_ROUTES = setOf(
     // on them too (M11).
     Routes.SHARD_RULES, Routes.SHARD_LEADERBOARDS, Routes.SHARD_MARKET, Routes.ATLAS,
     Routes.NOTIFICATIONS,
+    // Events (M13): the calendar and the history are drawer rows, so the drawer
+    // gesture works on them. The event page and an arc are detail screens and are
+    // deliberately absent — a back gesture there means "back", not "open the menu".
+    Routes.EVENTS, Routes.MY_EVENTS,
     Routes.PLAYER_CHARACTERS, Routes.PLAYER_VENDORS, Routes.PLAYER_HOUSES,
     Routes.ADMIN_DASHBOARD, Routes.ADMIN_CONTENT, Routes.ADMIN_MODERATION, Routes.ADMIN_SUPPORT,
 )
@@ -109,13 +132,16 @@ private val TOP_LEVEL_ROUTES = setOf(
 @OptIn(ExperimentalMaterial3Api::class)
 @Composable
 fun RunicApp(
-    brand: BrandDto?,
+    appearance: SiteAppearance,
     onChangeServer: () -> Unit,
     modifier: Modifier = Modifier,
     deepLinkStream: String? = null,
+    deepLinkRef: String? = null,
     onDeepLinkConsumed: () -> Unit = {},
     sessionViewModel: SessionViewModel = hiltViewModel(),
+    inboxBadgeViewModel: InboxBadgeViewModel = hiltViewModel(),
 ) {
+    val brand = appearance.brand
     val navController = rememberNavController()
     val drawerState = rememberDrawerState(DrawerValue.Closed)
     val scope = rememberCoroutineScope()
@@ -123,17 +149,30 @@ fun RunicApp(
     val session by sessionViewModel.session.collectAsStateWithLifecycle()
     // What this shard publishes, independently of who the caller is (§5, M11).
     val shardFeatures by sessionViewModel.shardFeatures.collectAsStateWithLifecycle()
+    // What this BACKEND serves at all, independently of both (§5, M13). A different
+    // question from the line above and gated separately — see `isEntryVisible`.
+    val capabilities by sessionViewModel.capabilities.collectAsStateWithLifecycle()
 
-    // Re-validate the cached role each time the app returns to the foreground (§4.3).
+    // Re-validate the cached role each time the app returns to the foreground (§4.3),
+    // and re-read the unread count with it: a tickle that arrived while the app was
+    // away is exactly what brings someone back to it.
     LifecycleResumeEffect(Unit) {
         sessionViewModel.revalidate()
+        inboxBadgeViewModel.refresh()
         onPauseOrDispose { }
     }
 
+    val unread by inboxBadgeViewModel.unread.collectAsStateWithLifecycle()
+    // The badge follows the session, so signing out clears it rather than leaving
+    // the previous account's count on the drawer.
+    LaunchedEffect(session) { inboxBadgeViewModel.refresh() }
+
     // A tapped push notification deep-links to its stream's screen (§11, item 7).
-    LaunchedEffect(deepLinkStream) {
+    LaunchedEffect(deepLinkStream, deepLinkRef) {
         val stream = deepLinkStream ?: return@LaunchedEffect
-        navController.navigate(Routes.forStream(stream)) {
+        // Both halves of the tickle: a `notification:` ref means there is an inbox
+        // row waiting, and that is where the tap goes (ENGAGEMENT.md phase 8).
+        navController.navigate(Routes.forTickle(stream, deepLinkRef)) {
             popUpTo(Routes.HOME) { saveState = true }
             launchSingleTop = true
         }
@@ -141,9 +180,37 @@ fun RunicApp(
     }
 
     val backStackEntry by navController.currentBackStackEntryAsState()
-    val currentRoute = backStackEntry?.destination?.route
+    // A destination's route is its NavHost *pattern*, so News reports
+    // "news?category={category}" (§6.2). Compare on the part before the query.
+    val currentRoute = backStackEntry?.destination?.route?.substringBefore('?')
     val isTopLevel = currentRoute in TOP_LEVEL_ROUTES
-    val entries = visibleEntries(APP_MENU, session, shardFeatures)
+    // The admin's nav overrides, then the gates — never the other way round. An
+    // override is presentation only: it may relabel, reorder, group and hide, so
+    // `pruneNav` still decides what this caller may see and remains the boundary
+    // (§6.1, AC-3). With no stored row the merge returns APP_MENU itself.
+    val nav = pruneNav(buildNavTree(APP_MENU, appearance.navPublic)) {
+        isEntryVisible(it, session, shardFeatures, capabilities)
+    }
+
+    val context = LocalContext.current
+    // An added link's path is site-relative; a hand-off needs it absolute against
+    // the configured base URL, which is exactly what the asset resolver does (§6.3).
+    val resolveUrl = LocalAssetResolver.current
+    val openNode: (NavNode) -> Unit = { node ->
+        scope.launch { drawerState.close() }
+        when (node) {
+            is NavNode.Item -> navController.navigateTopLevel(node.entry.route)
+            // A link the app resolved opens like any other drawer row, detail screen
+            // or not: one rule, and back-press lands on Home as it does from every
+            // row. One it could not resolve goes to the browser, absolute against
+            // the site's base URL (§6.3).
+            is NavNode.Link -> node.route
+                ?.let { navController.navigateTopLevel(it) }
+                ?: resolveUrl(node.path)?.let { WebHandoff.open(context, it) }
+            // Section headers aren't clickable — the group is always open (§6.3).
+            is NavNode.Section -> Unit
+        }
+    }
 
     ModalNavigationDrawer(
         drawerState = drawerState,
@@ -161,6 +228,14 @@ fun RunicApp(
                 // unreachable. See RunicGateway M10.
                 Column(Modifier.verticalScroll(rememberScrollState())) {
                 Spacer(Modifier.height(12.dp))
+                // The instance's logo above its name (§5.6). Decorative — the name
+                // is the very next line — and absent on an instance that uploaded
+                // none, in which case the header is exactly what it was before M12.
+                BrandLogo(
+                    logo = brand?.logo,
+                    height = 32.dp,
+                    modifier = Modifier.padding(start = 24.dp, end = 24.dp, bottom = 4.dp),
+                )
                 Text(
                     text = brand?.name?.takeIf { it.isNotBlank() } ?: stringResource(R.string.app_name),
                     style = MaterialTheme.typography.titleLarge,
@@ -169,17 +244,34 @@ fun RunicApp(
                 )
                 HorizontalDivider()
                 Spacer(Modifier.height(8.dp))
-                entries.forEach { entry ->
-                    NavigationDrawerItem(
-                        label = { Text(stringResource(entry.labelRes)) },
-                        selected = currentRoute == entry.route,
-                        onClick = {
-                            scope.launch { drawerState.close() }
-                            navController.navigateTopLevel(entry.route)
-                        },
-                        colors = drawerItemColors,
-                        modifier = Modifier.padding(NavigationDrawerItemDefaults.ItemPadding),
-                    )
+                nav.forEach { node ->
+                    if (node is NavNode.Section) {
+                        // A group the admin created: its label as a header, its rows
+                        // beneath it. Always open — a drawer is already a vertical
+                        // list, so the website's dropdown does not translate (§6.3).
+                        Text(
+                            text = node.label,
+                            style = MaterialTheme.typography.labelLarge,
+                            color = MaterialTheme.colorScheme.onSurfaceVariant,
+                            modifier = Modifier.padding(
+                                start = 28.dp,
+                                end = 28.dp,
+                                top = 12.dp,
+                                bottom = 4.dp,
+                            ),
+                        )
+                        node.items.forEach { child ->
+                            NavRow(
+                                node = child,
+                                currentRoute = currentRoute,
+                                colors = drawerItemColors,
+                                indented = true,
+                                unread = unread,
+                            ) { openNode(child) }
+                        }
+                    } else {
+                        NavRow(node, currentRoute, drawerItemColors, unread = unread) { openNode(node) }
+                    }
                 }
 
                 HorizontalDivider(Modifier.padding(vertical = 8.dp))
@@ -203,6 +295,7 @@ fun RunicApp(
                         }
                     },
                     colors = drawerItemColors,
+                    shape = LocalShardStructure.current.pill,
                     modifier = Modifier.padding(NavigationDrawerItemDefaults.ItemPadding),
                 )
                 NavigationDrawerItem(
@@ -213,6 +306,7 @@ fun RunicApp(
                         onChangeServer()
                     },
                     colors = drawerItemColors,
+                    shape = LocalShardStructure.current.pill,
                     modifier = Modifier.padding(NavigationDrawerItemDefaults.ItemPadding),
                 )
                 }
@@ -230,13 +324,24 @@ fun RunicApp(
                         actionIconContentColor = MaterialTheme.colorScheme.onSurface,
                     ),
                     title = {
-                        Text(
-                            text = (brand?.name?.takeIf { it.isNotBlank() }
-                                ?: stringResource(R.string.app_name)).uppercase(),
-                            style = MaterialTheme.typography.titleSmall.copy(letterSpacing = 1.2.sp),
-                            maxLines = 1,
-                            overflow = TextOverflow.Ellipsis,
-                        )
+                        val name = brand?.name?.takeIf { it.isNotBlank() }
+                            ?: stringResource(R.string.app_name)
+                        // The logo stands in for the title here, so unlike the drawer's
+                        // it is named for a screen reader — and it falls back to the
+                        // text when the instance has no logo or the load fails (§5.6).
+                        BrandLogo(
+                            logo = brand?.logo,
+                            height = 24.dp,
+                            contentDescription = name,
+                        ) {
+                            Text(
+                                text = name.uppercase(),
+                                style = MaterialTheme.typography.titleSmall
+                                    .copy(letterSpacing = 1.2.sp),
+                                maxLines = 1,
+                                overflow = TextOverflow.Ellipsis,
+                            )
+                        }
                     },
                     navigationIcon = {
                         if (isTopLevel) {
@@ -267,6 +372,80 @@ fun RunicApp(
     }
 }
 
+/**
+ * One drawer row: a coded entry, or an admin's added link (§6.3).
+ *
+ * A link that the app can open natively is deliberately indistinguishable from a
+ * coded row — that is the point of resolving it. One that hands off to the browser
+ * carries a trailing icon, so leaving the app is never a surprise.
+ */
+@Composable
+private fun NavRow(
+    node: NavNode,
+    currentRoute: String?,
+    colors: NavigationDrawerItemColors,
+    indented: Boolean = false,
+    unread: Int = 0,
+    onClick: () -> Unit,
+) {
+    val route = when (node) {
+        is NavNode.Item -> node.entry.route
+        is NavNode.Link -> node.route
+        is NavNode.Section -> null
+    }
+    val label = when (node) {
+        // An admin's label wins over the bundled one, and is the same string in
+        // every locale — see MenuEntry.label.
+        is NavNode.Item -> node.entry.label ?: stringResource(node.entry.labelRes)
+        is NavNode.Link -> node.label
+        is NavNode.Section -> return
+    }
+    val handsOff = node is NavNode.Link && node.route == null
+    // The unread count rides on whichever row leads to the inbox — including an
+    // admin's own nav override pointing at it, since the badge belongs to the
+    // destination, not to the bundled entry.
+    val showsUnread = !handsOff && unread > 0 && route == Routes.NOTIFICATIONS
+
+    NavigationDrawerItem(
+        label = { Text(label) },
+        selected = route != null && currentRoute == route.substringBefore('?'),
+        onClick = onClick,
+        badge = when {
+            handsOff -> {
+                {
+                    Icon(
+                        Icons.AutoMirrored.Filled.ExitToApp,
+                        contentDescription = stringResource(R.string.nav_opens_in_browser),
+                        modifier = Modifier.size(18.dp),
+                    )
+                }
+            }
+            showsUnread -> {
+                {
+                    // Named for a screen reader: "7" beside "Notifications" reads as
+                    // a count to a sighted user and as a bare number to everyone else.
+                    val spoken = stringResource(R.string.inbox_unread_count, unread)
+                    Text(
+                        text = unread.toString(),
+                        style = MaterialTheme.typography.labelLarge,
+                        modifier = Modifier.semantics { contentDescription = spoken },
+                    )
+                }
+            }
+            else -> null
+        },
+        colors = colors,
+        // Like Card's elevation, NavigationDrawerItem takes its shape as a default
+        // argument (CircleShape) rather than from the theme, so --radius-pill has to
+        // be handed to it at every call site or the selected row stays fully round
+        // while every other radius follows the shard (phase 8's AC-5 walk).
+        shape = LocalShardStructure.current.pill,
+        modifier = Modifier
+            .padding(NavigationDrawerItemDefaults.ItemPadding)
+            .padding(start = if (indented) 16.dp else 0.dp),
+    )
+}
+
 @Composable
 private fun RunicNavHost(
     navController: NavHostController,
@@ -284,7 +463,19 @@ private fun RunicNavHost(
         composable(Routes.HOME) {
             HomeScreen(brand = brand)
         }
-        composable(Routes.NEWS) {
+        // The category is optional: navigating to plain Routes.NEWS matches this
+        // pattern with no argument and opens the default tab, which is every route
+        // into the screen except an admin's nav override or added link (§6.2).
+        composable(
+            route = Routes.NEWS_ROUTE,
+            arguments = listOf(
+                navArgument(Routes.Args.CATEGORY) {
+                    type = NavType.StringType
+                    nullable = true
+                    defaultValue = null
+                },
+            ),
+        ) {
             NewsScreen(onOpenPost = { category, idOrSlug ->
                 navController.navigate(Routes.post(category, idOrSlug))
             })
@@ -298,6 +489,50 @@ private fun RunicNavHost(
         ) {
             PostScreen()
         }
+        // Events (M13). CORE's routes, so these screens are reachable on a backend
+        // with no game module at all — which is why they sit above the shard block
+        // rather than inside it.
+        composable(Routes.EVENTS) {
+            EventsScreen(onOpenEvent = { slug -> navController.navigate(Routes.event(slug)) })
+        }
+        // The app's one route with a query argument. `run` is optional and nullable:
+        // navigating to Routes.event(slug) with no run matches this pattern with no
+        // argument, which is every route in except an announcement's link.
+        composable(
+            route = Routes.EVENT_ROUTE,
+            arguments = listOf(
+                navArgument(Routes.Args.SLUG) { type = NavType.StringType },
+                navArgument(Routes.Args.RUN) {
+                    type = NavType.StringType
+                    nullable = true
+                    defaultValue = null
+                },
+            ),
+        ) {
+            EventScreen(
+                onOpenSeries = { slug -> navController.navigate(Routes.eventSeries(slug)) },
+                onOpenRun = { slug, runId ->
+                    navController.navigate(Routes.event(slug, runId.toString()))
+                },
+            )
+        }
+        composable(
+            route = Routes.EVENT_SERIES,
+            arguments = listOf(navArgument(Routes.Args.SLUG) { type = NavType.StringType }),
+        ) {
+            EventSeriesScreen(onOpenEvent = { slug -> navController.navigate(Routes.event(slug)) })
+        }
+        composable(Routes.MY_EVENTS) {
+            // Signed out, this route is not in the drawer — but a saved back-stack
+            // entry can still be restored onto it, so the shell says where to go
+            // rather than letting the screen ask the server and render a 401.
+            when (session) {
+                is Session.SignedIn -> MyEventsScreen(onOpenRun = { slug, runId ->
+                    navController.navigate(Routes.event(slug, runId.toString()))
+                })
+                Session.SignedOut -> LaunchedEffect(Unit) { navController.navigateTopLevel(Routes.HOME) }
+            }
+        }
         composable(Routes.SHARD) {
             ShardScreen(onOpenBoard = { board ->
                 navController.navigate(
@@ -399,9 +634,24 @@ private fun RunicNavHost(
         }
         composable(Routes.NOTIFICATIONS) {
             // Signed-in only; a sign-out (or demotion) sends the user home rather than
-            // leaving stale settings up. The backend gates every call regardless (§5).
+            // leaving another account's items up. The backend gates every call
+            // regardless, and the inbox routes are role-agnostic (§5) — staff have an
+            // inbox for the same reason players do, which on the web took a second
+            // mount to be true.
             when (session) {
-                is Session.SignedIn -> NotificationsScreen()
+                is Session.SignedIn -> InboxScreen(
+                    onOpenSettings = { navController.navigate(Routes.NOTIFICATIONS_SETTINGS) },
+                    // A notification whose link the app can render opens in the app.
+                    // `navigate`, not `navigateTopLevel`: the inbox is where the
+                    // reader came from and back should return there.
+                    onOpenRoute = { route -> navController.navigate(route) },
+                )
+                Session.SignedOut -> LaunchedEffect(Unit) { navController.navigateTopLevel(Routes.HOME) }
+            }
+        }
+        composable(Routes.NOTIFICATIONS_SETTINGS) {
+            when (session) {
+                is Session.SignedIn -> NotificationSettingsScreen()
                 Session.SignedOut -> LaunchedEffect(Unit) { navController.navigateTopLevel(Routes.HOME) }
             }
         }

app/src/main/java/com/runicgateway/app/ui/components/BrandAssets.kt

@@ -0,0 +1,157 @@
+/*
+ * SPDX-License-Identifier: GPL-3.0-or-later
+ */
+package com.runicgateway.app.ui.components
+
+import androidx.compose.foundation.layout.fillMaxWidth
+import androidx.compose.foundation.layout.height
+import androidx.compose.foundation.layout.widthIn
+import androidx.compose.material3.MaterialTheme
+import androidx.compose.runtime.Composable
+import androidx.compose.runtime.getValue
+import androidx.compose.runtime.mutableStateOf
+import androidx.compose.runtime.remember
+import androidx.compose.runtime.setValue
+import androidx.compose.ui.Modifier
+import androidx.compose.ui.draw.clip
+import androidx.compose.ui.layout.ContentScale
+import androidx.compose.ui.unit.Dp
+import androidx.compose.ui.unit.dp
+import coil.compose.AsyncImage
+import com.runicgateway.app.ui.LocalAssetResolver
+
+/**
+ * The two brand assets an instance can upload — the logo and the hero
+ * (THEMING_AND_NAV.md §5.6, M12 phase 4). Both have ridden in `BrandDto` since
+ * M1 and neither has ever been drawn; the app has always spelled the instance
+ * out in text wherever the website shows a mark.
+ *
+ * **The rule that governs this whole file: an empty slot renders nothing.** Not
+ * a placeholder, not a reserved gap, not the app's own emblem — an instance
+ * that has uploaded no logo must lay out exactly as it did before this phase
+ * existed, which is §2 applied to assets. The website's `BrandLogo.jsx` opens
+ * with the same `if (!brand.logo) return null`.
+ *
+ * **A failed load is an empty slot.** No broken-image icon and no retry: an
+ * asset that 404s, or that can't be reached because the shard is down, must
+ * degrade to the same layout as an instance that never uploaded one. That is
+ * why nothing here reserves its space up front — every size modifier hangs off
+ * the image itself, so when the image isn't composed neither is its padding.
+ * A caller that wants space *below* a hero passes it as `Modifier.padding`
+ * rather than a sibling `Spacer`, and gets both cases right for free.
+ */
+
+/**
+ * Widest a logo may draw, as a multiple of its height. Mirrors the website's
+ * `maxWidth: height * 6` — an operator who uploads a long wordmark gets it
+ * scaled down rather than pushing the drawer header or the top bar's title out
+ * of shape.
+ */
+private const val LOGO_MAX_ASPECT = 6f
+
+/** The Home hero's band height (§5.6, phase 4). See [BrandHero] for why it's fixed. */
+private val HERO_HEIGHT = 180.dp
+
+/**
+ * The instance's uploaded logo at [height], or [fallback] when there is none.
+ *
+ * [fallback] defaults to drawing nothing, which is what the drawer header wants:
+ * the instance name sits directly below it, so an instance with no logo simply
+ * has the name where it has always been. The top bar passes the name itself,
+ * because there the logo *replaces* the title — leaving that blank on a failed
+ * load would strand the app in an unnamed shell until the next resume refresh,
+ * and "a failed load is an empty slot" means the slot falls back to whatever
+ * empty would have shown, which for the top bar is the text.
+ *
+ * There is deliberately no fallback while the load is still in flight. Drawing
+ * the text first would flash text → logo on every navigation for the sake of
+ * one frame, since Coil serves the second and later reads from its memory cache.
+ *
+ * Pass [contentDescription] only where the logo stands alone. Beside or above
+ * the name in text it is decorative, and describing it would have a screen
+ * reader say the instance's name twice — the same call the website's `alt=''`
+ * makes.
+ */
+@Composable
+fun BrandLogo(
+    logo: String?,
+    height: Dp,
+    modifier: Modifier = Modifier,
+    contentDescription: String? = null,
+    fallback: @Composable () -> Unit = {},
+) {
+    val url = brandAssetUrl(logo, LocalAssetResolver.current)
+    // Keyed on the url so a refreshed appearance that swaps the logo (§5.5) gets
+    // a fresh attempt rather than inheriting the old one's failure.
+    var failed by remember(url) { mutableStateOf(false) }
+
+    if (url == null || failed) {
+        fallback()
+        return
+    }
+    AsyncImage(
+        model = url,
+        contentDescription = contentDescription,
+        contentScale = ContentScale.Fit,
+        onError = { failed = true },
+        modifier = modifier
+            .height(height)
+            .widthIn(max = height * LOGO_MAX_ASPECT),
+    )
+}
+
+/**
+ * The instance's hero image as a full-width band above Home's title block, or
+ * nothing when there is none.
+ *
+ * **Fixed height and cropped**, rather than the intrinsic aspect ratio the app's
+ * other images (`PostScreen`, `BlockRenderer`) draw at. The website's hero is a
+ * CSS background driven by `hero_layout`, which the app does not port, so the
+ * app needs its own rule — and the website's *default* hero is a square emblem,
+ * so an uploaded square is a case to expect rather than an edge one. At the
+ * intrinsic aspect that square would be a ~360dp block that pushes the status
+ * card off the first screenful; cropped to a band, a wide banner and a square
+ * both give the same frame above the title.
+ *
+ * Clipped to `shapes.medium`, so the hero follows the shard's `--radius-card`
+ * like every other surface the admin can round off (§5.2).
+ *
+ * Decorative: Home spells the instance's name and tagline out in text directly
+ * below, so the hero carries no content description.
+ */
+@Composable
+fun BrandHero(hero: String?, modifier: Modifier = Modifier) {
+    val url = brandAssetUrl(hero, LocalAssetResolver.current)
+    var failed by remember(url) { mutableStateOf(false) }
+
+    if (url == null || failed) return
+    AsyncImage(
+        model = url,
+        contentDescription = null,
+        contentScale = ContentScale.Crop,
+        onError = { failed = true },
+        modifier = modifier
+            .fillMaxWidth()
+            .height(HERO_HEIGHT)
+            .clip(MaterialTheme.shapes.medium),
+    )
+}
+
+/**
+ * Resolve a brand asset slot to a loadable URL, or null when the slot is empty.
+ *
+ * The blank check has to happen on **both** sides of [resolve]: `BrandDto`
+ * defaults every asset field to `""` rather than null (the server publishes the
+ * empty string for "not set"), and a resolver given a path it cannot make
+ * absolute may hand one straight back. Null out of here is the signal for "draw
+ * nothing", so a blank slipping through would put a zero-size image request in
+ * the layout instead of no image at all.
+ *
+ * Pulled out of the composables purely so it can be tested: the app has no
+ * Robolectric, so a composable body cannot run in a JVM unit test, but this rule
+ * is the whole of §5.6's "renders nothing when unset" and it is worth pinning.
+ */
+internal fun brandAssetUrl(path: String?, resolve: (String?) -> String?): String? =
+    path?.takeIf { it.isNotBlank() }
+        ?.let(resolve)
+        ?.takeIf { it.isNotBlank() }

app/src/main/java/com/runicgateway/app/ui/events/EventScreen.kt

@@ -0,0 +1,310 @@
+/*
+ * SPDX-License-Identifier: GPL-3.0-or-later
+ */
+package com.runicgateway.app.ui.events
+
+import androidx.compose.foundation.clickable
+import androidx.compose.foundation.layout.Arrangement
+import androidx.compose.foundation.layout.Column
+import androidx.compose.foundation.layout.PaddingValues
+import androidx.compose.foundation.layout.Row
+import androidx.compose.foundation.layout.fillMaxSize
+import androidx.compose.foundation.layout.fillMaxWidth
+import androidx.compose.foundation.layout.padding
+import androidx.compose.foundation.layout.width
+import androidx.compose.foundation.lazy.LazyColumn
+import androidx.compose.material3.MaterialTheme
+import androidx.compose.material3.Text
+import androidx.compose.runtime.Composable
+import androidx.compose.runtime.getValue
+import androidx.compose.ui.Alignment
+import androidx.compose.ui.Modifier
+import androidx.compose.ui.res.stringResource
+import androidx.compose.ui.text.style.TextAlign
+import androidx.compose.ui.unit.dp
+import androidx.hilt.navigation.compose.hiltViewModel
+import androidx.lifecycle.compose.collectAsStateWithLifecycle
+import com.runicgateway.app.R
+import com.runicgateway.app.data.api.dto.EventOccurrenceDto
+import com.runicgateway.app.data.api.dto.EventParticipantDto
+import com.runicgateway.app.data.api.dto.PublicEventDto
+import com.runicgateway.app.ui.UiState
+import com.runicgateway.app.ui.components.ErrorView
+import com.runicgateway.app.ui.components.HtmlText
+import com.runicgateway.app.ui.components.LoadingView
+import com.runicgateway.app.ui.components.PillTone
+import com.runicgateway.app.ui.components.ShardCard
+import com.runicgateway.app.ui.components.StatusPill
+
+/**
+ * One event's public page (EVENTS.md § API surface, M13).
+ *
+ * The storyline, its arc, what is live, what is next, what happened recently, and
+ * a results table once an occurrence has published one.
+ *
+ * **The plan behind the event is never shown**, because the server never sends
+ * it: a live run carries the LABEL of the phase it is in — resolved from the
+ * version that run pinned, so an edit since does not relabel it — and nothing
+ * else. Phases, steps and actions are the operator's.
+ */
+@Composable
+fun EventScreen(
+    onOpenSeries: (String) -> Unit,
+    onOpenRun: (String, Long) -> Unit,
+    modifier: Modifier = Modifier,
+    viewModel: EventViewModel = hiltViewModel(),
+) {
+    val state by viewModel.state.collectAsStateWithLifecycle()
+
+    // Error before content. Phase 13 found the inverse of this one tier along: a
+    // `if (loading || !form)` spinner above the error branch left a failed load
+    // spinning for ever with nothing on screen naming the problem.
+    when (val s = state) {
+        is UiState.Error -> ErrorView(s.kind, onRetry = viewModel::load, modifier = modifier)
+        is UiState.Loading -> LoadingView(modifier)
+        is UiState.Success -> EventBody(s.data, onOpenSeries, onOpenRun, modifier)
+    }
+}
+
+@Composable
+private fun EventBody(
+    event: PublicEventDto,
+    onOpenSeries: (String) -> Unit,
+    onOpenRun: (String, Long) -> Unit,
+    modifier: Modifier = Modifier,
+) {
+    LazyColumn(
+        modifier = modifier.fillMaxSize(),
+        contentPadding = PaddingValues(16.dp),
+        verticalArrangement = Arrangement.spacedBy(16.dp),
+    ) {
+        item(key = "head") {
+            Column(verticalArrangement = Arrangement.spacedBy(6.dp)) {
+                Text(
+                    text = event.title,
+                    style = MaterialTheme.typography.headlineSmall,
+                    color = MaterialTheme.colorScheme.onSurface,
+                )
+                event.summary?.takeIf { it.isNotBlank() }?.let {
+                    Text(
+                        text = it,
+                        style = MaterialTheme.typography.bodyMedium,
+                        color = MaterialTheme.colorScheme.onSurfaceVariant,
+                    )
+                }
+                event.series?.let { series ->
+                    Text(
+                        text = stringResource(R.string.events_part_of, series.name),
+                        style = MaterialTheme.typography.bodyMedium,
+                        color = MaterialTheme.colorScheme.primary,
+                        modifier = Modifier.clickable { onOpenSeries(series.slug) },
+                    )
+                }
+            }
+        }
+
+        // The one fact a visitor came for, above the storyline rather than below
+        // it: whether it is happening now, and if not, when it next is.
+        item(key = "headline") { Headline(event) }
+
+        event.body?.takeIf { it.isNotBlank() }?.let { body ->
+            item(key = "body") {
+                ShardCard(Modifier.fillMaxWidth()) {
+                    // Sanitized on write, the treatment a wiki page and a forum
+                    // post already get.
+                    HtmlText(body, Modifier.padding(16.dp))
+                }
+            }
+        }
+
+        event.results?.let { results ->
+            item(key = "results-head") {
+                Column(verticalArrangement = Arrangement.spacedBy(2.dp)) {
+                    Text(
+                        text = stringResource(R.string.events_results),
+                        style = MaterialTheme.typography.titleMedium,
+                        color = MaterialTheme.colorScheme.onSurface,
+                    )
+                    Text(
+                        text = eventDateTime(results.scheduledFor, event.timezone),
+                        style = MaterialTheme.typography.bodySmall,
+                        color = MaterialTheme.colorScheme.onSurfaceVariant,
+                    )
+                }
+            }
+            if (results.participants.isEmpty()) {
+                item(key = "results-empty") {
+                    Text(
+                        text = stringResource(R.string.events_results_nobody),
+                        style = MaterialTheme.typography.bodyMedium,
+                        color = MaterialTheme.colorScheme.onSurfaceVariant,
+                    )
+                }
+            } else {
+                items(results.participants.size, key = { "p$it" }) { index ->
+                    ParticipantRow(results.participants[index])
+                }
+            }
+        }
+
+        occurrenceSection(
+            key = "upcoming",
+            titleRes = R.string.events_coming_up,
+            list = event.upcoming,
+            timezone = event.timezone,
+            slug = event.slug,
+            onOpenRun = onOpenRun,
+            linkResults = false,
+        )
+        occurrenceSection(
+            key = "past",
+            titleRes = R.string.events_previously,
+            list = event.past,
+            timezone = event.timezone,
+            slug = event.slug,
+            onOpenRun = onOpenRun,
+            linkResults = true,
+        )
+
+        if (event.current == null && event.next == null && event.past.isEmpty()) {
+            item(key = "unscheduled") {
+                Text(
+                    text = stringResource(R.string.events_never_scheduled),
+                    style = MaterialTheme.typography.bodyMedium,
+                    color = MaterialTheme.colorScheme.onSurfaceVariant,
+                )
+            }
+        }
+    }
+}
+
+@Composable
+private fun Headline(event: PublicEventDto) {
+    ShardCard(Modifier.fillMaxWidth()) {
+        Column(Modifier.padding(16.dp), verticalArrangement = Arrangement.spacedBy(6.dp)) {
+            val current = event.current
+            when {
+                event.live && current != null -> {
+                    StatusPill(
+                        text = stringResource(R.string.events_status_live),
+                        tone = PillTone.Success,
+                    )
+                    Text(
+                        // The phase LABEL, and only while it is live.
+                        text = current.phase?.takeIf { it.isNotBlank() }
+                            ?: stringResource(R.string.events_under_way),
+                        style = MaterialTheme.typography.titleMedium,
+                        color = MaterialTheme.colorScheme.onSurface,
+                    )
+                }
+                event.next != null -> {
+                    Text(
+                        text = stringResource(R.string.events_next),
+                        style = MaterialTheme.typography.labelMedium,
+                        color = MaterialTheme.colorScheme.onSurfaceVariant,
+                    )
+                    Text(
+                        text = eventDateTime(event.next.scheduledFor, event.next.timezone ?: event.timezone),
+                        style = MaterialTheme.typography.titleMedium,
+                        color = MaterialTheme.colorScheme.onSurface,
+                    )
+                }
+                else -> Text(
+                    text = stringResource(R.string.events_nothing_scheduled),
+                    style = MaterialTheme.typography.bodyMedium,
+                    color = MaterialTheme.colorScheme.onSurfaceVariant,
+                )
+            }
+        }
+    }
+}
+
+/**
+ * A titled list of occurrences, or nothing at all when there are none.
+ *
+ * `linkResults` is what separates the two calls: only a PAST occurrence that
+ * actually published results gets its own tap target, because on any other one
+ * `?run=` would change nothing a reader could see.
+ */
+private fun androidx.compose.foundation.lazy.LazyListScope.occurrenceSection(
+    key: String,
+    titleRes: Int,
+    list: List<EventOccurrenceDto>,
+    timezone: String?,
+    slug: String,
+    onOpenRun: (String, Long) -> Unit,
+    linkResults: Boolean,
+) {
+    if (list.isEmpty()) return
+    item(key = "$key-title") {
+        Text(
+            text = stringResource(titleRes),
+            style = MaterialTheme.typography.titleMedium,
+            color = MaterialTheme.colorScheme.onSurface,
+        )
+    }
+    items(list.size, key = { "$key-${list[it].runId}" }) { index ->
+        val occurrence = list[index]
+        val tappable = linkResults && occurrence.resultsPublishedAt != null
+        ShardCard(
+            modifier = Modifier
+                .fillMaxWidth()
+                .then(
+                    if (tappable) Modifier.clickable { onOpenRun(slug, occurrence.runId) }
+                    else Modifier,
+                ),
+        ) {
+            Row(
+                Modifier.fillMaxWidth().padding(16.dp),
+                horizontalArrangement = Arrangement.spacedBy(12.dp),
+                verticalAlignment = Alignment.CenterVertically,
+            ) {
+                Text(
+                    text = eventDateTime(occurrence.scheduledFor, occurrence.timezone ?: timezone),
+                    style = MaterialTheme.typography.bodyMedium,
+                    color = MaterialTheme.colorScheme.onSurface,
+                    modifier = Modifier.weight(1f),
+                )
+                Text(
+                    text = stringResource(
+                        statusWordRes(occurrence.status, occurrence.scheduledFor),
+                    ),
+                    style = MaterialTheme.typography.bodySmall,
+                    color = MaterialTheme.colorScheme.onSurfaceVariant,
+                )
+            }
+        }
+    }
+}
+
+@Composable
+private fun ParticipantRow(participant: EventParticipantDto) {
+    Row(
+        Modifier.fillMaxWidth(),
+        horizontalArrangement = Arrangement.spacedBy(12.dp),
+        verticalAlignment = Alignment.CenterVertically,
+    ) {
+        Text(
+            text = participant.rank?.toString() ?: "—",
+            style = MaterialTheme.typography.bodyMedium,
+            color = MaterialTheme.colorScheme.onSurfaceVariant,
+            textAlign = TextAlign.End,
+            modifier = Modifier.width(32.dp),
+        )
+        Text(
+            // A module supplies a display name in its participation meta or it does
+            // not; the member key is never published, so there is genuinely nothing
+            // else to render.
+            text = participant.name?.takeIf { it.isNotBlank() }
+                ?: stringResource(R.string.events_participant_unnamed),
+            style = MaterialTheme.typography.bodyMedium,
+            color = MaterialTheme.colorScheme.onSurface,
+            modifier = Modifier.weight(1f),
+        )
+        Text(
+            text = scoreText(participant.score),
+            style = MaterialTheme.typography.bodyMedium,
+            color = MaterialTheme.colorScheme.onSurface,
+        )
+    }
+}

app/src/main/java/com/runicgateway/app/ui/events/EventSeriesScreen.kt

@@ -0,0 +1,113 @@
+/*
+ * SPDX-License-Identifier: GPL-3.0-or-later
+ */
+package com.runicgateway.app.ui.events
+
+import androidx.compose.foundation.clickable
+import androidx.compose.foundation.layout.Arrangement
+import androidx.compose.foundation.layout.Column
+import androidx.compose.foundation.layout.PaddingValues
+import androidx.compose.foundation.layout.Row
+import androidx.compose.foundation.layout.fillMaxSize
+import androidx.compose.foundation.layout.fillMaxWidth
+import androidx.compose.foundation.layout.padding
+import androidx.compose.foundation.layout.width
+import androidx.compose.foundation.lazy.LazyColumn
+import androidx.compose.material3.MaterialTheme
+import androidx.compose.material3.Text
+import androidx.compose.runtime.Composable
+import androidx.compose.runtime.getValue
+import androidx.compose.ui.Modifier
+import androidx.compose.ui.text.style.TextAlign
+import androidx.compose.ui.unit.dp
+import androidx.hilt.navigation.compose.hiltViewModel
+import androidx.lifecycle.compose.collectAsStateWithLifecycle
+import com.runicgateway.app.ui.UiState
+import com.runicgateway.app.ui.components.ErrorView
+import com.runicgateway.app.ui.components.LoadingView
+import com.runicgateway.app.ui.components.ShardCard
+
+/**
+ * One arc (EVENTS.md §I, M13).
+ *
+ * **The arc is the thing the tooling this replaces could not express at all.** A
+ * calendar plugin has no series field, so "Royal Spy Mission → Risky Partner →
+ * Message From the Void" existed only in a GM's head and in whatever the forum
+ * post said. This screen is that continuity, in the order an editor arranged it —
+ * which is why the events are numbered rather than dated: an arc has an order, and
+ * its parts may be months apart or run out of sequence.
+ */
+@Composable
+fun EventSeriesScreen(
+    onOpenEvent: (String) -> Unit,
+    modifier: Modifier = Modifier,
+    viewModel: EventSeriesViewModel = hiltViewModel(),
+) {
+    val state by viewModel.state.collectAsStateWithLifecycle()
+
+    // Error first, then loading — the order Phase 13 had to fix one tier along.
+    when (val s = state) {
+        is UiState.Error -> ErrorView(s.kind, onRetry = viewModel::load, modifier = modifier)
+        is UiState.Loading -> LoadingView(modifier)
+        is UiState.Success -> {
+            val series = s.data
+            LazyColumn(
+                modifier = modifier.fillMaxSize(),
+                contentPadding = PaddingValues(16.dp),
+                verticalArrangement = Arrangement.spacedBy(12.dp),
+            ) {
+                item(key = "head") {
+                    Column(verticalArrangement = Arrangement.spacedBy(6.dp)) {
+                        Text(
+                            text = series.name,
+                            style = MaterialTheme.typography.headlineSmall,
+                            color = MaterialTheme.colorScheme.onSurface,
+                        )
+                        series.description?.takeIf { it.isNotBlank() }?.let {
+                            Text(
+                                text = it,
+                                style = MaterialTheme.typography.bodyMedium,
+                                color = MaterialTheme.colorScheme.onSurfaceVariant,
+                            )
+                        }
+                    }
+                }
+                items(series.events.size, key = { series.events[it].slug }) { index ->
+                    val entry = series.events[index]
+                    ShardCard(
+                        modifier = Modifier
+                            .fillMaxWidth()
+                            .clickable { onOpenEvent(entry.slug) },
+                    ) {
+                        Row(
+                            Modifier.fillMaxWidth().padding(16.dp),
+                            horizontalArrangement = Arrangement.spacedBy(14.dp),
+                        ) {
+                            Text(
+                                text = (index + 1).toString(),
+                                style = MaterialTheme.typography.headlineSmall,
+                                color = MaterialTheme.colorScheme.primary,
+                                textAlign = TextAlign.End,
+                                modifier = Modifier.width(32.dp),
+                            )
+                            Column(verticalArrangement = Arrangement.spacedBy(4.dp)) {
+                                Text(
+                                    text = entry.title,
+                                    style = MaterialTheme.typography.titleMedium,
+                                    color = MaterialTheme.colorScheme.onSurface,
+                                )
+                                entry.summary?.takeIf { it.isNotBlank() }?.let {
+                                    Text(
+                                        text = it,
+                                        style = MaterialTheme.typography.bodyMedium,
+                                        color = MaterialTheme.colorScheme.onSurfaceVariant,
+                                    )
+                                }
+                            }
+                        }
+                    }
+                }
+            }
+        }
+    }
+}

app/src/main/java/com/runicgateway/app/ui/events/EventSeriesViewModel.kt

@@ -0,0 +1,50 @@
+/*
+ * SPDX-License-Identifier: GPL-3.0-or-later
+ */
+package com.runicgateway.app.ui.events
+
+import androidx.lifecycle.SavedStateHandle
+import androidx.lifecycle.ViewModel
+import androidx.lifecycle.viewModelScope
+import com.runicgateway.app.data.api.dto.EventSeriesDto
+import com.runicgateway.app.data.repository.EventsRepository
+import com.runicgateway.app.ui.UiState
+import com.runicgateway.app.ui.navigation.Routes
+import com.runicgateway.app.ui.toUiState
+import dagger.hilt.android.lifecycle.HiltViewModel
+import kotlinx.coroutines.flow.MutableStateFlow
+import kotlinx.coroutines.flow.StateFlow
+import kotlinx.coroutines.flow.asStateFlow
+import kotlinx.coroutines.launch
+import javax.inject.Inject
+
+/**
+ * One arc (PLAN.md §9 M13).
+ *
+ * A series with nothing listed in it answers 404 rather than an empty page, so
+ * there is no "empty arc" state to render: the error branch is the whole of it,
+ * and that is the server's decision rather than this screen's — an empty page
+ * would publish that an operator has named something they have not announced.
+ */
+@HiltViewModel
+class EventSeriesViewModel @Inject constructor(
+    private val repository: EventsRepository,
+    savedStateHandle: SavedStateHandle,
+) : ViewModel() {
+
+    private val slug: String = savedStateHandle.get<String>(Routes.Args.SLUG).orEmpty()
+
+    private val _state = MutableStateFlow<UiState<EventSeriesDto>>(UiState.Loading)
+    val state: StateFlow<UiState<EventSeriesDto>> = _state.asStateFlow()
+
+    init {
+        load()
+    }
+
+    fun load() {
+        _state.value = UiState.Loading
+        viewModelScope.launch {
+            _state.value = repository.series(slug).toUiState()
+        }
+    }
+}

app/src/main/java/com/runicgateway/app/ui/events/EventTimes.kt

@@ -0,0 +1,166 @@
+/*
+ * SPDX-License-Identifier: GPL-3.0-or-later
+ */
+package com.runicgateway.app.ui.events
+
+import androidx.annotation.StringRes
+import com.runicgateway.app.R
+import com.runicgateway.app.core.time.parseWireInstant
+import java.time.Instant
+import java.time.ZoneId
+import java.time.format.DateTimeFormatter
+import java.time.format.FormatStyle
+import java.util.Locale
+
+/**
+ * Rendering an event's instant and its status word (EVENTS.md §I).
+ *
+ * Everything here is pure and takes its clock, zone and locale as parameters, so
+ * the rules below are unit-tested off-device rather than eyeballed on one.
+ *
+ * ## The split, which is the one thing about event times that is easy to get wrong
+ *
+ * The server returns UTC instants and never guesses the reader's zone. The client
+ * places them, and it places the two halves differently:
+ *
+ *  - the **day** an entry is filed under is the READER's own — "what is on this
+ *    month" is a question about the month the person holding the phone is living
+ *    in;
+ *  - the **time** beside it is always the EVENT's zone, carried on the entry —
+ *    because every listing this feature replaces is written in the shard's local
+ *    zone, and "8pm" means the shard's evening to everyone reading it.
+ *
+ * Rendering the time in the reader's zone instead is defensible and wrong here: a
+ * player in Berlin told an American shard's event is at 02:00 has been told
+ * something true and useless, and told it in a way that makes the shard's own
+ * announcement look like a mistake.
+ */
+
+/**
+ * A participation score, as a reader should see it.
+ *
+ * Scores are `DECIMAL(18,4)` on the wire because a module may score by distance,
+ * time or a weighted tally — but most score by counting, and rendering a plain
+ * tally of kills as `12.0` reads as a rounding artefact. So a whole number prints
+ * whole and a fraction keeps its digits, with trailing zeros trimmed: `1420`,
+ * `318.5`, `0.25`.
+ */
+fun scoreText(score: Double, locale: Locale = Locale.getDefault()): String {
+    if (!score.isFinite()) return "0"
+    if (score == Math.floor(score) && Math.abs(score) < 1e15) {
+        return String.format(locale, "%d", score.toLong())
+    }
+    return String.format(locale, "%.4f", score).trimEnd('0').trimEnd('.', ',')
+}
+
+/** The event's own wall clock, with the zone named so it misreads as nothing. */
+fun eventTime(
+    instant: String?,
+    timezone: String?,
+    locale: Locale = Locale.getDefault(),
+): String {
+    val at = parseWireInstant(instant) ?: return ""
+    val zone = eventZone(timezone)
+    val time = DateTimeFormatter.ofPattern("HH:mm", locale).withZone(zone).format(at)
+    return "$time ${shortZone(timezone)}"
+}
+
+/**
+ * The event's own day and time together, for a screen showing one occurrence.
+ *
+ * Localized rather than patterned, because a full date's field order is the
+ * locale's business; only the zone stays the event's.
+ */
+fun eventDateTime(
+    instant: String?,
+    timezone: String?,
+    locale: Locale = Locale.getDefault(),
+): String {
+    val at = parseWireInstant(instant) ?: return ""
+    val zone = eventZone(timezone)
+    val text = DateTimeFormatter
+        .ofLocalizedDateTime(FormatStyle.MEDIUM, FormatStyle.SHORT)
+        .withLocale(locale)
+        .withZone(zone)
+        .format(at)
+    return "$text ${shortZone(timezone)}"
+}
+
+/** The reader's own day, for the heading an entry is filed under. */
+fun readerDayLabel(
+    instant: String?,
+    zone: ZoneId = ZoneId.systemDefault(),
+    locale: Locale = Locale.getDefault(),
+): String {
+    val at = parseWireInstant(instant) ?: return ""
+    return DateTimeFormatter
+        .ofLocalizedDate(FormatStyle.FULL)
+        .withLocale(locale)
+        .withZone(zone)
+        .format(at)
+}
+
+/**
+ * The zone as a reader recognises it: `America/New_York` → `New York`.
+ *
+ * Not the abbreviation (`EDT`), which is unstable across the year and unknown to
+ * most readers of a shard in another country.
+ */
+fun shortZone(timezone: String?): String {
+    if (timezone.isNullOrBlank()) return "UTC"
+    return timezone.substringAfterLast('/').replace('_', ' ')
+}
+
+/**
+ * The event's zone, or UTC when its column holds something `java.time` will not
+ * read.
+ *
+ * A typo in a definition's timezone must still render: UTC off the instant is the
+ * honest answer when the zone cannot be honoured, and it is what the web client
+ * falls back to for the same reason.
+ */
+private fun eventZone(timezone: String?): ZoneId = try {
+    if (timezone.isNullOrBlank()) ZoneId.of("UTC") else ZoneId.of(timezone)
+} catch (_: Exception) {
+    ZoneId.of("UTC")
+}
+
+/**
+ * The word beside an occurrence, for the four statuses the server publishes.
+ *
+ * **`cancelled` needs the instant, and that is the whole reason this takes one.**
+ * The server publishes `failed` and `missed` as `cancelled` too — to a visitor the
+ * three are one event, and the difference between them is about the deployment —
+ * but the three do not share one English sentence. *Did not happen* is right for a
+ * past occurrence and a plain falsehood for a future one, and a run four days out
+ * that an operator has called off is exactly the common case: this is the defect
+ * Phase 14a's own calendar shipped and the live walk caught, which is why it is
+ * restated here rather than ported.
+ *
+ * So **the tense follows the clock, not the status**. A future call-off reads
+ * *Cancelled*; a past one reads *Did not happen*, which is also the honest word
+ * for the failed and missed runs folded in with it.
+ *
+ * An unrecognised status reads *Scheduled*, mirroring the server's own fallback:
+ * `publicStatus()` folds anything it does not know to `scheduled`, so a word the
+ * app has never seen is a contract break rather than a state, and rendering a raw
+ * enum at a reader is not an improvement on it.
+ */
+@StringRes
+fun statusWordRes(status: String?, scheduledFor: String?, now: Instant = Instant.now()): Int =
+    when (status) {
+        "live" -> R.string.events_status_live
+        "completed" -> R.string.events_status_completed
+        "cancelled" -> {
+            val at = parseWireInstant(scheduledFor)
+            // An unreadable instant is treated as past, which is the safer of the
+            // two: "did not happen" about something unplaceable in time is vague,
+            // while "cancelled" about a past run implies it is still coming.
+            if (at != null && at.isAfter(now)) {
+                R.string.events_status_cancelled
+            } else {
+                R.string.events_status_did_not_happen
+            }
+        }
+        else -> R.string.events_status_scheduled
+    }

app/src/main/java/com/runicgateway/app/ui/events/EventViewModel.kt

@@ -0,0 +1,59 @@
+/*
+ * SPDX-License-Identifier: GPL-3.0-or-later
+ */
+package com.runicgateway.app.ui.events
+
+import androidx.lifecycle.SavedStateHandle
+import androidx.lifecycle.ViewModel
+import androidx.lifecycle.viewModelScope
+import com.runicgateway.app.data.api.dto.PublicEventDto
+import com.runicgateway.app.data.repository.EventsRepository
+import com.runicgateway.app.ui.UiState
+import com.runicgateway.app.ui.navigation.Routes
+import com.runicgateway.app.ui.toUiState
+import dagger.hilt.android.lifecycle.HiltViewModel
+import kotlinx.coroutines.flow.MutableStateFlow
+import kotlinx.coroutines.flow.StateFlow
+import kotlinx.coroutines.flow.asStateFlow
+import kotlinx.coroutines.launch
+import javax.inject.Inject
+
+/**
+ * One event's page (PLAN.md §9 M13, EVENTS.md § API surface).
+ *
+ * **`run` is read from the route and passed through untouched**, because that is
+ * what an announcement's link carries. The page lives at the definition's slug —
+ * one stable address, so a link posted in Discord survives a retitle — and the
+ * occurrence has to be in the query or a mail about last Friday's invasion would
+ * open next Friday's.
+ *
+ * A run that belongs to some other event is **not** filtered here. The server
+ * ignores it and answers with this event anyway, which turns a stale link in a
+ * months-old mail into the page it was about rather than a dead end; second-
+ * guessing that would undo it.
+ */
+@HiltViewModel
+class EventViewModel @Inject constructor(
+    private val repository: EventsRepository,
+    savedStateHandle: SavedStateHandle,
+) : ViewModel() {
+
+    private val slug: String = savedStateHandle.get<String>(Routes.Args.SLUG).orEmpty()
+
+    /** Null unless the route carried one; never an empty string forwarded to the server. */
+    private val run: String? = savedStateHandle.get<String>(Routes.Args.RUN)?.takeIf { it.isNotBlank() }
+
+    private val _state = MutableStateFlow<UiState<PublicEventDto>>(UiState.Loading)
+    val state: StateFlow<UiState<PublicEventDto>> = _state.asStateFlow()
+
+    init {
+        load()
+    }
+
+    fun load() {
+        _state.value = UiState.Loading
+        viewModelScope.launch {
+            _state.value = repository.event(slug, run).toUiState()
+        }
+    }
+}

app/src/main/java/com/runicgateway/app/ui/events/EventsScreen.kt

@@ -0,0 +1,191 @@
+/*
+ * SPDX-License-Identifier: GPL-3.0-or-later
+ */
+package com.runicgateway.app.ui.events
+
+import androidx.compose.foundation.clickable
+import androidx.compose.foundation.layout.Arrangement
+import androidx.compose.foundation.layout.Column
+import androidx.compose.foundation.layout.Row
+import androidx.compose.foundation.layout.fillMaxSize
+import androidx.compose.foundation.layout.fillMaxWidth
+import androidx.compose.foundation.layout.padding
+import androidx.compose.foundation.lazy.LazyColumn
+import androidx.compose.foundation.lazy.items
+import androidx.compose.material3.MaterialTheme
+import androidx.compose.material3.Text
+import androidx.compose.runtime.Composable
+import androidx.compose.runtime.getValue
+import androidx.compose.ui.Alignment
+import androidx.compose.ui.Modifier
+import androidx.compose.ui.res.stringResource
+import androidx.compose.ui.text.font.FontStyle
+import androidx.compose.ui.unit.dp
+import androidx.hilt.navigation.compose.hiltViewModel
+import androidx.lifecycle.compose.collectAsStateWithLifecycle
+import com.runicgateway.app.R
+import com.runicgateway.app.data.api.dto.EventCalendarEntryDto
+import com.runicgateway.app.ui.UiState
+import com.runicgateway.app.ui.components.EmptyView
+import com.runicgateway.app.ui.components.ErrorView
+import com.runicgateway.app.ui.components.LoadingView
+import com.runicgateway.app.ui.components.PillTone
+import com.runicgateway.app.ui.components.ShardCard
+import com.runicgateway.app.ui.components.StatusPill
+
+/**
+ * The public event calendar (EVENTS.md §I, M13).
+ *
+ * **A list, not a month grid**, which is the same call the web client makes and
+ * for the same reason: an operator's question is "what does this month look
+ * like" — coverage, clashes, the gap on the third weekend — and a grid answers
+ * it. A visitor's question is "what is on, and when is the next one", which a
+ * chronological list answers in one glance and a grid answers by making them
+ * count squares. On a phone the grid is not even a close second.
+ *
+ * **A projection is drawn differently from a run**, one tier along from the
+ * operator's own reason for the distinction: past the materialisation horizon
+ * there is no row, nothing is committed to, and nothing can be cancelled. Drawing
+ * a forecast identically to a booking would be the screen promising something the
+ * server has not.
+ */
+@Composable
+fun EventsScreen(
+    onOpenEvent: (String) -> Unit,
+    modifier: Modifier = Modifier,
+    viewModel: EventsViewModel = hiltViewModel(),
+) {
+    val state by viewModel.state.collectAsStateWithLifecycle()
+
+    when (val s = state) {
+        is UiState.Loading -> LoadingView(modifier)
+        is UiState.Error -> ErrorView(s.kind, onRetry = viewModel::load, modifier = modifier)
+        is UiState.Success -> {
+            val entries = s.data.entries
+            if (entries.isEmpty()) {
+                EmptyView(stringResource(R.string.events_empty), modifier)
+            } else {
+                Calendar(entries, s.data.truncated, onOpenEvent, modifier)
+            }
+        }
+    }
+}
+
+/**
+ * Group by the READER's day, preserving the server's order rather than re-sorting.
+ *
+ * Internal + pure so the grouping — and the fact that it never reorders — is
+ * unit-tested without Compose.
+ */
+internal fun groupByReaderDay(entries: List<EventCalendarEntryDto>): List<CalendarDayGroup> {
+    val days = mutableListOf<CalendarDayGroup>()
+    for (entry in entries) {
+        val label = readerDayLabel(entry.scheduledFor)
+        val last = days.lastOrNull()
+        if (last != null && last.label == label) {
+            last.entries.add(entry)
+        } else {
+            days.add(CalendarDayGroup(label, mutableListOf(entry)))
+        }
+    }
+    return days
+}
+
+/** A mutable builder shape for [groupByReaderDay]; the screen only reads it. */
+internal data class CalendarDayGroup(
+    val label: String,
+    val entries: MutableList<EventCalendarEntryDto>,
+)
+
+@Composable
+private fun Calendar(
+    entries: List<EventCalendarEntryDto>,
+    truncated: Boolean,
+    onOpenEvent: (String) -> Unit,
+    modifier: Modifier = Modifier,
+) {
+    val days = groupByReaderDay(entries)
+    LazyColumn(
+        modifier = modifier.fillMaxSize(),
+        contentPadding = androidx.compose.foundation.layout.PaddingValues(16.dp),
+        verticalArrangement = Arrangement.spacedBy(16.dp),
+    ) {
+        days.forEach { day ->
+            item(key = "day-${day.label}") {
+                Text(
+                    text = day.label,
+                    style = MaterialTheme.typography.labelLarge,
+                    color = MaterialTheme.colorScheme.onSurfaceVariant,
+                )
+            }
+            items(
+                items = day.entries,
+                key = { "${it.slug}-${it.scheduledFor}-${it.kind}" },
+            ) { entry ->
+                EntryCard(entry, onOpenEvent)
+            }
+        }
+        if (truncated) {
+            item(key = "truncated") {
+                Text(
+                    text = stringResource(R.string.events_truncated),
+                    style = MaterialTheme.typography.bodySmall,
+                    color = MaterialTheme.colorScheme.onSurfaceVariant,
+                )
+            }
+        }
+    }
+}
+
+@Composable
+private fun EntryCard(entry: EventCalendarEntryDto, onOpenEvent: (String) -> Unit) {
+    ShardCard(
+        modifier = Modifier
+            .fillMaxWidth()
+            // A projection has a page too — the definition's — so it opens like any
+            // other entry. What it does not have is an occurrence to link to.
+            .clickable { onOpenEvent(entry.slug) },
+    ) {
+        Column(Modifier.padding(16.dp), verticalArrangement = Arrangement.spacedBy(6.dp)) {
+            Row(
+                Modifier.fillMaxWidth(),
+                horizontalArrangement = Arrangement.spacedBy(12.dp),
+                verticalAlignment = Alignment.CenterVertically,
+            ) {
+                Text(
+                    text = entry.title,
+                    style = MaterialTheme.typography.titleMedium,
+                    color = MaterialTheme.colorScheme.onSurface,
+                    modifier = Modifier.weight(1f),
+                )
+                StatusPill(
+                    text = stringResource(statusWordRes(entry.status, entry.scheduledFor)),
+                    tone = if (entry.live) PillTone.Success else PillTone.Neutral,
+                )
+            }
+            Text(
+                text = eventTime(entry.scheduledFor, entry.timezone),
+                style = MaterialTheme.typography.bodyMedium,
+                color = MaterialTheme.colorScheme.onSurfaceVariant,
+            )
+            entry.seriesName?.takeIf { it.isNotBlank() }?.let { series ->
+                Text(
+                    text = series,
+                    style = MaterialTheme.typography.bodySmall,
+                    color = MaterialTheme.colorScheme.onSurfaceVariant,
+                )
+            }
+            if (entry.isProjected) {
+                // Said in words rather than drawn as a dashed border, because a
+                // phone reader skimming a list will not decode a border and the
+                // distinction is worth more than the pixel it would cost.
+                Text(
+                    text = stringResource(R.string.events_projected),
+                    style = MaterialTheme.typography.bodySmall,
+                    fontStyle = FontStyle.Italic,
+                    color = MaterialTheme.colorScheme.onSurfaceVariant,
+                )
+            }
+        }
+    }
+}

app/src/main/java/com/runicgateway/app/ui/events/EventsViewModel.kt

@@ -0,0 +1,51 @@
+/*
+ * SPDX-License-Identifier: GPL-3.0-or-later
+ */
+package com.runicgateway.app.ui.events
+
+import androidx.lifecycle.ViewModel
+import androidx.lifecycle.viewModelScope
+import com.runicgateway.app.data.api.dto.EventCalendarDto
+import com.runicgateway.app.data.repository.EventsRepository
+import com.runicgateway.app.ui.UiState
+import com.runicgateway.app.ui.toUiState
+import dagger.hilt.android.lifecycle.HiltViewModel
+import kotlinx.coroutines.flow.MutableStateFlow
+import kotlinx.coroutines.flow.StateFlow
+import kotlinx.coroutines.flow.asStateFlow
+import kotlinx.coroutines.launch
+import javax.inject.Inject
+
+/**
+ * The public event calendar (PLAN.md §9 M13, EVENTS.md §I).
+ *
+ * **No window is asked for**, and that is the whole of this view model's design.
+ * The server's default is now through 31 days out, so a client that computed a
+ * window before it could ask anything would make every deep link carry two ISO
+ * instants and would have to agree with the server about what "now" is. The
+ * window bound and the entry cap are the server's defence on the one surface with
+ * no login in front of it; there is nothing for the app to add.
+ *
+ * `toUiState`, not `toShardUiState`: these are CORE routes. A 404 here means the
+ * backend has no events at all, not that an admin switched a shard surface off,
+ * and offering "not published here" for it would name the wrong cause.
+ */
+@HiltViewModel
+class EventsViewModel @Inject constructor(
+    private val repository: EventsRepository,
+) : ViewModel() {
+
+    private val _state = MutableStateFlow<UiState<EventCalendarDto>>(UiState.Loading)
+    val state: StateFlow<UiState<EventCalendarDto>> = _state.asStateFlow()
+
+    init {
+        load()
+    }
+
+    fun load() {
+        _state.value = UiState.Loading
+        viewModelScope.launch {
+            _state.value = repository.calendar().toUiState()
+        }
+    }
+}

app/src/main/java/com/runicgateway/app/ui/events/MyEventsScreen.kt

@@ -0,0 +1,142 @@
+/*
+ * SPDX-License-Identifier: GPL-3.0-or-later
+ */
+package com.runicgateway.app.ui.events
+
+import androidx.compose.foundation.clickable
+import androidx.compose.foundation.layout.Arrangement
+import androidx.compose.foundation.layout.Column
+import androidx.compose.foundation.layout.PaddingValues
+import androidx.compose.foundation.layout.Row
+import androidx.compose.foundation.layout.fillMaxSize
+import androidx.compose.foundation.layout.fillMaxWidth
+import androidx.compose.foundation.layout.padding
+import androidx.compose.material3.MaterialTheme
+import androidx.compose.material3.Text
+import androidx.compose.material3.TextButton
+import androidx.compose.runtime.Composable
+import androidx.compose.runtime.getValue
+import androidx.compose.ui.Alignment
+import androidx.compose.ui.Modifier
+import androidx.compose.ui.res.stringResource
+import androidx.compose.ui.text.style.TextAlign
+import androidx.compose.ui.unit.dp
+import androidx.hilt.navigation.compose.hiltViewModel
+import androidx.lifecycle.compose.collectAsStateWithLifecycle
+import com.runicgateway.app.R
+import com.runicgateway.app.data.api.dto.EventHistoryEntryDto
+import com.runicgateway.app.ui.UiState
+import com.runicgateway.app.ui.components.EmptyView
+import com.runicgateway.app.ui.components.ErrorView
+import com.runicgateway.app.ui.components.LoadingView
+import com.runicgateway.app.ui.components.ShardCard
+
+/**
+ * This account's event participation (EVENTS.md §J, M13).
+ *
+ * **The screen's one real design decision is what an unranked row says.** A run
+ * whose participants were collected but whose results have not been published has
+ * a score and no rank, and that is a real state rather than an error — it is the
+ * same state the admin run console has shown since events Phase 10. Rendering a
+ * dash with nothing explaining it would read as a bug; the row says the results
+ * are not published, which is a fact about the event rather than about the reader.
+ *
+ * Reached by **one drawer row for every signed-in account**, players and staff
+ * alike. The website mounts this twice only because its `RequirePlayer` guard sits
+ * over `/account` and the route behind it is role-agnostic; the app has no such
+ * wall, so it needs no second mount.
+ */
+@Composable
+fun MyEventsScreen(
+    onOpenRun: (String, Long) -> Unit,
+    modifier: Modifier = Modifier,
+    viewModel: MyEventsViewModel = hiltViewModel(),
+) {
+    val state by viewModel.state.collectAsStateWithLifecycle()
+
+    when (val items = state.items) {
+        is UiState.Loading -> LoadingView(modifier)
+        is UiState.Error -> ErrorView(items.kind, onRetry = viewModel::load, modifier = modifier)
+        is UiState.Success -> if (items.data.isEmpty()) {
+            EmptyView(stringResource(R.string.events_history_empty), modifier)
+        } else {
+            androidx.compose.foundation.lazy.LazyColumn(
+                modifier = modifier.fillMaxSize(),
+                contentPadding = PaddingValues(16.dp),
+                verticalArrangement = Arrangement.spacedBy(12.dp),
+            ) {
+                items(items.data.size, key = { items.data[it].id }) { index ->
+                    HistoryRow(items.data[index], onOpenRun)
+                }
+                if (state.hasMore) {
+                    item(key = "more") {
+                        TextButton(
+                            onClick = viewModel::loadMore,
+                            enabled = !state.loadingMore,
+                            modifier = Modifier.fillMaxWidth(),
+                        ) {
+                            Text(
+                                stringResource(
+                                    if (state.loadingMore) R.string.events_loading
+                                    else R.string.events_show_more,
+                                ),
+                            )
+                        }
+                    }
+                }
+            }
+        }
+    }
+}
+
+@Composable
+private fun HistoryRow(entry: EventHistoryEntryDto, onOpenRun: (String, Long) -> Unit) {
+    ShardCard(
+        modifier = Modifier
+            .fillMaxWidth()
+            // Straight to the occurrence the reader took part in, not to whatever
+            // is next: `?run=` is what makes the event page answer about this one.
+            .clickable { onOpenRun(entry.slug, entry.runId) },
+    ) {
+        Row(
+            Modifier.fillMaxWidth().padding(16.dp),
+            horizontalArrangement = Arrangement.spacedBy(12.dp),
+            verticalAlignment = Alignment.CenterVertically,
+        ) {
+            Column(Modifier.weight(1f), verticalArrangement = Arrangement.spacedBy(4.dp)) {
+                Text(
+                    text = entry.title,
+                    style = MaterialTheme.typography.titleMedium,
+                    color = MaterialTheme.colorScheme.onSurface,
+                )
+                Text(
+                    text = eventDateTime(entry.scheduledFor, entry.timezone),
+                    style = MaterialTheme.typography.bodySmall,
+                    color = MaterialTheme.colorScheme.onSurfaceVariant,
+                )
+                entry.seriesName?.takeIf { it.isNotBlank() }?.let {
+                    Text(
+                        text = it,
+                        style = MaterialTheme.typography.bodySmall,
+                        color = MaterialTheme.colorScheme.onSurfaceVariant,
+                    )
+                }
+            }
+            Column(horizontalAlignment = Alignment.End) {
+                Text(
+                    text = entry.rank
+                        ?.let { stringResource(R.string.events_rank, it) }
+                        ?: stringResource(R.string.events_results_unpublished),
+                    style = MaterialTheme.typography.bodyMedium,
+                    color = MaterialTheme.colorScheme.onSurface,
+                    textAlign = TextAlign.End,
+                )
+                Text(
+                    text = stringResource(R.string.events_score, scoreText(entry.score)),
+                    style = MaterialTheme.typography.bodySmall,
+                    color = MaterialTheme.colorScheme.onSurfaceVariant,
+                )
+            }
+        }
+    }
+}

app/src/main/java/com/runicgateway/app/ui/events/MyEventsViewModel.kt

@@ -0,0 +1,117 @@
+/*
+ * SPDX-License-Identifier: GPL-3.0-or-later
+ */
+package com.runicgateway.app.ui.events
+
+import androidx.lifecycle.ViewModel
+import androidx.lifecycle.viewModelScope
+import com.runicgateway.app.core.auth.Session
+import com.runicgateway.app.core.auth.SessionManager
+import com.runicgateway.app.core.result.ApiResult
+import com.runicgateway.app.data.api.dto.EventHistoryEntryDto
+import com.runicgateway.app.data.repository.EventsRepository
+import com.runicgateway.app.ui.UiState
+import com.runicgateway.app.ui.toUiState
+import dagger.hilt.android.lifecycle.HiltViewModel
+import kotlinx.coroutines.flow.MutableStateFlow
+import kotlinx.coroutines.flow.StateFlow
+import kotlinx.coroutines.flow.asStateFlow
+import kotlinx.coroutines.flow.distinctUntilChanged
+import kotlinx.coroutines.flow.map
+import kotlinx.coroutines.launch
+import javax.inject.Inject
+
+/**
+ * This account's event participation (PLAN.md §9 M13, EVENTS.md §J).
+ *
+ * **Self-scoped by the session and nothing else.** There is no id parameter on
+ * the route and deliberately none here: one account never reads another's, and
+ * there is no argument that could later grow into one.
+ *
+ * **Keyset-paged on the participation row's own id, never an offset** — the list
+ * gains a row every time the reader attends something, so an offset page would
+ * skip and repeat rows around the seam.
+ *
+ * ## Why this watches the session, when no other screen here does
+ *
+ * **A drawer route's view model outlives a sign-out.** `navigateTopLevel` saves
+ * and restores back-stack state, so the `NavBackStackEntry` for this route keeps
+ * its `ViewModelStore` across a sign-out and a sign-in as somebody else — and a
+ * view model that loads only in `init` never runs again. The live walk found the
+ * consequence: signing out of an admin account and back in as a player showed the
+ * PLAYER the admin's participation history, with no request made at all.
+ *
+ * The public event screens have the same lifetime and do not care, because a
+ * calendar is the same for everybody. This one is per-account, so the account is
+ * what it keys on: the flow emits the current session immediately, which is also
+ * the first load, and re-emits only when the signed-in id actually changes — a
+ * resume revalidation returning the same user does not refetch.
+ */
+@HiltViewModel
+class MyEventsViewModel @Inject constructor(
+    private val repository: EventsRepository,
+    sessionManager: SessionManager,
+) : ViewModel() {
+
+    data class State(
+        val items: UiState<List<EventHistoryEntryDto>> = UiState.Loading,
+        val hasMore: Boolean = false,
+        val loadingMore: Boolean = false,
+    )
+
+    private val _state = MutableStateFlow(State())
+    val state: StateFlow<State> = _state.asStateFlow()
+
+    init {
+        viewModelScope.launch {
+            sessionManager.state
+                .map { (it as? Session.SignedIn)?.user?.id }
+                .distinctUntilChanged()
+                .collect { userId ->
+                    // Signed out: drop the rows rather than leave the last
+                    // account's on screen behind a shell that is about to
+                    // navigate away.
+                    if (userId == null) _state.value = State(items = UiState.Success(emptyList()))
+                    else load()
+                }
+        }
+    }
+
+    fun load() {
+        _state.value = State()
+        viewModelScope.launch {
+            val result = repository.history(PAGE)
+            _state.value = State(
+                items = result.toUiState(),
+                // A full page means there is probably another; a short one is the
+                // end. One request rather than a count the server does not send.
+                hasMore = (result as? ApiResult.Ok)?.data?.size == PAGE,
+            )
+        }
+    }
+
+    fun loadMore() {
+        val current = _state.value
+        val shown = (current.items as? UiState.Success)?.data ?: return
+        val last = shown.lastOrNull() ?: return
+        if (current.loadingMore || !current.hasMore) return
+
+        _state.value = current.copy(loadingMore = true)
+        viewModelScope.launch {
+            when (val result = repository.history(PAGE, before = last.id)) {
+                is ApiResult.Ok -> _state.value = State(
+                    items = UiState.Success(shown + result.data),
+                    hasMore = result.data.size == PAGE,
+                )
+                // A failed NEXT page keeps the pages already read rather than
+                // replacing a screenful of history with an error: the reader can
+                // still see what loaded, and tapping again retries.
+                else -> _state.value = current.copy(loadingMore = false)
+            }
+        }
+    }
+
+    private companion object {
+        const val PAGE = 25
+    }
+}

app/src/main/java/com/runicgateway/app/ui/home/HomeScreen.kt

@@ -26,6 +26,7 @@ import com.runicgateway.app.R
 import com.runicgateway.app.data.api.dto.BrandDto
 import com.runicgateway.app.data.api.dto.StatusDto
 import com.runicgateway.app.ui.UiState
+import com.runicgateway.app.ui.components.BrandHero
 import com.runicgateway.app.ui.components.ErrorView
 import com.runicgateway.app.ui.components.FeatureCard
 import com.runicgateway.app.ui.components.LoadingView
@@ -59,6 +60,12 @@ private fun HomeContent(brand: BrandDto?, status: StatusDto, modifier: Modifier
             .verticalScroll(rememberScrollState())
             .padding(20.dp),
     ) {
+        // The instance's hero above the title block (§5.6) — Home is the one screen
+        // with a hero-shaped space. Its bottom gap rides on the image's own modifier
+        // rather than a Spacer, so an instance with no hero (or one whose hero fails
+        // to load) opens on the title exactly where it has always been.
+        BrandHero(hero = brand?.hero, modifier = Modifier.padding(bottom = 16.dp))
+
         Text(
             text = brand?.name?.takeIf { it.isNotBlank() } ?: stringResource(R.string.app_name),
             style = MaterialTheme.typography.headlineMedium,

app/src/main/java/com/runicgateway/app/ui/navigation/Menu.kt

@@ -6,9 +6,12 @@ package com.runicgateway.app.ui.navigation
 import androidx.annotation.StringRes
 import com.runicgateway.app.R
 import com.runicgateway.app.core.auth.Session
+import com.runicgateway.app.data.repository.Capability
 import com.runicgateway.app.data.repository.ShardFeature
 import com.runicgateway.app.data.repository.ShardFeatures
+import com.runicgateway.app.data.repository.SiteCapabilities
 import com.runicgateway.app.data.repository.canSee
+import com.runicgateway.app.data.repository.canUse
 
 /**
  * One shared, declarative, access-level navigation definition (PLAN.md §5): a
@@ -52,6 +55,29 @@ data class MenuEntry(
      * isn't shard-derived and only [access] applies.
      */
     val feature: String? = null,
+    /**
+     * The backend capability this row needs, or null when it needs none (M13).
+     *
+     * **A different question from [feature], which is why it is a second field
+     * and not a wider one.** This asks whether the code behind the row is
+     * *installed at all* — a per-HOST fact, from `GET /public/modules` and core's
+     * own list — while [feature] asks whether this shard publishes that surface
+     * to *this viewer*, which is per-viewer and admin-configurable. A site with no
+     * game module has no `shard` capability and no shard rows, whoever is looking;
+     * a site with one may still hide its market from anonymous visitors.
+     *
+     * The two also fail differently, and [canUse] is where that lives.
+     */
+    val capability: String? = null,
+    /**
+     * An admin's own label for this row, from the shard's `nav_public` override
+     * (THEMING_AND_NAV.md §6). Null — always, as coded — means [labelRes] stands.
+     *
+     * A label set this way is **not localized**: it is one string for every locale,
+     * which is what an admin typing a label means, and it matches the website. It
+     * only ever arrives via [applyNavOverrides]; nothing in [APP_MENU] sets it.
+     */
+    val label: String? = null,
 )
 
 /**
@@ -62,21 +88,84 @@ data class MenuEntry(
 val APP_MENU: List<MenuEntry> = listOf(
     MenuEntry(Routes.HOME, R.string.menu_home),
     MenuEntry(Routes.NEWS, R.string.menu_news),
+    // Events are CORE's, so this row is gated on core's own capability rather than
+    // a module's: a site with no game module still has a calendar. Placed here to
+    // match the website's own nav, where Events is the row after News.
+    MenuEntry(Routes.EVENTS, R.string.menu_events, capability = Capability.EVENTS),
     MenuEntry(Routes.WIKI, R.string.menu_wiki),
-    MenuEntry(Routes.SHARD, R.string.menu_shard, feature = ShardFeature.STATUS),
+    // The shard group. Every row needs the game module INSTALLED (one capability,
+    // because that is the only question a capability can answer) and its own
+    // feature published to this viewer (M11) — both, independently.
+    MenuEntry(
+        Routes.SHARD,
+        R.string.menu_shard,
+        feature = ShardFeature.STATUS,
+        capability = Capability.SHARD,
+    ),
     // Protocol 3.0 shard content (M11). Each hides when the shard doesn't publish it,
     // which for a brand-new install is every one of them until the plugin has swept.
-    MenuEntry(Routes.SHARD_RULES, R.string.menu_rules, feature = ShardFeature.RULESET),
-    MenuEntry(Routes.ATLAS, R.string.menu_atlas, feature = ShardFeature.ATLAS),
-    MenuEntry(Routes.SHARD_LEADERBOARDS, R.string.menu_leaderboards, feature = ShardFeature.LEADERBOARDS),
-    MenuEntry(Routes.SHARD_MARKET, R.string.menu_market, feature = ShardFeature.MARKET),
+    MenuEntry(
+        Routes.SHARD_RULES,
+        R.string.menu_rules,
+        feature = ShardFeature.RULESET,
+        capability = Capability.SHARD,
+    ),
+    MenuEntry(
+        Routes.ATLAS,
+        R.string.menu_atlas,
+        feature = ShardFeature.ATLAS,
+        capability = Capability.SHARD,
+    ),
+    MenuEntry(
+        Routes.SHARD_LEADERBOARDS,
+        R.string.menu_leaderboards,
+        feature = ShardFeature.LEADERBOARDS,
+        capability = Capability.SHARD,
+    ),
+    MenuEntry(
+        Routes.SHARD_MARKET,
+        R.string.menu_market,
+        feature = ShardFeature.MARKET,
+        capability = Capability.SHARD,
+    ),
     MenuEntry(Routes.page("about"), R.string.menu_about),
     MenuEntry(Routes.CONTACT, R.string.menu_contact),
     MenuEntry(Routes.ACCOUNT, R.string.menu_account, MenuAccess.SIGNED_IN),
     MenuEntry(Routes.NOTIFICATIONS, R.string.menu_notifications, MenuAccess.SIGNED_IN),
-    MenuEntry(Routes.PLAYER_CHARACTERS, R.string.menu_my_characters, MenuAccess.PLAYER),
-    MenuEntry(Routes.PLAYER_VENDORS, R.string.menu_my_vendors, MenuAccess.PLAYER),
-    MenuEntry(Routes.PLAYER_HOUSES, R.string.menu_my_houses, MenuAccess.PLAYER),
+    // Participation history: SIGNED_IN, not PLAYER. The route is `requireAuth`
+    // alone and self-scoped on the caller's own id, and the website needed two
+    // mounts for it only because `RequirePlayer` guards `/account` there. Staff
+    // attend events too, and event history is not game-linked data.
+    MenuEntry(
+        Routes.MY_EVENTS,
+        R.string.menu_my_events,
+        MenuAccess.SIGNED_IN,
+        capability = Capability.EVENTS,
+    ),
+    // These three read `/player/shard/*`, which is the SAME module's player mount —
+    // so they need the capability for the same reason the public rows do. They
+    // carry no `feature`, because the visibility framework covers the public
+    // surfaces and these are self-service, gated by role and ownership instead.
+    // That asymmetry is exactly why the live walk found them and the suite did
+    // not: "a shard row" had been defined as "a row with a feature".
+    MenuEntry(
+        Routes.PLAYER_CHARACTERS,
+        R.string.menu_my_characters,
+        MenuAccess.PLAYER,
+        capability = Capability.SHARD,
+    ),
+    MenuEntry(
+        Routes.PLAYER_VENDORS,
+        R.string.menu_my_vendors,
+        MenuAccess.PLAYER,
+        capability = Capability.SHARD,
+    ),
+    MenuEntry(
+        Routes.PLAYER_HOUSES,
+        R.string.menu_my_houses,
+        MenuAccess.PLAYER,
+        capability = Capability.SHARD,
+    ),
     // Staff operations (§1, M10) — revealed for staff roles; the backend re-checks every call.
     MenuEntry(Routes.ADMIN_DASHBOARD, R.string.menu_admin_dashboard, MenuAccess.STAFF),
     MenuEntry(Routes.ADMIN_CONTENT, R.string.menu_admin_content, MenuAccess.STAFF),
@@ -85,28 +174,52 @@ val APP_MENU: List<MenuEntry> = listOf(
 )
 
 /**
- * The entries the given [session] may see, given the shard [features] it may reach.
- * Pure + side-effect-free so the gating is unit-tested without Compose.
+ * The entries the given [session] may see, on a backend with these [capabilities]
+ * and this shard's [features]. Pure + side-effect-free so the gating is unit-tested
+ * without Compose.
  *
- * Two independent filters, and both must pass:
+ * Three independent filters, and all three must pass:
  *
  *  - [MenuEntry.access] against the session — who the caller is.
+ *  - [MenuEntry.capability] against what this backend serves — whether the code
+ *    behind the row is installed at all (M13). Per host.
  *  - [MenuEntry.feature] against the shard's live visibility config — what this shard
- *    publishes at all (M11). `null` [features] means the answer isn't known yet and
- *    every shard entry shows; see [canSee] for why that direction is deliberate.
+ *    publishes to this viewer (M11). Per viewer.
+ *
+ * **The last two both fail open on an unknown answer, but "unknown" means
+ * different things to them.** A `null` [features] is unknown; so is a `null`
+ * [capabilities] — but a *non-null* [capabilities] that does not name the string
+ * is an ANSWER, and it hides. Without that, a site with no game module renders
+ * five shard rows that each 404. See [canUse].
  */
 fun visibleEntries(
     entries: List<MenuEntry>,
     session: Session,
     features: ShardFeatures? = null,
-): List<MenuEntry> =
-    entries.filter { entry ->
-        val allowedByRole = when (entry.access) {
-            MenuAccess.PUBLIC -> true
-            MenuAccess.SIGNED_IN -> session is Session.SignedIn
-            MenuAccess.PLAYER -> session is Session.SignedIn && (session.user.isPlayer || session.user.isStaff)
-            MenuAccess.STAFF -> session is Session.SignedIn && session.user.isStaff
-            MenuAccess.MODERATOR -> session is Session.SignedIn && session.user.isModerator
-        }
-        allowedByRole && (entry.feature == null || canSee(features, entry.feature))
+    capabilities: SiteCapabilities? = null,
+): List<MenuEntry> = entries.filter { isEntryVisible(it, session, features, capabilities) }
+
+/**
+ * [visibleEntries] for a single entry — the same three filters, and the same
+ * boundary. Split out because the drawer is a tree once an admin groups rows into
+ * sections (§6.3): [pruneNav] applies this predicate inside a section as well, and
+ * both callers must ask exactly one question or a sectioned row could be gated by
+ * a rule its top-level twin is not.
+ */
+fun isEntryVisible(
+    entry: MenuEntry,
+    session: Session,
+    features: ShardFeatures? = null,
+    capabilities: SiteCapabilities? = null,
+): Boolean {
+    val allowedByRole = when (entry.access) {
+        MenuAccess.PUBLIC -> true
+        MenuAccess.SIGNED_IN -> session is Session.SignedIn
+        MenuAccess.PLAYER -> session is Session.SignedIn && (session.user.isPlayer || session.user.isStaff)
+        MenuAccess.STAFF -> session is Session.SignedIn && session.user.isStaff
+        MenuAccess.MODERATOR -> session is Session.SignedIn && session.user.isModerator
     }
+    return allowedByRole &&
+        canUse(capabilities, entry.capability) &&
+        (entry.feature == null || canSee(features, entry.feature))
+}

app/src/main/java/com/runicgateway/app/ui/navigation/NavOverrides.kt

@@ -0,0 +1,171 @@
+/*
+ * SPDX-License-Identifier: GPL-3.0-or-later
+ */
+package com.runicgateway.app.ui.navigation
+
+import kotlinx.serialization.json.JsonArray
+import kotlinx.serialization.json.JsonObject
+import kotlinx.serialization.json.JsonPrimitive
+import kotlinx.serialization.json.booleanOrNull
+import kotlinx.serialization.json.doubleOrNull
+
+/**
+ * Apply the admin's stored public-nav overrides to the app's coded menu
+ * (THEMING_AND_NAV.md §6). The Kotlin counterpart of the website's
+ * `client/src/lib/navOverrides.js`, narrowed to what a drawer can express.
+ *
+ * **This is presentation, never authorization.** An override carries `label`,
+ * `order` and `hidden` and nothing else: it cannot introduce a route, cannot
+ * touch [MenuEntry.access] or [MenuEntry.feature], and cannot un-hide anything —
+ * `hidden: false` is simply the absence of hiding. [visibleEntries] therefore runs
+ * **after** this merge, unchanged, and remains the actual boundary (§6.1, AC-3).
+ *
+ * Fail-safe throughout, matching the web: anything unrecognized — an unknown path,
+ * a non-string label, a path the app doesn't surface in its menu — is ignored
+ * rather than rejected, so a stale or hand-edited settings row degrades to the
+ * coded menu instead of rendering a broken drawer.
+ */
+
+/** A usable override for one menu row. Absent fields mean "as coded". */
+internal data class NavOverride(
+    val label: String? = null,
+    val order: Double? = null,
+    val hidden: Boolean = false,
+    /**
+     * The id of the section this row was dropped into, or null for a top-level
+     * row. Read here but honored only by the tree build (`NavTree.kt`) — the flat
+     * [applyNavOverrides] has nowhere to put it. Not validated against the stored
+     * sections here; that is the tree's job, since only it knows them.
+     */
+    val section: String? = null,
+) {
+    /**
+     * Nothing a **flat** list can express. [section] is deliberately not part of
+     * this: to [applyNavOverrides] a section-only override says nothing, so an
+     * instance that only ever grouped rows still gets its coded list back by
+     * identity. The tree build adds its own check.
+     */
+    val isEmpty: Boolean get() = label == null && order == null && !hidden
+}
+
+/**
+ * The `items` map out of a stored `nav_public` value.
+ *
+ * Two shapes exist, because website phase 10 added sections and links without
+ * migrating what phases 6-8 had already stored: `{items, sections, links}` and a
+ * bare map of path → override. A bare map is unambiguous — every key is a path,
+ * so a key can never be the string `items`.
+ *
+ * `sections` and `links` come out of the same wrapper, and only ever out of the
+ * wrapped shape — see [sectionsOf] and [linksOf].
+ */
+internal fun itemsOf(navPublic: JsonObject?): Map<String, JsonObject> {
+    if (navPublic == null) return emptyMap()
+    val items = wrapperOf(navPublic)?.get("items") as? JsonObject ?: navPublic
+    return items.entries
+        .mapNotNull { (key, value) -> (value as? JsonObject)?.let { key to it } }
+        .toMap()
+}
+
+/**
+ * The stored value as the wrapped `{items, sections, links}` shape, or null when
+ * it is the bare items map phases 6-8 wrote. The discriminator is the web's: an
+ * `items` **object**, which a bare map can never carry because every key in one is
+ * a path.
+ */
+private fun wrapperOf(navPublic: JsonObject?): JsonObject? =
+    navPublic?.takeIf { it["items"] is JsonObject }
+
+internal fun sectionsOf(navPublic: JsonObject?): List<JsonObject> = jsonObjectsAt(navPublic,"sections")
+
+internal fun linksOf(navPublic: JsonObject?): List<JsonObject> = jsonObjectsAt(navPublic,"links")
+
+private fun jsonObjectsAt(navPublic: JsonObject?, key: String): List<JsonObject> =
+    (wrapperOf(navPublic)?.get(key) as? JsonArray)
+        ?.mapNotNull { it as? JsonObject }
+        .orEmpty()
+
+// Field by field, like every other read in M12: a bad `label` must not discard a
+// good `order` beside it.
+//
+// `group` is ignored — it names a section of the *admin sidebar*, a nav the app
+// never renders, and a value it cannot honor is better dropped than half-applied.
+internal fun cleanOverride(raw: JsonObject): NavOverride {
+    val label = (raw["label"] as? JsonPrimitive)
+        ?.takeIf { it.isString }
+        ?.content
+        ?.trim()
+        ?.takeIf { it.isNotEmpty() }
+    val order = (raw["order"] as? JsonPrimitive)
+        ?.takeIf { !it.isString }
+        ?.doubleOrNull
+        ?.takeIf { it.isFinite() }
+    val hidden = (raw["hidden"] as? JsonPrimitive)
+        ?.takeIf { !it.isString }
+        ?.booleanOrNull == true
+    val section = (raw["section"] as? JsonPrimitive)
+        ?.takeIf { it.isString }
+        ?.content
+        ?.takeIf { it.isNotEmpty() }
+    return NavOverride(label = label, order = order, hidden = hidden, section = section)
+}
+
+/**
+ * [base] with the admin's overrides applied: rows relabeled, reordered and
+ * dropped as the stored row asks.
+ *
+ * @param base the coded menu — the only source of `route`, `access` and `feature`
+ * @param navPublic the parsed `nav_public` row, or null when the admin never
+ *   edited the nav. Null, malformed, and "nothing usable in it" all return [base]
+ *   itself, which is what makes an untouched instance's drawer provably today's
+ *   (§2, AC-1).
+ */
+fun applyNavOverrides(base: List<MenuEntry>, navPublic: JsonObject?): List<MenuEntry> {
+    val items = itemsOf(navPublic)
+    if (items.isEmpty()) return base
+
+    val coded = base.map { it.route }.toSet()
+    // Keyed by app route, and only for a route the coded menu actually declares.
+    // This is where an override for a path the app doesn't surface in its drawer —
+    // a news category tab, a Shard hub board — is dropped (§6.2). The web does the
+    // same with an unknown `to`.
+    val overrides = buildMap {
+        for ((path, raw) in items) {
+            val route = appRouteForWebPath(path) ?: continue
+            if (route !in coded) continue
+            val override = cleanOverride(raw)
+            if (!override.isEmpty) put(route, override)
+        }
+    }
+    if (overrides.isEmpty()) return base
+
+    // Rows the website's nav knows about are the ones an override can move; the
+    // app's own surfaces (Contact, Account, the player groups, the staff rows)
+    // have no counterpart to be reordered against and keep their coded order,
+    // appended after the public block — which is exactly where they sit today, so
+    // this partition is the current layout rather than a new one (§6.2).
+    val (mapped, appOnly) = base.partition { it.route in WEB_ROUTE_ORDER }
+
+    val sorted = mapped
+        // An untouched row's sort key is its index in the WEBSITE's nav, not the
+        // app's: a stored `order` is a position in that list, so both keys have to
+        // sit on one number line to be comparable at all.
+        //
+        // Two tie-breaks, the web's: an explicit order beats a coincidental index
+        // (the admin said "first", so first), and two explicit orders keep code
+        // order, because the sort is stable.
+        .sortedWith(
+            compareBy<MenuEntry> { entry ->
+                overrides[entry.route]?.order ?: WEB_ROUTE_ORDER.getValue(entry.route).toDouble()
+            }.thenByDescending { overrides[it.route]?.order != null },
+        )
+
+    return (sorted + appOnly).mapNotNull { entry ->
+        val override = overrides[entry.route] ?: return@mapNotNull entry
+        when {
+            override.hidden -> null
+            override.label != null -> entry.copy(label = override.label)
+            else -> entry
+        }
+    }
+}

app/src/main/java/com/runicgateway/app/ui/navigation/NavPaths.kt

@@ -0,0 +1,324 @@
+/*
+ * SPDX-License-Identifier: GPL-3.0-or-later
+ */
+package com.runicgateway.app.ui.navigation
+
+import com.runicgateway.app.data.repository.ContentRepository.PostCategory
+
+/**
+ * The website path → app route table (THEMING_AND_NAV.md §6.2).
+ *
+ * The public nav an admin edits is keyed by **website** paths, so honoring it in
+ * the app needs a translation. This is the one new piece of cross-repo coupling
+ * the milestone introduces, which is why it lives in a single file with the
+ * website's own arrays quoted right beside it — the coupling is visible and
+ * reviewable in one place rather than spread across the drawer's call sites.
+ *
+ * ## The nav is TWO arrays now, and that is what M13 had to correct
+ *
+ * This file was written when the website's public nav was one sixteen-row array.
+ * Since the module-system cutover on 2026-08-12 it is **core's eight rows plus
+ * every installed module's**, interleaved at render time by `withModuleNav`, and
+ * a module's pages are mounted by core at `/<module id>/<path>` — so the nine
+ * shard rows moved from `/site/champs` to `/uo/champs` and this table stopped
+ * resolving any of them. Three things followed, all of them true of the shipped
+ * app until M13: a nav override on a shard row was ignored, an added link to a
+ * shard page handed off to a browser instead of opening natively, and the sort
+ * key line below was a sixteen-row line against a nav numbered differently.
+ *
+ * **The nine `/uo/` paths are hardcoded, and they are ONE module's.** The alternative
+ * — reading the installed module's id from `GET /public/modules` and building
+ * `/<id>/shard` — is forbidden by `MODULE_API.md` §2.9 (*"a client must not infer
+ * a route from a capability"*) and would hardcode the same path shape less
+ * visibly. A site running a different game module matches none of these nine, its
+ * links hand off to a Custom Tab, and that is the correct answer rather than a
+ * gap: core cannot tell the app what another module calls its pages.
+ *
+ * Verbatim from `website/client/src/components/SiteHeader.jsx`, which is the
+ * exported owner of core's list (`export const NAV`, and Admin → Navigation edits
+ * exactly it):
+ *
+ * ```js
+ * export const NAV = [
+ *   { label: 'Home', to: '/', end: true },
+ *   { label: 'News', to: '/site/news' },
+ *   { label: 'Events', to: '/site/events' },
+ *   { label: 'Screenshots', to: '/site/screenshots' },
+ *   { label: 'Five on Friday', to: '/site/five-on-friday' },
+ *   { label: 'Newsletter', to: '/site/newsletter' },
+ *   { label: 'Wiki', to: '/wiki' },
+ *   { label: 'About', to: '/site/about' },
+ * ]
+ * ```
+ *
+ * and from `module-uo/client/src/entry.jsx`, which registers the rest:
+ *
+ * ```jsx
+ * registry.registerNav(ID, {
+ *   area: 'public',
+ *   items: [
+ *     { label: 'Shard',        to: '/uo/shard',        feature: 'status' },
+ *     { label: 'Champions',    to: '/uo/champs',       feature: 'champs' },
+ *     { label: 'Guilds',       to: '/uo/guilds',       feature: 'guilds' },
+ *     { label: 'Governors',    to: '/uo/governors',    feature: 'governors' },
+ *     { label: 'Houses',       to: '/uo/houses',       feature: 'houses' },
+ *     { label: 'Rules',        to: '/uo/rules',        feature: 'ruleset' },
+ *     { label: 'Atlas',        to: '/uo/atlas',        feature: 'atlas' },
+ *     { label: 'Leaderboards', to: '/uo/leaderboards', feature: 'leaderboards' },
+ *     { label: 'Market',       to: '/uo/market',       feature: 'market' },
+ *   ],
+ * })
+ * ```
+ *
+ * None of those nine declares an `order`, so `mergeFlat` appends them after core's
+ * rows in registration order — which is the order they are listed in below.
+ *
+ * The `feature` values are **not** mirrored here on purpose. [APP_MENU] is the
+ * app's own source of truth for gating, and a second copy of a security-relevant
+ * value that drifts silently is worth more than it costs. This table carries the
+ * mapping and nothing else.
+ *
+ * Not every row maps to something the app shows in its drawer, and that is the
+ * design rather than an omission — see [WEB_PATH_TO_ROUTE].
+ */
+
+/** One row of the website's public nav: its path, and the app route it opens. */
+data class WebNavPath(val path: String, val route: String)
+
+/**
+ * The website's public nav in **its** order, mapped to app routes.
+ *
+ * The order is load-bearing, not decorative: a stored `order` is an index into
+ * *this* list (the admin's editor writes the position a row holds on the web), so
+ * a row the admin never moved has to take its key from the same number line or
+ * explicit and implicit keys would be incomparable. See `NavOverrides.kt`.
+ *
+ * Core's eight first, then the module's nine, because that is what `withModuleNav`
+ * renders and therefore what the admin's editor numbered.
+ */
+val WEBSITE_PUBLIC_NAV: List<WebNavPath> = listOf(
+    WebNavPath("/", Routes.HOME),
+    WebNavPath("/site/news", Routes.NEWS),
+    WebNavPath("/site/events", Routes.EVENTS),
+    // The app's News screen carries all four categories as tabs, so these three
+    // have a route but no drawer row of their own — see the note below.
+    WebNavPath("/site/screenshots", Routes.news(PostCategory.SCREENSHOTS)),
+    WebNavPath("/site/five-on-friday", Routes.news(PostCategory.FIVE_ON_FRIDAY)),
+    WebNavPath("/site/newsletter", Routes.news(PostCategory.NEWSLETTER)),
+    WebNavPath("/wiki", Routes.WIKI),
+    WebNavPath("/site/about", Routes.page("about")),
+    // module-uo's rows. Mounted by core at `/<module id>/<path>`, which is why
+    // every one of these is `/uo/` and not `/site/`.
+    WebNavPath("/uo/shard", Routes.SHARD),
+    // Behind the Shard hub in the app, deliberately — no drawer row either.
+    WebNavPath("/uo/champs", Routes.SHARD_CHAMPS),
+    WebNavPath("/uo/guilds", Routes.SHARD_GUILDS),
+    WebNavPath("/uo/governors", Routes.SHARD_GOVERNORS),
+    WebNavPath("/uo/houses", Routes.SHARD_HOUSES),
+    WebNavPath("/uo/rules", Routes.SHARD_RULES),
+    WebNavPath("/uo/atlas", Routes.ATLAS),
+    WebNavPath("/uo/leaderboards", Routes.SHARD_LEADERBOARDS),
+    WebNavPath("/uo/market", Routes.SHARD_MARKET),
+)
+
+/**
+ * The same table as a lookup.
+ *
+ * **A mapped route is not the same thing as a drawer row.** Seven of these paths
+ * resolve to a screen the app reaches some other way: the three news categories
+ * are tabs on one News screen, and champs / guilds / governors / houses sit behind
+ * the Shard hub because that is the better shape on a phone. An override for one
+ * of them is **ignored** — §6.1's rule is that a nav override may never introduce
+ * navigation, and the hub is a design decision, not an accident to correct. The
+ * merge enforces that by intersecting with [APP_MENU]; nothing here needs to know
+ * which rows those are.
+ *
+ * The mapping still exists for all sixteen because phase 6's added links resolve
+ * an admin-authored path against the same table, and *there* a category tab or a
+ * hub board is a perfectly good destination — the admin asked for it by path.
+ */
+val WEB_PATH_TO_ROUTE: Map<String, String> =
+    WEBSITE_PUBLIC_NAV.associate { it.path to it.route }
+
+/**
+ * Each app route's index in the website's own nav order — the sort key a row the
+ * admin never moved takes, so it lands on the same number line as a stored
+ * `order`. All sixteen routes are distinct, so this loses nothing.
+ */
+internal val WEB_ROUTE_ORDER: Map<String, Int> =
+    WEBSITE_PUBLIC_NAV.withIndex().associate { (index, row) -> row.route to index }
+
+/**
+ * The app route a website nav path opens, or null when the app has no screen for
+ * it. A trailing slash is tolerated (`/wiki/` is `/wiki`) since a hand-edited
+ * settings row may carry one; the root path is left alone.
+ */
+fun appRouteForWebPath(path: String?): String? = WEB_PATH_TO_ROUTE[normalizeWebPath(path)]
+
+/** `/wiki/` → `/wiki`, blank → null, and `/` left alone. */
+private fun normalizeWebPath(path: String?): String? {
+    val trimmed = path?.trim().orEmpty()
+    if (trimmed.isEmpty()) return null
+    val normalized = if (trimmed.length > 1) trimmed.trimEnd('/') else trimmed
+    return normalized.ifEmpty { "/" }
+}
+
+/**
+ * The website's top-level paths that are **not** CMS pages.
+ *
+ * The site serves its CMS pages from a top-level `/<slug>` (React Router ranks its
+ * static routes above that dynamic one), which is what lets [resolveWebPath]'s
+ * last rule open an admin-authored page natively. These are the segments that rule
+ * must not swallow: the SPA's own sections, and the two server mounts. A link to
+ * one of them hands off to the browser, which is where they actually live.
+ */
+private val RESERVED_TOP_LEVEL = setOf(
+    "admin", "account", "player", "site", "wiki", "invite", "preview", "api", "uploads",
+    // An installed module's pages are mounted at `/<id>/…` and are not CMS pages.
+    // Only ids the app knows about need listing: an unknown module's `/<id>` would
+    // resolve to a CMS page that 404s, which is the same answer the browser gives
+    // it, and core cannot enumerate them for us here anyway.
+    "uo",
+)
+
+/**
+ * The app route an **arbitrary** website path opens, or null when the app has no
+ * screen for it and the link must hand off to a Custom Tab (§6.3).
+ *
+ * [appRouteForWebPath] answers for the sixteen paths the *nav* is built from; this
+ * answers for a path an admin typed into an added link, which may name any page on
+ * the site. It is the app's read of the site's own route table, and like the table
+ * above it is cross-repo coupling kept in one file — quoted here for the same
+ * reason, from `website/client/src/App.jsx`:
+ *
+ * ```jsx
+ * <Route path="/" element={<Portal />} />
+ * <Route path="/site/news" element={<News />} />
+ * <Route path="/site/screenshots" element={<Screenshots />} />
+ * <Route path="/site/five-on-friday" element={<FiveOnFriday />} />
+ * <Route path="/site/newsletter" element={<Newsletter />} />
+ * <Route path="/site/newsletter/:id" element={<NewsletterIssue />} />
+ * <Route path="/site/events" element={<Events />} />
+ * <Route path="/site/events/series/:slug" element={<EventSeries />} />
+ * <Route path="/site/events/:slug" element={<EventPage />} />
+ * <Route path="/site/about" element={<About />} />
+ * <Route path="/site/status" element={<Status />} />
+ * <Route path="/wiki" element={<Wiki />} />
+ * <Route path="/wiki/:slug" element={<WikiArticle />} />
+ * // Installed modules' pages, mounted at `/<module id>/<path>`:
+ * //   /uo/shard, /uo/shard/activity, /uo/champs, /uo/guilds, /uo/guilds/:id,
+ * //   /uo/governors, /uo/houses, /uo/rules, /uo/leaderboards, /uo/market,
+ * //   /uo/market/vendors/:serial, /uo/atlas, /uo/atlas/:slug
+ * // CMS pages: top-level /:slug, matched only after the named routes above
+ * <Route path="/:slug" element={<CmsPage />} />
+ * ```
+ *
+ * Note what is *not* in it: no `/site/news/<id>` (a news item renders on its
+ * category page; the newsletter's is the site's one post-detail route), no
+ * `/page/<slug>`, and no `/contact` — the app's contact form is app-only (§6.2).
+ *
+ * ```
+ * /                               → HOME
+ * /site/news                      → NEWS
+ * /site/{screenshots,five-on-friday,newsletter}
+ *                                 → NEWS, that category's tab
+ * /site/newsletter/<id>           → POST         (the site's one post-detail route)
+ * /site/events                    → EVENTS
+ * /site/events/series/<slug>      → EVENT_SERIES
+ * /site/events/<slug>[?run=<id>]  → EVENT        (the one route that takes a query)
+ * /wiki                           → WIKI
+ * /wiki/<slug>                    → WIKI_PAGE
+ * /uo/<shard surface>             → the mapped shard route (§6.2)
+ * /uo/atlas/<slug>                → ATLAS_CREATURE
+ * /uo/market/vendors/<serial>     → SHARD_MARKET_VENDOR
+ * /site/about                     → PAGE("about")
+ * /<slug>                         → PAGE(slug), unless <slug> is reserved
+ * anything else                   → null, i.e. the Custom Tab
+ * ```
+ *
+ * **A path carrying a query or a fragment hands off — with exactly one
+ * exception.** The rule exists because no app route took either, so a native
+ * match would quietly drop what the admin wrote while the browser honors it. The
+ * event page (M13) is the first route that takes a query, and it takes one key:
+ * `run`, which is what every `event.` announcement's `eventUrl` carries. So a
+ * `?run=` on an event path resolves natively and **anything else in a query
+ * string, any second parameter, and any fragment still hand off** — the carve-out
+ * is one key on one path, not a general "parse the query".
+ *
+ * That narrowness is the point: an admin who writes `/site/events/x?utm=mail` gets
+ * the browser, which honors `utm`, rather than an app screen that silently ignored
+ * it.
+ *
+ * Resolving a path is not the same as being allowed to see the screen behind it.
+ * A link to `/site/market` on a shard that does not publish the market lands on
+ * the Market screen's honest "not published here" state, which is what typing the
+ * URL on the web does too (§6.3).
+ */
+fun resolveWebPath(path: String?): String? {
+    val raw = path?.trim().orEmpty()
+    // A fragment is never honored natively: no app route has one to put it in.
+    if (raw.isEmpty() || '#' in raw) return null
+
+    val queryAt = raw.indexOf('?')
+    val query = if (queryAt >= 0) raw.substring(queryAt + 1) else ""
+    val normalized = normalizeWebPath(if (queryAt >= 0) raw.substring(0, queryAt) else raw)
+        ?: return null
+
+    if (query.isEmpty()) WEB_PATH_TO_ROUTE[normalized]?.let { return it }
+    if (!normalized.startsWith("/")) return null
+
+    // Blank segments ("/site//news") mean a malformed path, not a slug.
+    val segments = normalized.removePrefix("/").split('/')
+    if (segments.any { it.isBlank() }) return null
+
+    // The one path that may carry a query, and the one key it may carry. Checked
+    // before the general "a query hands off" rule below, and nowhere else.
+    if (segments.size == 3 && segments[0] == "site" && segments[1] == "events" &&
+        segments[2] != "series"
+    ) {
+        // No query is the ordinary case — a link to the event rather than to one
+        // of its occurrences. A query is honored only when it is exactly the run.
+        if (query.isEmpty()) return Routes.event(segments[2])
+        val run = runParam(query) ?: return null
+        return Routes.event(segments[2], run)
+    }
+    if (query.isNotEmpty()) return null
+
+    return when {
+        segments.size == 1 -> segments[0].takeIf { it !in RESERVED_TOP_LEVEL }?.let(Routes::page)
+        segments[0] == "wiki" && segments.size == 2 -> Routes.wikiPage(segments[1])
+        segments[0] == "site" && segments.size == 3 && segments[1] == "newsletter" ->
+            Routes.post(PostCategory.NEWSLETTER.urlSlug, segments[2])
+        segments[0] == "site" && segments.size == 4 && segments[1] == "events" &&
+            segments[2] == "series" -> Routes.eventSeries(segments[3])
+        segments[0] == MODULE_UO && segments.size == 3 && segments[1] == "atlas" ->
+            Routes.atlasCreature(segments[2])
+        segments[0] == MODULE_UO && segments.size == 4 && segments[1] == "market" &&
+            segments[2] == "vendors" -> Routes.marketVendor(segments[3])
+        else -> null
+    }
+}
+
+/**
+ * The `run` value of a query that consists of **exactly** `run=<something>`, or
+ * null for every other query — including one that merely contains a `run` among
+ * others.
+ *
+ * Deliberately not a query parser. A second parameter means the writer meant
+ * something the app cannot honor, and the honest answer to that is the browser.
+ * An empty value (`?run=`) is null too: it would reach the screen as a blank
+ * string and be forwarded to the server as one.
+ */
+private fun runParam(query: String): String? {
+    val value = query.removePrefix("run=")
+    if (value.length == query.length || value.isEmpty()) return null
+    return value.takeIf { '&' !in it && '=' !in it }
+}
+
+/**
+ * The module id whose public pages this table maps.
+ *
+ * Named once rather than spelled into four branches, so what is coupled to one
+ * module is countable. It is a literal on purpose — see the file header.
+ */
+private const val MODULE_UO = "uo"

app/src/main/java/com/runicgateway/app/ui/navigation/NavTree.kt

@@ -0,0 +1,239 @@
+/*
+ * SPDX-License-Identifier: GPL-3.0-or-later
+ */
+package com.runicgateway.app.ui.navigation
+
+import kotlinx.serialization.json.JsonObject
+import kotlinx.serialization.json.JsonPrimitive
+import kotlinx.serialization.json.doubleOrNull
+
+/**
+ * The drawer as a one-level tree: the coded menu, plus the **sections** an admin
+ * grouped rows into and the **links** they added of their own (THEMING_AND_NAV.md
+ * §6.3). The Kotlin counterpart of the website's `buildPublicNav` + `pruneNav`.
+ *
+ * The public nav is the one nav an admin can restructure rather than only reorder,
+ * and §6.1's invariant survives that structurally rather than by vigilance: a
+ * coded row is still keyed by a website path the app's own table declares, so an
+ * override still cannot invent a destination or touch a gate, while everything
+ * that *can* name an arbitrary path lives in [NavNode.Link], where the path rule
+ * is applied and the result is resolved through [resolveWebPath].
+ *
+ * An added link carries no gate and needs none — the screen behind it enforces its
+ * own access, so a link to somewhere this caller cannot reach lands on that
+ * screen's own honest state, exactly as typing the URL on the web does.
+ */
+sealed interface NavNode {
+
+    /** A coded [MenuEntry], relabeled/reordered by the merge but never re-gated. */
+    data class Item(val entry: MenuEntry) : NavNode
+
+    /**
+     * An admin-authored link to a page on this site.
+     *
+     * @param path the stored website path, already validated — this is what a
+     *   Custom Tab opens, resolved against the site's base URL
+     * @param route the app route [path] maps to, or null when the app has no
+     *   screen for it and the link must hand off (§6.3)
+     */
+    data class Link(
+        val id: String,
+        val label: String,
+        val path: String,
+        val route: String?,
+    ) : NavNode
+
+    /**
+     * A drawer group: its [label] as a header, its [items] beneath it.
+     *
+     * The website renders these as click-to-open dropdowns; a drawer is already a
+     * vertical list, so the app renders the group open (§6.3). Never empty — see
+     * [pruneNav].
+     */
+    data class Section(
+        val id: String,
+        val label: String,
+        val items: List<NavNode>,
+    ) : NavNode
+}
+
+/** A usable `sections` entry. */
+private data class SectionSpec(val id: String, val label: String, val order: Double?)
+
+/** A usable `links` entry, with its section already checked against the stored ones. */
+private data class LinkSpec(
+    val id: String,
+    val label: String,
+    val to: String,
+    val order: Double?,
+    val section: String?,
+)
+
+/** One node waiting to be placed: its sort key, and whether that key was stored. */
+private data class Placed(val node: NavNode, val section: String?, val key: Double, val explicit: Boolean)
+
+/**
+ * Characters that must never appear in a stored link path. The same rule the
+ * website applies on read: a value that would leave the origin, or carry markup
+ * into a link, is dropped rather than rendered.
+ */
+private val FORBIDDEN_IN_PATH = Regex("""[\s<>"'\\]""")
+
+// Forgiving, like every other read in M12: an entry that is not usable is dropped
+// and its neighbours kept. A repeated id is dropped too — the first wins, since
+// the id is what a link's identity in the drawer is.
+private fun readSections(raw: List<JsonObject>): List<SectionSpec> {
+    val seen = mutableSetOf<String>()
+    return raw.mapNotNull { section ->
+        val id = section.stringOrNull("id") ?: return@mapNotNull null
+        val label = section.stringOrNull("label")?.trim()?.takeIf { it.isNotEmpty() } ?: return@mapNotNull null
+        if (!seen.add(id)) return@mapNotNull null
+        SectionSpec(id = id, label = label, order = section.orderOrNull())
+    }
+}
+
+private fun readLinks(raw: List<JsonObject>, knownSections: Set<String>): List<LinkSpec> {
+    val seen = mutableSetOf<String>()
+    return raw.mapNotNull { link ->
+        val id = link.stringOrNull("id") ?: return@mapNotNull null
+        val label = link.stringOrNull("label")?.trim()?.takeIf { it.isNotEmpty() } ?: return@mapNotNull null
+        val to = link.stringOrNull("to") ?: return@mapNotNull null
+        if (!to.startsWith("/") || to.startsWith("//") || FORBIDDEN_IN_PATH.containsMatchIn(to)) {
+            return@mapNotNull null
+        }
+        if (!seen.add(id)) return@mapNotNull null
+        LinkSpec(
+            id = id,
+            label = label,
+            to = to,
+            order = link.orderOrNull(),
+            // A link naming a section that does not exist is a top-level link, not
+            // a dropped one: the admin's destination is still good.
+            section = link.stringOrNull("section")?.takeIf { it in knownSections },
+        )
+    }
+}
+
+private fun JsonObject.stringOrNull(key: String): String? =
+    (this[key] as? JsonPrimitive)?.takeIf { it.isString }?.content
+
+private fun JsonObject.orderOrNull(): Double? =
+    (this["order"] as? JsonPrimitive)?.takeIf { !it.isString }?.doubleOrNull?.takeIf { it.isFinite() }
+
+// Two tie-breaks, the web's and phase 5's: an explicit order beats a coincidental
+// index (the admin said "first", so first), and two explicit orders keep
+// declaration order, because the sort is stable.
+private fun List<Placed>.place(): List<NavNode> =
+    sortedWith(compareBy<Placed> { it.key }.thenByDescending { it.explicit }).map { it.node }
+
+/**
+ * The coded menu with the admin's `nav_public` applied in full: relabeled,
+ * reordered and hidden as phase 5 already did, plus grouped into sections and
+ * joined by added links.
+ *
+ * With no sections and no links this **is** phase 5 — [applyNavOverrides] answers,
+ * so an untouched instance still gets [APP_MENU] back by identity and AC-1's proof
+ * is unchanged (§2). The tree build only runs when the admin actually created
+ * structure.
+ *
+ * @param base the coded menu — the only source of `route`, `access` and `feature`
+ * @param navPublic the parsed `nav_public` row, or null when the admin never
+ *   edited the nav
+ */
+fun buildNavTree(base: List<MenuEntry>, navPublic: JsonObject?): List<NavNode> {
+    val sections = readSections(sectionsOf(navPublic))
+    val links = readLinks(linksOf(navPublic), sections.map { it.id }.toSet())
+    if (sections.isEmpty() && links.isEmpty()) {
+        return applyNavOverrides(base, navPublic).map { NavNode.Item(it) }
+    }
+
+    val knownSections = sections.map { it.id }.toSet()
+    val coded = base.map { it.route }.toSet()
+    // Keyed by app route, and only for a route the coded menu declares — the same
+    // narrowing as the flat merge, so an override for a path the app maps but does
+    // not surface (a news category tab, a Shard hub board) is dropped here too.
+    val overrides = buildMap {
+        for ((path, raw) in itemsOf(navPublic)) {
+            val route = appRouteForWebPath(path) ?: continue
+            if (route !in coded) continue
+            val override = cleanOverride(raw)
+            // A section the stored value never declares is no section at all.
+            val section = override.section?.takeIf { it in knownSections }
+            if (!override.isEmpty || section != null) put(route, override.copy(section = section))
+        }
+    }
+
+    // The app's own surfaces (Contact, Account, the player groups, the staff rows)
+    // have no website counterpart to be reordered against or grouped under, so they
+    // keep their coded order after the public block — where they already sit (§6.2).
+    val (mapped, appOnly) = base.partition { it.route in WEB_ROUTE_ORDER }
+
+    val placed = mutableListOf<Placed>()
+    for (entry in mapped) {
+        val override = overrides[entry.route]
+        if (override?.hidden == true) continue
+        placed += Placed(
+            node = NavNode.Item(override?.label?.let { entry.copy(label = it) } ?: entry),
+            section = override?.section,
+            // An untouched row's key is its index in the WEBSITE's nav, so stored
+            // and implicit keys sit on one number line (phase 5).
+            key = override?.order ?: WEB_ROUTE_ORDER.getValue(entry.route).toDouble(),
+            explicit = override?.order != null,
+        )
+    }
+    // An admin-created entity with no stored order appends after the coded rows, in
+    // creation order, rather than jumping to the front on a 0 default.
+    var next = WEBSITE_PUBLIC_NAV.size
+    for (section in sections) {
+        placed += Placed(
+            node = NavNode.Section(section.id, section.label, emptyList()),
+            section = null,
+            key = section.order ?: (next++).toDouble(),
+            explicit = section.order != null,
+        )
+    }
+    for (link in links) {
+        placed += Placed(
+            node = NavNode.Link(link.id, link.label, link.to, resolveWebPath(link.to)),
+            section = link.section,
+            key = link.order ?: (next++).toDouble(),
+            explicit = link.order != null,
+        )
+    }
+
+    val top = placed.filter { it.node is NavNode.Section || it.section == null }.place()
+    return top.map { node ->
+        if (node !is NavNode.Section) {
+            node
+        } else {
+            node.copy(items = placed.filter { it.section == node.id }.place())
+        }
+    } + appOnly.map { NavNode.Item(it) }
+}
+
+/**
+ * The tree with this caller's gates applied — and a section they empty dropped.
+ *
+ * This is the boundary, and it runs **after** [buildNavTree], never before: an
+ * override is presentation, so a row it relabels, moves or marks `hidden: false`
+ * is still shown only if [isVisible] says so (§6.1, AC-3).
+ *
+ * The empty-section case is the one with real correctness risk and the reason the
+ * rule is ported rather than left to the drawer: a group whose every member is
+ * withheld by the caller's role or by the shard's visibility config must not draw
+ * as a header with nothing under it.
+ *
+ * Links are not gated — see [NavNode].
+ *
+ * @param isVisible the caller's own predicate, applied to coded items only, so
+ *   this file stays ignorant of sessions and shard features
+ */
+fun pruneNav(tree: List<NavNode>, isVisible: (MenuEntry) -> Boolean): List<NavNode> {
+    fun keep(node: NavNode) = node !is NavNode.Item || isVisible(node.entry)
+    return tree.mapNotNull { node ->
+        when (node) {
+            is NavNode.Section -> node.copy(items = node.items.filter(::keep)).takeIf { it.items.isNotEmpty() }
+            else -> node.takeIf { keep(it) }
+        }
+    }
+}

app/src/main/java/com/runicgateway/app/ui/navigation/Routes.kt

@@ -3,6 +3,8 @@
  */
 package com.runicgateway.app.ui.navigation
 
+import com.runicgateway.app.data.repository.ContentRepository
+
 /**
  * Navigation destinations for the M1 public surface (PLAN.md §5). Routes are
  * plain strings for Navigation-Compose; argument-bearing routes expose a
@@ -14,6 +16,19 @@ object Routes {
     const val WIKI = "wiki"
     const val CONTACT = "contact"
 
+    /**
+     * The News hub's NavHost pattern: [NEWS] plus an optional category, so a link
+     * to one of the website's three category pages can land on the matching tab
+     * (THEMING_AND_NAV.md §6.2). Navigating to plain [NEWS] matches this pattern
+     * with no argument and opens the default tab, so every existing call site —
+     * the drawer, [forStream] — is unaffected.
+     *
+     * Declared beside [NEWS] rather than replacing it because the two are used for
+     * different things: this is what `composable()` and `destination.route` speak,
+     * [NEWS] is what callers navigate to.
+     */
+    const val NEWS_ROUTE = "news?category={category}"
+
     /** Native login (§4.1) and the signed-in account surface (§5). */
     const val LOGIN = "login"
     const val ACCOUNT = "account"
@@ -22,8 +37,38 @@ object Routes {
     const val ACCOUNT_TRUSTED_DEVICES = "account/trusted-devices"
     const val ACCOUNT_RECOVERY_CODES = "account/recovery-codes"
 
-    /** Opt-in push notification settings (§11, signed-in). */
+    /**
+     * The in-app inbox (ENGAGEMENT.md phase 8, signed-in) and its settings.
+     *
+     * The bare route is the CONTENT and the named sub-route the preferences, which
+     * is exactly how the web surface is laid out (`/account/notifications` and
+     * `…/settings`) — and what a person means when they tap "Notifications".
+     */
     const val NOTIFICATIONS = "notifications"
+    const val NOTIFICATIONS_SETTINGS = "notifications/settings"
+
+    /**
+     * Events (§9 M13) — CORE's, not a module's: these screens exist on a backend
+     * with no game module at all, which is why they are not under `shard/`.
+     *
+     * **[EVENT_ROUTE] is the app's first route that takes a query**, and it takes
+     * exactly one: `run`, naming which occurrence a results table is about. The
+     * page lives at the definition's slug so a weekly event has one address that
+     * survives a retitle, and the occurrence has to live somewhere else. See
+     * [resolveWebPath], whose "a query hands off" rule this is the one exception
+     * to.
+     *
+     * **[MY_EVENTS] is `account/events` and not `events/mine`**, which is not
+     * cosmetic: `events/mine` and `events/{slug}` are both two segments, and a
+     * static-versus-argument race between two NavHost patterns is exactly the bug
+     * events Phase 13 shipped one tier along, where a static `events/new` outranked
+     * `events/:id` in React Router and made creating an event impossible for seven
+     * phases. Under `account/` there is no dynamic sibling and no race to lose.
+     */
+    const val EVENTS = "events"
+    const val EVENT_ROUTE = "events/{slug}?run={run}"
+    const val EVENT_SERIES = "events/series/{slug}"
+    const val MY_EVENTS = "account/events"
 
     /** Public shard hub (§6.2). */
     const val SHARD = "shard"
@@ -75,10 +120,18 @@ object Routes {
         const val CATEGORY = "category"
         const val ID_OR_SLUG = "idOrSlug"
         const val SERIAL = "serial"
+        const val RUN = "run"
     }
 
     fun page(slug: String) = "page/$slug"
     fun post(categoryUrlSlug: String, idOrSlug: String) = "news/$categoryUrlSlug/$idOrSlug"
+
+    /**
+     * The News hub with [category] preselected. Takes the enum rather than a slug
+     * so an unmapped category cannot reach the NavHost — the screen's tabs are the
+     * enum's entries, and a slug it doesn't know would select nothing.
+     */
+    fun news(category: ContentRepository.PostCategory) = "news?category=${category.urlSlug}"
     fun wikiPage(slug: String) = "wiki/$slug"
 
     /** The character-sheet route for an in-game serial (e.g. "0x24C"). */
@@ -90,6 +143,21 @@ object Routes {
     /** One creature's atlas page, by slug. */
     fun atlasCreature(slug: String) = "atlas/$slug"
 
+    /**
+     * One event's page, optionally about one occurrence.
+     *
+     * [runId] is what an announcement's link carries, and it is dropped when
+     * absent rather than sent as an empty argument — `events/x?run=` would reach
+     * the screen as a blank string and be forwarded to the server as one.
+     */
+    fun event(slug: String, runId: String? = null): String {
+        val base = "events/$slug"
+        return if (runId.isNullOrBlank()) base else "$base?run=$runId"
+    }
+
+    /** One arc, by slug. */
+    fun eventSeries(slug: String) = "events/series/$slug"
+
     /**
      * The in-app destination a tapped push notification deep-links to (§11, M7
      * Part 2 work item 7). Maps a stream id to the screen that shows its content;
@@ -106,6 +174,35 @@ object Routes {
         com.runicgateway.app.core.push.PushStreams.VENDOR_SALE -> PLAYER_VENDORS
         com.runicgateway.app.core.push.PushStreams.HOUSE_IDOC -> PLAYER_HOUSES
         com.runicgateway.app.core.push.PushStreams.ACCOUNT_LOGIN -> ACCOUNT
-        else -> HOME
+        // An engagement rule's tickle carries the TRIGGER id as its stream
+        // (ENGAGEMENT.md §7.2's one namespace), and `event.run.started` is the only
+        // event trigger that is also a push stream. The calendar is the honest
+        // destination when there is no inbox row to send it to — the tickle names
+        // no occurrence, so there is no page to open. A row, when there is one,
+        // wins via [forTickle] and carries the link that does.
+        else -> if (streamId.startsWith(EVENT_STREAM_PREFIX)) EVENTS else HOME
     }
+
+    /** What every core `event.` trigger id begins with (EVENTS.md §J). */
+    private const val EVENT_STREAM_PREFIX = "event."
+
+
+    /**
+     * Where a tapped tickle lands, given both halves of `{ stream, ref }`.
+     *
+     * **A `notification:<id>` ref means the engine wrote this user an inbox row**
+     * (`pushChannel.js` builds it), so the tap goes to the inbox whatever the
+     * stream is — an engagement rule's stream id is a TRIGGER id in §7.2's one
+     * namespace, and [forStream]'s fixed map would send most of them to Home.
+     * Every other tickle keeps the route it has always had, so no shipped stream
+     * changes where it lands.
+     *
+     * The ref is not decoded beyond that prefix and is never rendered: it is a
+     * hint that a row exists, and the app's contract is wake-and-pull.
+     */
+    fun forTickle(streamId: String, ref: String?): String =
+        if (ref != null && ref.startsWith(INBOX_REF_PREFIX)) NOTIFICATIONS else forStream(streamId)
+
+    /** What `pushChannel.js` prefixes an inbox row's id with. */
+    const val INBOX_REF_PREFIX = "notification:"
 }

app/src/main/java/com/runicgateway/app/ui/news/NewsViewModel.kt

@@ -3,12 +3,14 @@
  */
 package com.runicgateway.app.ui.news
 
+import androidx.lifecycle.SavedStateHandle
 import androidx.lifecycle.ViewModel
 import androidx.lifecycle.viewModelScope
 import com.runicgateway.app.data.api.dto.PostDto
 import com.runicgateway.app.data.repository.ContentRepository
 import com.runicgateway.app.data.repository.ContentRepository.PostCategory
 import com.runicgateway.app.ui.UiState
+import com.runicgateway.app.ui.navigation.Routes
 import com.runicgateway.app.ui.toUiState
 import dagger.hilt.android.lifecycle.HiltViewModel
 import kotlinx.coroutines.flow.MutableStateFlow
@@ -21,9 +23,15 @@ import javax.inject.Inject
 @HiltViewModel
 class NewsViewModel @Inject constructor(
     private val contentRepository: ContentRepository,
+    savedStateHandle: SavedStateHandle,
 ) : ViewModel() {
 
-    private val _category = MutableStateFlow(PostCategory.NEWS)
+    // Which tab to open on. Absent — every route into this screen except an
+    // admin's nav override or added link (THEMING_AND_NAV.md §6.2) — is the
+    // default feed, and so is a slug the app doesn't know.
+    private val _category = MutableStateFlow(
+        PostCategory.fromUrlSlug(savedStateHandle[Routes.Args.CATEGORY]) ?: PostCategory.NEWS,
+    )
     val category: StateFlow<PostCategory> = _category.asStateFlow()
 
     private val _state = MutableStateFlow<UiState<List<PostDto>>>(UiState.Loading)

app/src/main/java/com/runicgateway/app/ui/notifications/InboxBadgeViewModel.kt

@@ -0,0 +1,60 @@
+/*
+ * SPDX-License-Identifier: GPL-3.0-or-later
+ */
+package com.runicgateway.app.ui.notifications
+
+import androidx.lifecycle.ViewModel
+import androidx.lifecycle.viewModelScope
+import com.runicgateway.app.core.auth.Session
+import com.runicgateway.app.core.auth.SessionManager
+import com.runicgateway.app.core.inbox.InboxCache
+import com.runicgateway.app.core.net.BaseUrlHolder
+import com.runicgateway.app.core.result.ApiResult
+import com.runicgateway.app.data.repository.NotificationsRepository
+import dagger.hilt.android.lifecycle.HiltViewModel
+import kotlinx.coroutines.flow.MutableStateFlow
+import kotlinx.coroutines.flow.StateFlow
+import kotlinx.coroutines.flow.asStateFlow
+import kotlinx.coroutines.launch
+import javax.inject.Inject
+
+/**
+ * The drawer's unread badge (ENGAGEMENT.md phase 8).
+ *
+ * Its own view model, and its own endpoint: `/notifications/unread-count` exists
+ * precisely because this is the question asked most often and it should not make
+ * the server assemble a page of bodies to answer with one integer. Refreshed when
+ * the app resumes rather than on a timer — the tickle is what says "something
+ * happened", so polling would be a second, worse copy of push.
+ *
+ * Falls back to the cached count while offline, for the same reason the inbox
+ * does: a badge that dropped to zero because the train went into a tunnel would
+ * be telling the user they have read something they have not.
+ */
+@HiltViewModel
+class InboxBadgeViewModel @Inject constructor(
+    private val notifications: NotificationsRepository,
+    private val cache: InboxCache,
+    private val sessionManager: SessionManager,
+    private val baseUrlHolder: BaseUrlHolder,
+) : ViewModel() {
+
+    private val _unread = MutableStateFlow(0)
+    val unread: StateFlow<Int> = _unread.asStateFlow()
+
+    /** Ask the server, falling back to the snapshot. A signed-out session is zero. */
+    fun refresh() = viewModelScope.launch {
+        val user = (sessionManager.state.value as? Session.SignedIn)?.user
+        if (user == null) {
+            _unread.value = 0
+            return@launch
+        }
+        when (val result = notifications.unreadCount()) {
+            is ApiResult.Ok -> _unread.value = result.data.unread
+            else -> {
+                val owner = InboxCache.ownerKey(baseUrlHolder.current?.toString(), user.id)
+                cache.read(owner)?.let { _unread.value = it.unread }
+            }
+        }
+    }
+}

app/src/main/java/com/runicgateway/app/ui/notifications/InboxFormatting.kt

@@ -0,0 +1,34 @@
+/*
+ * SPDX-License-Identifier: GPL-3.0-or-later
+ */
+package com.runicgateway.app.ui.notifications
+
+import com.runicgateway.app.core.time.parseWireInstant
+import java.time.ZoneId
+import java.time.format.DateTimeFormatter
+import java.time.format.FormatStyle
+
+/**
+ * Render an inbox item's `createdAt` for display, in the device's own zone and
+ * locale (ENGAGEMENT.md phase 8). Pure, so it is unit-testable off-device.
+ *
+ * **Two shapes have to be accepted, and which one arrives is not the app's to
+ * decide** — see [parseWireInstant], which owns that trap for every screen that
+ * reads a timestamp, this one and the event screens (M13).
+ *
+ * Anything unparseable returns null and the row simply shows no stamp: a
+ * notification with an odd date is still worth reading.
+ */
+fun inboxTimestamp(
+    raw: String,
+    zone: ZoneId = ZoneId.systemDefault(),
+    formatter: DateTimeFormatter =
+        DateTimeFormatter.ofLocalizedDateTime(FormatStyle.MEDIUM, FormatStyle.SHORT),
+): String? {
+    val instant = parseWireInstant(raw) ?: return null
+    return try {
+        formatter.withZone(zone).format(instant)
+    } catch (_: Exception) {
+        null
+    }
+}

app/src/main/java/com/runicgateway/app/ui/notifications/InboxScreen.kt

@@ -0,0 +1,215 @@
+/*
+ * SPDX-License-Identifier: GPL-3.0-or-later
+ */
+package com.runicgateway.app.ui.notifications
+
+import androidx.compose.foundation.background
+import androidx.compose.foundation.clickable
+import androidx.compose.foundation.layout.Arrangement
+import androidx.compose.foundation.layout.Box
+import androidx.compose.foundation.layout.Column
+import androidx.compose.foundation.layout.PaddingValues
+import androidx.compose.foundation.layout.Row
+import androidx.compose.foundation.layout.fillMaxSize
+import androidx.compose.foundation.layout.fillMaxWidth
+import androidx.compose.foundation.layout.padding
+import androidx.compose.foundation.layout.size
+import androidx.compose.foundation.lazy.LazyColumn
+import androidx.compose.foundation.lazy.items
+import androidx.compose.foundation.shape.CircleShape
+import androidx.compose.material.icons.Icons
+import androidx.compose.material.icons.filled.Settings
+import androidx.compose.material3.Icon
+import androidx.compose.material3.IconButton
+import androidx.compose.material3.MaterialTheme
+import androidx.compose.material3.Text
+import androidx.compose.material3.TextButton
+import androidx.compose.runtime.Composable
+import androidx.compose.runtime.LaunchedEffect
+import androidx.compose.runtime.getValue
+import androidx.compose.ui.Alignment
+import androidx.compose.ui.Modifier
+import androidx.compose.ui.draw.clip
+import androidx.compose.ui.platform.LocalContext
+import androidx.compose.ui.res.stringResource
+import androidx.compose.ui.text.font.FontWeight
+import androidx.compose.ui.unit.dp
+import androidx.hilt.navigation.compose.hiltViewModel
+import androidx.lifecycle.compose.collectAsStateWithLifecycle
+import com.runicgateway.app.R
+import com.runicgateway.app.core.web.WebHandoff
+import com.runicgateway.app.data.api.dto.NotificationItemDto
+import com.runicgateway.app.ui.UiState
+import com.runicgateway.app.ui.components.EmptyView
+import com.runicgateway.app.ui.components.ErrorView
+import com.runicgateway.app.ui.components.LoadingView
+import com.runicgateway.app.ui.components.ShardCard
+
+/**
+ * The in-app inbox (ENGAGEMENT.md phase 8): what the engine's `inapp` channel
+ * wrote for this user, newest first.
+ *
+ * This is the drawer's "Notifications" — the settings that used to live there are
+ * one tap away behind the gear, mirroring exactly what phase 7 shipped on the web
+ * (the bare path is the inbox, `…/settings` is the preferences). It is what a
+ * tapped push tickle deep-links to, and the pull that follows the wake.
+ *
+ * **The list carries content, so it is deliberately plain text.** An item's body
+ * is the server's `toText` render, never the email HTML — that markup is table
+ * rows and inline hex with a light-only `color-scheme`, which in a themed app
+ * would be a pale card in a dark one. It also means there is no operator markup
+ * on this surface to sanitize.
+ */
+@Composable
+fun InboxScreen(
+    onOpenSettings: () -> Unit,
+    onOpenRoute: (String) -> Unit,
+    modifier: Modifier = Modifier,
+    viewModel: InboxViewModel = hiltViewModel(),
+) {
+    val state by viewModel.state.collectAsStateWithLifecycle()
+    val context = LocalContext.current
+
+    Column(modifier.fillMaxSize()) {
+        Row(
+            modifier = Modifier.fillMaxWidth().padding(start = 16.dp, end = 4.dp, top = 8.dp),
+            verticalAlignment = Alignment.CenterVertically,
+        ) {
+            Text(
+                text = if (state.unread > 0) {
+                    stringResource(R.string.inbox_unread_count, state.unread)
+                } else {
+                    stringResource(R.string.inbox_all_read)
+                },
+                style = MaterialTheme.typography.labelLarge,
+                color = MaterialTheme.colorScheme.onSurfaceVariant,
+                modifier = Modifier.weight(1f),
+            )
+            if (state.unread > 0) {
+                TextButton(onClick = viewModel::markAllRead) {
+                    Text(stringResource(R.string.inbox_mark_all_read))
+                }
+            }
+            IconButton(onClick = onOpenSettings) {
+                Icon(Icons.Filled.Settings, stringResource(R.string.inbox_open_settings))
+            }
+        }
+
+        // Showing the snapshot rather than the server's answer is said out loud: a
+        // notification surface that quietly showed a stale list would be lying
+        // about the one thing it exists to be — current.
+        if (state.fromCache) {
+            Text(
+                text = stringResource(R.string.inbox_offline_cached),
+                style = MaterialTheme.typography.bodySmall,
+                color = MaterialTheme.colorScheme.onSurfaceVariant,
+                modifier = Modifier.padding(horizontal = 16.dp, vertical = 4.dp),
+            )
+        }
+
+        when (val items = state.items) {
+            is UiState.Loading -> LoadingView()
+            is UiState.Error -> ErrorView(items.kind, onRetry = viewModel::load)
+            is UiState.Success -> if (items.data.isEmpty()) {
+                EmptyView(stringResource(R.string.inbox_empty))
+            } else {
+                InboxList(
+                    items = items.data,
+                    hasMore = state.hasMore && !state.fromCache,
+                    onEndReached = viewModel::loadMore,
+                    onOpen = { item ->
+                        viewModel.markRead(item.id)
+                        // Most items have no url at all — an inbox row is complete on
+                        // its own — and the ones that do carry a SITE-RELATIVE path.
+                        //
+                        // A path the app has a screen for opens natively (M13): an
+                        // event announcement's link is the case that made this worth
+                        // doing. Everything else resolves against the configured
+                        // shard and goes to the browser, exactly as before.
+                        val route = viewModel.routeFor(item)
+                        if (route != null) {
+                            onOpenRoute(route)
+                        } else {
+                            viewModel.linkFor(item)?.let { WebHandoff.open(context, it) }
+                        }
+                    },
+                )
+            }
+        }
+    }
+}
+
+@Composable
+private fun InboxList(
+    items: List<NotificationItemDto>,
+    hasMore: Boolean,
+    onEndReached: () -> Unit,
+    onOpen: (NotificationItemDto) -> Unit,
+) {
+    LazyColumn(
+        modifier = Modifier.fillMaxSize().padding(horizontal = 16.dp),
+        verticalArrangement = Arrangement.spacedBy(8.dp),
+        contentPadding = PaddingValues(vertical = 12.dp),
+    ) {
+        items(items, key = { it.id }) { item -> InboxCard(item, onOpen) }
+        if (hasMore) {
+            item {
+                // Paging by "the last row came into view" rather than a button: the
+                // cursor is the last id on screen, so reaching the end IS the request.
+                LaunchedEffect(items.lastOrNull()?.id) { onEndReached() }
+                Box(Modifier.fillMaxWidth().padding(16.dp), contentAlignment = Alignment.Center) {
+                    Text(
+                        stringResource(R.string.inbox_loading_more),
+                        style = MaterialTheme.typography.bodySmall,
+                        color = MaterialTheme.colorScheme.onSurfaceVariant,
+                    )
+                }
+            }
+        }
+    }
+}
+
+@Composable
+private fun InboxCard(item: NotificationItemDto, onOpen: (NotificationItemDto) -> Unit) {
+    ShardCard(Modifier.fillMaxWidth().clickable { onOpen(item) }) {
+        Column(Modifier.padding(16.dp)) {
+            Row(verticalAlignment = Alignment.CenterVertically) {
+                if (!item.read) {
+                    // The unread mark is a dot beside the title AND a heavier weight
+                    // on it: colour alone would carry the whole signal, which is not
+                    // a distinction everyone can see.
+                    Box(
+                        Modifier
+                            .padding(end = 8.dp)
+                            .size(8.dp)
+                            .clip(CircleShape)
+                            .background(MaterialTheme.colorScheme.primary),
+                    )
+                }
+                Text(
+                    text = item.title,
+                    style = MaterialTheme.typography.titleSmall,
+                    fontWeight = if (item.read) FontWeight.Normal else FontWeight.Bold,
+                    modifier = Modifier.weight(1f),
+                )
+            }
+            item.body?.takeIf { it.isNotBlank() }?.let {
+                Text(
+                    text = it,
+                    style = MaterialTheme.typography.bodyMedium,
+                    color = MaterialTheme.colorScheme.onSurfaceVariant,
+                    modifier = Modifier.padding(top = 6.dp),
+                )
+            }
+            val stamp = item.createdAt?.let { inboxTimestamp(it) }
+            if (stamp != null) {
+                Text(
+                    text = stamp,
+                    style = MaterialTheme.typography.labelSmall,
+                    color = MaterialTheme.colorScheme.onSurfaceVariant,
+                    modifier = Modifier.padding(top = 8.dp),
+                )
+            }
+        }
+    }
+}

app/src/main/java/com/runicgateway/app/ui/notifications/InboxViewModel.kt

@@ -0,0 +1,307 @@
+/*
+ * SPDX-License-Identifier: GPL-3.0-or-later
+ */
+package com.runicgateway.app.ui.notifications
+
+import androidx.lifecycle.ViewModel
+import androidx.lifecycle.viewModelScope
+import com.runicgateway.app.core.auth.Session
+import com.runicgateway.app.core.auth.SessionManager
+import com.runicgateway.app.core.inbox.InboxCache
+import com.runicgateway.app.core.net.BaseUrlHolder
+import com.runicgateway.app.core.result.ApiResult
+import com.runicgateway.app.core.result.map
+import com.runicgateway.app.data.api.dto.NotificationItemDto
+import com.runicgateway.app.data.repository.NotificationsRepository
+import com.runicgateway.app.ui.UiState
+import com.runicgateway.app.ui.navigation.resolveWebPath
+import com.runicgateway.app.ui.toUiState
+import dagger.hilt.android.lifecycle.HiltViewModel
+import kotlinx.coroutines.flow.MutableStateFlow
+import kotlinx.coroutines.flow.StateFlow
+import kotlinx.coroutines.flow.asStateFlow
+import kotlinx.coroutines.flow.distinctUntilChanged
+import kotlinx.coroutines.flow.map
+import kotlinx.coroutines.flow.update
+import kotlinx.coroutines.launch
+import javax.inject.Inject
+
+/**
+ * Drives the in-app inbox (ENGAGEMENT.md phase 8): the items the engine's `inapp`
+ * channel wrote for this user, newest first, with the unread badge and the two
+ * mark-read writes.
+ *
+ * **The tickle contract is wake-and-pull, and this is the pull.** A push tickle
+ * carries `{ stream, ref }` and nothing else by design; `ref` is a HINT that an
+ * inbox row exists, never content, and `pushChannel.js` says so in as many words —
+ * the two rows are independent and either can be retried, so a client that
+ * rendered the ref would show nothing the first time a retry reordered them. So a
+ * tap deep-links here and this refreshes; the ref is not read.
+ *
+ * **Paging is keyset, not offset.** The next page is `before = the last id on
+ * screen`, because the list gains rows at the top while it is being read and an
+ * offset would show the same item twice or skip one.
+ *
+ * **It reloads when the ACCOUNT changes, not merely when it is created.** A
+ * drawer route's view model outlives a sign-out: `navigateTopLevel` saves and
+ * restores back-stack state, so the `NavBackStackEntry` keeps its
+ * `ViewModelStore` and a view model that loaded only in `init` never runs again.
+ * Signing out and back in as somebody else showed the second account the FIRST
+ * account's inbox — titles and body text written for another person — with no
+ * request made at all, while the badge beside it showed the new account's real
+ * count, because the shell refreshes that one on every session change.
+ *
+ * [InboxCache] was never the hole: it is keyed by `(base URL, user id)` and a
+ * snapshot has never crossed an account. The hole was the in-memory state, which
+ * nothing invalidated.
+ */
+@HiltViewModel
+class InboxViewModel @Inject constructor(
+    private val notifications: NotificationsRepository,
+    private val cache: InboxCache,
+    private val sessionManager: SessionManager,
+    private val baseUrlHolder: BaseUrlHolder,
+) : ViewModel() {
+
+    data class State(
+        val items: UiState<List<NotificationItemDto>> = UiState.Loading,
+        val unread: Int = 0,
+        val hasMore: Boolean = false,
+        val loadingMore: Boolean = false,
+        val refreshing: Boolean = false,
+        /**
+         * True while what is on screen came from [InboxCache] rather than the
+         * server. The screen says so — an inbox that quietly showed a stale list
+         * would be a notification surface that lies about being current.
+         */
+        val fromCache: Boolean = false,
+        /** When that snapshot was captured; only meaningful with [fromCache]. */
+        val cachedAt: Long? = null,
+    )
+
+    private val _state = MutableStateFlow(State())
+    val state: StateFlow<State> = _state.asStateFlow()
+
+    init {
+        viewModelScope.launch {
+            sessionManager.state
+                .map { (it as? Session.SignedIn)?.user?.id }
+                .distinctUntilChanged()
+                .collect { userId ->
+                    if (userId == null) {
+                        // Signed out. The shell is already navigating away; drop the
+                        // rows rather than leave them addressable behind it.
+                        _state.value = State(items = UiState.Success(emptyList()))
+                    } else {
+                        // Reset BEFORE loading, not after: `load()` paints the cache
+                        // only when there is no `Success` on screen, so the previous
+                        // account's rows would otherwise stay up — and stay up for
+                        // the whole round trip.
+                        _state.value = State()
+                        load()
+                    }
+                }
+        }
+    }
+
+    /**
+     * Show the cached page immediately, then refresh from the server.
+     *
+     * The cache is painted first rather than after a failure so a cold open on a
+     * slow connection shows the last known inbox instead of a spinner; a
+     * successful pull replaces it, and a network failure leaves it up with
+     * [State.fromCache] set. A *server* error is a different thing from being
+     * offline and is not papered over with stale rows — unless there is nothing
+     * else to show, in which case the error is still what the screen reports.
+     */
+    fun load() = viewModelScope.launch {
+        val owner = ownerKey()
+        if (owner != null && _state.value.items !is UiState.Success) {
+            cache.read(owner)?.let { snapshot ->
+                _state.update {
+                    it.copy(
+                        items = UiState.Success(snapshot.items),
+                        unread = snapshot.unread,
+                        fromCache = true,
+                        cachedAt = snapshot.savedAt,
+                    )
+                }
+            }
+        }
+        refresh()
+    }
+
+    /** Pull the newest page. Keeps whatever is on screen until it succeeds. */
+    fun refresh() = viewModelScope.launch {
+        _state.update { it.copy(refreshing = true) }
+        when (val result = notifications.inbox()) {
+            is ApiResult.Ok -> {
+                val page = result.data
+                _state.update {
+                    it.copy(
+                        items = UiState.Success(page.items),
+                        unread = page.unread,
+                        hasMore = page.hasMore,
+                        refreshing = false,
+                        fromCache = false,
+                        cachedAt = null,
+                    )
+                }
+                ownerKey()?.let { cache.write(it, page.items, page.unread) }
+            }
+            else -> {
+                // Nothing cached to fall back on → the error IS the screen. Something
+                // cached → keep it up and label it, which is the whole point of §7's
+                // "the app degrades, it does not fail".
+                val holdCache = _state.value.items is UiState.Success && _state.value.fromCache
+                _state.update {
+                    it.copy(
+                        items = if (holdCache) it.items else result.map { page -> page.items }.toUiState(),
+                        refreshing = false,
+                    )
+                }
+            }
+        }
+    }
+
+    /**
+     * Append the next page.
+     *
+     * A no-op while one is in flight, when the server said there is no next page,
+     * or while the list is the cached snapshot — paging a cache we know to be one
+     * page long would ask the server for `before` an id it may no longer have.
+     */
+    fun loadMore() = viewModelScope.launch {
+        val current = _state.value
+        val shown = (current.items as? UiState.Success)?.data ?: return@launch
+        if (current.loadingMore || !current.hasMore || current.fromCache) return@launch
+        val cursor = shown.lastOrNull()?.id ?: return@launch
+
+        _state.update { it.copy(loadingMore = true) }
+        when (val result = notifications.inbox(before = cursor)) {
+            is ApiResult.Ok -> {
+                // Guard the same id arriving twice: a keyset window can shift under
+                // a concurrent write, and a duplicate id in a LazyColumn key crashes.
+                val seen = shown.mapTo(mutableSetOf()) { it.id }
+                val appended = result.data.items.filterNot { it.id in seen }
+                _state.update {
+                    it.copy(
+                        items = UiState.Success(shown + appended),
+                        unread = result.data.unread,
+                        hasMore = result.data.hasMore,
+                        loadingMore = false,
+                    )
+                }
+            }
+            // A failed "more" leaves the pages already read alone — losing them
+            // because the fourth page timed out would be worse than stopping.
+            else -> _state.update { it.copy(loadingMore = false, hasMore = false) }
+        }
+    }
+
+    /**
+     * Mark one item read, optimistically.
+     *
+     * The row flips locally before the call so the tap feels immediate, and the
+     * server's post-write `unread` replaces the local guess when it lands. A
+     * failure is not rolled back: read-ness is the least consequential thing in
+     * the app to get briefly wrong, and un-reading a row under the user's finger
+     * looks like a bug. The next refresh corrects it.
+     */
+    fun markRead(id: Long) = viewModelScope.launch {
+        val shown = (_state.value.items as? UiState.Success)?.data ?: return@launch
+        if (shown.firstOrNull { it.id == id }?.read != false) return@launch
+
+        _state.update { current ->
+            current.copy(
+                items = UiState.Success(shown.map { if (it.id == id) it.copy(read = true) else it }),
+                unread = (current.unread - 1).coerceAtLeast(0),
+            )
+        }
+        when (val result = notifications.markRead(id)) {
+            is ApiResult.Ok -> _state.update { it.copy(unread = result.data.unread) }
+            else -> Unit
+        }
+        cacheCurrent()
+    }
+
+    /** Mark the whole inbox read. Same optimism, and the same reason for it. */
+    fun markAllRead() = viewModelScope.launch {
+        val shown = (_state.value.items as? UiState.Success)?.data ?: return@launch
+        _state.update {
+            it.copy(items = UiState.Success(shown.map { item -> item.copy(read = true) }), unread = 0)
+        }
+        notifications.markAllRead()
+        cacheCurrent()
+    }
+
+    /**
+     * The absolute link for an item, or null when it has none this app can open.
+     *
+     * **An item's `url` is SITE-RELATIVE** — `/guilds/the-silver-anvil/forum/403`
+     * is what the server writes, because it is rendered from the template's button
+     * block for a browser that is already on the site. A phone is not, so it has to
+     * be resolved against the configured base or every link in the inbox is dead;
+     * the live rig is what caught that.
+     *
+     * `HttpUrl.resolve` does both jobs: it absolutises a relative path and it
+     * returns null for anything that would not end up as http(s) — a `javascript:`
+     * or `intent:` url in a notification body opens nothing at all.
+     */
+    fun linkFor(item: NotificationItemDto): String? {
+        val raw = item.url?.trim().orEmpty()
+        if (raw.isEmpty()) return null
+        return baseUrlHolder.current?.resolve(raw)?.toString()
+    }
+
+    /**
+     * The app route this item opens natively, or null when it has none and
+     * [linkFor] should hand it to a browser (M13).
+     *
+     * **Why this exists at all:** events Phase 14a gave the six public `event.`
+     * triggers an `eventUrl` of the form `/site/events/<slug>?run=<id>`, so an
+     * inbox row about an event now has a native destination — and opening a
+     * Custom Tab onto a page the app itself renders is a worse answer than it was
+     * when there was no such page.
+     *
+     * **It reuses `resolveWebPath` rather than adding a second link-routing
+     * mechanism.** That function is already the app's read of the site's own route
+     * table, it already answers null for everything it does not recognise, and
+     * every path it does not recognise still hands off exactly as before. Adding a
+     * parser here would put the decision in two places.
+     *
+     * The item's url is site-relative by contract, but an absolute one on this
+     * host is accepted too: the shape is the server's to change, and a link that
+     * opened the browser only because it arrived fully qualified would be a
+     * puzzle. An absolute url on ANOTHER host is not ours to route — the app has
+     * no screen for somebody else's site — so it falls through to the browser.
+     */
+    fun routeFor(item: NotificationItemDto): String? {
+        val raw = item.url?.trim().orEmpty()
+        if (raw.isEmpty()) return null
+        val base = baseUrlHolder.current ?: return null
+        val resolved = base.resolve(raw) ?: return null
+        if (resolved.host != base.host) return null
+        val query = resolved.query
+        return resolveWebPath(resolved.encodedPath + if (query.isNullOrEmpty()) "" else "?$query")
+    }
+
+    /**
+     * Keep the snapshot in step with a local read.
+     *
+     * Without this, going offline right after reading everything would bring the
+     * badge back on the next cold open. Only ever written for the account that
+     * owns it — [InboxCache] scopes by (base URL, user id).
+     */
+    private suspend fun cacheCurrent() {
+        val owner = ownerKey() ?: return
+        val current = _state.value
+        val shown = (current.items as? UiState.Success)?.data ?: return
+        cache.write(owner, shown, current.unread)
+    }
+
+    private fun ownerKey(): String? {
+        val user = (sessionManager.state.value as? Session.SignedIn)?.user ?: return null
+        return InboxCache.ownerKey(baseUrlHolder.current?.toString(), user.id)
+    }
+}

app/src/main/java/com/runicgateway/app/ui/notifications/NotificationSettingsScreen.kt

@@ -0,0 +1,271 @@
+/*
+ * SPDX-License-Identifier: GPL-3.0-or-later
+ */
+package com.runicgateway.app.ui.notifications
+
+import android.Manifest
+import android.os.Build
+import androidx.activity.compose.rememberLauncherForActivityResult
+import androidx.activity.result.contract.ActivityResultContracts
+import androidx.compose.foundation.layout.Arrangement
+import androidx.compose.foundation.layout.Column
+import androidx.compose.foundation.layout.FlowRow
+import androidx.compose.foundation.layout.ExperimentalLayoutApi
+import androidx.compose.foundation.layout.Row
+import androidx.compose.foundation.layout.Spacer
+import androidx.compose.foundation.layout.fillMaxSize
+import androidx.compose.foundation.layout.fillMaxWidth
+import androidx.compose.foundation.layout.height
+import androidx.compose.foundation.layout.padding
+import androidx.compose.foundation.rememberScrollState
+import androidx.compose.foundation.verticalScroll
+import androidx.compose.material3.FilterChip
+import androidx.compose.material3.HorizontalDivider
+import androidx.compose.material3.MaterialTheme
+import androidx.compose.material3.Switch
+import androidx.compose.material3.Text
+import androidx.compose.runtime.Composable
+import androidx.compose.runtime.getValue
+import androidx.compose.ui.Alignment
+import androidx.compose.ui.Modifier
+import androidx.compose.ui.res.stringResource
+import androidx.compose.ui.text.font.FontStyle
+import androidx.compose.ui.unit.dp
+import androidx.hilt.navigation.compose.hiltViewModel
+import androidx.lifecycle.compose.collectAsStateWithLifecycle
+import com.runicgateway.app.R
+import com.runicgateway.app.data.api.dto.NotificationChannelDto
+import com.runicgateway.app.data.api.dto.NotificationChannelItemDto
+import com.runicgateway.app.data.api.dto.NotificationChannelPrefsDto
+import com.runicgateway.app.ui.UiState
+import com.runicgateway.app.ui.components.EmptyView
+import com.runicgateway.app.ui.components.ErrorView
+import com.runicgateway.app.ui.components.LoadingView
+import com.runicgateway.app.ui.components.SectionLabel
+
+/**
+ * The notification **settings** screen (PLAN.md §11, ENGAGEMENT.md phase 8): every
+ * subscribable id with a control per channel that applies to it.
+ *
+ * It used to be the drawer's "Notifications"; that entry is the inbox now and this
+ * is behind its gear, which is the arrangement phase 7 shipped on the web. What
+ * changed underneath is bigger than the move: the screen asks
+ * `/notifications/channels` and so can express email and on-site preferences, not
+ * just whether a stream pushes.
+ *
+ * **A channel with two modes gets a switch and one with three gets chips**, and
+ * which is which comes off the wire — `email` is the one that supports `digest`
+ * today, and a fourth channel with its own modes would render correctly here
+ * without an app release.
+ */
+@Composable
+fun NotificationSettingsScreen(
+    modifier: Modifier = Modifier,
+    viewModel: NotificationSettingsViewModel = hiltViewModel(),
+) {
+    val state by viewModel.state.collectAsStateWithLifecycle()
+
+    // Ask once for POST_NOTIFICATIONS when the user first switches a push mode on
+    // (API 33+). Email and in-app need no permission — only push posts anything.
+    val permissionLauncher = rememberLauncherForActivityResult(
+        ActivityResultContracts.RequestPermission(),
+    ) { /* granted or not, the preference is already saved server-side */ }
+
+    fun ensureNotificationPermission() {
+        if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.TIRAMISU) {
+            permissionLauncher.launch(Manifest.permission.POST_NOTIFICATIONS)
+        }
+    }
+
+    Column(
+        modifier = modifier
+            .fillMaxSize()
+            .verticalScroll(rememberScrollState())
+            .padding(16.dp),
+    ) {
+        Text(
+            text = stringResource(R.string.notifications_title),
+            style = MaterialTheme.typography.titleLarge,
+        )
+        Spacer(Modifier.height(4.dp))
+        Text(
+            text = stringResource(R.string.notifications_subtitle),
+            style = MaterialTheme.typography.bodyMedium,
+            color = MaterialTheme.colorScheme.onSurfaceVariant,
+        )
+        Spacer(Modifier.height(16.dp))
+
+        state.feedback?.let { fb ->
+            Text(
+                text = stringResource(fb.messageRes),
+                style = MaterialTheme.typography.bodyMedium,
+                color = if (fb.ok) MaterialTheme.colorScheme.primary else MaterialTheme.colorScheme.error,
+                modifier = Modifier.padding(bottom = 12.dp),
+            )
+        }
+
+        // A shard with no push relay still has email and on-site preferences worth
+        // setting, so this is a note beside the list now rather than the whole
+        // screen — which is what it had to be when push was all there was.
+        if (!state.supported) {
+            Text(
+                text = stringResource(R.string.notifications_unsupported),
+                style = MaterialTheme.typography.bodySmall,
+                color = MaterialTheme.colorScheme.onSurfaceVariant,
+                fontStyle = FontStyle.Italic,
+                modifier = Modifier.padding(bottom = 12.dp),
+            )
+        }
+
+        when (val prefs = state.prefs) {
+            is UiState.Loading -> LoadingView()
+            is UiState.Error -> ErrorView(kind = prefs.kind, onRetry = viewModel::load)
+            is UiState.Success -> ChannelPrefsList(
+                prefs = prefs.data,
+                hasLinkedAccount = state.hasLinkedAccount,
+                pushSupported = state.supported,
+                busy = state.busy,
+                onSetMode = { item, channel, mode ->
+                    if (channel == CHANNEL_PUSH && mode != MODE_OFF) ensureNotificationPermission()
+                    viewModel.setMode(item, channel, mode)
+                },
+            )
+        }
+    }
+}
+
+@Composable
+private fun ChannelPrefsList(
+    prefs: NotificationChannelPrefsDto,
+    hasLinkedAccount: Boolean,
+    pushSupported: Boolean,
+    busy: Boolean,
+    onSetMode: (NotificationChannelItemDto, String, String) -> Unit,
+) {
+    if (prefs.items.isEmpty()) {
+        EmptyView(message = stringResource(R.string.notifications_empty))
+        return
+    }
+    val channelsById = prefs.channels.associateBy { it.id }
+    val (personal, general) = prefs.items.partition { it.personal }
+
+    if (general.isNotEmpty()) {
+        SectionLabel(stringResource(R.string.notifications_section_general))
+        Spacer(Modifier.height(8.dp))
+        general.forEach { item ->
+            ItemRow(item, channelsById, hint = null, enabled = !busy, pushSupported = pushSupported, onSetMode = onSetMode)
+            HorizontalDivider()
+        }
+        Spacer(Modifier.height(20.dp))
+    }
+
+    if (personal.isNotEmpty()) {
+        SectionLabel(stringResource(R.string.notifications_section_personal))
+        Spacer(Modifier.height(8.dp))
+        personal.forEach { item ->
+            val selectable = itemSelectable(item, hasLinkedAccount)
+            ItemRow(
+                item = item,
+                channelsById = channelsById,
+                hint = if (!selectable) stringResource(R.string.notifications_requires_link) else null,
+                enabled = !busy && selectable,
+                pushSupported = pushSupported,
+                onSetMode = onSetMode,
+            )
+            HorizontalDivider()
+        }
+    }
+}
+
+@Composable
+private fun ItemRow(
+    item: NotificationChannelItemDto,
+    channelsById: Map<String, NotificationChannelDto>,
+    hint: String?,
+    enabled: Boolean,
+    pushSupported: Boolean,
+    onSetMode: (NotificationChannelItemDto, String, String) -> Unit,
+) {
+    Column(Modifier.fillMaxWidth().padding(vertical = 12.dp)) {
+        Text(
+            text = item.label,
+            style = MaterialTheme.typography.bodyLarge,
+            color = if (enabled) MaterialTheme.colorScheme.onSurface else MaterialTheme.colorScheme.onSurfaceVariant,
+        )
+        Text(
+            text = hint ?: item.description,
+            style = MaterialTheme.typography.bodySmall,
+            color = MaterialTheme.colorScheme.onSurfaceVariant,
+            fontStyle = if (hint != null) FontStyle.Italic else FontStyle.Normal,
+        )
+        // The item's OWN channel list, in the registry's order. An id nothing can
+        // push carries no push control at all, rather than a dead switch.
+        item.channels.forEach { channelId ->
+            val channel = channelsById[channelId] ?: return@forEach
+            if (channelId == CHANNEL_PUSH && !pushSupported) return@forEach
+            ChannelControl(
+                channel = channel,
+                mode = item.modes[channelId] ?: channel.defaultMode,
+                enabled = enabled,
+                onSetMode = { mode -> onSetMode(item, channelId, mode) },
+            )
+        }
+    }
+}
+
+@OptIn(ExperimentalLayoutApi::class)
+@Composable
+private fun ChannelControl(
+    channel: NotificationChannelDto,
+    mode: String,
+    enabled: Boolean,
+    onSetMode: (String) -> Unit,
+) {
+    val modes = channel.modes.ifEmpty { listOf(MODE_OFF) }
+    Row(
+        modifier = Modifier.fillMaxWidth().padding(top = 8.dp),
+        verticalAlignment = Alignment.CenterVertically,
+    ) {
+        Text(
+            text = channel.label,
+            style = MaterialTheme.typography.bodyMedium,
+            color = MaterialTheme.colorScheme.onSurfaceVariant,
+            modifier = Modifier.weight(1f).padding(end = 12.dp),
+        )
+        // Two modes is a yes/no question and reads best as a switch; three is a
+        // choice and needs its options named — `digest` means nothing as an
+        // unlabelled third state.
+        if (modes.size == 2 && modes.contains(MODE_OFF)) {
+            val on = modes.first { it != MODE_OFF }
+            Switch(
+                checked = mode != MODE_OFF,
+                onCheckedChange = { checked -> onSetMode(if (checked) on else MODE_OFF) },
+                enabled = enabled,
+            )
+        } else {
+            FlowRow(horizontalArrangement = Arrangement.spacedBy(6.dp)) {
+                modes.forEach { candidate ->
+                    FilterChip(
+                        selected = candidate == mode,
+                        onClick = { if (candidate != mode) onSetMode(candidate) },
+                        enabled = enabled,
+                        label = { Text(modeLabel(candidate)) },
+                    )
+                }
+            }
+        }
+    }
+}
+
+/**
+ * Copy for a delivery mode. A mode this build has never heard of is labelled with
+ * its own wire name rather than hidden — the server accepts it, so a chip reading
+ * `weekly` is more use to the person in front of it than a control that vanished.
+ */
+@Composable
+private fun modeLabel(mode: String): String = when (mode) {
+    MODE_OFF -> stringResource(R.string.notifications_mode_off)
+    "instant" -> stringResource(R.string.notifications_mode_instant)
+    "digest" -> stringResource(R.string.notifications_mode_digest)
+    else -> mode
+}

app/src/main/java/com/runicgateway/app/ui/notifications/NotificationSettingsViewModel.kt

@@ -0,0 +1,167 @@
+/*
+ * SPDX-License-Identifier: GPL-3.0-or-later
+ */
+package com.runicgateway.app.ui.notifications
+
+import androidx.annotation.StringRes
+import androidx.lifecycle.ViewModel
+import androidx.lifecycle.viewModelScope
+import com.runicgateway.app.R
+import com.runicgateway.app.core.auth.Session
+import com.runicgateway.app.core.auth.SessionManager
+import com.runicgateway.app.core.push.PushManager
+import com.runicgateway.app.core.result.ApiResult
+import com.runicgateway.app.data.api.dto.NotificationChannelItemDto
+import com.runicgateway.app.data.api.dto.NotificationChannelPrefsDto
+import com.runicgateway.app.data.repository.NotificationsRepository
+import com.runicgateway.app.data.repository.PlayerShardRepository
+import com.runicgateway.app.ui.UiState
+import com.runicgateway.app.ui.toUiState
+import dagger.hilt.android.lifecycle.HiltViewModel
+import kotlinx.coroutines.flow.MutableStateFlow
+import kotlinx.coroutines.flow.StateFlow
+import kotlinx.coroutines.flow.asStateFlow
+import kotlinx.coroutines.flow.distinctUntilChanged
+import kotlinx.coroutines.flow.map
+import kotlinx.coroutines.flow.update
+import kotlinx.coroutines.launch
+import javax.inject.Inject
+
+/** The push channel's id — the one channel that also drives a device registration. */
+const val CHANNEL_PUSH = "push"
+
+/** The mode every channel accepts, and the one that means "do not deliver". */
+const val MODE_OFF = "off"
+
+/**
+ * Drives the notification **settings** screen (PLAN.md §11, ENGAGEMENT.md phase 8).
+ *
+ * **This screen moved off `/notifications/subscriptions` onto
+ * `/notifications/channels`.** The old endpoint asked one question — is push on
+ * for this stream — and there are now three channels to ask it of. The server
+ * keeps `notification_subscriptions` as the push projection of the new table and
+ * fans every write to either into the other, so the shipped APK's screen went on
+ * working the whole time and this one is not a migration anybody has to run.
+ *
+ * **The controls are rendered from the wire, never from a hardcoded three.** Each
+ * item names the channels that apply to it — a trigger-only id carries no `push`
+ * because nothing is registered to push it — and each channel names the modes it
+ * accepts, which is how `email`'s `digest` reaches the app without an app release.
+ * The modes the server sends are the EFFECTIVE ones (it has already substituted
+ * each channel's default), so this class never re-implements the defaulting.
+ */
+@HiltViewModel
+class NotificationSettingsViewModel @Inject constructor(
+    private val notifications: NotificationsRepository,
+    private val playerShard: PlayerShardRepository,
+    private val pushManager: PushManager,
+    sessionManager: SessionManager,
+) : ViewModel() {
+
+    data class Feedback(val ok: Boolean, @param:StringRes val messageRes: Int)
+
+    data class State(
+        val prefs: UiState<NotificationChannelPrefsDto> = UiState.Loading,
+        /** Whether the user has ≥1 linked game account — personal streams need it. */
+        val hasLinkedAccount: Boolean = false,
+        /** Whether this shard advertises a push relay at all (else the screen says so). */
+        val supported: Boolean = true,
+        val busy: Boolean = false,
+        val feedback: Feedback? = null,
+    )
+
+    private val _state = MutableStateFlow(State())
+    val state: StateFlow<State> = _state.asStateFlow()
+
+    init {
+        viewModelScope.launch {
+            pushManager.supported.collect { supported -> _state.update { it.copy(supported = supported) } }
+        }
+        // Reloaded on an account change for the reason the inbox is, and one
+        // reason more: these controls are WRITTEN from. A screen still rendering
+        // the previous account's preferences would send this account's PUT built
+        // out of them, so a stale render here corrupts rather than merely
+        // discloses.
+        viewModelScope.launch {
+            sessionManager.state
+                .map { (it as? Session.SignedIn)?.user?.id }
+                .distinctUntilChanged()
+                .collect { userId -> if (userId != null) load() }
+        }
+    }
+
+    fun load() {
+        _state.update { it.copy(prefs = UiState.Loading) }
+        viewModelScope.launch {
+            _state.update { it.copy(prefs = notifications.channelPrefs().toUiState()) }
+            // A linked game account gates the personal streams; failure → treat as none.
+            val linked = (playerShard.accounts() as? ApiResult.Ok)?.data?.isNotEmpty() == true
+            _state.update { it.copy(hasLinkedAccount = linked) }
+        }
+    }
+
+    fun clearFeedback() = _state.update { it.copy(feedback = null) }
+
+    /**
+     * Set one (item, channel) pair.
+     *
+     * One pair, one sparse PUT: the endpoint writes only what it is given, so a
+     * toggle cannot disturb a channel this screen is not showing — and the
+     * response is the full stored truth, which is what the screen re-renders
+     * from. An entry the server drops (an unknown id, an inapplicable channel)
+     * therefore shows up as the control springing back, not as a silent lie.
+     */
+    fun setMode(item: NotificationChannelItemDto, channel: String, mode: String) {
+        val current = _state.value
+        if (current.busy) return
+        if (channel == CHANNEL_PUSH && !itemSelectable(item, current.hasLinkedAccount)) return
+
+        _state.update { it.copy(busy = true, feedback = null) }
+        viewModelScope.launch {
+            when (val result = notifications.setChannelMode(item.id, channel, mode)) {
+                is ApiResult.Ok -> {
+                    _state.update { it.copy(prefs = UiState.Success(result.data)) }
+                    if (channel == CHANNEL_PUSH) reconcilePush(result.data) else finish(true, R.string.notifications_saved)
+                }
+                is ApiResult.NetworkError -> finish(false, R.string.error_network)
+                is ApiResult.HttpError -> finish(false, R.string.notifications_save_error)
+            }
+        }
+    }
+
+    /**
+     * Register or unregister the device to match the stored push set (PLAN.md §11).
+     *
+     * Read from the RESPONSE rather than from what was just sent, because the
+     * server may have dropped the entry — and because "is any push mode on" is a
+     * question about the whole table, not about the row that changed.
+     */
+    private suspend fun reconcilePush(prefs: NotificationChannelPrefsDto) {
+        val anyPushOn = prefs.items.any { item ->
+            val mode = item.modes[CHANNEL_PUSH]
+            mode != null && mode != MODE_OFF
+        }
+        if (!anyPushOn) {
+            pushManager.disable()
+            finish(true, R.string.notifications_all_off)
+            return
+        }
+        when (val res = pushManager.enable()) {
+            is PushManager.PushResult.Enabled -> finish(true, R.string.notifications_saved)
+            is PushManager.PushResult.Unsupported -> finish(false, R.string.notifications_unsupported)
+            is PushManager.PushResult.NotSignedIn -> finish(false, R.string.notifications_save_error)
+            is PushManager.PushResult.Failed ->
+                finish(false, if (res.status == 400) R.string.notifications_relay_error else R.string.notifications_save_error)
+        }
+    }
+
+    private fun finish(ok: Boolean, @StringRes messageRes: Int) =
+        _state.update { it.copy(busy = false, feedback = Feedback(ok, messageRes)) }
+}
+
+/**
+ * Whether an item's controls are selectable for a user: a personal stream needs a
+ * linked game account (PLAN.md §11). Pure so the gating is unit-tested without Compose.
+ */
+fun itemSelectable(item: NotificationChannelItemDto, hasLinkedAccount: Boolean): Boolean =
+    !item.requiresLinkedAccount || hasLinkedAccount

app/src/main/java/com/runicgateway/app/ui/notifications/NotificationsScreen.kt

@@ -1,182 +0,0 @@
-/*
- * SPDX-License-Identifier: GPL-3.0-or-later
- */
-package com.runicgateway.app.ui.notifications
-
-import android.Manifest
-import android.os.Build
-import androidx.activity.compose.rememberLauncherForActivityResult
-import androidx.activity.result.contract.ActivityResultContracts
-import androidx.compose.foundation.layout.Column
-import androidx.compose.foundation.layout.Row
-import androidx.compose.foundation.layout.Spacer
-import androidx.compose.foundation.layout.fillMaxSize
-import androidx.compose.foundation.layout.fillMaxWidth
-import androidx.compose.foundation.layout.height
-import androidx.compose.foundation.layout.padding
-import androidx.compose.foundation.rememberScrollState
-import androidx.compose.foundation.verticalScroll
-import androidx.compose.material3.HorizontalDivider
-import androidx.compose.material3.MaterialTheme
-import androidx.compose.material3.Switch
-import androidx.compose.material3.Text
-import androidx.compose.runtime.Composable
-import androidx.compose.runtime.getValue
-import androidx.compose.ui.Alignment
-import androidx.compose.ui.Modifier
-import androidx.compose.ui.platform.LocalContext
-import androidx.compose.ui.res.stringResource
-import androidx.compose.ui.text.font.FontStyle
-import androidx.compose.ui.unit.dp
-import androidx.hilt.navigation.compose.hiltViewModel
-import androidx.lifecycle.compose.collectAsStateWithLifecycle
-import com.runicgateway.app.R
-import com.runicgateway.app.data.api.dto.NotificationStreamDto
-import com.runicgateway.app.ui.UiState
-import com.runicgateway.app.ui.components.EmptyView
-import com.runicgateway.app.ui.components.ErrorView
-import com.runicgateway.app.ui.components.LoadingView
-import com.runicgateway.app.ui.components.SectionLabel
-
-/**
- * The Notifications settings screen (PLAN.md §11, M7 Part 2 work item 6): the
- * subscribable catalog with per-stream toggles. Personal streams are greyed until a
- * game account is linked; turning a stream on requests the POST_NOTIFICATIONS
- * permission (API 33+) and registers the device, turning them all off unregisters it.
- */
-@Composable
-fun NotificationsScreen(
-    modifier: Modifier = Modifier,
-    viewModel: NotificationsViewModel = hiltViewModel(),
-) {
-    val state by viewModel.state.collectAsStateWithLifecycle()
-    val context = LocalContext.current
-
-    // Ask once for POST_NOTIFICATIONS when the user first enables a stream (API 33+).
-    val permissionLauncher = rememberLauncherForActivityResult(
-        ActivityResultContracts.RequestPermission(),
-    ) { /* granted or not, the subscription is already saved server-side */ }
-
-    fun ensureNotificationPermission() {
-        if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.TIRAMISU) {
-            permissionLauncher.launch(Manifest.permission.POST_NOTIFICATIONS)
-        }
-    }
-
-    Column(
-        modifier = modifier
-            .fillMaxSize()
-            .verticalScroll(rememberScrollState())
-            .padding(16.dp),
-    ) {
-        Text(
-            text = stringResource(R.string.notifications_title),
-            style = MaterialTheme.typography.titleLarge,
-        )
-        Spacer(Modifier.height(4.dp))
-        Text(
-            text = stringResource(R.string.notifications_subtitle),
-            style = MaterialTheme.typography.bodyMedium,
-            color = MaterialTheme.colorScheme.onSurfaceVariant,
-        )
-        Spacer(Modifier.height(16.dp))
-
-        if (!state.supported) {
-            EmptyView(message = stringResource(R.string.notifications_unsupported))
-            return@Column
-        }
-
-        state.feedback?.let { fb ->
-            Text(
-                text = stringResource(fb.messageRes),
-                style = MaterialTheme.typography.bodyMedium,
-                color = if (fb.ok) MaterialTheme.colorScheme.primary else MaterialTheme.colorScheme.error,
-                modifier = Modifier.padding(bottom = 12.dp),
-            )
-        }
-
-        when (val catalog = state.catalog) {
-            is UiState.Loading -> LoadingView()
-            is UiState.Error -> ErrorView(kind = catalog.kind, onRetry = viewModel::load)
-            is UiState.Success -> StreamList(
-                streams = catalog.data,
-                subscribed = state.subscribed,
-                hasLinkedAccount = state.hasLinkedAccount,
-                busy = state.busy,
-                onToggle = { stream, on ->
-                    if (on) ensureNotificationPermission()
-                    viewModel.setSubscribed(stream, on)
-                },
-            )
-        }
-    }
-}
-
-@Composable
-private fun StreamList(
-    streams: List<NotificationStreamDto>,
-    subscribed: Set<String>,
-    hasLinkedAccount: Boolean,
-    busy: Boolean,
-    onToggle: (NotificationStreamDto, Boolean) -> Unit,
-) {
-    if (streams.isEmpty()) {
-        EmptyView(message = stringResource(R.string.notifications_empty))
-        return
-    }
-    val (personal, general) = streams.partition { it.personal }
-
-    if (general.isNotEmpty()) {
-        SectionLabel(stringResource(R.string.notifications_section_general))
-        Spacer(Modifier.height(8.dp))
-        general.forEach { stream ->
-            StreamRow(stream, subscribed.contains(stream.id), enabled = !busy, hint = null) { on ->
-                onToggle(stream, on)
-            }
-            HorizontalDivider()
-        }
-        Spacer(Modifier.height(20.dp))
-    }
-
-    if (personal.isNotEmpty()) {
-        SectionLabel(stringResource(R.string.notifications_section_personal))
-        Spacer(Modifier.height(8.dp))
-        personal.forEach { stream ->
-            val selectable = streamSelectable(stream, hasLinkedAccount)
-            val hint = if (!selectable) stringResource(R.string.notifications_requires_link) else null
-            StreamRow(stream, subscribed.contains(stream.id) && selectable, enabled = !busy && selectable, hint = hint) { on ->
-                onToggle(stream, on)
-            }
-            HorizontalDivider()
-        }
-    }
-}
-
-@Composable
-private fun StreamRow(
-    stream: NotificationStreamDto,
-    checked: Boolean,
-    enabled: Boolean,
-    hint: String?,
-    onToggle: (Boolean) -> Unit,
-) {
-    Row(
-        modifier = Modifier.fillMaxWidth().padding(vertical = 12.dp),
-        verticalAlignment = Alignment.CenterVertically,
-    ) {
-        Column(modifier = Modifier.weight(1f).padding(end = 12.dp)) {
-            Text(
-                text = stream.label,
-                style = MaterialTheme.typography.bodyLarge,
-                color = if (enabled) MaterialTheme.colorScheme.onSurface else MaterialTheme.colorScheme.onSurfaceVariant,
-            )
-            Text(
-                text = hint ?: stream.description,
-                style = MaterialTheme.typography.bodySmall,
-                color = MaterialTheme.colorScheme.onSurfaceVariant,
-                fontStyle = if (hint != null) FontStyle.Italic else FontStyle.Normal,
-            )
-        }
-        Switch(checked = checked, onCheckedChange = onToggle, enabled = enabled)
-    }
-}

app/src/main/java/com/runicgateway/app/ui/notifications/NotificationsViewModel.kt

@@ -1,135 +0,0 @@
-/*
- * SPDX-License-Identifier: GPL-3.0-or-later
- */
-package com.runicgateway.app.ui.notifications
-
-import androidx.annotation.StringRes
-import androidx.lifecycle.ViewModel
-import androidx.lifecycle.viewModelScope
-import com.runicgateway.app.R
-import com.runicgateway.app.core.push.PushManager
-import com.runicgateway.app.core.result.ApiResult
-import com.runicgateway.app.data.api.dto.NotificationStreamDto
-import com.runicgateway.app.data.repository.NotificationsRepository
-import com.runicgateway.app.data.repository.PlayerShardRepository
-import com.runicgateway.app.ui.UiState
-import com.runicgateway.app.ui.toUiState
-import dagger.hilt.android.lifecycle.HiltViewModel
-import kotlinx.coroutines.flow.MutableStateFlow
-import kotlinx.coroutines.flow.StateFlow
-import kotlinx.coroutines.flow.asStateFlow
-import kotlinx.coroutines.flow.update
-import kotlinx.coroutines.launch
-import javax.inject.Inject
-
-/**
- * Drives the Notifications settings screen (PLAN.md §11, M7 Part 2 work item 6):
- * the stream catalog with per-stream toggles bound to
- * `GET/PUT /auth/me/notifications/subscriptions`. A **personal** stream is greyed
- * until the user has a linked game account (§11), and turning the opt-in set
- * non-empty/empty drives the [PushManager] to register/unregister the device.
- */
-@HiltViewModel
-class NotificationsViewModel @Inject constructor(
-    private val notifications: NotificationsRepository,
-    private val playerShard: PlayerShardRepository,
-    private val pushManager: PushManager,
-) : ViewModel() {
-
-    data class Feedback(val ok: Boolean, @param:StringRes val messageRes: Int)
-
-    data class State(
-        val catalog: UiState<List<NotificationStreamDto>> = UiState.Loading,
-        val subscribed: Set<String> = emptySet(),
-        /** Whether the user has ≥1 linked game account — personal streams need it. */
-        val hasLinkedAccount: Boolean = false,
-        /** Whether this shard advertises a push relay at all (else the screen says so). */
-        val supported: Boolean = true,
-        val busy: Boolean = false,
-        val feedback: Feedback? = null,
-    )
-
-    private val _state = MutableStateFlow(State())
-    val state: StateFlow<State> = _state.asStateFlow()
-
-    init {
-        viewModelScope.launch {
-            pushManager.supported.collect { supported -> _state.update { it.copy(supported = supported) } }
-        }
-        load()
-    }
-
-    fun load() {
-        _state.update { it.copy(catalog = UiState.Loading) }
-        viewModelScope.launch {
-            val catalog = notifications.streams().let { result ->
-                when (result) {
-                    is ApiResult.Ok -> ApiResult.Ok(result.data.streams)
-                    is ApiResult.HttpError -> result
-                    is ApiResult.NetworkError -> result
-                }
-            }
-            _state.update { it.copy(catalog = catalog.toUiState()) }
-
-            when (val subs = notifications.subscriptions()) {
-                is ApiResult.Ok -> _state.update { it.copy(subscribed = subs.data.streams.toSet()) }
-                else -> Unit
-            }
-            // A linked game account gates the personal streams; failure → treat as none.
-            val linked = (playerShard.accounts() as? ApiResult.Ok)?.data?.isNotEmpty() == true
-            _state.update { it.copy(hasLinkedAccount = linked) }
-        }
-    }
-
-    fun clearFeedback() = _state.update { it.copy(feedback = null) }
-
-    /** Toggle [stream]; refuses a personal stream with no linked account. */
-    fun setSubscribed(stream: NotificationStreamDto, on: Boolean) {
-        val s = _state.value
-        if (s.busy) return
-        if (on && !streamSelectable(stream, s.hasLinkedAccount)) return
-        val next = if (on) s.subscribed + stream.id else s.subscribed - stream.id
-
-        _state.update { it.copy(busy = true, feedback = null) }
-        viewModelScope.launch {
-            when (val result = notifications.setSubscriptions(next.toList())) {
-                is ApiResult.Ok -> {
-                    val stored = result.data.streams.toSet()
-                    _state.update { it.copy(subscribed = stored) }
-                    reconcilePush(stored)
-                }
-                is ApiResult.NetworkError -> finish(false, R.string.error_network)
-                is ApiResult.HttpError -> finish(false, R.string.notifications_save_error)
-            }
-        }
-    }
-
-    /**
-     * Register or unregister the device to match the opted-in set (PLAN.md §11:
-     * register when signed-in + subscribed, unregister when the set empties).
-     */
-    private suspend fun reconcilePush(subscribed: Set<String>) {
-        if (subscribed.isEmpty()) {
-            pushManager.disable()
-            finish(true, R.string.notifications_all_off)
-            return
-        }
-        when (val res = pushManager.enable()) {
-            is PushManager.PushResult.Enabled -> finish(true, R.string.notifications_saved)
-            is PushManager.PushResult.Unsupported -> finish(false, R.string.notifications_unsupported)
-            is PushManager.PushResult.NotSignedIn -> finish(false, R.string.notifications_save_error)
-            is PushManager.PushResult.Failed ->
-                finish(false, if (res.status == 400) R.string.notifications_relay_error else R.string.notifications_save_error)
-        }
-    }
-
-    private fun finish(ok: Boolean, @StringRes messageRes: Int) =
-        _state.update { it.copy(busy = false, feedback = Feedback(ok, messageRes)) }
-}
-
-/**
- * Whether a stream's toggle is selectable for a user: a personal stream needs a
- * linked game account (PLAN.md §11). Pure so the gating is unit-tested without Compose.
- */
-fun streamSelectable(stream: NotificationStreamDto, hasLinkedAccount: Boolean): Boolean =
-    !stream.requiresLinkedAccount || hasLinkedAccount

app/src/main/java/com/runicgateway/app/ui/session/SessionViewModel.kt

@@ -10,6 +10,8 @@ import com.runicgateway.app.core.auth.SessionManager
 import com.runicgateway.app.data.repository.AuthRepository
 import com.runicgateway.app.data.repository.ShardFeatures
 import com.runicgateway.app.data.repository.ShardFeaturesRepository
+import com.runicgateway.app.data.repository.SiteCapabilities
+import com.runicgateway.app.data.repository.SiteCapabilitiesRepository
 import dagger.hilt.android.lifecycle.HiltViewModel
 import kotlinx.coroutines.flow.StateFlow
 import kotlinx.coroutines.launch
@@ -26,6 +28,7 @@ class SessionViewModel @Inject constructor(
     sessionManager: SessionManager,
     private val authRepository: AuthRepository,
     shardFeaturesRepository: ShardFeaturesRepository,
+    siteCapabilitiesRepository: SiteCapabilitiesRepository,
 ) : ViewModel() {
 
     val session: StateFlow<Session> = sessionManager.state
@@ -38,6 +41,19 @@ class SessionViewModel @Inject constructor(
      */
     val shardFeatures: StateFlow<ShardFeatures?> = shardFeaturesRepository.features
 
+    /**
+     * What this BACKEND serves — core's capabilities and every installed module's
+     * (M13). Exposed here for the reason [shardFeatures] is: the shared menu is
+     * the consumer, and a row is filtered by both.
+     *
+     * **Read-only here, and deliberately not refreshed here.** This answer is per
+     * HOST, not per viewer: signing in does not install a module. It is resolved
+     * beside the appearance in [com.runicgateway.app.ui.AppViewModel], which is
+     * what owns the host's lifecycle — first load, resume, and the Settings →
+     * Server switch that invalidates it.
+     */
+    val capabilities: StateFlow<SiteCapabilities?> = siteCapabilitiesRepository.capabilities
+
     init {
         // The answer is per-viewer, so it is re-resolved on every session change.
         // A StateFlow conflates equal values, so a resume revalidation that returns

app/src/main/java/com/runicgateway/app/ui/theme/Font.kt

@@ -6,35 +6,117 @@ package com.runicgateway.app.ui.theme
 import androidx.compose.ui.text.ExperimentalTextApi
 import androidx.compose.ui.text.font.Font
 import androidx.compose.ui.text.font.FontFamily
+import androidx.compose.ui.text.font.FontStyle
 import androidx.compose.ui.text.font.FontVariation
 import androidx.compose.ui.text.font.FontWeight
 import com.runicgateway.app.R
 
 /**
- * Type families for the M5 shard-website design pass (docs/android/PLAN.md §M5).
+ * Every type family the app can draw with — the eight the admin's Appearance page
+ * can select between (THEMING_AND_NAV.md §5.3) plus the two system stacks its
+ * "shipped default" options resolve to.
  *
- * - [Cinzel] — the engraved serif display face used for headings, screen titles,
- *   and the top-bar title. Shipped as a single weight-axis **variable** font
- *   (`res/font/cinzel_variable.ttf`, SIL OFL — see `app/licenses/Cinzel-OFL.txt`);
- *   the 500/600/700 instances the design uses are pinned via [FontVariation]
- *   (supported on API 26+, and our minSdk is 29).
- * - [AppSerif] — the parchment body face. Android's platform serif is Noto Serif,
- *   which reads as the design's Georgia body copy without bundling another binary.
- * - [AppSans] — the label/meta/button face (the design's "Helvetica Neue" runs).
+ * All eight webfonts are **bundled**, not downloadable: the Play Store font
+ * provider is the only downloadable-font source Compose ships with, so a
+ * de-Googled device would silently fall back and every text style would gain an
+ * async loading state. The binaries are taken verbatim from `google/fonts`, which
+ * is how [Cinzel] arrived in M5; each carries its SIL OFL licence under
+ * `app/licenses/`, **never** under `res/font/` (aapt rejects a `.txt` there).
+ *
+ * A family reaches a text style through [ShardTypeface], which is what maps a
+ * shard's `--display` / `--serif` / `--sans` stacks onto these. The three
+ * declared *shipped* roles are [Cinzel] for the engraved display/headline/title
+ * block, [AppSerif] for parchment body copy, and [AppSans] for the letter-spaced
+ * label/meta/button block.
+ *
+ * ## Weights
+ *
+ * The type scale asks for four: 400 (body), 500 and 700 (labels), 600 (display).
+ * Every family here must supply all four, because a family is **not** confined to
+ * the role its dropdown lives in — the `modern` preset puts Work Sans in the
+ * display slot and the `fantasy` preset puts EB Garamond in the sans slot, both
+ * bypassing the server's per-role option list (see [ShardTypeface]). The variable
+ * families pin the four instances through [FontVariation] (API 26+; minSdk is 29).
+ *
+ * Two families are exceptions, both upstream facts rather than choices:
+ * - **[IMFellEnglish] has a single weight.** Its one 400 face answers all four
+ *   requests and Android synthesises the bold. The website's dropdown labels it
+ *   "(no bold weight)" for the same reason.
+ * - **[Cinzel] is left at the 500/600/700 it shipped with in M5.** It is the only
+ *   family the server offers in the display role alone, so nothing can ask it for
+ *   400; adding an instance would have edited M5's type for no reachable case.
+ *
+ * ## Italics
+ *
+ * Four families carry a true italic — the same four `client/index.html` requests
+ * one for. The rest are upright-only and Compose skews them, which is what the
+ * app already did for every family before this milestone and what the website
+ * does for its own upright-only faces. The app draws italic in two places.
  */
 @OptIn(ExperimentalTextApi::class)
-private fun cinzel(weight: FontWeight) =
+private fun variable(resId: Int, weight: FontWeight, style: FontStyle = FontStyle.Normal) =
     Font(
-        R.font.cinzel_variable,
+        resId,
         weight = weight,
+        style = style,
         variationSettings = FontVariation.Settings(FontVariation.weight(weight.weight)),
     )
 
+// The four weights the type scale asks for, in the order Compose prefers to match.
+private val ScaleWeights = listOf(
+    FontWeight.Normal,   // 400 — body
+    FontWeight.Medium,   // 500 — labelMedium / labelSmall
+    FontWeight.SemiBold, // 600 — display / headline / title
+    FontWeight.Bold,     // 700 — labelLarge
+)
+
+/** A variable family pinned at the four scale weights, upright only. */
+private fun variableFamily(resId: Int) =
+    FontFamily(ScaleWeights.map { variable(resId, it) })
+
+/** A variable family pinned at the four scale weights, upright and italic. */
+private fun variableFamily(uprightResId: Int, italicResId: Int) =
+    FontFamily(
+        ScaleWeights.map { variable(uprightResId, it) } +
+            ScaleWeights.map { variable(italicResId, it, FontStyle.Italic) },
+    )
+
+private fun cinzel(weight: FontWeight) = variable(R.font.cinzel_variable, weight)
+
 val Cinzel = FontFamily(
     cinzel(FontWeight.Medium),   // 500
     cinzel(FontWeight.SemiBold), // 600
     cinzel(FontWeight.Bold),     // 700
 )
 
+val EBGaramond = variableFamily(R.font.eb_garamond_variable, R.font.eb_garamond_italic)
+val Merriweather = variableFamily(R.font.merriweather_variable, R.font.merriweather_italic)
+val PlayfairDisplay =
+    variableFamily(R.font.playfair_display_variable, R.font.playfair_display_italic)
+val Inter = variableFamily(R.font.inter_variable)
+val WorkSans = variableFamily(R.font.work_sans_variable)
+val SourceSans3 = variableFamily(R.font.source_sans_3_variable)
+
+/**
+ * IM Fell English, whose upstream release is a single 400 face per style — there
+ * is no weight axis and no bold cut to pin. Declared once per style so a request
+ * at 500/600/700 lands on it rather than falling out of the family.
+ */
+val IMFellEnglish = FontFamily(
+    Font(R.font.im_fell_english_regular, weight = FontWeight.Normal),
+    Font(R.font.im_fell_english_italic, weight = FontWeight.Normal, style = FontStyle.Italic),
+)
+
+/**
+ * The platform serif (Noto Serif), which is what the website's
+ * `Georgia, "Times New Roman", serif` stack resolves to on Android — and the
+ * app's shipped body face since M5.
+ */
 val AppSerif = FontFamily.Serif
+
+/**
+ * The platform sans (Roboto), which the website's
+ * `"Helvetica Neue", Arial, sans-serif` stack resolves to on Android — and the
+ * app's shipped label face since M5.
+ */
 val AppSans = FontFamily.SansSerif

app/src/main/java/com/runicgateway/app/ui/theme/ShardTypeface.kt

@@ -0,0 +1,95 @@
+/*
+ * SPDX-License-Identifier: GPL-3.0-or-later
+ */
+package com.runicgateway.app.ui.theme
+
+import androidx.compose.runtime.Immutable
+import androidx.compose.ui.text.font.FontFamily
+
+/**
+ * The shard's resolved type families — the `fonts` third of the admin's
+ * Appearance page (THEMING_AND_NAV.md §5.3), alongside [ShardPalette] and
+ * [ShardStructure].
+ *
+ * The three roles map onto the M5 type scale's three groups verbatim: `--display`
+ * carries the Cinzel display/headline/title block, `--serif` the body block, and
+ * `--sans` the label/meta/button block. Sizes, weights and tracking do not move —
+ * only the family, which is why [shardTypography] is a one-field substitution and
+ * an unthemed shard is a provable no-op (§2, AC-1).
+ *
+ * Resolution is pure, so the acceptance tests need no Compose rule.
+ */
+@Immutable
+data class ShardTypeface(
+    /** `--display`. */
+    val display: FontFamily = Cinzel,
+    /** `--serif`. */
+    val serif: FontFamily = AppSerif,
+    /** `--sans`. */
+    val sans: FontFamily = AppSans,
+) {
+    companion object {
+        /** The shipped app: the three M5 families. */
+        val Shipped = ShardTypeface()
+
+        /**
+         * Resolve a `theme` token map into three families, **field by field** (§2):
+         * an unreadable `--sans` must not cost the `--serif` beside it, exactly as
+         * in [ShardPalette.resolve] and [ShardStructure.resolve].
+         */
+        fun resolve(theme: Map<String, String>): ShardTypeface {
+            if (theme.isEmpty()) return Shipped
+            return ShardTypeface(
+                display = family(theme["--display"]) ?: Shipped.display,
+                serif = family(theme["--serif"]) ?: Shipped.serif,
+                sans = family(theme["--sans"]) ?: Shipped.sans,
+            )
+        }
+    }
+}
+
+/**
+ * Every family name the server can publish, keyed by the lowercased first family
+ * of the stack.
+ *
+ * **This map is deliberately global rather than per-role**, and that is not a
+ * simplification. The server validates an *admin-entered* font against
+ * `FONT_OPTIONS[role]`, but a preset's tokens are copied verbatim by
+ * `resolveThemeTokens` and never pass through that list — `modern` publishes
+ * `--display: 'Work Sans', Arial, sans-serif`, which the display dropdown does
+ * not offer, and `fantasy` publishes `--sans: 'EB Garamond', Georgia, serif`,
+ * which the sans dropdown does not either. A per-role lookup would have missed
+ * the display face of one preset and the label face of the other. It is the same
+ * trap phase 2 hit with `--shadow-card`, in a different token group.
+ *
+ * The two system entries are the "shipped default" options: neither pulls in a
+ * webfont on the web, and on Android both resolve to the platform family the app
+ * has drawn with since M5.
+ */
+private val FamiliesByFirstName: Map<String, FontFamily> = mapOf(
+    "cinzel" to Cinzel,
+    "eb garamond" to EBGaramond,
+    "merriweather" to Merriweather,
+    "playfair display" to PlayfairDisplay,
+    "im fell english" to IMFellEnglish,
+    "inter" to Inter,
+    "work sans" to WorkSans,
+    "source sans 3" to SourceSans3,
+    "georgia" to AppSerif,
+    "helvetica neue" to AppSans,
+)
+
+/**
+ * Resolve a CSS font stack to a family by **its first name**, which is how the
+ * value is constructed server-side and the only part of it that carries the
+ * admin's choice — everything after the first comma is the web's fallback chain,
+ * which Android has no use for.
+ *
+ * Returns `null` for a stack this app cannot draw, so the caller falls back to
+ * the role's shipped family rather than to some other role's.
+ */
+private fun family(stack: String?): FontFamily? {
+    val first = stack?.substringBefore(',')?.trim()?.trim('\'', '"')?.trim()
+    if (first.isNullOrEmpty()) return null
+    return FamiliesByFirstName[first.lowercase()]
+}

app/src/main/java/com/runicgateway/app/ui/theme/Theme.kt

@@ -36,7 +36,14 @@ internal fun shardColorScheme(palette: ShardPalette): ColorScheme = darkColorSch
     onSurfaceVariant = palette.muted,
     surfaceContainer = palette.elevated,
     surfaceContainerHigh = palette.elevated,
+    // Material's filled Card takes its container from surfaceContainerHighest —
+    // FilledCardTokens.ContainerColor, checked in the 1.3.0 artifact's bytecode.
+    // Leaving it unmapped is what made every ShardCard draw in darkColorScheme()'s
+    // default grey instead of --panel-flat, on themed AND untouched instances alike
+    // (found on device in phase 8's AC-5 walk; see "Phase 8 as landed").
+    surfaceContainerHighest = palette.elevated,
     surfaceContainerLow = palette.surface,
+    surfaceContainerLowest = palette.surface,
     outline = palette.outline,
     outlineVariant = palette.divider,
     secondaryContainer = palette.pillBg,   // neutral chips / selected drawer item
@@ -60,7 +67,10 @@ internal fun shardColorScheme(palette: ShardPalette): ColorScheme = darkColorSch
  * for the ten tokens with a Material role, and through [LocalShardPalette] for
  * the five without one. The radii split the same way — [MaterialTheme]'s shape
  * scale for everything Material draws, [LocalShardStructure] for the pill and
- * the card depth, which it cannot carry.
+ * the card depth, which it cannot carry. The type families need no split and so
+ * no composition local: every text style in the app comes from
+ * [MaterialTheme.typography], and the two that override anything override the
+ * style rather than the family.
  */
 @Composable
 fun RunicGatewayTheme(
@@ -75,6 +85,8 @@ fun RunicGatewayTheme(
     }
     val colorScheme = remember(palette) { shardColorScheme(palette) }
     val structure = remember(appearance) { ShardStructure.resolve(appearance.theme) }
+    val typeface = remember(appearance) { ShardTypeface.resolve(appearance.theme) }
+    val typography = remember(typeface) { shardTypography(typeface) }
 
     CompositionLocalProvider(
         LocalShardPalette provides palette,
@@ -82,7 +94,7 @@ fun RunicGatewayTheme(
     ) {
         MaterialTheme(
             colorScheme = colorScheme,
-            typography = Typography,
+            typography = typography,
             shapes = structure.shapes,
             content = content,
         )

app/src/main/java/com/runicgateway/app/ui/theme/Type.kt

@@ -9,73 +9,82 @@ import androidx.compose.ui.text.font.FontWeight
 import androidx.compose.ui.unit.sp
 
 /**
- * The M5 type scale. Three families carry the design (see [ui/theme/Font.kt]):
- * [Cinzel] for the engraved display/headline/title roles, [AppSerif] (Noto Serif)
- * for parchment body copy, and [AppSans] for the letter-spaced label/meta/button
- * roles. Sizes and tracking mirror the "Runic Gateway Screens" mockup.
+ * The M5 type scale, drawn in whichever three families the shard resolved to
+ * (THEMING_AND_NAV.md §5.3).
+ *
+ * Only the family moves. Every size, weight, line height and tracking below is
+ * the M5 value from the "Runic Gateway Screens" mockup, so `ShardTypeface.Shipped`
+ * — an unthemed instance, a backend that predates the feature, a settings call
+ * that failed — reproduces the pre-M12 scale exactly. [androidx.compose.material3.Typography]
+ * implements `equals`, so AC-1 asserts that in one comparison.
+ *
+ * The three groups map onto the three roles verbatim: [ShardTypeface.display]
+ * carries the engraved display/headline/title block, [ShardTypeface.serif] the
+ * parchment body copy, and [ShardTypeface.sans] the letter-spaced
+ * label/meta/button roles.
  */
-val Typography = Typography(
-    // Display / headline / title — Cinzel engraved serif
+internal fun shardTypography(faces: ShardTypeface) = Typography(
+    // Display / headline / title — the engraved serif role
     displayLarge = TextStyle(
-        fontFamily = Cinzel, fontWeight = FontWeight.SemiBold,
+        fontFamily = faces.display, fontWeight = FontWeight.SemiBold,
         fontSize = 40.sp, lineHeight = 46.sp, letterSpacing = 0.4.sp,
     ),
     displayMedium = TextStyle(
-        fontFamily = Cinzel, fontWeight = FontWeight.SemiBold,
+        fontFamily = faces.display, fontWeight = FontWeight.SemiBold,
         fontSize = 32.sp, lineHeight = 40.sp, letterSpacing = 0.3.sp,
     ),
     displaySmall = TextStyle(
-        fontFamily = Cinzel, fontWeight = FontWeight.SemiBold,
+        fontFamily = faces.display, fontWeight = FontWeight.SemiBold,
         fontSize = 28.sp, lineHeight = 36.sp, letterSpacing = 0.2.sp,
     ),
     headlineLarge = TextStyle(
-        fontFamily = Cinzel, fontWeight = FontWeight.SemiBold,
+        fontFamily = faces.display, fontWeight = FontWeight.SemiBold,
         fontSize = 26.sp, lineHeight = 34.sp, letterSpacing = 0.2.sp,
     ),
     headlineMedium = TextStyle(
-        fontFamily = Cinzel, fontWeight = FontWeight.SemiBold,
+        fontFamily = faces.display, fontWeight = FontWeight.SemiBold,
         fontSize = 24.sp, lineHeight = 32.sp, letterSpacing = 0.2.sp,
     ),
     headlineSmall = TextStyle(
-        fontFamily = Cinzel, fontWeight = FontWeight.SemiBold,
+        fontFamily = faces.display, fontWeight = FontWeight.SemiBold,
         fontSize = 22.sp, lineHeight = 28.sp, letterSpacing = 0.2.sp,
     ),
     titleLarge = TextStyle(
-        fontFamily = Cinzel, fontWeight = FontWeight.SemiBold,
+        fontFamily = faces.display, fontWeight = FontWeight.SemiBold,
         fontSize = 20.sp, lineHeight = 26.sp, letterSpacing = 0.2.sp,
     ),
     titleMedium = TextStyle(
-        fontFamily = Cinzel, fontWeight = FontWeight.SemiBold,
+        fontFamily = faces.display, fontWeight = FontWeight.SemiBold,
         fontSize = 17.sp, lineHeight = 24.sp, letterSpacing = 0.15.sp,
     ),
     titleSmall = TextStyle(
-        fontFamily = Cinzel, fontWeight = FontWeight.SemiBold,
+        fontFamily = faces.display, fontWeight = FontWeight.SemiBold,
         fontSize = 15.sp, lineHeight = 22.sp, letterSpacing = 0.1.sp,
     ),
-    // Body — parchment serif
+    // Body — the parchment serif role
     bodyLarge = TextStyle(
-        fontFamily = AppSerif, fontWeight = FontWeight.Normal,
+        fontFamily = faces.serif, fontWeight = FontWeight.Normal,
         fontSize = 16.sp, lineHeight = 26.sp, letterSpacing = 0.15.sp,
     ),
     bodyMedium = TextStyle(
-        fontFamily = AppSerif, fontWeight = FontWeight.Normal,
+        fontFamily = faces.serif, fontWeight = FontWeight.Normal,
         fontSize = 15.sp, lineHeight = 24.sp, letterSpacing = 0.15.sp,
     ),
     bodySmall = TextStyle(
-        fontFamily = AppSerif, fontWeight = FontWeight.Normal,
+        fontFamily = faces.serif, fontWeight = FontWeight.Normal,
         fontSize = 13.sp, lineHeight = 20.sp, letterSpacing = 0.2.sp,
     ),
-    // Labels / meta / buttons — sans, letter-spaced
+    // Labels / meta / buttons — the sans role, letter-spaced
     labelLarge = TextStyle(
-        fontFamily = AppSans, fontWeight = FontWeight.Bold,
+        fontFamily = faces.sans, fontWeight = FontWeight.Bold,
         fontSize = 14.sp, lineHeight = 18.sp, letterSpacing = 0.45.sp,
     ),
     labelMedium = TextStyle(
-        fontFamily = AppSans, fontWeight = FontWeight.Medium,
+        fontFamily = faces.sans, fontWeight = FontWeight.Medium,
         fontSize = 12.sp, lineHeight = 16.sp, letterSpacing = 0.4.sp,
     ),
     labelSmall = TextStyle(
-        fontFamily = AppSans, fontWeight = FontWeight.Medium,
+        fontFamily = faces.sans, fontWeight = FontWeight.Medium,
         fontSize = 11.sp, lineHeight = 15.sp, letterSpacing = 0.5.sp,
     ),
 )

app/src/main/res/values/strings.xml

@@ -37,8 +37,11 @@
 
     <!-- ── Navigation menu (§5) ────────────────────────────────────────── -->
     <string name="nav_open_menu">Open navigation menu</string>
+    <!-- On an admin-added link the app has no screen for; it opens in a browser (§6.3). -->
+    <string name="nav_opens_in_browser">Opens in your browser</string>
     <string name="menu_home">Home</string>
     <string name="menu_news">News</string>
+    <string name="menu_events">Events</string>
     <string name="menu_wiki">Wiki</string>
     <string name="menu_shard">Shard</string>
     <string name="menu_rules">Rules</string>
@@ -48,6 +51,7 @@
     <string name="menu_about">About</string>
     <string name="menu_contact">Contact</string>
     <string name="menu_account">My account</string>
+    <string name="menu_my_events">My events</string>
     <string name="menu_my_characters">My characters</string>
     <string name="menu_my_vendors">My vendors</string>
     <string name="menu_my_houses">My houses</string>
@@ -482,7 +486,7 @@
     <!-- ── Push notifications (§11, M7 Part 2) ─────────────────────────── -->
     <string name="menu_notifications">Notifications</string>
     <string name="notifications_title">Notifications</string>
-    <string name="notifications_subtitle">Choose what this shard notifies you about. Nothing is sent unless you turn it on.</string>
+    <string name="notifications_subtitle">Choose what this shard notifies you about, and how it reaches you. Nothing is sent unless you turn it on.</string>
     <string name="notifications_section_general">General</string>
     <string name="notifications_section_personal">Your game account</string>
     <string name="notifications_requires_link">Link a game account to enable this.</string>
@@ -493,6 +497,18 @@
     <string name="notifications_save_error">Couldn\'t save your notification settings. Try again.</string>
     <string name="notifications_relay_error">This shard\'s push relay isn\'t reachable right now.</string>
 
+    <!-- The in-app inbox and the per-channel settings (ENGAGEMENT.md phase 8). -->
+    <string name="notifications_mode_off">Off</string>
+    <string name="notifications_mode_instant">As it happens</string>
+    <string name="notifications_mode_digest">Daily summary</string>
+    <string name="inbox_empty">Nothing here yet. Notifications you\'re sent will show up here.</string>
+    <string name="inbox_all_read">All caught up</string>
+    <string name="inbox_unread_count">%1$d unread</string>
+    <string name="inbox_mark_all_read">Mark all read</string>
+    <string name="inbox_open_settings">Notification settings</string>
+    <string name="inbox_loading_more">Loading more…</string>
+    <string name="inbox_offline_cached">Offline — showing what was saved on this device.</string>
+
     <!-- Notification channels + the ongoing foreground-service notification. -->
     <string name="push_channel_messages">Shard notifications</string>
     <string name="push_channel_messages_desc">Alerts you opted into from this shard.</string>
@@ -511,4 +527,43 @@
     <string name="push_stream_house_idoc">Your house entered IDOC</string>
     <string name="push_stream_account_login">Login to your account</string>
     <string name="push_stream_generic">New notification</string>
+
+    <!-- ── Events (§9 M13, EVENTS.md §I) ─────────────────────────── -->
+    <!--
+      The four status words. `cancelled` has TWO, chosen by the clock rather than
+      the status: "did not happen" is right for a past occurrence and false for a
+      future one, and a run four days out that an operator called off is the common
+      case. See EventTimes.statusWordRes.
+    -->
+    <string name="events_status_live">Happening now</string>
+    <string name="events_status_scheduled">Scheduled</string>
+    <string name="events_status_completed">Finished</string>
+    <string name="events_status_cancelled">Cancelled</string>
+    <string name="events_status_did_not_happen">Did not happen</string>
+
+    <string name="events_empty">Nothing on the calendar just yet — check back soon.</string>
+    <!-- A forecast past the materialisation horizon: nothing is committed to it. -->
+    <string name="events_projected">Expected — not yet confirmed</string>
+    <string name="events_truncated">Showing the first part of a busy calendar.</string>
+
+    <string name="events_part_of">Part of %1$s</string>
+    <string name="events_next">Next</string>
+    <string name="events_under_way">Under way</string>
+    <string name="events_nothing_scheduled">Nothing scheduled at the moment.</string>
+    <string name="events_never_scheduled">This event has not been scheduled yet.</string>
+    <string name="events_coming_up">Coming up</string>
+    <string name="events_previously">Previously</string>
+    <string name="events_results">Results</string>
+    <string name="events_results_nobody">Results were published with nobody recorded.</string>
+    <!-- A module puts a display name in its participation meta or it does not; the
+         member key is never published, so there is nothing else to render. -->
+    <string name="events_participant_unnamed">Unnamed</string>
+
+    <string name="events_history_empty">You have not taken part in an event yet.</string>
+    <string name="events_rank">Rank %1$d</string>
+    <!-- Not a dash: an unranked row is a real state, not a missing value. -->
+    <string name="events_results_unpublished">Results not published</string>
+    <string name="events_score">Score %1$s</string>
+    <string name="events_show_more">Show more</string>
+    <string name="events_loading">Loading…</string>
 </resources>

app/src/test/java/com/runicgateway/app/data/api/dto/NotificationsDtoTest.kt

@@ -82,4 +82,71 @@ class NotificationsDtoTest {
         )
         assertNull(dto.push.ntfyUrl)
     }
+
+    // ── The inbox + per-channel prefs (ENGAGEMENT.md phases 3, 7/8) ────────
+
+    @Test fun inboxPageDecodesWithItsUnreadCount() {
+        val dto = json.decodeFromString<NotificationInboxDto>(
+            """{"items":[{"id":42,"triggerId":"team.post.created","title":"New post",
+                 "body":"Someone posted in your team.","url":"https://shard.example/teams/1",
+                 "read":false,"readAt":null,"createdAt":"2026-08-31T12:30:00.000Z"}],
+                 "hasMore":true,"unread":3}""",
+        )
+        assertEquals(1, dto.items.size)
+        assertEquals(42L, dto.items.first().id)
+        assertEquals("team.post.created", dto.items.first().triggerId)
+        assertFalse(dto.items.first().read)
+        assertTrue(dto.hasMore)
+        // The whole inbox, not the page — the badge and the list come from one response.
+        assertEquals(3, dto.unread)
+    }
+
+    @Test fun anItemWithNoBodyOrUrlDecodes() {
+        // Most items have neither: an inbox row is complete on its own.
+        val dto = json.decodeFromString<NotificationItemDto>(
+            """{"id":7,"triggerId":"news.post","title":"Patch notes","body":null,"url":null,
+                "read":true,"readAt":"2026-08-31T13:00:00.000Z","createdAt":"2026-08-31T12:30:00.000Z"}""",
+        )
+        assertNull(dto.body)
+        assertNull(dto.url)
+        assertTrue(dto.read)
+    }
+
+    @Test fun channelPrefsDecodeTheirModesAndPerItemChannels() {
+        val dto = json.decodeFromString<NotificationChannelPrefsDto>(
+            """{"channels":[
+                 {"id":"push","label":"Push","carriesContent":false,"defaultMode":"off",
+                  "supportsDigest":false,"modes":["off","instant"]},
+                 {"id":"email","label":"Email","carriesContent":true,"defaultMode":"off",
+                  "supportsDigest":true,"modes":["off","instant","digest"]}],
+               "items":[
+                 {"id":"uo.house.idoc_warning","label":"House in danger","description":"",
+                  "personal":true,"requiresLinkedAccount":true,"ceiling":"authenticated",
+                  "channels":["email","inapp"],"modes":{"email":"digest","inapp":"instant"}}]}""",
+        )
+        assertFalse(dto.channels.first { it.id == "push" }.carriesContent)
+        assertTrue(dto.channels.first { it.id == "email" }.supportsDigest)
+        val item = dto.items.single()
+        // A trigger-only id carries no push facet at all — the UI renders controls
+        // from THIS list, never from a hardcoded three.
+        assertFalse(item.channels.contains("push"))
+        assertEquals("digest", item.modes["email"])
+        assertNull(item.modes["push"])
+    }
+
+    @Test fun theSparseUpdateAlwaysCarriesItsPrefsField() {
+        // Same reasoning as the subscriptions DTO: kotlinx omits a property equal
+        // to its default, and the validator requires the field.
+        val body = json.encodeToString(NotificationChannelPrefsUpdateDto(emptyList()))
+        assertEquals("""{"prefs":[]}""", body)
+    }
+
+    @Test fun theSparseUpdateSendsOnlyThePairItNames() {
+        val body = json.encodeToString(
+            NotificationChannelPrefsUpdateDto(
+                listOf(NotificationChannelPrefDto(id = "news.post", channel = "email", mode = "digest")),
+            ),
+        )
+        assertEquals("""{"prefs":[{"id":"news.post","channel":"email","mode":"digest"}]}""", body)
+    }
 }

app/src/test/java/com/runicgateway/app/data/api/fake/FakeEventsApi.kt

@@ -0,0 +1,60 @@
+/*
+ * SPDX-License-Identifier: GPL-3.0-or-later
+ */
+package com.runicgateway.app.data.api.fake
+
+import com.runicgateway.app.data.api.EventsApi
+import com.runicgateway.app.data.api.dto.EventCalendarDto
+import com.runicgateway.app.data.api.dto.EventHistoryDto
+import com.runicgateway.app.data.api.dto.EventSeriesResponse
+import com.runicgateway.app.data.api.dto.PublicEventResponse
+
+/**
+ * A configurable fake of [EventsApi] (M13). Set the `var` a call should answer
+ * with; set [error] to make every call throw.
+ *
+ * [lastRun] and [lastBefore] are what the tests that matter assert on: the run a
+ * page was asked about, and the keyset cursor a history page walked back from.
+ */
+class FakeEventsApi : EventsApi {
+
+    var error: Throwable? = null
+
+    var calendar: EventCalendarDto = EventCalendarDto()
+    var event: PublicEventResponse = PublicEventResponse()
+    var series: EventSeriesResponse = EventSeriesResponse()
+    var history: EventHistoryDto = EventHistoryDto()
+
+    /** The `run` the last event read carried, so a test can assert a blank was dropped. */
+    var lastRun: String? = null
+    var lastSlug: String? = null
+
+    /** The keyset cursor the last history page asked for; null on a first page. */
+    var lastBefore: Long? = null
+    var historyCalls: Int = 0
+
+    private fun <T> reply(value: T): T {
+        error?.let { throw it }
+        return value
+    }
+
+    override suspend fun getCalendar(from: String?, to: String?, seriesId: Long?): EventCalendarDto =
+        reply(calendar)
+
+    override suspend fun getEvent(slug: String, run: String?): PublicEventResponse {
+        lastSlug = slug
+        lastRun = run
+        return reply(event)
+    }
+
+    override suspend fun getSeries(slug: String): EventSeriesResponse {
+        lastSlug = slug
+        return reply(series)
+    }
+
+    override suspend fun getHistory(limit: Int?, before: Long?): EventHistoryDto {
+        historyCalls++
+        lastBefore = before
+        return reply(history)
+    }
+}

app/src/test/java/com/runicgateway/app/data/api/fake/FakeNotificationsApi.kt

@@ -0,0 +1,106 @@
+/*
+ * SPDX-License-Identifier: GPL-3.0-or-later
+ */
+package com.runicgateway.app.data.api.fake
+
+import com.runicgateway.app.data.api.NotificationsApi
+import com.runicgateway.app.data.api.dto.NotificationChannelPrefDto
+import com.runicgateway.app.data.api.dto.NotificationChannelPrefsDto
+import com.runicgateway.app.data.api.dto.NotificationChannelPrefsUpdateDto
+import com.runicgateway.app.data.api.dto.NotificationInboxDto
+import com.runicgateway.app.data.api.dto.NotificationReadResultDto
+import com.runicgateway.app.data.api.dto.NotificationStreamsDto
+import com.runicgateway.app.data.api.dto.NotificationSubscriptionsDto
+import com.runicgateway.app.data.api.dto.NotificationUnreadDto
+import com.runicgateway.app.data.api.dto.PushDeviceDto
+import com.runicgateway.app.data.api.dto.RegisterDeviceRequest
+
+/**
+ * A configurable fake of [NotificationsApi] for the inbox and settings ViewModel
+ * tests. Read endpoints return their `var`; [error] makes every call throw, which
+ * is how the offline and server-error branches are driven.
+ *
+ * [pages] keys the inbox by its cursor — `null` is the first page — so a test can
+ * describe a two-page inbox without a callback, and [lastPrefsUpdate] records the
+ * body of the sparse PUT so a test can assert that ONE pair was sent.
+ */
+class FakeNotificationsApi : NotificationsApi {
+
+    var error: Throwable? = null
+
+    var streams: NotificationStreamsDto = NotificationStreamsDto()
+    var subscriptions: NotificationSubscriptionsDto = NotificationSubscriptionsDto(emptyList())
+    var channelPrefs: NotificationChannelPrefsDto = NotificationChannelPrefsDto()
+    var pages: Map<Long?, NotificationInboxDto> = mapOf(null to NotificationInboxDto())
+    var unread: NotificationUnreadDto = NotificationUnreadDto()
+    var readResult: NotificationReadResultDto = NotificationReadResultDto(ok = true)
+
+    var lastPrefsUpdate: List<NotificationChannelPrefDto>? = null
+    var markedRead: MutableList<Long> = mutableListOf()
+    var markAllReadCalls: Int = 0
+    var inboxCalls: MutableList<Long?> = mutableListOf()
+
+    private fun failIfSet() { error?.let { throw it } }
+
+    override suspend fun registerDevice(body: RegisterDeviceRequest): PushDeviceDto {
+        failIfSet()
+        return PushDeviceDto(id = 1)
+    }
+
+    override suspend fun listDevices(): List<PushDeviceDto> {
+        failIfSet()
+        return emptyList()
+    }
+
+    override suspend fun deleteDevice(id: Long) = failIfSet()
+
+    override suspend fun streams(): NotificationStreamsDto {
+        failIfSet()
+        return streams
+    }
+
+    override suspend fun subscriptions(): NotificationSubscriptionsDto {
+        failIfSet()
+        return subscriptions
+    }
+
+    override suspend fun putSubscriptions(body: NotificationSubscriptionsDto): NotificationSubscriptionsDto {
+        failIfSet()
+        subscriptions = body
+        return body
+    }
+
+    override suspend fun channelPrefs(): NotificationChannelPrefsDto {
+        failIfSet()
+        return channelPrefs
+    }
+
+    override suspend fun putChannelPrefs(body: NotificationChannelPrefsUpdateDto): NotificationChannelPrefsDto {
+        failIfSet()
+        lastPrefsUpdate = body.prefs
+        return channelPrefs
+    }
+
+    override suspend fun inbox(limit: Int?, before: Long?, unread: Boolean?): NotificationInboxDto {
+        failIfSet()
+        inboxCalls.add(before)
+        return pages[before] ?: NotificationInboxDto()
+    }
+
+    override suspend fun unreadCount(): NotificationUnreadDto {
+        failIfSet()
+        return unread
+    }
+
+    override suspend fun markRead(id: Long): NotificationReadResultDto {
+        failIfSet()
+        markedRead.add(id)
+        return readResult
+    }
+
+    override suspend fun markAllRead(): NotificationReadResultDto {
+        failIfSet()
+        markAllReadCalls++
+        return readResult
+    }
+}

app/src/test/java/com/runicgateway/app/data/api/fake/FakePublicApi.kt

@@ -13,6 +13,7 @@ import com.runicgateway.app.data.api.dto.GovernorDto
 import com.runicgateway.app.data.api.dto.GovernorTermDto
 import com.runicgateway.app.data.api.dto.GuildDto
 import com.runicgateway.app.data.api.dto.HouseDto
+import com.runicgateway.app.data.api.dto.ModulesDto
 import com.runicgateway.app.data.api.dto.OnlineStaffDto
 import com.runicgateway.app.data.api.dto.PageDto
 import com.runicgateway.app.data.api.dto.PostDto
@@ -67,6 +68,19 @@ class FakePublicApi : PublicApi {
     var houses: List<HouseDto> = emptyList()
     var shardFeatures: ShardFeaturesDto = ShardFeaturesDto()
 
+    /**
+     * `GET /public/modules` (M13). Empty by default, which is a real answer: a
+     * backend serving no modules at all.
+     */
+    var modules: ModulesDto = ModulesDto()
+
+    /**
+     * Per-call failures, for the one thing [error] cannot express: capability
+     * resolution reads TWO routes and one failing is not the same as both.
+     */
+    var statusError: Throwable? = null
+    var modulesError: Throwable? = null
+
     // Protocol 3.0 content (M11). `ruleset` is nullable on the wire: null means the
     // shard has never published one, which is a success, not a failure.
     var ruleset: RulesetDto? = null
@@ -94,9 +108,17 @@ class FakePublicApi : PublicApi {
     }
 
     override suspend fun probeStatus(absoluteStatusUrl: String): StatusDto = reply(status)
-    override suspend fun getStatus(): StatusDto = reply(status)
+    override suspend fun getStatus(): StatusDto {
+        statusError?.let { throw it }
+        return reply(status)
+    }
     override suspend fun getSettings(): SettingsDto = reply(settings)
 
+    override suspend fun getModules(): ModulesDto {
+        modulesError?.let { throw it }
+        return reply(modules)
+    }
+
     override suspend fun getPosts(category: String): List<PostDto> = reply(posts)
     override suspend fun getPost(category: String, idOrSlug: String): PostDto = reply(post)
     override suspend fun getPage(slug: String): PageDto = reply(page)

app/src/test/java/com/runicgateway/app/data/repository/SiteCapabilitiesRepositoryTest.kt

@@ -0,0 +1,160 @@
+/*
+ * SPDX-License-Identifier: GPL-3.0-or-later
+ */
+package com.runicgateway.app.data.repository
+
+import com.runicgateway.app.data.api.dto.InstalledModuleDto
+import com.runicgateway.app.data.api.dto.ModulesDto
+import com.runicgateway.app.data.api.dto.StatusDto
+import com.runicgateway.app.data.api.dto.VersionDto
+import com.runicgateway.app.data.api.fake.FakePublicApi
+import com.runicgateway.app.util.httpError
+import kotlinx.coroutines.test.runTest
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertFalse
+import org.junit.Assert.assertNotNull
+import org.junit.Assert.assertNull
+import org.junit.Assert.assertTrue
+import org.junit.Test
+import java.io.IOException
+
+/**
+ * What this backend serves, and — the point of the class — the three different
+ * things "we don't know" can mean (PLAN.md §9 M13).
+ *
+ * **Absence of an answer is not an answer of absence.** Before M13 the app
+ * collapsed a 404, a dead network and "no such module" into one `null` and
+ * treated all three as "show everything", which rendered five shard rows that
+ * each 404 on a site running a different game.
+ */
+class SiteCapabilitiesRepositoryTest {
+
+    private val api = FakePublicApi()
+    private val repository = SiteCapabilitiesRepository(api)
+
+    private fun serving(core: List<String>, moduleCaps: List<String>) {
+        api.status = StatusDto(version = VersionDto(capabilities = core))
+        api.modules = ModulesDto(
+            modules = listOf(InstalledModuleDto(id = "uo", capabilities = moduleCaps)),
+        )
+    }
+
+    @Test fun bothListsAreMergedAndStaySeparable() = runTest {
+        serving(core = listOf("events"), moduleCaps = listOf("shard", "atlas"))
+        repository.refresh()
+
+        val answer = repository.capabilities.value!!
+        assertEquals(setOf("events"), answer.core)
+        assertEquals(setOf("shard", "atlas"), answer.modules)
+        // A menu entry does not care which half serves it.
+        assertTrue("events" in answer)
+        assertTrue("shard" in answer)
+        assertFalse("market" in answer)
+    }
+
+    @Test fun aBackendWithNoModulesAnswersRatherThanFailing() = runTest {
+        api.status = StatusDto(version = VersionDto(capabilities = listOf("events")))
+        api.modules = ModulesDto(modules = emptyList())
+        repository.refresh()
+
+        val answer = repository.capabilities.value!!
+        assertTrue("events" in answer)
+        // The answer that hides the shard rows, and the whole reason for the class.
+        assertFalse("shard" in answer)
+        assertFalse(canUse(answer, Capability.SHARD))
+        assertTrue(canUse(answer, Capability.EVENTS))
+    }
+
+    @Test fun aBackendOlderThanEventsOmitsTheKeyAndThatIsAnAnswer() = runTest {
+        // No `capabilities` in the version block at all — the value is in what is
+        // absent, and it must not read as "unknown".
+        api.status = StatusDto(version = VersionDto(service = "runic-gateway"))
+        api.modules = ModulesDto(modules = listOf(InstalledModuleDto(id = "uo", capabilities = listOf("shard"))))
+        repository.refresh()
+
+        val answer = repository.capabilities.value!!
+        assertTrue(answer.core.isEmpty())
+        assertFalse(canUse(answer, Capability.EVENTS))
+        assertTrue(canUse(answer, Capability.SHARD))
+    }
+
+    // ── The three failure directions ─────────────────────────────────────
+
+    @Test fun aHostThatHasNeverAnsweredLeavesTheGateOpen() = runTest {
+        api.error = IOException("offline")
+        repository.refresh()
+
+        // Null, not empty. The drawer renders as it did before this existed rather
+        // than flickering its rows in on every cold start.
+        assertNull(repository.capabilities.value)
+        assertTrue(canUse(repository.capabilities.value, Capability.SHARD))
+        assertTrue(canUse(repository.capabilities.value, Capability.EVENTS))
+    }
+
+    @Test fun aFailedRefreshKeepsTheLastAnswer() = runTest {
+        serving(core = listOf("events"), moduleCaps = listOf("shard"))
+        repository.refresh()
+
+        api.error = IOException("offline")
+        repository.refresh()
+
+        // A moment with no connectivity is not an uninstall.
+        val answer = repository.capabilities.value!!
+        assertTrue("shard" in answer)
+        assertTrue("events" in answer)
+    }
+
+    @Test fun oneCallFailingKeepsThatHalfAndUpdatesTheOther() = runTest {
+        serving(core = listOf("events"), moduleCaps = listOf("shard"))
+        repository.refresh()
+
+        // The module list answers with the game module gone; the status call is down.
+        api.statusError = httpError(500)
+        api.modules = ModulesDto(modules = emptyList())
+        repository.refresh()
+
+        val answer = repository.capabilities.value!!
+        // The half that answered is believed…
+        assertFalse("shard" in answer)
+        // …and the half that did not keeps what it last said.
+        assertTrue("events" in answer)
+    }
+
+    @Test fun aFiveHundredOnTheModuleListIsNotAnEmptyList() = runTest {
+        serving(core = listOf("events"), moduleCaps = listOf("shard"))
+        repository.refresh()
+
+        // Core answers 500 for a module list read before its loader ran, precisely
+        // so a caller cannot read it as "no modules installed".
+        api.modulesError = httpError(500)
+        repository.refresh()
+
+        assertTrue("shard" in repository.capabilities.value!!)
+    }
+
+    @Test fun aServerSwitchDropsTheAnswerEntirely() = runTest {
+        serving(core = listOf("events"), moduleCaps = listOf("shard"))
+        repository.refresh()
+        assertNotNull(repository.capabilities.value)
+
+        repository.invalidate()
+
+        // Not "empty" — unknown. The new host has said nothing, and inheriting the
+        // old one's answer would hide its shard rows until its first read lands.
+        assertNull(repository.capabilities.value)
+        assertTrue(canUse(repository.capabilities.value, Capability.SHARD))
+    }
+
+    @Test fun twoModulesMayDeclareTheSameString() = runTest {
+        api.status = StatusDto()
+        api.modules = ModulesDto(
+            modules = listOf(
+                InstalledModuleDto(id = "uo", capabilities = listOf("shard")),
+                InstalledModuleDto(id = "other", capabilities = listOf("shard", "cards")),
+            ),
+        )
+        repository.refresh()
+
+        assertEquals(setOf("shard", "cards"), repository.capabilities.value!!.modules)
+    }
+}

app/src/test/java/com/runicgateway/app/ui/ContentViewModelTest.kt

@@ -38,15 +38,22 @@ class ContentViewModelTest {
     private val settings = SettingsRepository(api)
 
     // ── News hub ──────────────────────────────────────────────────────────
+    /** No category argument: how every route into the hub but §6.2's arrives. */
+    private fun newsViewModel(category: String? = null) =
+        NewsViewModel(
+            content,
+            SavedStateHandle(category?.let { mapOf(Routes.Args.CATEGORY to it) } ?: emptyMap()),
+        )
+
     @Test fun newsLoadsSelectedCategory() {
         api.posts = listOf(PostDto(id = 1, category = "news", title = "Hi"))
-        val vm = NewsViewModel(content)
+        val vm = newsViewModel()
         assertTrue(vm.state.value is UiState.Success)
         assertEquals(1, (vm.state.value as UiState.Success).data.size)
     }
 
     @Test fun newsSelectCategoryReloads() {
-        val vm = NewsViewModel(content)
+        val vm = newsViewModel()
         api.posts = listOf(PostDto(id = 2, category = "newsletter", title = "N"))
         vm.selectCategory(ContentRepository.PostCategory.NEWSLETTER)
         assertEquals(ContentRepository.PostCategory.NEWSLETTER, vm.category.value)
@@ -55,7 +62,20 @@ class ContentViewModelTest {
 
     @Test fun newsServerErrorIsUiError() {
         api.error = httpError(500)
-        assertTrue(NewsViewModel(content).state.value is UiState.Error)
+        assertTrue(newsViewModel().state.value is UiState.Error)
+    }
+
+    @Test fun newsOpensOnTheCategoryTheRouteAsksFor() {
+        // The app's half of an admin's nav override or added link pointing at one of
+        // the website's three category pages (THEMING_AND_NAV.md §6.2).
+        val vm = newsViewModel("five-on-friday")
+        assertEquals(ContentRepository.PostCategory.FIVE_ON_FRIDAY, vm.category.value)
+    }
+
+    @Test fun newsFallsBackToTheDefaultFeedForAnUnknownCategory() {
+        // A hand-edited settings row, or a category the site has and the app doesn't.
+        assertEquals(ContentRepository.PostCategory.NEWS, newsViewModel("bogus").category.value)
+        assertEquals(ContentRepository.PostCategory.NEWS, newsViewModel().category.value)
     }
 
     // ── Post detail (SavedStateHandle args) ─────────────────────────────────

app/src/test/java/com/runicgateway/app/ui/components/BrandAssetsTest.kt

@@ -0,0 +1,104 @@
+/*
+ * SPDX-License-Identifier: GPL-3.0-or-later
+ */
+package com.runicgateway.app.ui.components
+
+import com.runicgateway.app.data.api.dto.BrandDto
+import com.runicgateway.app.data.appearance.SiteAppearance
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertNull
+import org.junit.Test
+
+/**
+ * §5.6's one testable rule: **an empty slot resolves to nothing.** The drawing
+ * itself is out of reach here — the app carries no Robolectric, so a composable
+ * body cannot run in a JVM test and phase 4's layout is AC-5's job — but the
+ * decision of whether to draw at all is pure, and it is the decision that keeps
+ * an unbranded instance laying out as it did before M12.
+ *
+ * The resolver is faked as the absolute-URL join the real one performs
+ * (`AppViewModel.resolveAsset`, unchanged by this phase), so these assert
+ * [brandAssetUrl]'s own contract rather than re-testing the network layer.
+ */
+class BrandAssetsTest {
+
+    private val resolve: (String?) -> String? = { path ->
+        when {
+            path.isNullOrBlank() -> null
+            path.startsWith("http") -> path
+            else -> "https://shard.example${if (path.startsWith("/")) "" else "/"}$path"
+        }
+    }
+
+    // --- the empty slot: every shape "not set" arrives in ------------------
+
+    @Test
+    fun `a null slot resolves to nothing`() {
+        assertNull(brandAssetUrl(null, resolve))
+    }
+
+    @Test
+    fun `an empty slot resolves to nothing`() {
+        // The server publishes "" for an asset that was never uploaded, and BrandDto
+        // defaults to it — this is the case that carries the untouched instance.
+        assertNull(brandAssetUrl("", resolve))
+    }
+
+    @Test
+    fun `a whitespace-only slot resolves to nothing`() {
+        assertNull(brandAssetUrl("   ", resolve))
+    }
+
+    @Test
+    fun `the shipped brand has neither a logo nor a hero`() {
+        // AC-1 for phase 4: nothing about a default BrandDto puts an image on screen.
+        val brand = BrandDto()
+        assertNull(brandAssetUrl(brand.logo, resolve))
+        assertNull(brandAssetUrl(brand.hero, resolve))
+    }
+
+    @Test
+    fun `a failed settings load leaves no brand to draw`() {
+        // SiteAppearance.NONE is what a dead backend produces (§2). It has no brand
+        // at all, so both slots are absent rather than empty.
+        val brand: BrandDto? = SiteAppearance.NONE.brand
+        assertNull(brand)
+        assertNull(brandAssetUrl(brand?.logo, resolve))
+        assertNull(brandAssetUrl(brand?.hero, resolve))
+    }
+
+    // --- the filled slot ---------------------------------------------------
+
+    @Test
+    fun `a site-relative upload resolves against the shard's base`() {
+        assertEquals(
+            "https://shard.example/uploads/brand/logo.png",
+            brandAssetUrl("/uploads/brand/logo.png", resolve),
+        )
+    }
+
+    @Test
+    fun `an absolute URL passes through`() {
+        // BRAND_LOGO may be set to an off-site URL; the resolver leaves those alone.
+        assertEquals(
+            "https://cdn.example/logo.svg",
+            brandAssetUrl("https://cdn.example/logo.svg", resolve),
+        )
+    }
+
+    // --- the second blank check -------------------------------------------
+
+    @Test
+    fun `a resolver that returns nothing resolves to nothing`() {
+        // No base URL configured yet: the real resolver hands the path back or gives
+        // up. Either way the slot must not become an image request.
+        assertNull(brandAssetUrl("/uploads/brand/logo.png") { null })
+    }
+
+    @Test
+    fun `a resolver that returns blank resolves to nothing`() {
+        // Why the blank check is on both sides of the resolver, not just the input.
+        assertNull(brandAssetUrl("/uploads/brand/logo.png") { "" })
+        assertNull(brandAssetUrl("/uploads/brand/logo.png") { "  " })
+    }
+}

app/src/test/java/com/runicgateway/app/ui/events/EventTimesTest.kt

@@ -0,0 +1,151 @@
+/*
+ * SPDX-License-Identifier: GPL-3.0-or-later
+ */
+package com.runicgateway.app.ui.events
+
+import com.runicgateway.app.R
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertNotEquals
+import org.junit.Assert.assertTrue
+import org.junit.Test
+import java.time.Instant
+import java.time.ZoneId
+import java.util.Locale
+
+/**
+ * Rendering an event's instant and its status word (EVENTS.md §I).
+ *
+ * Two of these are regression tests for defects the WEBSITE shipped and its live
+ * walk caught in events Phase 14a — restated in Kotlin because a rule that is
+ * only written down in another language gets re-derived wrong.
+ */
+class EventTimesTest {
+
+    private val uk = Locale.UK
+
+    // ── The zone split: the day is the reader's, the time is the event's ──
+
+    @Test fun theTimeIsTheEventsZoneNotTheReaders() {
+        // 2026-09-11T00:00Z is 20:00 the previous evening in New York. A shard's
+        // 8pm event is 8pm to everyone reading about it; rendering the reader's
+        // 02:00 would be true and useless.
+        assertEquals("20:00 New York", eventTime("2026-09-11T00:00:00Z", "America/New_York", uk))
+        assertEquals("02:00 Berlin", eventTime("2026-09-11T00:00:00Z", "Europe/Berlin", uk))
+    }
+
+    @Test fun theDayHeadingIsTheReadersOwn() {
+        // The same instant files under different days for two readers, which is the
+        // other half of the split: "what is on this month" is about the month the
+        // person holding the phone is living in.
+        val instant = "2026-09-11T00:30:00Z"
+        val london = readerDayLabel(instant, ZoneId.of("Europe/London"), uk)
+        val newYork = readerDayLabel(instant, ZoneId.of("America/New_York"), uk)
+        assertNotEquals(london, newYork)
+        assertTrue(london, london.contains("11"))
+        assertTrue(newYork, newYork.contains("10"))
+    }
+
+    @Test fun anUnknownZoneFallsBackToUtcRatherThanThrowing() {
+        // A typo in a definition's timezone column must still render.
+        assertEquals("00:00 Nowhere", eventTime("2026-09-11T00:00:00Z", "Mars/Nowhere", uk))
+        assertEquals("00:00 UTC", eventTime("2026-09-11T00:00:00Z", null, uk))
+    }
+
+    @Test fun aZonelessStampIsReadAsUtc() {
+        // MariaDB DATETIME read back as a string reaches the wire with no zone. It
+        // is what the server stored, so it is UTC — reading it as local time would
+        // shift every event by the device's offset.
+        assertEquals("00:00 UTC", eventTime("2026-09-11 00:00:00", "UTC", uk))
+    }
+
+    @Test fun anUnreadableInstantRendersNothingRatherThanCrashing() {
+        assertEquals("", eventTime("not a date", "UTC", uk))
+        assertEquals("", eventDateTime(null, "UTC", uk))
+        assertEquals("", readerDayLabel("", ZoneId.of("UTC"), uk))
+    }
+
+    @Test fun theZoneIsNamedAsAReaderRecognisesIt() {
+        assertEquals("New York", shortZone("America/New_York"))
+        assertEquals("Berlin", shortZone("Europe/Berlin"))
+        assertEquals("UTC", shortZone(null))
+        assertEquals("UTC", shortZone("  "))
+    }
+
+    // ── Scores are fractional, and the walk is why we know ───────────────
+
+    @Test fun aWholeScorePrintsWhole() {
+        // Most modules score by counting, and `12.0` reads as a rounding artefact.
+        assertEquals("1420", scoreText(1420.0, uk))
+        assertEquals("0", scoreText(0.0, uk))
+        assertEquals("-5", scoreText(-5.0, uk))
+    }
+
+    @Test fun aFractionalScoreKeepsItsDigits() {
+        // The live walk's first history row was 318.5. Declaring this field `Long`
+        // did not round it — kotlinx refused the whole body, and a 200 rendered as
+        // "Something went wrong on the server."
+        assertEquals("318.5", scoreText(318.5, uk))
+        assertEquals("0.25", scoreText(0.25, uk))
+        // DECIMAL(18,4): four places, and no trailing zeros past the last digit.
+        assertEquals("1.0625", scoreText(1.0625, uk))
+    }
+
+    @Test fun aNonFiniteScoreDoesNotReachTheScreen() {
+        assertEquals("0", scoreText(Double.NaN, uk))
+        assertEquals("0", scoreText(Double.POSITIVE_INFINITY, uk))
+    }
+
+    // ── The status word: the tense follows the CLOCK, not the status ──────
+
+    @Test fun aFutureCancellationReadsCancelled() {
+        // Phase 14a's own defect: the calendar told a visitor an event four days
+        // away "DID NOT HAPPEN". It had been cancelled, not missed.
+        val now = Instant.parse("2026-09-08T12:00:00Z")
+        assertEquals(
+            R.string.events_status_cancelled,
+            statusWordRes("cancelled", "2026-09-12T20:00:00Z", now),
+        )
+    }
+
+    @Test fun aPastCancellationReadsDidNotHappen() {
+        // Which is also the honest word for the `failed` and `missed` runs the
+        // server folds into `cancelled`.
+        val now = Instant.parse("2026-09-08T12:00:00Z")
+        assertEquals(
+            R.string.events_status_did_not_happen,
+            statusWordRes("cancelled", "2026-09-01T20:00:00Z", now),
+        )
+    }
+
+    @Test fun anUnreadableInstantOnACancellationReadsPast() {
+        val now = Instant.parse("2026-09-08T12:00:00Z")
+        assertEquals(
+            R.string.events_status_did_not_happen,
+            statusWordRes("cancelled", null, now),
+        )
+    }
+
+    @Test fun theOtherThreeStatusesDoNotDependOnTheClock() {
+        val past = Instant.parse("2027-01-01T00:00:00Z")
+        val future = Instant.parse("2020-01-01T00:00:00Z")
+        for (now in listOf(past, future)) {
+            assertEquals(R.string.events_status_live, statusWordRes("live", "2026-09-12T20:00:00Z", now))
+            assertEquals(R.string.events_status_completed, statusWordRes("completed", "2026-09-01T20:00:00Z", now))
+            assertEquals(R.string.events_status_scheduled, statusWordRes("scheduled", "2026-09-12T20:00:00Z", now))
+        }
+    }
+
+    @Test fun anUnknownStatusFallsBackTheWayTheServerDoes() {
+        // `publicStatus()` folds anything it does not know to `scheduled`, so a word
+        // the app has never seen is a contract break rather than a state — and
+        // rendering a raw enum at a reader is not an improvement on it.
+        assertEquals(
+            R.string.events_status_scheduled,
+            statusWordRes("starting", "2026-09-12T20:00:00Z", Instant.now()),
+        )
+        assertEquals(
+            R.string.events_status_scheduled,
+            statusWordRes(null, null, Instant.now()),
+        )
+    }
+}

app/src/test/java/com/runicgateway/app/ui/events/EventsViewModelsTest.kt

@@ -0,0 +1,261 @@
+/*
+ * SPDX-License-Identifier: GPL-3.0-or-later
+ */
+package com.runicgateway.app.ui.events
+
+import androidx.lifecycle.SavedStateHandle
+import com.runicgateway.app.core.auth.SessionManager
+import com.runicgateway.app.core.auth.StoredSession
+import com.runicgateway.app.core.auth.TokenStore
+import com.runicgateway.app.data.api.dto.SafeUserDto
+import com.runicgateway.app.data.api.dto.EventCalendarDto
+import com.runicgateway.app.data.api.dto.EventCalendarEntryDto
+import com.runicgateway.app.data.api.dto.EventHistoryDto
+import com.runicgateway.app.data.api.dto.EventHistoryEntryDto
+import com.runicgateway.app.data.api.dto.EventSeriesDto
+import com.runicgateway.app.data.api.dto.EventSeriesResponse
+import com.runicgateway.app.data.api.dto.PublicEventDto
+import com.runicgateway.app.data.api.dto.PublicEventResponse
+import com.runicgateway.app.data.api.fake.FakeEventsApi
+import com.runicgateway.app.data.repository.EventsRepository
+import com.runicgateway.app.ui.ErrorKind
+import com.runicgateway.app.ui.UiState
+import com.runicgateway.app.util.MainDispatcherRule
+import com.runicgateway.app.util.httpError
+import kotlinx.coroutines.test.runTest
+import kotlinx.serialization.json.Json
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertNull
+import org.junit.Assert.assertTrue
+import org.junit.Rule
+import org.junit.Test
+import java.io.IOException
+
+/** The four event screens' view models (PLAN.md §9 M13). */
+class EventsViewModelsTest {
+
+    @get:Rule val dispatcher = MainDispatcherRule()
+
+    private val api = FakeEventsApi()
+    private val repository = EventsRepository(api)
+
+    private fun entry(slug: String, at: String, kind: String = "run") =
+        EventCalendarEntryDto(kind = kind, title = slug, slug = slug, scheduledFor = at)
+
+    // ── The calendar ─────────────────────────────────────────────────────
+
+    @Test fun theCalendarAsksForNoWindow() = runTest {
+        api.calendar = EventCalendarDto(entries = listOf(entry("a", "2026-09-11T20:00:00Z")))
+
+        val state = EventsViewModel(repository).state.value
+
+        assertTrue(state is UiState.Success)
+        assertEquals(1, (state as UiState.Success).data.entries.size)
+    }
+
+    @Test fun aFourOhFourOnTheCalendarIsNotAFeatureBeingSwitchedOff() = runTest {
+        // These are CORE routes: `toShardUiState`'s "not published here" would name
+        // the wrong cause, and offer an explanation an admin cannot act on.
+        api.error = httpError(404)
+
+        val state = EventsViewModel(repository).state.value
+
+        assertEquals(ErrorKind.NOT_FOUND, (state as UiState.Error).kind)
+    }
+
+    @Test fun theServersOrderIsPreservedByTheDayGrouping() {
+        // The server already sorted by instant; grouping must not re-sort. Two
+        // entries on one reader-day share a heading, a third on another starts one.
+        val entries = listOf(
+            entry("a", "2026-09-11T20:00:00Z"),
+            entry("b", "2026-09-11T21:00:00Z"),
+            entry("c", "2026-09-14T20:00:00Z"),
+        )
+
+        val days = groupByReaderDay(entries)
+
+        assertEquals(2, days.size)
+        assertEquals(listOf("a", "b"), days[0].entries.map { it.slug })
+        assertEquals(listOf("c"), days[1].entries.map { it.slug })
+    }
+
+    @Test fun anEntrySaysWhetherItIsAForecast() {
+        assertTrue(entry("a", "2026-09-11T20:00:00Z", kind = "projected").isProjected)
+        assertTrue(!entry("a", "2026-09-11T20:00:00Z").isProjected)
+    }
+
+    // ── One event ────────────────────────────────────────────────────────
+
+    @Test fun theRunIsPassedThroughUntouched() = runTest {
+        api.event = PublicEventResponse(PublicEventDto(slug = "yew"))
+        val handle = SavedStateHandle(mapOf("slug" to "yew", "run" to "3692"))
+
+        EventViewModel(repository, handle)
+
+        assertEquals("yew", api.lastSlug)
+        assertEquals("3692", api.lastRun)
+    }
+
+    @Test fun aBlankRunIsDroppedRatherThanForwarded() = runTest {
+        api.event = PublicEventResponse(PublicEventDto(slug = "yew"))
+        val handle = SavedStateHandle(mapOf("slug" to "yew", "run" to "  "))
+
+        EventViewModel(repository, handle)
+
+        assertNull(api.lastRun)
+    }
+
+    @Test fun anAbsentRunIsNotSent() = runTest {
+        api.event = PublicEventResponse(PublicEventDto(slug = "yew"))
+
+        EventViewModel(repository, SavedStateHandle(mapOf("slug" to "yew")))
+
+        assertNull(api.lastRun)
+    }
+
+    @Test fun theEnvelopeIsUnwrappedForTheScreen() = runTest {
+        api.event = PublicEventResponse(PublicEventDto(slug = "yew", title = "The Yew Invasion"))
+
+        val state = EventViewModel(repository, SavedStateHandle(mapOf("slug" to "yew"))).state.value
+
+        assertEquals("The Yew Invasion", (state as UiState.Success).data.title)
+    }
+
+    // ── An arc ───────────────────────────────────────────────────────────
+
+    @Test fun anArcWithNothingListedIsAnErrorRatherThanAnEmptyPage() = runTest {
+        // The server's decision, not the screen's: a page for an empty arc would
+        // publish that an operator has named something they have not announced.
+        api.error = httpError(404)
+
+        val state = EventSeriesViewModel(repository, SavedStateHandle(mapOf("slug" to "void"))).state.value
+
+        assertEquals(ErrorKind.NOT_FOUND, (state as UiState.Error).kind)
+    }
+
+    @Test fun anArcUnwrapsItsEnvelope() = runTest {
+        api.series = EventSeriesResponse(EventSeriesDto(name = "The Void", slug = "void"))
+
+        val state = EventSeriesViewModel(repository, SavedStateHandle(mapOf("slug" to "void"))).state.value
+
+        assertEquals("The Void", (state as UiState.Success).data.name)
+    }
+
+    // ── Participation history ────────────────────────────────────────────
+
+    private fun rows(vararg ids: Long) = EventHistoryDto(
+        entries = ids.map { EventHistoryEntryDto(id = it, runId = it, slug = "e$it") },
+    )
+
+    @Test fun aFractionalScoreDecodesRatherThanFailingTheWholeBody() {
+        // The regression the live walk found: `score` is DECIMAL(18,4) on the wire
+        // and a `Long` field makes kotlinx refuse the ENTIRE response, so a 200
+        // reaches the screen as a server error. Decoded from real JSON so the DTO's
+        // type is what is under test, not a hand-built object.
+        val json = Json { ignoreUnknownKeys = true; explicitNulls = false }
+
+        val history = json.decodeFromString<EventHistoryDto>(
+            """{"entries":[{"id":2,"runId":3667,"title":"Midsummer Fair","slug":"mf","score":318.5,"rank":null}]}""",
+        )
+        assertEquals(318.5, history.entries.single().score, 0.0)
+
+        val event = json.decodeFromString<PublicEventResponse>(
+            """{"event":{"slug":"mf","results":{"runId":1,"participants":[{"name":"A","score":318.5}]}}}""",
+        )
+        assertEquals(318.5, event.event.results!!.participants.single().score, 0.0)
+    }
+
+    // A signed-in session manager, so the history view model has an account to
+    // scope to. The screen is unreachable signed out.
+    private class FakeTokenStore(private var stored: StoredSession?) : TokenStore {
+        override fun load(): StoredSession? = stored
+        override fun save(session: StoredSession) { stored = session }
+        override fun clear() { stored = null }
+    }
+
+    private fun playerDto(userId: Long) =
+        SafeUserDto(id = userId, username = "u$userId", role = "player")
+
+    private fun sessionFor(userId: Long) =
+        SessionManager(FakeTokenStore(StoredSession("a", "r", userId, "u$userId", "player")))
+
+    @Test fun switchingAccountDoesNotShowThePreviousOnesHistory() {
+        // **The leak the live walk found, and the suite could not.** A drawer
+        // route's view model survives a sign-out: `navigateTopLevel` saves and
+        // restores back-stack state, so the entry keeps its ViewModelStore and a
+        // view model that loaded only in `init` never runs again. Signing out of
+        // an admin and in as a player showed the player the admin's rows, with no
+        // request made at all.
+        val sessions = sessionFor(33)
+        api.history = rows(9, 8)
+        val vm = MyEventsViewModel(repository, sessions)
+        assertEquals(2, (vm.state.value.items as UiState.Success).data.size)
+
+        api.history = rows(1)
+        sessions.onSignedOut()
+        // Signed out, the previous account's rows are gone rather than left up.
+        assertEquals(0, (vm.state.value.items as UiState.Success).data.size)
+
+        sessions.onSignedIn("a", "r", playerDto(35))
+        assertEquals(listOf(1L), (vm.state.value.items as UiState.Success).data.map { it.id })
+    }
+
+    @Test fun aResumeRevalidationReturningTheSameUserDoesNotRefetch() {
+        // The other half: the gate is the account, not every session emission.
+        val sessions = sessionFor(33)
+        api.history = rows(9, 8)
+        val vm = MyEventsViewModel(repository, sessions)
+        val callsAfterFirstLoad = api.historyCalls
+
+        sessions.onUserRefreshed(playerDto(33))
+
+        assertEquals(callsAfterFirstLoad, api.historyCalls)
+        assertEquals(2, (vm.state.value.items as UiState.Success).data.size)
+    }
+
+    @Test fun aShortFirstPageIsTheEnd() = runTest {
+        api.history = rows(3, 2, 1)
+
+        val state = MyEventsViewModel(repository, sessionFor(1)).state.value
+
+        assertEquals(3, (state.items as UiState.Success).data.size)
+        assertTrue(!state.hasMore)
+    }
+
+    @Test fun aFullPageWalksBackOnTheLastRowsOwnId() = runTest {
+        // Keyset, never an offset: the list gains rows at the top as the reader
+        // attends things, so an offset page would skip and repeat around the seam.
+        api.history = rows(*(1L..25L).reversed().toList().toLongArray())
+        val vm = MyEventsViewModel(repository, sessionFor(1))
+        assertTrue(vm.state.value.hasMore)
+
+        api.history = rows(0)
+        vm.loadMore()
+
+        assertEquals(1L, api.lastBefore)
+        assertEquals(26, (vm.state.value.items as UiState.Success).data.size)
+        assertTrue(!vm.state.value.hasMore)
+    }
+
+    @Test fun aFailedNextPageKeepsThePagesAlreadyRead() = runTest {
+        api.history = rows(*(1L..25L).reversed().toList().toLongArray())
+        val vm = MyEventsViewModel(repository, sessionFor(1))
+
+        api.error = IOException("offline")
+        vm.loadMore()
+
+        // Not an error screen replacing a screenful of history.
+        assertEquals(25, (vm.state.value.items as UiState.Success).data.size)
+        assertTrue(!vm.state.value.loadingMore)
+    }
+
+    @Test fun loadMoreDoesNothingWithoutAFullFirstPage() = runTest {
+        api.history = rows(2, 1)
+        val vm = MyEventsViewModel(repository, sessionFor(1))
+        val callsAfterLoad = api.historyCalls
+
+        vm.loadMore()
+
+        assertEquals(callsAfterLoad, api.historyCalls)
+    }
+}

app/src/test/java/com/runicgateway/app/ui/navigation/MenuCapabilityGatingTest.kt

@@ -0,0 +1,175 @@
+/*
+ * SPDX-License-Identifier: GPL-3.0-or-later
+ */
+package com.runicgateway.app.ui.navigation
+
+import com.runicgateway.app.core.auth.Role
+import com.runicgateway.app.core.auth.Session
+import com.runicgateway.app.core.auth.SessionUser
+import com.runicgateway.app.data.repository.Capability
+import com.runicgateway.app.data.repository.ShardFeature
+import com.runicgateway.app.data.repository.ShardFeatures
+import com.runicgateway.app.data.repository.SiteCapabilities
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertFalse
+import org.junit.Assert.assertTrue
+import org.junit.Test
+
+/**
+ * The third gate on a drawer row (PLAN.md §5, §9 M13): whether the code behind it
+ * is installed on this backend at all.
+ *
+ * **A different question from the feature flag, which is why it is a third
+ * filter.** Capability is per HOST — it changes when an operator installs or
+ * removes a module. A feature is per VIEWER — it changes on sign-in. The two also
+ * fail differently, and the difference is the bug this milestone fixed.
+ */
+class MenuCapabilityGatingTest {
+
+    private fun signedIn(role: Role) =
+        Session.SignedIn(SessionUser(id = 1, username = "u", role = role))
+
+    private fun serving(vararg caps: String) =
+        SiteCapabilities(core = emptySet(), modules = caps.toSet())
+
+    private val shardEntry = MenuEntry(
+        "shard",
+        0,
+        MenuAccess.PUBLIC,
+        feature = ShardFeature.STATUS,
+        capability = Capability.SHARD,
+    )
+    private val eventsEntry = MenuEntry("events", 0, MenuAccess.PUBLIC, capability = Capability.EVENTS)
+    private val plainEntry = MenuEntry("news", 0, MenuAccess.PUBLIC)
+
+    private fun everyFeature() = ShardFeatures(level = "anonymous", visible = setOf(ShardFeature.STATUS))
+
+    @Test fun aRowHidesWhenTheBackendSaysItsModuleIsNotInstalled() {
+        // The whole point. On a site with no game module `/public/shard/features`
+        // 404s, so the FEATURE answer is unknown and fails open — and before M13
+        // that was the only answer the app had, so the row rendered and 404'd.
+        val entries = listOf(plainEntry, shardEntry, eventsEntry)
+
+        val visible = visibleEntries(
+            entries,
+            Session.SignedOut,
+            features = null,
+            capabilities = serving("events"),
+        ).map { it.route }
+
+        assertEquals(listOf("news", "events"), visible)
+    }
+
+    @Test fun anUnknownCapabilityAnswerLeavesEveryRowShowing() {
+        // A host that has never answered. Same fail-open direction the feature gate
+        // takes, and for the same reason: the server gates every call regardless.
+        val entries = listOf(plainEntry, shardEntry, eventsEntry)
+
+        val visible = visibleEntries(
+            entries,
+            Session.SignedOut,
+            features = everyFeature(),
+            capabilities = null,
+        ).map { it.route }
+
+        assertEquals(listOf("news", "shard", "events"), visible)
+    }
+
+    @Test fun anEmptyAnswerIsNotAnUnknownAnswer() {
+        // The distinction the whole milestone rests on, as one assertion.
+        assertTrue(isEntryVisible(shardEntry, Session.SignedOut, everyFeature(), null))
+        assertFalse(isEntryVisible(shardEntry, Session.SignedOut, everyFeature(), serving()))
+    }
+
+    @Test fun bothGatesMustPassAndNeitherCanOverrideTheOther() {
+        val installed = serving(Capability.SHARD)
+
+        // Installed but not published to this viewer: hidden.
+        assertFalse(
+            isEntryVisible(shardEntry, Session.SignedOut, ShardFeatures("anonymous", emptySet()), installed),
+        )
+        // Published but the module is gone: hidden. (Not a state a real backend
+        // reaches, and the gate must not depend on that.)
+        assertFalse(isEntryVisible(shardEntry, Session.SignedOut, everyFeature(), serving()))
+        // Both: shown.
+        assertTrue(isEntryVisible(shardEntry, Session.SignedOut, everyFeature(), installed))
+    }
+
+    @Test fun theRoleGateStillOutranksBoth() {
+        // An admin row is an admin row on a backend that serves everything.
+        val adminEntry = MenuEntry("admin/dashboard", 0, MenuAccess.STAFF)
+        assertFalse(
+            isEntryVisible(adminEntry, Session.SignedOut, everyFeature(), serving(Capability.SHARD)),
+        )
+        assertTrue(
+            isEntryVisible(adminEntry, signedIn(Role.ADMIN), everyFeature(), serving(Capability.SHARD)),
+        )
+    }
+
+    @Test fun aRowWithNoCapabilityIsNeverGatedByOne() {
+        // Every row that predates M13 keeps the behaviour it had.
+        assertTrue(isEntryVisible(plainEntry, Session.SignedOut, null, serving()))
+        assertTrue(isEntryVisible(plainEntry, Session.SignedOut, null, null))
+    }
+
+    // ── The shipped menu, as coded ───────────────────────────────────────
+
+    @Test fun everyRowOnAModulePathDeclaresTheShardCapability() {
+        // **Defined by ROUTE, not by "has a feature", and the live walk is why.**
+        // The first cut of this test asked whether every row with a `feature`
+        // declared the capability — which is true and insufficient: the three
+        // player game-data rows read `/player/shard/*`, the same module's player
+        // mount, and carry no feature at all because they are gated by ownership
+        // rather than by the visibility framework. They rendered on a backend with
+        // no module installed and answered "This content couldn't be found",
+        // through a green suite.
+        val onAModulePath = APP_MENU.filter {
+            it.route.startsWith("shard") || it.route.startsWith("player/") || it.route == Routes.ATLAS
+        }
+        assertEquals(8, onAModulePath.size)
+        assertTrue(
+            onAModulePath.filter { it.capability != Capability.SHARD }.map { it.route }.toString(),
+            onAModulePath.all { it.capability == Capability.SHARD },
+        )
+    }
+
+    @Test fun aModuleLessBackendShowsNoModuleRowToAnybody() {
+        // The walk's assertion, as a test: every rung, and not one module row.
+        val core = SiteCapabilities(core = setOf(Capability.EVENTS), modules = emptySet())
+        for (session in listOf(
+            Session.SignedOut,
+            signedIn(Role.PLAYER),
+            signedIn(Role.ADMIN),
+        )) {
+            val visible = visibleEntries(APP_MENU, session, everyFeature(), core).map { it.route }
+            assertTrue(
+                visible.toString(),
+                visible.none {
+                    it.startsWith("shard") || it.startsWith("player/") || it == Routes.ATLAS
+                },
+            )
+            // …and the core rows are all still there.
+            assertTrue(Routes.EVENTS in visible)
+            assertTrue(Routes.NEWS in visible)
+        }
+    }
+
+    @Test fun bothEventRowsDeclareCoresCapabilityAndNoFeature() {
+        // Events are core's. A `feature` on one of them would gate a core screen on
+        // a module's visibility config, which is the coupling this separation exists
+        // to prevent.
+        val eventRows = APP_MENU.filter { it.capability == Capability.EVENTS }
+        assertEquals(listOf(Routes.EVENTS, Routes.MY_EVENTS), eventRows.map { it.route })
+        assertTrue(eventRows.all { it.feature == null })
+    }
+
+    @Test fun myEventsIsSignedInRatherThanPlayer() {
+        // The route is `requireAuth` alone and self-scoped; staff attend events too,
+        // and the website needed two mounts only because of its own /account guard.
+        val row = APP_MENU.first { it.route == Routes.MY_EVENTS }
+        assertEquals(MenuAccess.SIGNED_IN, row.access)
+        assertTrue(isEntryVisible(row, signedIn(Role.ADMIN), null, serving(Capability.EVENTS)))
+        assertTrue(isEntryVisible(row, signedIn(Role.PLAYER), null, serving(Capability.EVENTS)))
+        assertFalse(isEntryVisible(row, Session.SignedOut, null, serving(Capability.EVENTS)))
+    }
+}

app/src/test/java/com/runicgateway/app/ui/navigation/NavOverridesTest.kt

@@ -0,0 +1,291 @@
+/*
+ * SPDX-License-Identifier: GPL-3.0-or-later
+ */
+package com.runicgateway.app.ui.navigation
+
+import com.runicgateway.app.core.auth.Role
+import com.runicgateway.app.core.auth.Session
+import com.runicgateway.app.core.auth.SessionUser
+import com.runicgateway.app.data.repository.ShardFeature
+import com.runicgateway.app.data.repository.ShardFeatures
+import kotlinx.serialization.json.JsonObject
+import kotlinx.serialization.json.buildJsonObject
+import kotlinx.serialization.json.put
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertNull
+import org.junit.Assert.assertSame
+import org.junit.Assert.assertTrue
+import org.junit.Test
+
+/**
+ * The public-nav override merge (THEMING_AND_NAV.md §6): label, order and hidden,
+ * applied to the coded [APP_MENU] and nothing else.
+ *
+ * Two things these tests are really about. **AC-1** — an instance whose admin never
+ * touched the nav must get the drawer the app shipped with, which here is the
+ * strongest possible assertion: the same list instance back. And **AC-3** — the
+ * merge runs before [visibleEntries] and cannot reach past it, so a `hidden: false`
+ * on a gated row still shows nothing.
+ */
+class NavOverridesTest {
+
+    private fun nav(vararg items: Pair<String, JsonObject>): JsonObject =
+        buildJsonObject { for ((path, entry) in items) put(path, entry) }
+
+    private fun entry(
+        label: String? = null,
+        order: Int? = null,
+        hidden: Boolean? = null,
+    ): JsonObject = buildJsonObject {
+        label?.let { put("label", it) }
+        order?.let { put("order", it) }
+        hidden?.let { put("hidden", it) }
+    }
+
+    private fun routes(nav: JsonObject?) = applyNavOverrides(APP_MENU, nav).map { it.route }
+
+    /**
+     * The public block once a stored row has made the merge sort it — the website's
+     * number line, not the app's coded order.
+     *
+     * **About sits above the shard rows here, and that is the corrected table
+     * showing through** (M13): About is core's last nav row at index 7 and the
+     * module's nine append after it at 8-16. Under the stale sixteen-row table
+     * About was index 15 and came last, which is what these assertions used to say.
+     */
+    private val mergedPublic = listOf(
+        Routes.HOME, Routes.NEWS, Routes.EVENTS, Routes.WIKI, Routes.page("about"),
+        Routes.SHARD, Routes.SHARD_RULES, Routes.ATLAS, Routes.SHARD_LEADERBOARDS,
+        Routes.SHARD_MARKET,
+    )
+
+    /** How many rows that block holds, so the take/drop below say why. */
+    private val publicBlock = mergedPublic.size
+
+    // ── AC-1: the untouched instance ─────────────────────────────────────
+
+    @Test fun noStoredRowReturnsTheCodedMenuItself() {
+        // Identity, not equality: the drawer of an instance that never edited its
+        // nav is the shipped one, and nothing was rebuilt to arrive at it.
+        assertSame(APP_MENU, applyNavOverrides(APP_MENU, null))
+    }
+
+    @Test fun anEmptyRowReturnsTheCodedMenuItself() {
+        assertSame(APP_MENU, applyNavOverrides(APP_MENU, buildJsonObject { }))
+    }
+
+    @Test fun aRowWithNothingUsableInItReturnsTheCodedMenuItself() {
+        // A blank label, a non-finite order, `hidden: false`, a path the app has no
+        // screen for, and a path it maps but doesn't put in the drawer. None of it
+        // says anything, so none of it may cost the coded menu.
+        val stored = nav(
+            "/" to entry(label = "   "),
+            "/site/news" to entry(hidden = false),
+            "/admin/appearance" to entry(label = "Nope"),
+            "/site/screenshots" to entry(label = "Shots", order = 0),
+            "/uo/champs" to entry(hidden = true),
+        )
+
+        assertSame(APP_MENU, applyNavOverrides(APP_MENU, stored))
+    }
+
+    @Test fun aMalformedEntryIsDroppedAndItsNeighbourKept() {
+        val stored = buildJsonObject {
+            put("/site/news", "not an object")
+            put("/wiki", entry(label = "Codex"))
+        }
+
+        val merged = applyNavOverrides(APP_MENU, stored)
+
+        assertEquals(mergedPublic, merged.take(publicBlock).map { it.route })
+        assertEquals("Codex", merged.first { it.route == Routes.WIKI }.label)
+        assertNull(merged.first { it.route == Routes.NEWS }.label)
+    }
+
+    // ── Labels ───────────────────────────────────────────────────────────
+
+    @Test fun aLabelOverridesTheBundledString() {
+        // `/uo/shard`, not `/site/shard`: the row belongs to module-uo and core
+        // mounts a module's pages at `/<id>/<path>` (M13).
+        val merged = applyNavOverrides(APP_MENU, nav("/uo/shard" to entry(label = "  The Realm  ")))
+
+        val shard = merged.first { it.route == Routes.SHARD }
+        assertEquals("The Realm", shard.label)
+        // The override lands on `label` and nothing else — the gates are untouched.
+        assertEquals(ShardFeature.STATUS, shard.feature)
+        assertEquals(MenuAccess.PUBLIC, shard.access)
+        assertEquals(mergedPublic, merged.take(publicBlock).map { it.route })
+    }
+
+    @Test fun aNonStringLabelIsIgnored() {
+        val stored = buildJsonObject { put("/wiki", buildJsonObject { put("label", 7) }) }
+
+        assertSame(APP_MENU, applyNavOverrides(APP_MENU, stored))
+    }
+
+    // ── Hidden ───────────────────────────────────────────────────────────
+
+    @Test fun hiddenDropsTheRow() {
+        val routes = routes(nav("/uo/market" to entry(hidden = true)))
+
+        assertTrue(Routes.SHARD_MARKET !in routes)
+        assertEquals(APP_MENU.size - 1, routes.size)
+    }
+
+    @Test fun homeCanBeHidden() {
+        // Mirrors the website, where `/` is hideable too. Home stays the NavHost's
+        // start destination and stays reachable by back-press; the app does not
+        // invent a policy the site doesn't have.
+        val routes = routes(nav("/" to entry(hidden = true)))
+
+        assertTrue(Routes.HOME !in routes)
+    }
+
+    @Test fun hiddenFalseHidesNothing() {
+        assertSame(APP_MENU, applyNavOverrides(APP_MENU, nav("/uo/market" to entry(hidden = false))))
+    }
+
+    @Test fun hiddenWinsOverALabelOnTheSameRow() {
+        val routes = routes(nav("/wiki" to entry(label = "Codex", hidden = true)))
+
+        assertTrue(Routes.WIKI !in routes)
+    }
+
+    // ── Order ────────────────────────────────────────────────────────────
+
+    @Test fun anExplicitOrderMovesTheRowWithinThePublicBlock() {
+        // The website's own indices: About is 7, and Market — the last row of all,
+        // now that the module's nine append after core's eight — is 16. Dragging
+        // About to the top and Home past the end writes exactly this.
+        val routes = routes(
+            nav(
+                "/site/about" to entry(order = 0),
+                "/" to entry(order = 17),
+            ),
+        )
+
+        assertEquals(
+            listOf(
+                Routes.page("about"), Routes.NEWS, Routes.EVENTS, Routes.WIKI, Routes.SHARD,
+                Routes.SHARD_RULES, Routes.ATLAS, Routes.SHARD_LEADERBOARDS, Routes.SHARD_MARKET,
+                Routes.HOME,
+            ),
+            routes.take(publicBlock),
+        )
+    }
+
+    @Test fun anUntouchedRowKeepsItsPlaceOnTheWebsitesNumberLine() {
+        // The tie-break that needs the website's order rather than the app's: an
+        // explicit 6 meets Wiki's implicit 6 (its index in the site's nav, where
+        // Events and the three news categories sit between News and Wiki). Explicit
+        // wins. That the number moved from 5 to 6 when the site gained a row is the
+        // whole reason this table has to track the site's nav rather than the app's.
+        val routes = routes(nav("/site/about" to entry(order = 6)))
+
+        assertEquals(
+            listOf(Routes.HOME, Routes.NEWS, Routes.EVENTS, Routes.page("about"), Routes.WIKI),
+            routes.take(5),
+        )
+    }
+
+    @Test fun theAppsOwnRowsKeepTheirCodedOrderAfterThePublicBlock() {
+        // Contact, Account, Notifications, My Events, the three player groups and
+        // the four staff rows have no website counterpart to be reordered against
+        // (§6.2) — My Events because `/account/events` is behind the site's own
+        // auth guard and is not on its public nav at all.
+        val tail = APP_MENU.drop(publicBlock).map { it.route }
+
+        val merged = routes(nav("/site/about" to entry(order = 0)))
+
+        assertEquals(tail, merged.drop(publicBlock))
+    }
+
+    @Test fun reorderingAndHidingCompose() {
+        val routes = routes(
+            nav(
+                "/site/about" to entry(order = 0),
+                "/" to entry(hidden = true),
+            ),
+        )
+
+        assertEquals(Routes.page("about"), routes.first())
+        assertTrue(Routes.HOME !in routes)
+    }
+
+    // ── The two stored shapes ────────────────────────────────────────────
+
+    @Test fun theWrappedShapeIsRead() {
+        // Website phase 10 wraps the map as {items, sections, links} without
+        // migrating what phases 6-8 stored bare, so both shapes are live.
+        val stored = buildJsonObject {
+            put("items", nav("/wiki" to entry(label = "Codex")))
+            put("sections", buildJsonObject { })
+            put("links", buildJsonObject { })
+        }
+
+        val merged = applyNavOverrides(APP_MENU, stored)
+
+        assertEquals("Codex", merged.first { it.route == Routes.WIKI }.label)
+    }
+
+    @Test fun sectionsAndLinksDoNotDisturbTheItemsMerge() {
+        // This merge is items-only; `buildNavTree` is what renders the structure
+        // around them (§6.3), and it leans on this staying true — an `items` map
+        // that says nothing still returns the coded menu itself.
+        val stored = buildJsonObject {
+            put("items", buildJsonObject { })
+            put("sections", buildJsonObject { put("id", "lore") })
+        }
+
+        assertSame(APP_MENU, applyNavOverrides(APP_MENU, stored))
+    }
+
+    // ── AC-3: the merge cannot reach past the gates ──────────────────────
+
+    @Test fun anOverrideCannotUnhideAFeatureGatedRow() {
+        val stored = nav(
+            "/uo/market" to entry(label = "Bazaar", hidden = false, order = 0),
+        )
+
+        val visible = visibleEntries(
+            applyNavOverrides(APP_MENU, stored),
+            Session.SignedIn(SessionUser(id = 1, username = "u", role = Role.ADMIN)),
+            ShardFeatures(level = "admin", visible = setOf(ShardFeature.STATUS)),
+        ).map { it.route }
+
+        // Relabeled and moved to the front, and still not shown: the shard does not
+        // publish the market, and an admin does not outrank that.
+        assertTrue(Routes.SHARD_MARKET !in visible)
+        assertTrue(Routes.SHARD in visible)
+    }
+
+    @Test fun anOverrideCannotUnhideARoleGatedRow() {
+        val stored = nav("/" to entry(order = 99))
+
+        val visible = visibleEntries(
+            applyNavOverrides(APP_MENU, stored),
+            Session.SignedOut,
+            features = null,
+        ).map { it.route }
+
+        assertTrue(Routes.ACCOUNT !in visible)
+        assertTrue(Routes.ADMIN_DASHBOARD !in visible)
+        assertTrue(Routes.PLAYER_CHARACTERS !in visible)
+    }
+
+    @Test fun theGatesRunOnTheMergedListNotTheCodedOne() {
+        // Hiding is subtractive on top of the gates, so the two compose: the row an
+        // admin hid is gone, and so is the row this caller may not see.
+        val stored = nav("/wiki" to entry(hidden = true))
+
+        val visible = visibleEntries(
+            applyNavOverrides(APP_MENU, stored),
+            Session.SignedOut,
+            ShardFeatures(level = "anonymous", visible = setOf(ShardFeature.STATUS)),
+        ).map { it.route }
+
+        assertTrue(Routes.WIKI !in visible)
+        assertTrue(Routes.SHARD_MARKET !in visible)
+        assertTrue(Routes.HOME in visible)
+    }
+}

app/src/test/java/com/runicgateway/app/ui/navigation/NavPathsTest.kt

@@ -0,0 +1,264 @@
+/*
+ * SPDX-License-Identifier: GPL-3.0-or-later
+ */
+package com.runicgateway.app.ui.navigation
+
+import com.runicgateway.app.data.repository.ContentRepository.PostCategory
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertNull
+import org.junit.Assert.assertTrue
+import org.junit.Test
+
+/**
+ * The website path → app route table (THEMING_AND_NAV.md §6.2).
+ *
+ * This is the milestone's one piece of cross-repo coupling, so the tests are
+ * mostly about the table's *shape* — that it stays complete, unambiguous, and
+ * honest about which rows the app actually surfaces in its drawer.
+ */
+class NavPathsTest {
+
+    @Test fun everyWebsiteNavPathIsMapped() {
+        // Core's eight rows plus module-uo's nine, both quoted in NavPaths.kt. If
+        // either side adds one, this is the test that says so — a path with no
+        // mapping is silently unresolvable in phase 6's link handling, which is
+        // exactly how the nine shard rows went stale for a month after the
+        // module-system cutover moved them from /site/ to /uo/ (M13).
+        assertEquals(17, WEBSITE_PUBLIC_NAV.size)
+        assertEquals(WEBSITE_PUBLIC_NAV.size, WEB_PATH_TO_ROUTE.size)
+    }
+
+    @Test fun theShardRowsAreTheModulesPathsNotCores() {
+        // The defect M13 fixed, kept as an assertion: these nine belong to
+        // module-uo and core mounts a module's pages at `/<id>/<path>`. A `/site/`
+        // spelling here is the stale table coming back.
+        val shard = WEBSITE_PUBLIC_NAV.map { it.path }.filter { it.startsWith("/uo/") }
+        assertEquals(9, shard.size)
+        assertTrue(WEBSITE_PUBLIC_NAV.none { it.path.startsWith("/site/shard") })
+        assertTrue(WEBSITE_PUBLIC_NAV.none { it.path == "/site/champs" })
+        assertNull(appRouteForWebPath("/site/champs"))
+        assertEquals(Routes.SHARD_CHAMPS, appRouteForWebPath("/uo/champs"))
+    }
+
+    @Test fun everyMappedRouteIsDistinct() {
+        // WEB_ROUTE_ORDER is keyed by route, so a duplicate would silently drop a
+        // row's position from the sort.
+        assertEquals(WEBSITE_PUBLIC_NAV.size, WEBSITE_PUBLIC_NAV.map { it.route }.toSet().size)
+        assertEquals(WEBSITE_PUBLIC_NAV.size, WEB_ROUTE_ORDER.size)
+    }
+
+    @Test fun theWebsitesOrderIsPreserved() {
+        // Load-bearing: a stored `order` is an index into this list. Core numbers
+        // 0-7 and `mergeFlat` appends the module's rows after them, none of which
+        // declares an `order` of its own.
+        assertEquals(0, WEB_ROUTE_ORDER[Routes.HOME])
+        assertEquals(1, WEB_ROUTE_ORDER[Routes.NEWS])
+        assertEquals(2, WEB_ROUTE_ORDER[Routes.EVENTS])
+        assertEquals(6, WEB_ROUTE_ORDER[Routes.WIKI])
+        assertEquals(7, WEB_ROUTE_ORDER[Routes.page("about")])
+        assertEquals(8, WEB_ROUTE_ORDER[Routes.SHARD])
+        assertEquals(16, WEB_ROUTE_ORDER[Routes.SHARD_MARKET])
+    }
+
+    @Test fun theDrawerRowsAreTheIntersectionWithAppMenu() {
+        // Ten of the seventeen have a drawer row. The other seven are mapped but not
+        // surfaced — three news category tabs and the four Shard hub boards — and
+        // an override for one of them is ignored rather than obeyed (§6.2).
+        val coded = APP_MENU.map { it.route }.toSet()
+        val surfaced = WEBSITE_PUBLIC_NAV.filter { it.route in coded }.map { it.path }
+
+        assertEquals(
+            listOf(
+                "/", "/site/news", "/site/events", "/wiki", "/site/about",
+                "/uo/shard", "/uo/rules", "/uo/atlas", "/uo/leaderboards", "/uo/market",
+            ),
+            surfaced,
+        )
+    }
+
+    @Test fun theSevenUnsurfacedPathsStillResolveToAScreen() {
+        // Phase 6's added links resolve against the same table, and there a category
+        // tab or a hub board is a perfectly good destination.
+        val unsurfaced = listOf(
+            "/site/screenshots", "/site/five-on-friday", "/site/newsletter",
+            "/uo/champs", "/uo/guilds", "/uo/governors", "/uo/houses",
+        )
+
+        assertTrue(unsurfaced.all { appRouteForWebPath(it) != null })
+        assertTrue(unsurfaced.none { appRouteForWebPath(it) in APP_MENU.map { e -> e.route } })
+    }
+
+    @Test fun theNewsCategoriesMapToTheirTab() {
+        assertEquals("news?category=screenshots", appRouteForWebPath("/site/screenshots"))
+        assertEquals("news?category=five-on-friday", appRouteForWebPath("/site/five-on-friday"))
+        assertEquals("news?category=newsletter", appRouteForWebPath("/site/newsletter"))
+        // The plain news path is the un-argumented route, so it matches the drawer's
+        // coded row and opens the default tab.
+        assertEquals(Routes.NEWS, appRouteForWebPath("/site/news"))
+    }
+
+    @Test fun theCategoryRouteMatchesTheNavHostPattern() {
+        // The pattern the NavHost declares and the value callers navigate to have to
+        // agree on the query key, or the argument arrives as null and the screen
+        // silently opens the default tab.
+        assertEquals("news?category={category}", Routes.NEWS_ROUTE)
+        assertTrue(Routes.NEWS_ROUTE.startsWith("${Routes.NEWS}?"))
+        for (category in PostCategory.entries) {
+            assertEquals("${Routes.NEWS}?category=${category.urlSlug}", Routes.news(category))
+        }
+    }
+
+    @Test fun theRoutePatternStripsToTheTopLevelRoute() {
+        // How RunicApp recognizes the News destination: `destination.route` is the
+        // pattern, and the drawer's row is the bare route.
+        assertEquals(Routes.NEWS, Routes.NEWS_ROUTE.substringBefore('?'))
+        assertEquals(Routes.NEWS, Routes.news(PostCategory.NEWSLETTER).substringBefore('?'))
+    }
+
+    // ── Lookup hygiene ───────────────────────────────────────────────────
+
+    @Test fun anUnknownPathResolvesToNothing() {
+        assertNull(appRouteForWebPath("/admin/appearance"))
+        assertNull(appRouteForWebPath("/site/news/some-post"))
+        assertNull(appRouteForWebPath("https://elsewhere.example/"))
+    }
+
+    @Test fun blankAndNullResolveToNothing() {
+        assertNull(appRouteForWebPath(null))
+        assertNull(appRouteForWebPath(""))
+        assertNull(appRouteForWebPath("   "))
+    }
+
+    @Test fun aTrailingSlashIsTolerated() {
+        // A hand-edited settings row may carry one; the root is left alone.
+        assertEquals(Routes.WIKI, appRouteForWebPath("/wiki/"))
+        assertEquals(Routes.SHARD, appRouteForWebPath("  /uo/shard/  "))
+        assertEquals(Routes.HOME, appRouteForWebPath("/"))
+    }
+
+    // ── resolveWebPath: an added link may name any page on the site (§6.3) ──
+
+    @Test fun theNavTablesPathsResolveTheSameWay() {
+        // An added link to a path the nav already knows must land where the nav row
+        // does, or the same destination would behave differently depending on how
+        // the admin reached it.
+        for (row in WEBSITE_PUBLIC_NAV) {
+            assertEquals(row.route, resolveWebPath(row.path))
+        }
+    }
+
+    @Test fun theSitesDetailRoutesResolve() {
+        // Read off website/client/src/App.jsx. Note what is NOT here: the site has
+        // no /site/news/<id> route — its one post-detail route is the newsletter's.
+        assertEquals(Routes.wikiPage("smithing"), resolveWebPath("/wiki/smithing"))
+        assertEquals(Routes.atlasCreature("dragon"), resolveWebPath("/uo/atlas/dragon"))
+        assertEquals(Routes.marketVendor("0x24C"), resolveWebPath("/uo/market/vendors/0x24C"))
+        assertEquals(Routes.post("newsletter", "12"), resolveWebPath("/site/newsletter/12"))
+        // The module's detail routes are the module's; the old /site/ spelling is
+        // not a second address for them.
+        assertNull(resolveWebPath("/site/atlas/dragon"))
+        assertNull(resolveWebPath("/site/market/vendors/0x24C"))
+    }
+
+    // ── Events (M13) ───────────────────────────────────────
+
+    @Test fun theEventPagesResolve() {
+        assertEquals(Routes.EVENTS, resolveWebPath("/site/events"))
+        assertEquals(Routes.event("the-yew-invasion"), resolveWebPath("/site/events/the-yew-invasion"))
+        assertEquals(
+            Routes.eventSeries("the-void"),
+            resolveWebPath("/site/events/series/the-void"),
+        )
+    }
+
+    @Test fun anEventUrlsRunIsCarriedThrough() {
+        // The one exception to "a query hands off", and the whole reason for it:
+        // this is the exact shape events Phase 14a's `eventUrl` writes into every
+        // announcement. Dropping the run would open next Friday's occurrence from a
+        // mail about last Friday's.
+        assertEquals(
+            Routes.event("the-yew-invasion", "3692"),
+            resolveWebPath("/site/events/the-yew-invasion?run=3692"),
+        )
+        assertEquals("events/the-yew-invasion?run=3692", Routes.event("the-yew-invasion", "3692"))
+    }
+
+    @Test fun theRunCarveOutIsOneKeyOnOnePath() {
+        // Narrow on purpose. Anything the app cannot honor natively hands off, so
+        // the browser gets the parameter the author actually wrote.
+        assertNull(resolveWebPath("/site/events/x?utm=mail"))
+        assertNull(resolveWebPath("/site/events/x?run=3&utm=mail"))
+        assertNull(resolveWebPath("/site/events/x?run="))
+        assertNull(resolveWebPath("/site/events/x#results"))
+        assertNull(resolveWebPath("/site/events?seriesId=3"))
+        assertNull(resolveWebPath("/site/events/series/the-void?run=3"))
+        // And no OTHER path gained a query: the rule is one path's, not general.
+        assertNull(resolveWebPath("/wiki/smithing?x=1"))
+    }
+
+    @Test fun anEventRouteWithNoRunCarriesNoEmptyArgument() {
+        // `events/x?run=` would reach the screen as a blank string and be forwarded
+        // to the server as one.
+        assertEquals("events/x", Routes.event("x"))
+        assertEquals("events/x", Routes.event("x", null))
+        assertEquals("events/x", Routes.event("x", "  "))
+    }
+
+    @Test fun theEventRoutePatternStripsToTheTopLevelRoute() {
+        // Same rule the News hub needs: `destination.route` is the pattern, and the
+        // drawer compares on the part before the query.
+        assertEquals(Routes.EVENTS, Routes.EVENT_ROUTE.substringBefore('?').substringBefore('/'))
+        assertEquals("events/{slug}", Routes.EVENT_ROUTE.substringBefore('?'))
+    }
+
+    @Test fun myEventsHasNoDynamicSibling() {
+        // `events/mine` would race `events/{slug}` — both two segments — which is
+        // the static-versus-argument bug events Phase 13 shipped one tier along.
+        assertTrue(Routes.MY_EVENTS.startsWith("account/"))
+        assertNull(resolveWebPath("/account/events"))
+    }
+
+    @Test fun aTopLevelSlugIsACmsPage() {
+        // The site serves CMS pages from a top-level /<slug>, so this is the rule
+        // that opens an admin's own page natively rather than in a browser.
+        assertEquals(Routes.page("donate"), resolveWebPath("/donate"))
+        assertEquals(Routes.page("about"), resolveWebPath("/site/about"))
+    }
+
+    @Test fun theSitesOwnSectionsAreNotCmsPages() {
+        // React Router ranks its static routes above /:slug, and so must the app —
+        // otherwise a link to the admin panel would open a 404 CMS page in-app
+        // instead of the real thing in a browser.
+        for (path in listOf("/admin", "/account", "/player", "/site", "/invite", "/preview", "/api", "/uploads")) {
+            assertNull(path, resolveWebPath(path))
+        }
+        // /wiki is reserved from the catch-all but mapped by the table above it.
+        assertEquals(Routes.WIKI, resolveWebPath("/wiki"))
+    }
+
+    @Test fun aPathTheAppHasNoScreenForHandsOff() {
+        assertNull(resolveWebPath("/site/status"))
+        assertNull(resolveWebPath("/uo/shard/activity"))
+        assertNull(resolveWebPath("/uo/guilds/12"))
+        // `/uo` is a module's namespace, not a CMS page slug.
+        assertNull(resolveWebPath("/uo"))
+        assertNull(resolveWebPath("/account/login"))
+        assertNull(resolveWebPath("/admin/navigation"))
+        assertNull(resolveWebPath("/site/atlas/dragon/extra"))
+    }
+
+    @Test fun aQueryOrFragmentHandsOff() {
+        // No app route but the event page takes either, so a native match would
+        // quietly drop what the admin wrote. The browser honors it exactly.
+        assertNull(resolveWebPath("/site/news?tag=patch"))
+        assertNull(resolveWebPath("/donate#tiers"))
+        assertEquals(Routes.NEWS, resolveWebPath("/site/news"))
+    }
+
+    @Test fun aMalformedPathResolvesToNothing() {
+        assertNull(resolveWebPath(null))
+        assertNull(resolveWebPath(""))
+        assertNull(resolveWebPath("/site//news"))
+        assertNull(resolveWebPath("https://elsewhere.example/donate"))
+    }
+}

app/src/test/java/com/runicgateway/app/ui/navigation/NavTreeTest.kt

@@ -0,0 +1,457 @@
+/*
+ * SPDX-License-Identifier: GPL-3.0-or-later
+ */
+package com.runicgateway.app.ui.navigation
+
+import com.runicgateway.app.core.auth.Role
+import com.runicgateway.app.core.auth.Session
+import com.runicgateway.app.core.auth.SessionUser
+import com.runicgateway.app.data.repository.ShardFeature
+import com.runicgateway.app.data.repository.ShardFeatures
+import kotlinx.serialization.json.JsonObject
+import kotlinx.serialization.json.buildJsonArray
+import kotlinx.serialization.json.buildJsonObject
+import kotlinx.serialization.json.put
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertNull
+import org.junit.Assert.assertSame
+import org.junit.Assert.assertTrue
+import org.junit.Test
+
+/**
+ * Drawer sections and added links (THEMING_AND_NAV.md §6.3) — the tree build and
+ * the gate that prunes it.
+ *
+ * Three things these tests are really about. **AC-1**: an admin who created no
+ * structure gets phase 5 back untouched, and an untouched instance gets the coded
+ * [APP_MENU] entries themselves. **AC-3**: [pruneNav] runs after the build and
+ * remains the boundary — including inside a section, and including the case where
+ * it empties one. And the link path rule, which is what keeps "an override may
+ * never introduce navigation" true of a feature whose whole job is to add entries:
+ * a link may name any page **on this site**, and nothing else.
+ */
+class NavTreeTest {
+
+    // ── Fixtures ─────────────────────────────────────────────────────────
+
+    private fun stored(
+        items: JsonObject = buildJsonObject { },
+        sections: List<JsonObject> = emptyList(),
+        links: List<JsonObject> = emptyList(),
+    ): JsonObject = buildJsonObject {
+        put("items", items)
+        put("sections", buildJsonArray { sections.forEach { add(it) } })
+        put("links", buildJsonArray { links.forEach { add(it) } })
+    }
+
+    private fun items(vararg entries: Pair<String, JsonObject>): JsonObject =
+        buildJsonObject { for ((path, entry) in entries) put(path, entry) }
+
+    private fun item(
+        label: String? = null,
+        order: Int? = null,
+        hidden: Boolean? = null,
+        section: String? = null,
+    ): JsonObject = buildJsonObject {
+        label?.let { put("label", it) }
+        order?.let { put("order", it) }
+        hidden?.let { put("hidden", it) }
+        section?.let { put("section", it) }
+    }
+
+    private fun section(id: String, label: String? = "Lore", order: Int? = null): JsonObject =
+        buildJsonObject {
+            put("id", id)
+            label?.let { put("label", it) }
+            order?.let { put("order", it) }
+        }
+
+    private fun link(
+        id: String = "l1",
+        label: String? = "Donate",
+        to: String? = "/donate",
+        order: Int? = null,
+        section: String? = null,
+    ): JsonObject = buildJsonObject {
+        put("id", id)
+        label?.let { put("label", it) }
+        to?.let { put("to", it) }
+        order?.let { put("order", it) }
+        section?.let { put("section", it) }
+    }
+
+    private fun tree(navPublic: JsonObject?) = buildNavTree(APP_MENU, navPublic)
+
+    /** Top-level routes, with a section standing in as `section:<id>`. */
+    private fun List<NavNode>.shape(): List<String> = map {
+        when (it) {
+            is NavNode.Item -> it.entry.route
+            is NavNode.Link -> "link:${it.id}"
+            is NavNode.Section -> "section:${it.id}"
+        }
+    }
+
+    private fun List<NavNode>.section(id: String): NavNode.Section =
+        filterIsInstance<NavNode.Section>().first { it.id == id }
+
+    private fun List<NavNode>.link(id: String): NavNode.Link =
+        filterIsInstance<NavNode.Link>().first { it.id == id }
+
+    // ── AC-1: no structure means phase 5, unchanged ──────────────────────
+
+    @Test fun noStoredRowIsTheCodedMenu() {
+        val nodes = tree(null)
+
+        assertEquals(APP_MENU.size, nodes.size)
+        // The entries themselves, not copies: with nothing stored, nothing was
+        // rebuilt to arrive at the drawer the app shipped with.
+        APP_MENU.forEachIndexed { index, entry ->
+            assertSame(entry, (nodes[index] as NavNode.Item).entry)
+        }
+    }
+
+    @Test fun withoutSectionsOrLinksTheBuildIsTheFlatMerge() {
+        // Phase 6 adds structure; it does not re-implement phase 5. An items-only
+        // row must give exactly what applyNavOverrides gives.
+        val row = stored(items = items("/site/about" to item(order = 0)))
+
+        assertEquals(
+            applyNavOverrides(APP_MENU, row).map { it.route },
+            tree(row).shape(),
+        )
+    }
+
+    @Test fun malformedSectionsAndLinksAreNotStructure() {
+        // Wrong kinds where the arrays should be — a hand-edited row, or the bare
+        // items map phases 6-8 stored. Neither is structure, so neither may cost
+        // the coded menu.
+        val row = buildJsonObject {
+            put("items", buildJsonObject { })
+            put("sections", buildJsonObject { put("id", "lore") })
+            put("links", "nope")
+        }
+
+        assertEquals(APP_MENU.map { it.route }, tree(row).shape())
+    }
+
+    // ── Sections ─────────────────────────────────────────────────────────
+
+    @Test fun aSectionCollectsItsMembersBeneathIt() {
+        val row = stored(
+            items = items(
+                "/wiki" to item(section = "lore"),
+                "/site/about" to item(section = "lore"),
+            ),
+            sections = listOf(section("lore", label = "  The Realm  ")),
+        )
+
+        val nodes = tree(row)
+
+        assertTrue(Routes.WIKI !in nodes.shape())
+        assertEquals("The Realm", nodes.section("lore").label)
+        assertEquals(
+            listOf(Routes.WIKI, Routes.page("about")),
+            nodes.section("lore").items.shape(),
+        )
+    }
+
+    @Test fun aSectionWithNoOrderAppendsAfterTheCodedRows() {
+        // An admin-created entity with no stored order appends in creation order
+        // rather than jumping to the front on a 0 default. The app's own rows stay
+        // behind it, where they already sit (§6.2).
+        val row = stored(
+            items = items("/wiki" to item(section = "lore")),
+            sections = listOf(section("lore")),
+        )
+
+        val shape = tree(row).shape()
+
+        // Nine public rows are left at the top level (Wiki moved into the section),
+        // then the section, then the app's own rows.
+        assertEquals("section:lore", shape[9])
+        assertEquals(Routes.CONTACT, shape[10])
+    }
+
+    @Test fun aSectionsOrderPlacesItAmongTheCodedRows() {
+        // Sections sort on the same number line as everything else: the website's
+        // seventeen indices, then admin-created entities after them.
+        val row = stored(
+            items = items("/wiki" to item(section = "lore")),
+            sections = listOf(section("lore", order = 0)),
+        )
+
+        assertEquals("section:lore", tree(row).shape().first())
+    }
+
+    @Test fun aSectionWithoutAUsableLabelIsDroppedAndItsMembersStayPut() {
+        val row = stored(
+            items = items("/wiki" to item(section = "lore")),
+            sections = listOf(section("lore", label = "   ")),
+        )
+
+        val nodes = tree(row)
+
+        assertTrue(nodes.filterIsInstance<NavNode.Section>().isEmpty())
+        // The section never existed, so the reference to it is dangling and the row
+        // is an ordinary top-level one — not a row that vanished with its section.
+        assertTrue(Routes.WIKI in nodes.shape())
+    }
+
+    @Test fun aRepeatedSectionIdKeepsTheFirst() {
+        val row = stored(
+            items = items("/wiki" to item(section = "lore")),
+            sections = listOf(section("lore", label = "First"), section("lore", label = "Second")),
+        )
+
+        val sections = tree(row).filterIsInstance<NavNode.Section>()
+
+        assertEquals(1, sections.size)
+        assertEquals("First", sections.single().label)
+    }
+
+    @Test fun anItemNamingAnUnknownSectionStaysTopLevel() {
+        val row = stored(
+            items = items("/wiki" to item(section = "nope")),
+            sections = listOf(section("lore")),
+        )
+
+        val nodes = tree(row)
+
+        assertTrue(Routes.WIKI in nodes.shape())
+        assertTrue(nodes.section("lore").items.isEmpty())
+    }
+
+    @Test fun aHiddenItemIsDroppedEvenInsideASection() {
+        val row = stored(
+            items = items("/wiki" to item(hidden = true, section = "lore")),
+            sections = listOf(section("lore")),
+        )
+
+        val nodes = tree(row)
+
+        assertTrue(Routes.WIKI !in nodes.shape())
+        assertTrue(nodes.section("lore").items.isEmpty())
+    }
+
+    @Test fun aLabelStillLandsOnASectionedRow() {
+        val row = stored(
+            items = items("/wiki" to item(label = "Codex", section = "lore")),
+            sections = listOf(section("lore")),
+        )
+
+        val wiki = tree(row).section("lore").items.filterIsInstance<NavNode.Item>().single()
+
+        assertEquals("Codex", wiki.entry.label)
+        // The override lands on the label and nothing else — the gates are untouched.
+        assertEquals(MenuAccess.PUBLIC, wiki.entry.access)
+        assertNull(wiki.entry.feature)
+    }
+
+    @Test fun aSectionRequestForARowTheDrawerDoesNotSurfaceIsIgnored() {
+        // Same rule as phase 5's: the app puts the hub boards behind the Shard hub
+        // deliberately, and grouping is no more an invitation to surface one than
+        // relabelling was (§6.2).
+        val row = stored(
+            items = items("/uo/champs" to item(section = "lore", label = "Champs")),
+            sections = listOf(section("lore")),
+        )
+
+        val nodes = tree(row)
+
+        assertTrue(nodes.section("lore").items.isEmpty())
+        assertTrue(Routes.SHARD_CHAMPS !in nodes.shape())
+    }
+
+    // ── Added links ──────────────────────────────────────────────────────
+
+    @Test fun aLinkTheAppCanResolveCarriesItsRoute() {
+        val row = stored(links = listOf(link(to = "/wiki/smithing")))
+
+        assertEquals(Routes.wikiPage("smithing"), tree(row).link("l1").route)
+    }
+
+    @Test fun aLinkTheAppCannotResolveHandsOff() {
+        // A null route is the Custom Tab; the path is kept verbatim so the browser
+        // gets exactly what the admin wrote.
+        val row = stored(links = listOf(link(to = "/site/status")))
+
+        val node = tree(row).link("l1")
+
+        assertNull(node.route)
+        assertEquals("/site/status", node.path)
+    }
+
+    @Test fun aLinkThatWouldLeaveTheOriginIsDropped() {
+        // The website's own read rule, ported: a stored value that is not a
+        // single-slash site path is dropped rather than rendered, so a hand-edited
+        // row cannot put an off-site link in the drawer.
+        val bad = listOf(
+            "//evil.example/x", "https://evil.example", "donate", "/don ate",
+            "/don\"ate", "/don'ate", "/don<ate", "/don\\ate",
+        )
+
+        for (to in bad) {
+            assertTrue(to, tree(stored(links = listOf(link(to = to)))).filterIsInstance<NavNode.Link>().isEmpty())
+        }
+    }
+
+    @Test fun aLinkWithoutAnIdLabelOrPathIsDropped() {
+        val row = stored(
+            links = listOf(
+                buildJsonObject {
+                    put("label", "No id")
+                    put("to", "/a")
+                },
+                link(id = "no-label", label = null),
+                link(id = "no-to", to = null),
+                link(id = "blank-label", label = "   "),
+                link(id = "good"),
+            ),
+        )
+
+        assertEquals(listOf("good"), tree(row).filterIsInstance<NavNode.Link>().map { it.id })
+    }
+
+    @Test fun aRepeatedLinkIdKeepsTheFirst() {
+        val row = stored(links = listOf(link(id = "l1", label = "First"), link(id = "l1", label = "Second")))
+
+        assertEquals("First", tree(row).link("l1").label)
+    }
+
+    @Test fun linksAppendAfterTheCodedRowsInCreationOrder() {
+        val row = stored(links = listOf(link(id = "a"), link(id = "b")))
+
+        val shape = tree(row).shape()
+
+        assertEquals(listOf("link:a", "link:b"), shape.filter { it.startsWith("link:") })
+        // Market, not About: the module's nine rows append after core's eight on the
+        // website's number line, so Market is the last coded row rather than About.
+        assertEquals(Routes.SHARD_MARKET, shape[shape.indexOf("link:a") - 1])
+    }
+
+    @Test fun aLinksOrderPlacesItAmongTheCodedRows() {
+        val row = stored(links = listOf(link(order = 0)))
+
+        assertEquals("link:l1", tree(row).shape().first())
+    }
+
+    @Test fun aLinkCanSitInsideASection() {
+        val row = stored(
+            items = items("/wiki" to item(section = "lore")),
+            sections = listOf(section("lore")),
+            links = listOf(link(section = "lore"), link(id = "top")),
+        )
+
+        val nodes = tree(row)
+
+        assertEquals(listOf(Routes.WIKI, "link:l1"), nodes.section("lore").items.shape())
+        assertTrue("link:top" in nodes.shape())
+    }
+
+    @Test fun aLinkNamingAnUnknownSectionStaysTopLevel() {
+        // Its destination is still good; only the grouping was wrong.
+        val row = stored(links = listOf(link(section = "nope")))
+
+        assertTrue("link:l1" in tree(row).shape())
+    }
+
+    // ── AC-3: the gates run after the build, and empty a section honestly ──
+
+    private val admin = Session.SignedIn(SessionUser(id = 1, username = "u", role = Role.ADMIN))
+
+    private fun prune(nodes: List<NavNode>, session: Session, features: ShardFeatures?) =
+        pruneNav(nodes) { isEntryVisible(it, session, features) }
+
+    @Test fun aSectionEmptiedByTheGatesIsDropped() {
+        // The case the rule exists for: a group whose every member is withheld by
+        // the shard's visibility config must not draw as a header over nothing.
+        val row = stored(
+            items = items("/uo/market" to item(section = "lore")),
+            sections = listOf(section("lore")),
+        )
+
+        val pruned = prune(
+            tree(row),
+            admin,
+            ShardFeatures(level = "admin", visible = setOf(ShardFeature.STATUS)),
+        )
+
+        assertTrue(pruned.filterIsInstance<NavNode.Section>().isEmpty())
+    }
+
+    @Test fun aSectionKeepsTheMembersThisCallerMaySee() {
+        val row = stored(
+            items = items(
+                "/uo/market" to item(section = "lore"),
+                "/wiki" to item(section = "lore"),
+            ),
+            sections = listOf(section("lore")),
+        )
+
+        val pruned = prune(
+            tree(row),
+            admin,
+            ShardFeatures(level = "admin", visible = setOf(ShardFeature.STATUS)),
+        )
+
+        assertEquals(listOf(Routes.WIKI), pruned.section("lore").items.shape())
+    }
+
+    @Test fun anOverrideCannotUnhideAGatedRowByGroupingIt() {
+        // Relabelled, moved to the front, marked `hidden: false` and tucked into a
+        // section of its own — and still not shown, because the shard does not
+        // publish the market and an admin does not outrank that.
+        val row = stored(
+            items = items("/uo/market" to item(label = "Bazaar", order = 0, hidden = false, section = "lore")),
+            sections = listOf(section("lore", order = 0)),
+        )
+
+        val pruned = prune(
+            tree(row),
+            admin,
+            ShardFeatures(level = "admin", visible = setOf(ShardFeature.STATUS)),
+        )
+
+        assertTrue(pruned.filterIsInstance<NavNode.Section>().isEmpty())
+        assertTrue(pruned.none { it is NavNode.Item && it.entry.route == Routes.SHARD_MARKET })
+    }
+
+    @Test fun aSectionSurvivesOnALinkAlone() {
+        // Links carry no gate — the page behind one enforces its own access — so a
+        // section holding one is never emptied by the caller's role.
+        val row = stored(
+            items = items("/uo/market" to item(section = "lore")),
+            sections = listOf(section("lore")),
+            links = listOf(link(section = "lore")),
+        )
+
+        val pruned = prune(tree(row), Session.SignedOut, ShardFeatures(level = "anonymous", visible = emptySet()))
+
+        assertEquals(listOf("link:l1"), pruned.section("lore").items.shape())
+    }
+
+    @Test fun theAppsOwnRowsAreStillGatedInTheTree() {
+        val row = stored(
+            items = items("/wiki" to item(section = "lore")),
+            sections = listOf(section("lore")),
+        )
+
+        val shape = prune(tree(row), Session.SignedOut, features = null).shape()
+
+        assertTrue(Routes.ACCOUNT !in shape)
+        assertTrue(Routes.ADMIN_DASHBOARD !in shape)
+        assertTrue(Routes.PLAYER_CHARACTERS !in shape)
+        assertTrue(Routes.CONTACT in shape)
+    }
+
+    @Test fun pruningAnUntouchedTreeIsTheCodedMenusVisibleEntries() {
+        // The two paths through the drawer have to agree: prune(tree) for a caller
+        // is exactly visibleEntries of the coded menu for that caller.
+        val features = ShardFeatures(level = "admin", visible = setOf(ShardFeature.STATUS, ShardFeature.MARKET))
+
+        assertEquals(
+            visibleEntries(APP_MENU, admin, features).map { it.route },
+            prune(tree(null), admin, features).shape(),
+        )
+    }
+}

app/src/test/java/com/runicgateway/app/ui/notifications/InboxFormattingTest.kt

@@ -0,0 +1,43 @@
+/*
+ * SPDX-License-Identifier: GPL-3.0-or-later
+ */
+package com.runicgateway.app.ui.notifications
+
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertNull
+import org.junit.Test
+import java.time.ZoneId
+import java.time.format.DateTimeFormatter
+import java.util.Locale
+
+/**
+ * The inbox timestamp (ENGAGEMENT.md phase 8). Both wire shapes have to be read,
+ * and the zoneless one has to be read as UTC — reading it as local time would
+ * shift every stamp by the device's offset and nobody would notice until they
+ * travelled.
+ */
+class InboxFormattingTest {
+
+    private val zone = ZoneId.of("America/New_York")
+    private val format: DateTimeFormatter =
+        DateTimeFormatter.ofPattern("yyyy-MM-dd HH:mm", Locale.US)
+
+    @Test fun readsAnIsoStampWithAZone() {
+        // 12:30 UTC is 08:30 in New York on that date (EDT).
+        assertEquals("2026-08-31 08:30", inboxTimestamp("2026-08-31T12:30:00.000Z", zone, format))
+    }
+
+    @Test fun readsAZonelessStampAsUtc() {
+        assertEquals("2026-08-31 08:30", inboxTimestamp("2026-08-31 12:30:00", zone, format))
+    }
+
+    @Test fun readsAZonelessStampWithATSeparator() {
+        assertEquals("2026-08-31 08:30", inboxTimestamp("2026-08-31T12:30:00", zone, format))
+    }
+
+    @Test fun anUnparseableStampShowsNothingRatherThanFailing() {
+        assertNull(inboxTimestamp("sometime last week", zone, format))
+        assertNull(inboxTimestamp("", zone, format))
+        assertNull(inboxTimestamp("   ", zone, format))
+    }
+}

app/src/test/java/com/runicgateway/app/ui/notifications/InboxViewModelTest.kt

@@ -0,0 +1,282 @@
+/*
+ * SPDX-License-Identifier: GPL-3.0-or-later
+ */
+package com.runicgateway.app.ui.notifications
+
+import com.runicgateway.app.core.auth.SessionManager
+import com.runicgateway.app.core.auth.StoredSession
+import com.runicgateway.app.core.auth.TokenStore
+import com.runicgateway.app.core.inbox.InboxCache
+import com.runicgateway.app.core.net.BaseUrlHolder
+import com.runicgateway.app.data.api.dto.NotificationInboxDto
+import com.runicgateway.app.data.api.dto.NotificationItemDto
+import com.runicgateway.app.data.api.dto.NotificationReadResultDto
+import com.runicgateway.app.data.api.dto.SafeUserDto
+import com.runicgateway.app.data.api.fake.FakeNotificationsApi
+import com.runicgateway.app.data.repository.NotificationsRepository
+import com.runicgateway.app.ui.UiState
+import com.runicgateway.app.util.FakeInboxCache
+import com.runicgateway.app.util.MainDispatcherRule
+import com.runicgateway.app.util.httpError
+import kotlinx.coroutines.runBlocking
+import okhttp3.HttpUrl.Companion.toHttpUrl
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertFalse
+import org.junit.Assert.assertNull
+import org.junit.Assert.assertTrue
+import org.junit.Rule
+import org.junit.Test
+import java.io.IOException
+
+/**
+ * The inbox view model (ENGAGEMENT.md phase 8): the pull behind the tickle, the
+ * keyset paging, the optimistic reads, and the offline snapshot — including the
+ * one property that makes caching a person's notifications safe at all, that a
+ * snapshot never crosses an account.
+ */
+class InboxViewModelTest {
+
+    @get:Rule val mainDispatcher = MainDispatcherRule()
+
+    private class FakeTokenStore(private var stored: StoredSession?) : TokenStore {
+        override fun load(): StoredSession? = stored
+        override fun save(session: StoredSession) { stored = session }
+        override fun clear() { stored = null }
+    }
+
+    private val api = FakeNotificationsApi()
+    private val cache = FakeInboxCache()
+    private val baseUrl = BaseUrlHolder().apply { set("https://shard.example/".toHttpUrl()) }
+
+    private fun session(userId: Long = 7) =
+        SessionManager(FakeTokenStore(StoredSession("access", "refresh", userId, "alice", "player")))
+
+    private fun viewModel(sessionManager: SessionManager = session()) =
+        InboxViewModel(NotificationsRepository(api), cache, sessionManager, baseUrl)
+
+    private fun item(id: Long, read: Boolean = false) =
+        NotificationItemDto(id = id, triggerId = "team.post.created", title = "Post $id", read = read)
+
+    private fun shown(vm: InboxViewModel) = (vm.state.value.items as? UiState.Success)?.data
+
+    @Test fun loadsTheFirstPageAndCachesIt() {
+        api.pages = mapOf(null to NotificationInboxDto(items = listOf(item(2), item(1)), unread = 2))
+        val vm = viewModel()
+
+        assertEquals(listOf(2L, 1L), shown(vm)?.map { it.id })
+        assertEquals(2, vm.state.value.unread)
+        assertFalse(vm.state.value.fromCache)
+        assertEquals(1, cache.writes)
+    }
+
+    @Test fun offlineFallsBackToTheSnapshotAndSaysSo() {
+        runBlocking { cache.seed(InboxCache.ownerKey("https://shard.example/", 7), listOf(item(9)), unread = 1) }
+        api.error = IOException("offline")
+        val vm = viewModel()
+
+        assertEquals(listOf(9L), shown(vm)?.map { it.id })
+        assertEquals(1, vm.state.value.unread)
+        assertTrue(vm.state.value.fromCache)
+    }
+
+    @Test fun aSnapshotIsNeverShownToAnotherAccount() {
+        // The property the whole cache design rests on: user 7's items must not
+        // appear under user 8's session, on a device both have signed into.
+        runBlocking { cache.seed(InboxCache.ownerKey("https://shard.example/", 7), listOf(item(9)), unread = 1) }
+        api.error = IOException("offline")
+        val vm = viewModel(session(userId = 8))
+
+        assertNull(shown(vm))
+        assertTrue(vm.state.value.items is UiState.Error)
+        assertEquals(0, vm.state.value.unread)
+    }
+
+    @Test fun aServerErrorWithNothingCachedIsTheScreen() {
+        api.error = httpError(500)
+        val vm = viewModel()
+
+        assertTrue(vm.state.value.items is UiState.Error)
+        assertFalse(vm.state.value.fromCache)
+    }
+
+    @Test fun loadMorePagesOnTheLastIdNotAnOffset() {
+        api.pages = mapOf(
+            null to NotificationInboxDto(items = listOf(item(9), item(8)), hasMore = true, unread = 2),
+            8L to NotificationInboxDto(items = listOf(item(7)), hasMore = false, unread = 2),
+        )
+        val vm = viewModel()
+        vm.loadMore()
+
+        assertEquals(listOf(null, 8L), api.inboxCalls)
+        assertEquals(listOf(9L, 8L, 7L), shown(vm)?.map { it.id })
+        assertFalse(vm.state.value.hasMore)
+    }
+
+    @Test fun loadMoreDropsAnIdAlreadyOnScreen() {
+        // A keyset window can shift under a concurrent write; a duplicate id in a
+        // LazyColumn key is a crash, not a cosmetic problem.
+        api.pages = mapOf(
+            null to NotificationInboxDto(items = listOf(item(9), item(8)), hasMore = true),
+            8L to NotificationInboxDto(items = listOf(item(8), item(7))),
+        )
+        val vm = viewModel()
+        vm.loadMore()
+
+        assertEquals(listOf(9L, 8L, 7L), shown(vm)?.map { it.id })
+    }
+
+    @Test fun loadMoreDoesNothingWhileShowingTheCache() {
+        runBlocking { cache.seed(InboxCache.ownerKey("https://shard.example/", 7), listOf(item(9)), unread = 1) }
+        api.error = IOException("offline")
+        val vm = viewModel()
+        api.inboxCalls.clear()
+        vm.loadMore()
+
+        assertTrue(api.inboxCalls.isEmpty())
+    }
+
+    @Test fun markReadFlipsTheRowAndTakesTheServersCount() {
+        api.pages = mapOf(null to NotificationInboxDto(items = listOf(item(2), item(1)), unread = 2))
+        api.readResult = NotificationReadResultDto(ok = true, unread = 1)
+        val vm = viewModel()
+        vm.markRead(2)
+
+        assertEquals(listOf(2L), api.markedRead)
+        assertTrue(shown(vm)!!.first { it.id == 2L }.read)
+        assertEquals(1, vm.state.value.unread)
+    }
+
+    @Test fun markReadIsNotSentTwiceForAnItemAlreadyRead() {
+        api.pages = mapOf(null to NotificationInboxDto(items = listOf(item(2, read = true)), unread = 0))
+        val vm = viewModel()
+        vm.markRead(2)
+
+        assertTrue(api.markedRead.isEmpty())
+    }
+
+    @Test fun markAllReadEmptiesTheBadgeAndUpdatesTheSnapshot() {
+        api.pages = mapOf(null to NotificationInboxDto(items = listOf(item(2), item(1)), unread = 2))
+        val vm = viewModel()
+        val writesAfterLoad = cache.writes
+        vm.markAllRead()
+
+        assertEquals(1, api.markAllReadCalls)
+        assertEquals(0, vm.state.value.unread)
+        assertTrue(shown(vm)!!.all { it.read })
+        // Without this write, going offline right after reading everything would
+        // bring the badge back on the next cold open.
+        assertEquals(writesAfterLoad + 1, cache.writes)
+    }
+
+    // ── The item link (found by the live rig, not by a test) ──────────────
+
+    @Test fun aSiteRelativeUrlIsResolvedAgainstTheShard() {
+        // What the server actually writes: the template's button block renders a
+        // path, because on the web the reader is already on the site.
+        val vm = viewModel()
+        val item = item(1).copy(url = "/guilds/the-silver-anvil/forum/403")
+        assertEquals("https://shard.example/guilds/the-silver-anvil/forum/403", vm.linkFor(item))
+    }
+
+    @Test fun anAbsoluteUrlIsLeftAlone() {
+        val vm = viewModel()
+        assertEquals("https://elsewhere.example/x", vm.linkFor(item(1).copy(url = "https://elsewhere.example/x")))
+    }
+
+    @Test fun anItemWithNoUrlHasNoLink() {
+        val vm = viewModel()
+        assertNull(vm.linkFor(item(1)))
+        assertNull(vm.linkFor(item(1).copy(url = "   ")))
+    }
+
+    @Test fun aUrlThatCouldNotBeOpenedSafelyResolvesToNothing() {
+        val vm = viewModel()
+        assertNull(vm.linkFor(item(1).copy(url = "javascript:alert(1)")))
+        assertNull(vm.linkFor(item(1).copy(url = "intent://evil#Intent;end")))
+    }
+
+    // ── The inbox belongs to ONE account ─────────────────────────────
+
+    @Test fun switchingAccountDoesNotShowThePreviousOnesInbox() {
+        // **Found on the emulator, not by a test.** A drawer route's view model
+        // outlives a sign-out: `navigateTopLevel` saves and restores back-stack
+        // state, so the entry keeps its ViewModelStore and a view model that
+        // loaded only in `init` never runs again. Signing out and back in as
+        // somebody else showed the second account the FIRST account's inbox —
+        // titles and body text written for another person — with no request made
+        // at all, while the badge beside it showed the new account's real count.
+        val sessions = session(userId = 7)
+        api.pages = mapOf(null to NotificationInboxDto(items = listOf(item(1), item(2)), unread = 2))
+        val vm = InboxViewModel(NotificationsRepository(api), cache, sessions, baseUrl)
+        assertEquals(listOf(1L, 2L), shown(vm)!!.map { it.id })
+
+        api.pages = mapOf(null to NotificationInboxDto(items = listOf(item(9)), unread = 1))
+        sessions.onSignedOut()
+        // Signed out, the previous account's rows are gone rather than left
+        // addressable behind a shell that is navigating away.
+        assertEquals(emptyList<Long>(), shown(vm)!!.map { it.id })
+
+        sessions.onSignedIn("a", "r", SafeUserDto(id = 8, username = "bob", role = "player"))
+        assertEquals(listOf(9L), shown(vm)!!.map { it.id })
+    }
+
+    @Test fun aResumeRevalidationReturningTheSameUserDoesNotRefetch() {
+        // The gate is the account, not every session emission — the app
+        // re-validates its role on every resume.
+        val sessions = session(userId = 7)
+        api.pages = mapOf(null to NotificationInboxDto(items = listOf(item(1)), unread = 1))
+        val vm = InboxViewModel(NotificationsRepository(api), cache, sessions, baseUrl)
+        val callsAfterFirstLoad = api.inboxCalls.size
+
+        sessions.onUserRefreshed(SafeUserDto(id = 7, username = "alice", role = "admin"))
+
+        assertEquals(callsAfterFirstLoad, api.inboxCalls.size)
+        assertEquals(listOf(1L), shown(vm)!!.map { it.id })
+    }
+
+    // ── Opening an item in the app rather than a browser (M13) ─────────
+
+    @Test fun anEventAnnouncementOpensNativelyAndKeepsItsRun() {
+        // The exact shape events Phase 14a writes into every announcement. Before
+        // M13 this opened a Custom Tab onto a page the app now renders itself.
+        val vm = viewModel()
+        val item = item(1).copy(url = "/site/events/the-yew-invasion?run=3692")
+
+        assertEquals("events/the-yew-invasion?run=3692", vm.routeFor(item))
+    }
+
+    @Test fun anAbsoluteUrlOnThisHostOpensNativelyToo() {
+        // The url's shape is the server's to change; a link that reached the browser
+        // only because it arrived fully qualified would be a puzzle.
+        val vm = viewModel()
+        val item = item(1).copy(url = "https://shard.example/site/events/yew?run=7")
+
+        assertEquals("events/yew?run=7", vm.routeFor(item))
+    }
+
+    @Test fun aLinkToAnotherHostIsNotOursToRoute() {
+        val vm = viewModel()
+        val item = item(1).copy(url = "https://elsewhere.example/site/events/yew")
+
+        assertNull(vm.routeFor(item))
+        // …and still opens, in the browser, exactly as it did before.
+        assertEquals("https://elsewhere.example/site/events/yew", vm.linkFor(item))
+    }
+
+    @Test fun everyOtherLinkStillHandsOff() {
+        // The change is additive: a path the app has no screen for behaves exactly
+        // as it did, and `linkFor` is still what opens it.
+        val vm = viewModel()
+        val forum = item(1).copy(url = "/guilds/the-silver-anvil/forum/403")
+
+        assertNull(vm.routeFor(forum))
+        assertEquals("https://shard.example/guilds/the-silver-anvil/forum/403", vm.linkFor(forum))
+    }
+
+    @Test fun anItemWithNoUrlHasNoRoute() {
+        val vm = viewModel()
+        assertNull(vm.routeFor(item(1)))
+        assertNull(vm.routeFor(item(1).copy(url = "   ")))
+        assertNull(vm.routeFor(item(1).copy(url = "javascript:alert(1)")))
+    }
+}

app/src/test/java/com/runicgateway/app/ui/notifications/NotificationRoutingTest.kt

@@ -4,7 +4,7 @@
 package com.runicgateway.app.ui.notifications
 
 import com.runicgateway.app.core.push.PushStreams
-import com.runicgateway.app.data.api.dto.NotificationStreamDto
+import com.runicgateway.app.data.api.dto.NotificationChannelItemDto
 import com.runicgateway.app.ui.navigation.Routes
 import org.junit.Assert.assertEquals
 import org.junit.Assert.assertFalse
@@ -12,8 +12,9 @@ import org.junit.Assert.assertTrue
 import org.junit.Test
 
 /**
- * Tests the pure push helpers: the stream → deep-link route map (PLAN.md §11 work
- * item 7) and the personal-stream gating (a personal stream needs a linked account).
+ * Tests the pure notification helpers: the stream → deep-link route map (PLAN.md
+ * §11 work item 7), the tickle routing that ENGAGEMENT.md phase 8 layered over it,
+ * and the personal-item gating (a personal id needs a linked game account).
  */
 class NotificationRoutingTest {
 
@@ -32,14 +33,41 @@ class NotificationRoutingTest {
         assertEquals(Routes.HOME, Routes.forStream("something.new"))
     }
 
-    @Test fun personalStreamNeedsLinkedAccount() {
-        val personal = NotificationStreamDto(id = "vendor.sale", personal = true, requiresLinkedAccount = true)
-        assertFalse(streamSelectable(personal, hasLinkedAccount = false))
-        assertTrue(streamSelectable(personal, hasLinkedAccount = true))
+    @Test fun personalItemNeedsLinkedAccount() {
+        val personal = NotificationChannelItemDto(id = "vendor.sale", personal = true, requiresLinkedAccount = true)
+        assertFalse(itemSelectable(personal, hasLinkedAccount = false))
+        assertTrue(itemSelectable(personal, hasLinkedAccount = true))
     }
 
-    @Test fun generalStreamIsAlwaysSelectable() {
-        val general = NotificationStreamDto(id = "news.post", personal = false, requiresLinkedAccount = false)
-        assertTrue(streamSelectable(general, hasLinkedAccount = false))
+    @Test fun generalItemIsAlwaysSelectable() {
+        val general = NotificationChannelItemDto(id = "news.post", personal = false, requiresLinkedAccount = false)
+        assertTrue(itemSelectable(general, hasLinkedAccount = false))
+    }
+
+    // ── The tickle → destination map (ENGAGEMENT.md phase 8) ───────────────
+
+    @Test fun inboxRefLandsOnTheInboxWhateverTheStream() {
+        // The engine's stream id is a TRIGGER id in the one namespace, so most of
+        // them are strangers to `forStream` — and every one of those would have
+        // dropped the user on Home if the ref were not read.
+        assertEquals(Routes.NOTIFICATIONS, Routes.forTickle("team.post.created", "notification:42"))
+        assertEquals(Routes.NOTIFICATIONS, Routes.forTickle("uo.house.idoc_warning", "notification:7"))
+    }
+
+    @Test fun anInboxRefWinsOverAStreamThatHasItsOwnScreen() {
+        assertEquals(Routes.NOTIFICATIONS, Routes.forTickle(PushStreams.NEWS_POST, "notification:1"))
+    }
+
+    @Test fun everyOtherTickleKeepsTheRouteItAlwaysHad() {
+        assertEquals(Routes.NEWS, Routes.forTickle(PushStreams.NEWS_POST, null))
+        assertEquals(Routes.SHARD, Routes.forTickle(PushStreams.CHAMP_START, "0x40001234"))
+        assertEquals(Routes.PLAYER_HOUSES, Routes.forTickle(PushStreams.HOUSE_IDOC, "britain-2026-08-31"))
+        assertEquals(Routes.HOME, Routes.forTickle("something.new", null))
+    }
+
+    @Test fun aRefThatMerelyMentionsNotificationIsNotAnInboxRef() {
+        // Prefix, not `contains`: a ref is opaque and another producer's could
+        // easily carry the word without being a row id.
+        assertEquals(Routes.NEWS, Routes.forTickle(PushStreams.NEWS_POST, "post-notification:3"))
     }
 }

app/src/test/java/com/runicgateway/app/ui/notifications/NotificationSettingsViewModelTest.kt

@@ -0,0 +1,88 @@
+/*
+ * SPDX-License-Identifier: GPL-3.0-or-later
+ */
+package com.runicgateway.app.ui.notifications
+
+import com.runicgateway.app.data.api.dto.NotificationChannelDto
+import com.runicgateway.app.data.api.dto.NotificationChannelItemDto
+import com.runicgateway.app.data.api.dto.NotificationChannelPrefsDto
+import com.runicgateway.app.data.api.fake.FakeNotificationsApi
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertNull
+import org.junit.Test
+
+/**
+ * The per-channel preferences the settings screen renders (ENGAGEMENT.md phases 3
+ * and 8). These are the wire-shape properties the UI is built ON rather than
+ * around, so they are asserted here rather than trusted: the controls come from
+ * each item's own `channels`, and the modes from each channel's own `modes`.
+ *
+ * The view model itself needs a [com.runicgateway.app.core.push.PushManager],
+ * which owns a foreground service and a `Context`; the sparse-PUT shape it sends
+ * is asserted through the repository instead, which is the part that could be
+ * wrong on the wire.
+ */
+class NotificationSettingsViewModelTest {
+
+    private val push = NotificationChannelDto(
+        id = "push", label = "Push", carriesContent = false,
+        defaultMode = "off", supportsDigest = false, modes = listOf("off", "instant"),
+    )
+    private val email = NotificationChannelDto(
+        id = "email", label = "Email", carriesContent = true,
+        defaultMode = "off", supportsDigest = true, modes = listOf("off", "instant", "digest"),
+    )
+
+    private fun prefs() = NotificationChannelPrefsDto(
+        channels = listOf(push, email),
+        items = listOf(
+            NotificationChannelItemDto(
+                id = "news.post", label = "News posts",
+                channels = listOf("push", "email"),
+                modes = mapOf("push" to "instant", "email" to "off"),
+            ),
+            NotificationChannelItemDto(
+                id = "uo.house.idoc_warning", label = "House in danger",
+                personal = true, requiresLinkedAccount = true,
+                // A trigger-only id: nothing is registered to push it, so it carries
+                // no push key at all — the screen must render no push control rather
+                // than a dead switch.
+                channels = listOf("email"),
+                modes = mapOf("email" to "digest"),
+            ),
+        ),
+    )
+
+    @Test fun aTriggerOnlyIdOffersNoPushControl() {
+        val item = prefs().items.first { it.id == "uo.house.idoc_warning" }
+        assertEquals(listOf("email"), item.channels)
+        assertNull(item.modes[CHANNEL_PUSH])
+    }
+
+    @Test fun emailIsTheChannelThatCarriesDigest() {
+        assertEquals(listOf("off", "instant", "digest"), email.modes)
+        assertEquals(listOf("off", "instant"), push.modes)
+    }
+
+    @Test fun personalItemsStillNeedALinkedAccount() {
+        val personal = prefs().items.first { it.personal }
+        assertEquals(false, itemSelectable(personal, hasLinkedAccount = false))
+        assertEquals(true, itemSelectable(personal, hasLinkedAccount = true))
+    }
+
+    @Test fun oneToggleSendsExactlyOnePair() = kotlinx.coroutines.runBlocking {
+        // The sparse PUT is the whole reason this screen can save a single control
+        // without holding the table: anything more in the body could clobber a
+        // channel it is not showing.
+        val api = FakeNotificationsApi()
+        api.channelPrefs = prefs()
+        val repo = com.runicgateway.app.data.repository.NotificationsRepository(api)
+
+        repo.setChannelMode("news.post", "email", "digest")
+
+        assertEquals(1, api.lastPrefsUpdate?.size)
+        assertEquals("news.post", api.lastPrefsUpdate?.first()?.id)
+        assertEquals("email", api.lastPrefsUpdate?.first()?.channel)
+        assertEquals("digest", api.lastPrefsUpdate?.first()?.mode)
+    }
+}

app/src/test/java/com/runicgateway/app/ui/theme/ShardColorSchemeTest.kt

@@ -57,16 +57,53 @@ class ShardColorSchemeTest {
         onErrorContainer = ShardDanger,
     )
 
+    /**
+     * The roles phase 8 deliberately moves off Material's defaults, and the values
+     * they move to.
+     *
+     * `surfaceContainerHighest` is the one that matters: it is
+     * `FilledCardTokens.ContainerColor`, so it is what every `ShardCard` paints with.
+     * Leaving it unmapped meant all 26 of them drew in `darkColorScheme()`'s grey
+     * rather than `--panel-a` — on themed instances *and* on untouched ones, which is
+     * why this is a visible change to the shipped app and not only a theming fix. It
+     * had been that way since M5; the AC-5 walk in phase 8 is what surfaced it,
+     * because M12 themed everything around the cards and left them behind.
+     *
+     * `surfaceContainerLowest` has no reader in this app today (the phase 8 sweep
+     * checked every Material component the app draws) and is mapped for consistency
+     * with `surfaceContainerLow`, not to fix anything.
+     *
+     * Everything else stays exactly where it was — that is what the test below is for.
+     */
+    private val deliberatelyChanged = mapOf(
+        "surfaceContainerHighest" to ShardElevated,
+        "surfaceContainerLowest" to ShardSurface,
+    )
+
     @Test
-    fun `the shipped palette reproduces the pre-M12 color scheme exactly`() {
-        assertEquals(roles(preM12Scheme), roles(shardColorScheme(ShardPalette.Shipped)))
+    fun `the shipped palette reproduces the pre-M12 color scheme but for the card container`() {
+        assertPreM12ApartFromTheCardContainer(shardColorScheme(ShardPalette.Shipped))
     }
 
     /** The same claim from the other end: an absent theme map is the shipped app. */
     @Test
     fun `an absent theme map reproduces the pre-M12 color scheme`() {
-        val resolved = shardColorScheme(ShardPalette.resolve(emptyMap()))
-        assertEquals(roles(preM12Scheme), roles(resolved))
+        assertPreM12ApartFromTheCardContainer(shardColorScheme(ShardPalette.resolve(emptyMap())))
+    }
+
+    /**
+     * Every role but [deliberatelyChanged] is byte-for-byte the pre-M12 value, and
+     * each of those really did move — asserting the new value alone would still pass
+     * if Material's default happened to equal it.
+     */
+    private fun assertPreM12ApartFromTheCardContainer(actual: ColorScheme) {
+        val before = roles(preM12Scheme)
+        val after = roles(actual)
+        assertEquals(before - deliberatelyChanged.keys, after - deliberatelyChanged.keys)
+        for ((role, expected) in deliberatelyChanged) {
+            assertEquals("$role should follow the palette", expected, after[role])
+            assertNotEquals("$role was already the palette's value", expected, before[role])
+        }
     }
 
     /** Sanity: the comparison is capable of failing, and covers the whole scheme. */
@@ -97,6 +134,22 @@ class ShardColorSchemeTest {
         assertEquals(ShardCta, roles["primary"])            // untouched by these two tokens
     }
 
+    /**
+     * The phase 8 fix, stated as the thing a shard operator actually sees: set
+     * `--panel-flat` and the app's cards follow. This is the assertion that would have
+     * failed before the AC-5 walk, when `surfaceContainerHighest` — Material's filled
+     * `Card` container — was left at `darkColorScheme()`'s grey.
+     */
+    @Test
+    fun `--panel-flat reaches the Material card container`() {
+        val roles = roles(shardColorScheme(ShardPalette.resolve(mapOf("--panel-flat" to "#1f160d"))))
+        val panel = Color(0xFF1F160D)
+        assertEquals(panel, roles["surfaceContainerHighest"]) // CardDefaults.cardColors()
+        assertEquals(panel, roles["surfaceVariant"])
+        assertEquals(panel, roles["surfaceContainer"])
+        assertEquals(panel, roles["surfaceContainerHigh"])
+    }
+
     /**
      * Every color role of a scheme, by name. `Color` is a value class, so the
      * roles are the `long`-returning getters and their names carry Kotlin's

app/src/test/java/com/runicgateway/app/ui/theme/ShardTypefaceTest.kt

@@ -0,0 +1,279 @@
+/*
+ * SPDX-License-Identifier: GPL-3.0-or-later
+ */
+package com.runicgateway.app.ui.theme
+
+import androidx.compose.ui.text.font.FontFamily
+import androidx.compose.ui.text.font.FontWeight
+import androidx.compose.ui.text.TextStyle
+import androidx.compose.ui.unit.sp
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertNotEquals
+import org.junit.Assert.assertSame
+import org.junit.Test
+import androidx.compose.material3.Typography as MaterialTypography
+
+/**
+ * [ShardTypeface.resolve] and [shardTypography] — the font third of the theme
+ * (§5.3).
+ *
+ * Like the shape scale and unlike the color scheme, material3's [MaterialTypography]
+ * implements `equals` (checked in the 1.3.0 bytecode), so the no-op proof is one
+ * comparison against a **verbatim copy of the pre-M12 scale** kept in this file.
+ * Copying it rather than referencing `shardTypography(Shipped)` is the point: the
+ * assertion is against what the app used to draw, so a stray edit to a size or a
+ * letter-spacing in `Type.kt` fails here rather than quietly redefining "shipped".
+ */
+class ShardTypefaceTest {
+
+    // ── the stacks, exactly as the server publishes them ──────────────────────
+
+    private val runicGateway = mapOf(
+        "--serif" to "Georgia, \"Times New Roman\", serif",
+        "--display" to "Cinzel, Georgia, serif",
+        "--sans" to "\"Helvetica Neue\", Arial, sans-serif",
+    )
+
+    private val fantasy = mapOf(
+        "--serif" to "'EB Garamond', Georgia, serif",
+        "--display" to "Cinzel, Georgia, serif",
+        "--sans" to "'EB Garamond', Georgia, serif",
+    )
+
+    private val modern = mapOf(
+        "--serif" to "Inter, Arial, sans-serif",
+        "--display" to "'Work Sans', Arial, sans-serif",
+        "--sans" to "Inter, Arial, sans-serif",
+    )
+
+    // ── the no-op proof (AC-1) ────────────────────────────────────────────────
+
+    @Test
+    fun `no theme resolves to the shipped families`() {
+        assertEquals(ShardTypeface.Shipped, ShardTypeface.resolve(emptyMap()))
+        assertSame(Cinzel, ShardTypeface.Shipped.display)
+        assertSame(FontFamily.Serif, ShardTypeface.Shipped.serif)
+        assertSame(FontFamily.SansSerif, ShardTypeface.Shipped.sans)
+    }
+
+    @Test
+    fun `the shipped scale is the pre-M12 scale`() {
+        assertEquals(preM12Typography, shardTypography(ShardTypeface.Shipped))
+    }
+
+    @Test
+    fun `the runic-gateway preset is a no-op`() {
+        assertEquals(ShardTypeface.Shipped, ShardTypeface.resolve(runicGateway))
+        assertEquals(preM12Typography, shardTypography(ShardTypeface.resolve(runicGateway)))
+    }
+
+    // ── the presets that bypass the per-role dropdown ─────────────────────────
+
+    @Test
+    fun `the fantasy preset puts EB Garamond in the serif and sans roles`() {
+        val faces = ShardTypeface.resolve(fantasy)
+        assertSame(Cinzel, faces.display)
+        assertSame(EBGaramond, faces.serif)
+        // Not an option the sans dropdown offers — a preset's tokens are copied
+        // verbatim and never pass through it.
+        assertSame(EBGaramond, faces.sans)
+    }
+
+    @Test
+    fun `the modern preset puts Work Sans in the display role and Inter in the serif role`() {
+        val faces = ShardTypeface.resolve(modern)
+        // Neither of these is in its role's FONT_OPTIONS list.
+        assertSame(WorkSans, faces.display)
+        assertSame(Inter, faces.serif)
+        assertSame(Inter, faces.sans)
+    }
+
+    // ── every option on the shortlist ─────────────────────────────────────────
+
+    @Test
+    fun `every serif option resolves`() {
+        assertSame(EBGaramond, serifFor("'EB Garamond', Georgia, serif"))
+        assertSame(Merriweather, serifFor("Merriweather, Georgia, serif"))
+        assertSame(PlayfairDisplay, serifFor("'Playfair Display', Georgia, serif"))
+        assertSame(IMFellEnglish, serifFor("'IM Fell English', Georgia, serif"))
+        assertSame(FontFamily.Serif, serifFor("Georgia, \"Times New Roman\", serif"))
+    }
+
+    @Test
+    fun `every display option resolves`() {
+        assertSame(Cinzel, displayFor("Cinzel, Georgia, serif"))
+        assertSame(PlayfairDisplay, displayFor("'Playfair Display', Georgia, serif"))
+        assertSame(EBGaramond, displayFor("'EB Garamond', Georgia, serif"))
+        assertSame(IMFellEnglish, displayFor("'IM Fell English', Georgia, serif"))
+    }
+
+    @Test
+    fun `every sans option resolves`() {
+        assertSame(Inter, sansFor("Inter, Arial, sans-serif"))
+        assertSame(WorkSans, sansFor("'Work Sans', Arial, sans-serif"))
+        assertSame(SourceSans3, sansFor("'Source Sans 3', Arial, sans-serif"))
+        assertSame(FontFamily.SansSerif, sansFor("\"Helvetica Neue\", Arial, sans-serif"))
+    }
+
+    // ── parsing: only the first name carries the choice ───────────────────────
+
+    @Test
+    fun `the fallback chain after the first comma is ignored`() {
+        // Same family however the web fallbacks are written, and a serif stack in
+        // the sans role still resolves to what it names.
+        assertSame(Merriweather, sansFor("Merriweather, Georgia, serif"))
+        assertSame(Merriweather, sansFor("Merriweather"))
+        assertSame(Merriweather, sansFor("Merriweather , whatever , serif"))
+    }
+
+    @Test
+    fun `quoting and casing do not matter`() {
+        assertSame(WorkSans, sansFor("'Work Sans', Arial, sans-serif"))
+        assertSame(WorkSans, sansFor("\"Work Sans\", Arial, sans-serif"))
+        assertSame(WorkSans, sansFor("Work Sans, Arial, sans-serif"))
+        assertSame(WorkSans, sansFor("  'WORK SANS' , Arial  "))
+    }
+
+    // ── per-field fallback (AC-2) ─────────────────────────────────────────────
+
+    @Test
+    fun `an unreadable role falls back to its own shipped family, not another role's`() {
+        val faces = ShardTypeface.resolve(
+            mapOf(
+                "--display" to "'Playfair Display', Georgia, serif",
+                "--serif" to "Comic Sans MS, cursive",
+                "--sans" to "",
+            ),
+        )
+        assertSame(PlayfairDisplay, faces.display)
+        assertSame(ShardTypeface.Shipped.serif, faces.serif)
+        assertSame(ShardTypeface.Shipped.sans, faces.sans)
+    }
+
+    @Test
+    fun `a theme with no font tokens keeps all three shipped families`() {
+        // A non-empty theme that touches only colors must not disturb the type.
+        assertEquals(
+            ShardTypeface.Shipped,
+            ShardTypeface.resolve(mapOf("--accent" to "#c9a227")),
+        )
+    }
+
+    @Test
+    fun `a blank or comma-only stack falls back`() {
+        assertSame(ShardTypeface.Shipped.sans, sansFor("   "))
+        assertSame(ShardTypeface.Shipped.sans, sansFor(","))
+        assertSame(ShardTypeface.Shipped.sans, sansFor("'', Arial, sans-serif"))
+    }
+
+    // ── the scale itself only ever changes family ─────────────────────────────
+
+    @Test
+    fun `a themed scale differs from the shipped one only in its families`() {
+        val themed = shardTypography(ShardTypeface.resolve(fantasy))
+        assertNotEquals(preM12Typography, themed)
+        assertEquals(
+            preM12Typography.bodyLarge,
+            themed.bodyLarge.copy(fontFamily = ShardTypeface.Shipped.serif),
+        )
+        assertEquals(
+            preM12Typography.labelLarge,
+            themed.labelLarge.copy(fontFamily = ShardTypeface.Shipped.sans),
+        )
+        assertEquals(
+            preM12Typography.displayLarge,
+            themed.displayLarge.copy(fontFamily = ShardTypeface.Shipped.display),
+        )
+    }
+
+    @Test
+    fun `each role reaches the styles it owns`() {
+        val themed = shardTypography(ShardTypeface.resolve(modern))
+        // display/headline/title
+        assertSame(WorkSans, themed.displaySmall.fontFamily)
+        assertSame(WorkSans, themed.headlineMedium.fontFamily)
+        assertSame(WorkSans, themed.titleSmall.fontFamily)
+        // body
+        assertSame(Inter, themed.bodyLarge.fontFamily)
+        assertSame(Inter, themed.bodySmall.fontFamily)
+        // labels
+        assertSame(Inter, themed.labelLarge.fontFamily)
+        assertSame(Inter, themed.labelSmall.fontFamily)
+    }
+
+    private fun serifFor(stack: String) =
+        ShardTypeface.resolve(mapOf("--serif" to stack)).serif
+
+    private fun displayFor(stack: String) =
+        ShardTypeface.resolve(mapOf("--display" to stack)).display
+
+    private fun sansFor(stack: String) =
+        ShardTypeface.resolve(mapOf("--sans" to stack)).sans
+
+    /**
+     * The type scale exactly as `ui/theme/Type.kt` declared it before M12, with the
+     * three families it named directly.
+     */
+    private val preM12Typography = MaterialTypography(
+        displayLarge = TextStyle(
+            fontFamily = Cinzel, fontWeight = FontWeight.SemiBold,
+            fontSize = 40.sp, lineHeight = 46.sp, letterSpacing = 0.4.sp,
+        ),
+        displayMedium = TextStyle(
+            fontFamily = Cinzel, fontWeight = FontWeight.SemiBold,
+            fontSize = 32.sp, lineHeight = 40.sp, letterSpacing = 0.3.sp,
+        ),
+        displaySmall = TextStyle(
+            fontFamily = Cinzel, fontWeight = FontWeight.SemiBold,
+            fontSize = 28.sp, lineHeight = 36.sp, letterSpacing = 0.2.sp,
+        ),
+        headlineLarge = TextStyle(
+            fontFamily = Cinzel, fontWeight = FontWeight.SemiBold,
+            fontSize = 26.sp, lineHeight = 34.sp, letterSpacing = 0.2.sp,
+        ),
+        headlineMedium = TextStyle(
+            fontFamily = Cinzel, fontWeight = FontWeight.SemiBold,
+            fontSize = 24.sp, lineHeight = 32.sp, letterSpacing = 0.2.sp,
+        ),
+        headlineSmall = TextStyle(
+            fontFamily = Cinzel, fontWeight = FontWeight.SemiBold,
+            fontSize = 22.sp, lineHeight = 28.sp, letterSpacing = 0.2.sp,
+        ),
+        titleLarge = TextStyle(
+            fontFamily = Cinzel, fontWeight = FontWeight.SemiBold,
+            fontSize = 20.sp, lineHeight = 26.sp, letterSpacing = 0.2.sp,
+        ),
+        titleMedium = TextStyle(
+            fontFamily = Cinzel, fontWeight = FontWeight.SemiBold,
+            fontSize = 17.sp, lineHeight = 24.sp, letterSpacing = 0.15.sp,
+        ),
+        titleSmall = TextStyle(
+            fontFamily = Cinzel, fontWeight = FontWeight.SemiBold,
+            fontSize = 15.sp, lineHeight = 22.sp, letterSpacing = 0.1.sp,
+        ),
+        bodyLarge = TextStyle(
+            fontFamily = FontFamily.Serif, fontWeight = FontWeight.Normal,
+            fontSize = 16.sp, lineHeight = 26.sp, letterSpacing = 0.15.sp,
+        ),
+        bodyMedium = TextStyle(
+            fontFamily = FontFamily.Serif, fontWeight = FontWeight.Normal,
+            fontSize = 15.sp, lineHeight = 24.sp, letterSpacing = 0.15.sp,
+        ),
+        bodySmall = TextStyle(
+            fontFamily = FontFamily.Serif, fontWeight = FontWeight.Normal,
+            fontSize = 13.sp, lineHeight = 20.sp, letterSpacing = 0.2.sp,
+        ),
+        labelLarge = TextStyle(
+            fontFamily = FontFamily.SansSerif, fontWeight = FontWeight.Bold,
+            fontSize = 14.sp, lineHeight = 18.sp, letterSpacing = 0.45.sp,
+        ),
+        labelMedium = TextStyle(
+            fontFamily = FontFamily.SansSerif, fontWeight = FontWeight.Medium,
+            fontSize = 12.sp, lineHeight = 16.sp, letterSpacing = 0.4.sp,
+        ),
+        labelSmall = TextStyle(
+            fontFamily = FontFamily.SansSerif, fontWeight = FontWeight.Medium,
+            fontSize = 11.sp, lineHeight = 15.sp, letterSpacing = 0.5.sp,
+        ),
+    )
+}

app/src/test/java/com/runicgateway/app/util/FakeInboxCache.kt

@@ -0,0 +1,49 @@
+/*
+ * SPDX-License-Identifier: GPL-3.0-or-later
+ */
+package com.runicgateway.app.util
+
+import com.runicgateway.app.core.inbox.InboxCache
+import com.runicgateway.app.data.api.dto.NotificationItemDto
+
+/**
+ * In-memory [InboxCache] for the inbox view-model tests — the same shape of stand-in
+ * `SessionManagerTest` uses for the encrypted token store.
+ *
+ * It keeps the real implementation's ONE load-bearing rule: a snapshot is handed
+ * back only to the owner that wrote it. A fake that ignored the key would let the
+ * cross-account test pass against a cache that leaks.
+ */
+class FakeInboxCache : InboxCache {
+
+    private var owner: String? = null
+    private var snapshot: InboxCache.Snapshot? = null
+
+    var writes: Int = 0
+    var cleared: Int = 0
+
+    override suspend fun read(owner: String): InboxCache.Snapshot? =
+        if (this.owner == owner) snapshot else null
+
+    override suspend fun write(owner: String, items: List<NotificationItemDto>, unread: Int) {
+        writes++
+        this.owner = owner
+        snapshot = InboxCache.Snapshot(
+            items = items.take(InboxCache.MAX_ITEMS),
+            unread = unread,
+            savedAt = 1_700_000_000_000,
+        )
+    }
+
+    override suspend fun clear() {
+        cleared++
+        owner = null
+        snapshot = null
+    }
+
+    /** Seed a snapshot as if a previous session had pulled one. */
+    suspend fun seed(owner: String, items: List<NotificationItemDto>, unread: Int) {
+        write(owner, items, unread)
+        writes = 0
+    }
+}

sonar-project.properties

@@ -32,10 +32,17 @@ sonar.coverage.jacoco.xmlReportPaths=app/build/reports/jacoco/jacocoTestReport/j
 # tests), and Android-framework glue (Keystore-backed stores, foreground push service,
 # notifications, Hilt modules). Testable logic — ViewModels, repositories, DTOs, and
 # pure core/ code — stays measured. See docs/android/COVERAGE_PLAN.md §1.
+#
+# ui/theme/ is excluded FILE BY FILE, not as a directory. It held only constants and
+# composables when COVERAGE_PLAN.md §2 phase 0 drew the list; M12 added three pure
+# resolvers to it (ShardPalette, ShardStructure, ShardTypeface) which are the
+# milestone's core logic and are covered 98–100%. A `ui/theme/**` glob would drop them
+# out of the denominator and hide a future regression in them. Theme.kt is the one
+# composable left in the directory.
 sonar.coverage.exclusions=\
   app/src/main/java/**/ui/**/*Screen.kt,\
   app/src/main/java/**/ui/**/*Screen*.kt,\
-  app/src/main/java/**/ui/theme/**,\
+  app/src/main/java/**/ui/theme/Theme.kt,\
   app/src/main/java/**/ui/components/**,\
   app/src/main/java/**/ui/page/BlockRenderer.kt,\
   app/src/main/java/**/ui/shard/ShardComponents.kt,\