ci(release): auto-release engine (conventional commits) for the APK

Replace the tag-triggered release.yml with link/'s language-agnostic release
engine, adapted for Android. On every push to main it derives the next version
from conventional-commit subjects since the last v* tag (feat!/BREAKING -> major,
feat -> minor, fix|perf -> patch; nothing releasable -> no release), generates a
grouped changelog, bumps versionName in build.gradle.kts (versionCode derived
major*10000+minor*100+patch, monotonic), builds the SIGNED release APK, then
commits the bump [skip ci], tags vX.Y.Z, and creates the Gitea release with the
notes + APK + SHA256SUMS.

Uses REGISTRY_USER/REGISTRY_TOKEN (write:repository) to push the bump + create
the release, matching link/. main must allow that account to push (bump lands on
main; the [skip ci] + head-commit guard prevent a re-trigger loop). Signing
secrets (ANDROID_KEYSTORE_BASE64/_PASSWORD, ANDROID_KEY_ALIAS/_PASSWORD) unchanged.
Same self-hosted-runner handling as pr-checks.yml (apt JDK 17, sdkmanager, chmod).

Co-Authored-By: Claude <noreply@anthropic.com>

.gitea/scripts/gen_tree.py

@@ -1,54 +0,0 @@
-#!/usr/bin/env python3
-"""Render an ASCII tree of tracked files, read from stdin (one path per line).
-
-Used by the `sync-project-tree` workflow to regenerate this repo's PROJECT_TREE.md
-snapshot in the RunicGateway/docs repo. Feed it `git ls-files`:
-
-    git ls-files | python3 .gitea/scripts/gen_tree.py <root-label>
-
-Deterministic ordering: directories before files, each group sorted
-case-insensitively with the raw name as a tiebreak. Output uses the classic
-`tree(1)` box-drawing style so the result is stable across runs and platforms.
-"""
-import sys
-
-
-def build(paths):
-    root = {}
-    for p in paths:
-        p = p.strip().replace("\\", "/")
-        if not p:
-            continue
-        node = root
-        for part in p.split("/"):
-            node = node.setdefault(part, {})
-    return root
-
-
-def render(node, prefix, lines):
-    entries = list(node.items())
-    # directories (non-empty children dict) before files, then case-insensitive name
-    entries.sort(key=lambda kv: (0 if kv[1] else 1, kv[0].lower(), kv[0]))
-    for i, (name, child) in enumerate(entries):
-        last = i == len(entries) - 1
-        branch = "└── " if last else "├── "
-        suffix = "/" if child else ""
-        lines.append(f"{prefix}{branch}{name}{suffix}")
-        if child:
-            render(child, prefix + ("    " if last else "│   "), lines)
-
-
-def main():
-    try:
-        sys.stdout.reconfigure(encoding="utf-8", newline="\n")
-    except AttributeError:
-        pass
-    root_label = sys.argv[1] if len(sys.argv) > 1 else "."
-    tree = build(sys.stdin.read().splitlines())
-    lines = [f"{root_label}/"]
-    render(tree, "", lines)
-    sys.stdout.write("\n".join(lines) + "\n")
-
-
-if __name__ == "__main__":
-    main()

.gitea/workflows/release.yml

@@ -1,23 +1,37 @@
-# Automated release for the Runic Gateway Android app.
+# Automated build + release for the Runic Gateway Android app.
 #
-# Trigger: pushing a version tag `v*` (e.g. `v0.1.0`). Tag-driven on purpose — the
+# Trigger: every push to `main` (i.e. every merged PR).
-# build never has to push to protected `main`; the tag *is* the release input.
 #
-# To cut a release:
+# Flow (two conceptual halves, kept separate on purpose) — mirrors link/'s engine:
-#   git tag v0.1.0 && git push origin v0.1.0
-#   (or create the tag from the Gitea UI). Re-build/re-release an existing tag via
-#   the workflow_dispatch input below.
 #
-# versionName = the tag without its leading `v`; versionCode = major*10000 +
+#   ┌── RELEASE ENGINE (language-agnostic) ─────────────────────────────┐
-# minor*100 + patch (deterministic + monotonic, PLAN.md §10). Both are injected
+#   │  reads: latest v* git tag + conventional-commit subjects          │
-# into app/build.gradle.kts for the build only — nothing is committed back to main.
+#   │  produces: next version, changelog, and (at the end) the release  │
+#   └───────────────────────────────────────────────────────────────────┘
+#   ┌── ANDROID ADAPTER (the only Android-specific part) ───────────────┐
+#   │  consumes: the version                                            │
+#   │  produces: the artifact (a signed release APK + SHA256SUMS)       │
+#   └───────────────────────────────────────────────────────────────────┘
+#
+# Version bump (conventional commits since the last v* tag):
+#   feat!: / BREAKING CHANGE  -> major     feat: -> minor     fix|perf: -> patch
+#   nothing releasable        -> no release is cut
+#   (first ever run, no tag)  -> releases the current build.gradle.kts version as-is
+# versionName is the semver; versionCode is derived major*10000+minor*100+patch so
+# it is deterministic + monotonic (PLAN.md §10). The bump is committed back to
+# app/build.gradle.kts, then tagged.
 #
 # Prerequisites (Settings -> Actions -> Secrets on RunicGateway/Android-app):
-#   REGISTRY_TOKEN  — Gitea access token with `write:repository` (create the release)
+#   REGISTRY_USER   — Gitea username the token below belongs to
+#   REGISTRY_TOKEN  — Gitea access token with `write:repository` (push the bump
+#                     commit + tag and create the release)
 #   ANDROID_KEYSTORE_BASE64    — base64 of the release .jks (single line)
 #   ANDROID_KEYSTORE_PASSWORD  — keystore password
 #   ANDROID_KEY_ALIAS          — key alias (e.g. runicgateway)
 #   ANDROID_KEY_PASSWORD       — key password (== store password for a PKCS12 keystore)
+#   Also: `main` must accept a direct push from the REGISTRY_USER account (disable
+#   branch protection for it, or add it as an exception) — the bump commit lands on
+#   main. The bump commit carries `[skip ci]`, so it does not re-trigger this workflow.
 #
 # Runner handling matches pr-checks.yml (self-hosted `ubuntu-latest`): the container
 # lacks git/curl/unzip and can't reach api.adoptium.net, so we apt-install the base
@@ -28,16 +42,11 @@ name: Release APK
 
 on:
   push:
-    tags:
+    branches: [main]
-      - 'v*'
+  workflow_dispatch: {}
-  workflow_dispatch:
-    inputs:
-      tag:
-        description: 'Existing v* tag to (re)build and release'
-        required: true
 
 concurrency:
-  group: release-apk-${{ github.event.inputs.tag || github.ref_name }}
+  group: release-apk
   cancel-in-progress: false
 
 env:
@@ -48,10 +57,10 @@ env:
 jobs:
   release:
     runs-on: ubuntu-latest
-    # Fail fast on a genuinely wedged run (e.g. a stalled SDK/network download on
+    # Don't loop on our own bump commit (belt-and-suspenders with [skip ci]).
-    # the self-hosted runner) instead of hanging forever and — because concurrency
+    # Quoted because the expression contains a colon (`chore(release):`), which an
-    # is `cancel-in-progress: false` — blocking every later release behind it.
+    # unquoted YAML scalar would misparse as a mapping value.
-    timeout-minutes: 30
+    if: "${{ !contains(github.event.head_commit.message, 'chore(release): bump version') }}"
     steps:
       - name: Install base tools + JDK 17
         run: |
@@ -59,46 +68,70 @@ jobs:
           apt-get install -y git curl unzip jq openjdk-17-jdk-headless
           echo "JAVA_HOME=/usr/lib/jvm/java-17-openjdk-amd64" >> "$GITHUB_ENV"
 
-      - name: Check out the release tag (full history for the changelog)
+      - name: Check out full history (need tags + commit log for the bump)
         uses: actions/checkout@v4
         with:
-          ref: ${{ github.event.inputs.tag || github.ref_name }}
           fetch-depth: 0
 
-      # ── Derive version + changelog straight from the tag ─────────────────
+      # ── RELEASE ENGINE: decide the next version + changelog ──────────────
-      - name: Plan the release (version + changelog from the tag)
+      - name: Plan the release (version + changelog)
         id: plan
         run: |
           set -euo pipefail
           mkdir -p dist
           git fetch --tags --force >/dev/null 2>&1 || true
 
-          TAG="${{ github.event.inputs.tag || github.ref_name }}"
+          # Current committed version (the `?: "x.y.z"` default in build.gradle.kts).
-          case "$TAG" in
+          MANIFEST_VERSION="$(sed -nE 's/.*\?: "([0-9]+\.[0-9]+\.[0-9]+)".*/\1/p' "${GRADLE_MODULE}/build.gradle.kts" | head -1)"
-            v[0-9]*) : ;;
+          LAST_TAG="$(git describe --tags --match 'v*' --abbrev=0 2>/dev/null || true)"
-            *) echo "::error::expected a v* version tag, got '$TAG'"; exit 1 ;;
+          if [ -n "$LAST_TAG" ]; then RANGE="${LAST_TAG}..HEAD"; else RANGE="HEAD"; fi
-          esac
-          VERSION="${TAG#v}"
 
-          # versionCode: deterministic + monotonic from the semver (PLAN.md §10).
+          SUBJECTS="$(git log --no-merges --format='%s' $RANGE || true)"
+          BODIES="$(git log --no-merges --format='%B' $RANGE || true)"
+
+          BUMP=none
+          if echo "$BODIES"   | grep -qE 'BREAKING[ -]CHANGE'          ; then BUMP=major; fi
+          if echo "$SUBJECTS" | grep -qE '^[a-z]+(\([^)]+\))?!:'       ; then BUMP=major; fi
+          if [ "$BUMP" = none ] && echo "$SUBJECTS" | grep -qE '^feat(\([^)]+\))?:'      ; then BUMP=minor; fi
+          if [ "$BUMP" = none ] && echo "$SUBJECTS" | grep -qE '^(fix|perf)(\([^)]+\))?:'; then BUMP=patch; fi
+
+          bump() { # <x.y.z> <major|minor|patch> -> bumped
+            IFS=. read -r MA MI PA <<< "$1"
+            case "$2" in
+              major) echo "$((MA+1)).0.0" ;;
+              minor) echo "${MA}.$((MI+1)).0" ;;
+              patch) echo "${MA}.${MI}.$((PA+1))" ;;
+            esac
+          }
+
+          RELEASE=true
+          if [ -z "$LAST_TAG" ]; then
+            VERSION="$MANIFEST_VERSION"              # first release: ship what's committed
+          elif [ "$BUMP" = none ]; then
+            RELEASE=false                            # no feat/fix/breaking since last tag
+            VERSION="${LAST_TAG#v}"
+          else
+            VERSION="$(bump "${LAST_TAG#v}" "$BUMP")"
+          fi
+
+          if git rev-parse -q --verify "refs/tags/v${VERSION}" >/dev/null; then
+            echo "Tag v${VERSION} already exists — nothing to release."
+            RELEASE=false
+          fi
+
+          # Derive a deterministic, monotonic versionCode from the semver.
           IFS=. read -r MA MI PA <<< "$VERSION"
-          : "${MA:=0}"; : "${MI:=0}"; : "${PA:=0}"
           VERSION_CODE=$(( MA*10000 + MI*100 + PA ))
 
-          # Changelog: conventional-commit subjects since the previous v* tag.
-          PREV_TAG="$(git describe --tags --match 'v*' --abbrev=0 "${TAG}^" 2>/dev/null || true)"
-          if [ -n "$PREV_TAG" ]; then RANGE="${PREV_TAG}..${TAG}"; else RANGE="${TAG}"; fi
-          SUBJECTS="$(git log --no-merges --format='%s' $RANGE || true)"
-
           {
-            echo "## Runic Gateway Android ${TAG}"
+            echo "## Runic Gateway Android v${VERSION}"
             echo
             FEATS="$(echo "$SUBJECTS" | grep -E '^feat'        || true)"
             FIXES="$(echo "$SUBJECTS" | grep -E '^(fix|perf)'  || true)"
             [ -n "$FEATS" ] && { echo "### Features";  echo "$FEATS" | sed 's/^/- /'; echo; }
             [ -n "$FIXES" ] && { echo "### Fixes";     echo "$FIXES" | sed 's/^/- /'; echo; }
             echo "### All changes"
-            if [ -n "$PREV_TAG" ]; then echo "Since ${PREV_TAG}:"; fi
+            if [ -n "$LAST_TAG" ]; then echo "Since ${LAST_TAG}:"; fi
             echo "$SUBJECTS" | sed 's/^/- /'
             echo
             echo "---"
@@ -107,25 +140,35 @@ jobs:
 
           echo "version=${VERSION}"          >> "$GITHUB_OUTPUT"
           echo "versionCode=${VERSION_CODE}" >> "$GITHUB_OUTPUT"
-          echo "tag=${TAG}"                  >> "$GITHUB_OUTPUT"
+          echo "tag=v${VERSION}"             >> "$GITHUB_OUTPUT"
-          echo "==> tag=${TAG} version=${VERSION} code=${VERSION_CODE} prev_tag=${PREV_TAG:-<none>}"
+          echo "release=${RELEASE}"          >> "$GITHUB_OUTPUT"
+          echo "bump=${BUMP}"                >> "$GITHUB_OUTPUT"
+          echo "==> release=${RELEASE} version=${VERSION} code=${VERSION_CODE} bump=${BUMP} last_tag=${LAST_TAG:-<none>}"
 
-      # ── SDK + signing keystore ───────────────────────────────────────────
+      # ── ANDROID ADAPTER: SDK + signing keystore ──────────────────────────
       - name: Set up Android SDK
+        if: ${{ steps.plan.outputs.release == 'true' }}
         uses: android-actions/setup-android@v3
-        with:
-          # Only put cmdline-tools on PATH. The action's default package set drags in
-          # the whole emulator + the legacy `tools` package (hundreds of MB, network-
-          # bound on this runner) that a headless APK build never uses. The next step
-          # installs exactly the packages we need.
-          packages: ''
 
       - name: Install Android SDK packages
+        if: ${{ steps.plan.outputs.release == 'true' }}
         run: |
           set +o pipefail
           yes | sdkmanager "platform-tools" "platforms;android-35" "build-tools;35.0.0"
 
+      - name: Cache Gradle
+        if: ${{ steps.plan.outputs.release == 'true' }}
+        uses: actions/cache@v4
+        with:
+          path: |
+            ~/.gradle/caches
+            ~/.gradle/wrapper
+          key: gradle-${{ runner.os }}-${{ hashFiles('**/*.gradle.kts', 'gradle/libs.versions.toml', 'gradle/wrapper/gradle-wrapper.properties') }}
+          restore-keys: |
+            gradle-${{ runner.os }}-
+
       - name: Decode signing keystore
+        if: ${{ steps.plan.outputs.release == 'true' }}
         env:
           ANDROID_KEYSTORE_BASE64: ${{ secrets.ANDROID_KEYSTORE_BASE64 }}
         run: |
@@ -137,8 +180,9 @@ jobs:
           printf '%s' "$ANDROID_KEYSTORE_BASE64" | base64 -d > "${RUNNER_TEMP}/release.jks"
           echo "ANDROID_KEYSTORE_FILE=${RUNNER_TEMP}/release.jks" >> "$GITHUB_ENV"
 
-      # ── Set the version, build the signed APK ────────────────────────────
+      # ── ANDROID ADAPTER: set the version, gate, build the signed APK ─────
-      - name: Set the app version to match the tag
+      - name: Set the app version to match the release
+        if: ${{ steps.plan.outputs.release == 'true' }}
         run: |
           set -euo pipefail
           VERSION="${{ steps.plan.outputs.version }}"
@@ -149,6 +193,7 @@ jobs:
           grep -nE "versionCode = |versionName = " "${GRADLE_MODULE}/build.gradle.kts"
 
       - name: Unit tests + signed release APK
+        if: ${{ steps.plan.outputs.release == 'true' }}
         env:
           ANDROID_KEYSTORE_PASSWORD: ${{ secrets.ANDROID_KEYSTORE_PASSWORD }}
           ANDROID_KEY_ALIAS: ${{ secrets.ANDROID_KEY_ALIAS }}
@@ -159,6 +204,7 @@ jobs:
           ./gradlew --no-daemon :${GRADLE_MODULE}:testDebugUnitTest :${GRADLE_MODULE}:assembleRelease
 
       - name: Package APK + SHA256SUMS
+        if: ${{ steps.plan.outputs.release == 'true' }}
         run: |
           set -euo pipefail
           SRC="${GRADLE_MODULE}/build/outputs/apk/release/app-release.apk"
@@ -167,8 +213,37 @@ jobs:
           ( cd dist && sha256sum "runic-gateway-${{ steps.plan.outputs.version }}.apk" > SHA256SUMS )
           ls -l dist && cat dist/SHA256SUMS
 
-      # ── Create the Gitea release + upload assets (no push to main) ───────
+      # ── RELEASE ENGINE: commit the bump, tag, push ───────────────────────
+      - name: Commit version bump and push tag
+        if: ${{ steps.plan.outputs.release == 'true' }}
+        env:
+          REGISTRY_USER: ${{ secrets.REGISTRY_USER }}
+          REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
+        run: |
+          set -euo pipefail
+          TAG="${{ steps.plan.outputs.tag }}"
+          # Secrets can arrive with a trailing newline; a stray CR/LF corrupts the
+          # remote URL / auth header. Strip line breaks before use.
+          CI_USER="$(printf '%s' "${REGISTRY_USER}" | tr -d '\r\n')"
+          CI_TOKEN="$(printf '%s' "${REGISTRY_TOKEN}" | tr -d '\r\n')"
+          git config user.name  "android-app-ci"
+          git config user.email "ci@whitlocktech.com"
+          git remote set-url origin \
+            "https://${CI_USER}:${CI_TOKEN}@${GITEA_HOST}/${REPO}.git"
+
+          git add "${GRADLE_MODULE}/build.gradle.kts"
+          if ! git diff --cached --quiet; then
+            git commit -m "chore(release): bump version to ${TAG} [skip ci]"
+            git push origin "HEAD:main"
+          else
+            echo "Version unchanged (first release) — no bump commit needed."
+          fi
+          git tag "${TAG}"
+          git push origin "${TAG}"
+
+      # ── RELEASE ENGINE: create the Gitea release + upload assets ─────────
       - name: Create Gitea release and upload assets
+        if: ${{ steps.plan.outputs.release == 'true' }}
         env:
           REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
         run: |

.gitea/workflows/sonarqube.yml

@@ -1,90 +0,0 @@
-# Run SonarQube static analysis against the code that just landed on `main` and
-# report the results to the self-hosted SonarQube server for review. This is
-# intentionally NON-BLOCKING: it triggers on push to main (i.e. AFTER merge),
-# not on pull_request, so it never gates a PR. It complements pr-checks.yml
-# (which gates PRs) and release.yml (which ships the APK) — this one only feeds
-# the dashboard.
-#
-# Prerequisites (one-time, in the Gitea UI — Repo → Settings → Actions):
-#   • Secret   SONAR_TOKEN     — a SonarQube "Analysis" token generated at
-#                                My Account → Security in SonarQube for the
-#                                Runic-Gateway-Android-app project (or a global one).
-#   • Variable SONAR_HOST_URL  — the SonarQube base URL on your LAN, e.g.
-#                                http://192.168.0.56:9000
-#     (kept as a variable, not committed, so the internal address stays out of git.)
-#
-# The runner (self-hosted `ubuntu-latest`, same as the other workflows) must be
-# able to reach SONAR_HOST_URL on your network. Nothing here waits on the
-# SonarQube Quality Gate, so a failing gate does not fail this job — check the
-# dashboard when you want to.
-#
-# Scope: the Sonar scanner reads sonar-project.properties and analyses the Kotlin
-# source directly. Before the scan we run the JVM unit tests + JaCoCo so SonarQube
-# receives real coverage (sonar.coverage.jacoco.xmlReportPaths) — otherwise it
-# reports 0% and the coverage gate fails despite the test suite existing. That
-# Gradle step needs JDK 17 + the Android SDK (same toolchain as pr-checks.yml);
-# the runner container is bare, so base tools are apt-installed first.
-
-name: SonarQube
-
-on:
-  push:
-    branches: [main]
-  # Allow re-running the analysis on demand from the Actions tab.
-  workflow_dispatch: {}
-
-concurrency:
-  group: sonarqube-${{ github.ref }}
-  cancel-in-progress: true
-
-jobs:
-  analysis:
-    runs-on: ubuntu-latest
-    steps:
-      # The bare runner container lacks git/curl/unzip (checkout + sdkmanager need
-      # them) and we install JDK 17 from the Ubuntu archive rather than
-      # actions/setup-java (this runner can't reach api.adoptium.net). Mirrors
-      # pr-checks.yml — see its header note.
-      - name: Install base tools + JDK 17
-        run: |
-          apt-get update
-          apt-get install -y git curl unzip openjdk-17-jdk-headless
-          echo "JAVA_HOME=/usr/lib/jvm/java-17-openjdk-amd64" >> "$GITHUB_ENV"
-
-      - name: Check out (full history for accurate new-code + blame)
-        uses: actions/checkout@v4
-        with:
-          # SonarQube uses git history to attribute issues to authors and to
-          # compute "new code". A shallow clone degrades both.
-          fetch-depth: 0
-
-      - name: Set up Android SDK
-        uses: android-actions/setup-android@v3
-
-      - name: Install Android SDK packages
-        run: |
-          set +o pipefail
-          yes | sdkmanager "platform-tools" "platforms;android-35" "build-tools;35.0.0"
-
-      - name: Cache Gradle
-        uses: actions/cache@v4
-        with:
-          path: |
-            ~/.gradle/caches
-            ~/.gradle/wrapper
-          key: gradle-${{ runner.os }}-${{ hashFiles('**/*.gradle.kts', 'gradle/libs.versions.toml', 'gradle/wrapper/gradle-wrapper.properties') }}
-          restore-keys: |
-            gradle-${{ runner.os }}-
-
-      # Produce the JaCoCo XML the scan reports as coverage. Scoped to the debug
-      # variant (matches enableUnitTestCoverage) to keep peak memory down.
-      - name: Unit tests + JaCoCo coverage
-        run: |
-          chmod +x ./gradlew
-          ./gradlew --no-daemon testDebugUnitTest jacocoTestReport
-
-      - name: Run SonarQube scan
-        uses: sonarsource/sonarqube-scan-action@v4
-        env:
-          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
-          SONAR_HOST_URL: ${{ vars.SONAR_HOST_URL }}

.gitea/workflows/sync-project-tree.yml

@@ -1,111 +0,0 @@
-name: sync-project-tree
-
-# Keeps this repo's file-layout snapshot (docs/android/PROJECT_TREE.md in the
-# RunicGateway/docs repo) current. On every push to `main` it regenerates the
-# tree from tracked files and, if it changed, opens (or force-updates) a pull
-# request against the docs repo. It never writes to the docs repo's `main`
-# directly. Auth reuses the same REGISTRY_USER / REGISTRY_TOKEN secrets the
-# other workflows use (the token needs repo read/write on RunicGateway/docs).
-
-on:
-  push:
-    branches: [main]
-  workflow_dispatch: {}
-
-concurrency:
-  group: sync-project-tree
-  cancel-in-progress: true
-
-env:
-  GITEA_HOST: gitea.whitlocktech.com
-  DOCS_REPO: RunicGateway/docs
-  SELF_REPO: RunicGateway/Android-app
-  DOCS_PATH: android/PROJECT_TREE.md
-  TREE_TITLE: Android App
-  ROOT_LABEL: android-app
-  PR_BRANCH: chore/sync-android-tree
-
-jobs:
-  sync:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Check out this repo
-        uses: actions/checkout@v4
-        with:
-          fetch-depth: 1
-
-      - name: Ensure python3 is available
-        run: |
-          set -euo pipefail
-          command -v python3 >/dev/null 2>&1 || { sudo apt-get update -qq && sudo apt-get install -y -qq python3; }
-
-      - name: Render PROJECT_TREE.md from tracked files
-        run: |
-          set -euo pipefail
-          mkdir -p _sync
-          {
-            printf '# %s — Project Tree\n\n' "${TREE_TITLE}"
-            printf '> **Auto-generated.** This file is maintained by the `sync-project-tree` CI workflow in\n'
-            printf '> the [`%s`](https://%s/%s) repository, which\n' "${SELF_REPO}" "${GITEA_HOST}" "${SELF_REPO}"
-            printf '> opens a pull request here whenever the tracked file layout on `main` changes. Do not edit\n'
-            printf '> by hand — changes will be overwritten by the next sync.\n\n'
-            printf 'A snapshot of the tracked files in the repository (build output, dependencies, and other\n'
-            printf 'git-ignored paths are excluded).\n\n'
-            printf '```text\n'
-            git ls-files | python3 .gitea/scripts/gen_tree.py "${ROOT_LABEL}"
-            printf '```\n'
-          } > _sync/PROJECT_TREE.md
-          echo "----- generated ${DOCS_PATH} -----"
-          cat _sync/PROJECT_TREE.md
-
-      - name: Open or update the docs PR if the tree changed
-        env:
-          REGISTRY_USER: ${{ secrets.REGISTRY_USER }}
-          REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
-        run: |
-          set -euo pipefail
-          # Secrets can carry a trailing CR/LF depending on how they were pasted;
-          # strip line breaks before they land in a URL or Authorization header.
-          CI_USER="$(printf '%s' "${REGISTRY_USER}" | tr -d '\r\n')"
-          CI_TOKEN="$(printf '%s' "${REGISTRY_TOKEN}" | tr -d '\r\n')"
-          API="https://${GITEA_HOST}/api/v1/repos/${DOCS_REPO}"
-          REMOTE="https://${CI_USER}:${CI_TOKEN}@${GITEA_HOST}/${DOCS_REPO}.git"
-
-          git clone --depth 1 "${REMOTE}" docs_repo
-          cd docs_repo
-          git config user.name  "runic-docs-bot"
-          git config user.email "ci@whitlocktech.com"
-
-          mkdir -p "$(dirname "${DOCS_PATH}")"
-          cp ../_sync/PROJECT_TREE.md "${DOCS_PATH}"
-          git add "${DOCS_PATH}"
-          if git diff --cached --quiet; then
-            echo "PROJECT_TREE.md already up to date — nothing to sync."
-            exit 0
-          fi
-
-          SHORT_SHA="$(echo "${GITHUB_SHA:-local}" | cut -c1-7)"
-          git checkout -B "${PR_BRANCH}"
-          git commit -m "docs(tree): sync ${DOCS_PATH} from ${SELF_REPO}@${SHORT_SHA} [skip ci]"
-          git push --force "${REMOTE}" "HEAD:${PR_BRANCH}"
-
-          # Open a PR only if one isn't already open for this branch (a force-push
-          # to an existing open PR's head updates it in place).
-          OPEN="$(curl -sSf -H "Authorization: token ${CI_TOKEN}" \
-            "${API}/pulls?state=open&limit=50" \
-            | jq --arg b "${PR_BRANCH}" '[.[] | select(.head.ref == $b)] | length')"
-          if [ "${OPEN}" = "0" ]; then
-            curl -sSf -X POST "${API}/pulls" \
-              -H "Authorization: token ${CI_TOKEN}" \
-              -H "Content-Type: application/json" \
-              -d "$(jq -n \
-                    --arg head "${PR_BRANCH}" \
-                    --arg base "main" \
-                    --arg title "docs(tree): sync ${DOCS_PATH}" \
-                    --arg body "Automated project-tree sync from [\`${SELF_REPO}\`](https://${GITEA_HOST}/${SELF_REPO}), regenerated from tracked files on \`main\`. Merge once the layout looks right; the workflow will keep this branch current until then." \
-                    '{head: $head, base: $base, title: $title, body: $body}')" \
-              >/dev/null
-            echo "Opened a new docs PR for ${PR_BRANCH}."
-          else
-            echo "Existing open docs PR for ${PR_BRANCH} was updated via force-push."
-          fi

app/build.gradle.kts

@@ -10,11 +10,6 @@ plugins {
     alias(libs.plugins.kotlin.serialization)
     alias(libs.plugins.ksp)
     alias(libs.plugins.hilt)
-    jacoco
-}
-
-jacoco {
-    toolVersion = "0.8.12"
 }
 
 // Release signing material (PLAN.md §12) is never committed. It is read from, in
@@ -53,19 +48,6 @@ android {
         versionName = (project.findProperty("versionName") as String?)?.takeIf { it.isNotBlank() } ?: "0.1.0"
 
         testInstrumentationRunner = "androidx.test.runner.AndroidJUnitRunner"
-
-        // Android App Links host (docs/android/APP_LINKS.md). autoVerify needs a
-        // *literal* host at build time, so a single multi-tenant APK cannot verify
-        // open-ended shard domains: App Links are a build-time opt-in. Left empty for
-        // the generic build (custom scheme only); a white-label/first-party build
-        // bakes one host with `-PappLinkHost=play.myshard.com`.
-        //   • BuildConfig.APP_LINK_HOST — SsoAuthManager reads it to pick the redirect.
-        //   • manifestPlaceholder appLinkHost — substituted into the intent-filter host;
-        //     empty falls back to the reserved `.invalid` sentinel so the autoVerify
-        //     filter is inert (matches no real link, never verifies).
-        val appLinkHost = (project.findProperty("appLinkHost") as String?)?.trim().orEmpty()
-        buildConfigField("String", "APP_LINK_HOST", "\"$appLinkHost\"")
-        manifestPlaceholders["appLinkHost"] = appLinkHost.ifBlank { "runic-gateway.invalid" }
     }
 
     signingConfigs {
@@ -83,11 +65,6 @@ android {
     }
 
     buildTypes {
-        debug {
-            // Produce a JaCoCo .exec from JVM unit tests so SonarQube receives real
-            // coverage (§12.1). Debug-only: the scan analyses the debug variant.
-            enableUnitTestCoverage = true
-        }
         release {
             // R8 full-mode minify + resource shrink (§7: no offline cache, so a lean
             // release APK). Keep rules live in proguard-rules.pro.
@@ -180,35 +157,3 @@ dependencies {
     androidTestImplementation(platform(libs.androidx.compose.bom))
     androidTestImplementation(libs.androidx.compose.ui.test.junit4)
 }
-
-// JaCoCo XML coverage from the JVM unit tests, consumed by SonarQube (§12.1). Generated,
-// DI (Hilt), and Compose-scaffold classes are excluded so they don't dilute the number;
-// pure-@Composable UI is excluded on the Sonar side (sonar.coverage.exclusions) because
-// JVM unit tests can't execute composable bodies without Robolectric.
-tasks.register<JacocoReport>("jacocoTestReport") {
-    dependsOn("testDebugUnitTest")
-    group = "verification"
-    description = "Generates JaCoCo XML/HTML coverage for the debug unit tests."
-
-    reports {
-        xml.required.set(true)
-        html.required.set(true)
-    }
-
-    val coverageExcludes = listOf(
-        "**/R.class", "**/R$*.class", "**/BuildConfig.*", "**/Manifest*.*",
-        "**/*_Hilt*.*", "**/Hilt_*.*", "**/*_Factory*.*", "**/*_MembersInjector*.*",
-        "**/*_Impl*.*", "**/di/**", "**/*Module.*", "**/*Module$*.*",
-        "**/*ComposableSingletons*.*", "**/ComposableSingletons$*.*",
-    )
-    val buildDirFile = layout.buildDirectory.get().asFile
-    classDirectories.setFrom(
-        fileTree("$buildDirFile/tmp/kotlin-classes/debug") { exclude(coverageExcludes) },
-    )
-    sourceDirectories.setFrom(files("src/main/java", "src/main/kotlin"))
-    executionData.setFrom(
-        fileTree(buildDirFile) {
-            include("outputs/unit_test_code_coverage/debugUnitTest/testDebugUnitTest.exec")
-        },
-    )
-}

app/src/debug/res/xml/network_security_config.xml

@@ -1,20 +0,0 @@
-<?xml version="1.0" encoding="utf-8"?>
-<!-- SPDX-License-Identifier: GPL-3.0-or-later -->
-<!--
-  Debug-only override of the main network_security_config.xml. Keeps the secure
-  base posture (no cleartext) but re-permits cleartext to loopback so debug builds
-  can reach a local website backend at http://127.0.0.1:3000 / http://localhost:3000
-  (ServerUrl allows plain HTTP only when allowInsecureHttp = BuildConfig.DEBUG).
-  Because the platform default already blocks cleartext at targetSdk 28+, this
-  domain-config is what actually makes the debug local-dev path work at runtime.
-
-  This file is compiled only into debug builds; release builds use the main
-  source set's config and permit no cleartext at all.
--->
-<network-security-config>
-    <base-config cleartextTrafficPermitted="false" />
-    <domain-config cleartextTrafficPermitted="true">
-        <domain includeSubdomains="false">127.0.0.1</domain>
-        <domain includeSubdomains="false">localhost</domain>
-    </domain-config>
-</network-security-config>

app/src/main/AndroidManifest.xml

@@ -6,13 +6,6 @@
     <uses-permission android:name="android.permission.INTERNET" />
     <uses-permission android:name="android.permission.ACCESS_NETWORK_STATE" />
 
-    <!-- Opt-in push notifications (M7): the runtime notification permission (API 33+)
-         and a foreground service that holds the persistent ntfy connection open — the
-         embedded UnifiedPush distributor, so no separate app is needed (PLAN.md §11). -->
-    <uses-permission android:name="android.permission.POST_NOTIFICATIONS" />
-    <uses-permission android:name="android.permission.FOREGROUND_SERVICE" />
-    <uses-permission android:name="android.permission.FOREGROUND_SERVICE_DATA_SYNC" />
-
     <application
         android:name=".RunicGatewayApp"
         android:allowBackup="true"
@@ -20,61 +13,19 @@
         android:fullBackupContent="@xml/backup_rules"
         android:icon="@mipmap/ic_launcher"
         android:label="@string/app_name"
-        android:networkSecurityConfig="@xml/network_security_config"
         android:roundIcon="@mipmap/ic_launcher_round"
         android:supportsRtl="true"
         android:theme="@style/Theme.RunicGateway">
 
-        <!-- singleTop so the SSO Custom Tab returning via the deep link reuses the
-             running task (onNewIntent) instead of stacking a second activity. -->
         <activity
             android:name=".MainActivity"
             android:exported="true"
-            android:launchMode="singleTop"
             android:theme="@style/Theme.RunicGateway">
             <intent-filter>
                 <action android:name="android.intent.action.MAIN" />
                 <category android:name="android.intent.category.LAUNCHER" />
             </intent-filter>
-
-            <!-- Native SSO callback (M9, PLAN.md §4.2). The bridge deep-links the
-                 one-time authorization code back to this fixed, app-owned custom
-                 scheme; it must match SsoAuthManager.REDIRECT_URI and the backend's
-                 MOBILE_AUTH_REDIRECT_URIS allowlist exactly. This is the permanent
-                 fallback on every build (docs/android/APP_LINKS.md). -->
-            <intent-filter>
-                <action android:name="android.intent.action.VIEW" />
-                <category android:name="android.intent.category.DEFAULT" />
-                <category android:name="android.intent.category.BROWSABLE" />
-                <data
-                    android:scheme="runicgateway"
-                    android:host="auth"
-                    android:path="/callback" />
-            </intent-filter>
-
-            <!-- App Links hardening (docs/android/APP_LINKS.md): a verified https
-                 callback that only the domain's real owner can claim. autoVerify
-                 needs a literal host, so ${appLinkHost} is baked at build time
-                 (build.gradle.kts). The generic build leaves it as the reserved
-                 runic-gateway.invalid sentinel — the filter then matches no real
-                 link and never verifies. A white-label build sets -PappLinkHost. -->
-            <intent-filter android:autoVerify="true">
-                <action android:name="android.intent.action.VIEW" />
-                <category android:name="android.intent.category.DEFAULT" />
-                <category android:name="android.intent.category.BROWSABLE" />
-                <data
-                    android:scheme="https"
-                    android:host="${appLinkHost}"
-                    android:path="/mobile/callback" />
-            </intent-filter>
         </activity>
-
-        <!-- The embedded distributor's persistent ntfy connection (M7, PLAN.md §11).
-             dataSync foreground type; not exported — started only by PushManager. -->
-        <service
-            android:name=".core.push.PushService"
-            android:exported="false"
-            android:foregroundServiceType="dataSync" />
     </application>
 
 </manifest>

app/src/main/java/com/runicgateway/app/MainActivity.kt

@@ -3,25 +3,18 @@
  */
 package com.runicgateway.app
 
-import android.content.Intent
 import android.graphics.Color
-import android.net.Uri
 import android.os.Bundle
 import androidx.activity.ComponentActivity
 import androidx.activity.SystemBarStyle
 import androidx.activity.compose.setContent
 import androidx.activity.enableEdgeToEdge
-import androidx.lifecycle.lifecycleScope
 import androidx.compose.foundation.layout.fillMaxSize
 import androidx.compose.material3.MaterialTheme
 import androidx.compose.material3.Surface
 import androidx.compose.runtime.CompositionLocalProvider
 import androidx.compose.runtime.getValue
-import androidx.compose.runtime.mutableStateOf
-import androidx.compose.runtime.setValue
 import androidx.compose.ui.Modifier
-import com.runicgateway.app.core.auth.sso.SsoAuthManager
-import com.runicgateway.app.core.push.PushNotifier
 import androidx.hilt.navigation.compose.hiltViewModel
 import androidx.lifecycle.compose.collectAsStateWithLifecycle
 import com.runicgateway.app.ui.AppViewModel
@@ -33,8 +26,6 @@ import com.runicgateway.app.ui.connect.ConnectScreen
 import com.runicgateway.app.ui.theme.RunicGatewayTheme
 import com.runicgateway.app.ui.theme.parseBrandColor
 import dagger.hilt.android.AndroidEntryPoint
-import kotlinx.coroutines.launch
-import javax.inject.Inject
 
 /**
  * Single-activity host (PLAN.md §2). Gates on [AppViewModel]: the first-run
@@ -44,23 +35,8 @@ import javax.inject.Inject
  */
 @AndroidEntryPoint
 class MainActivity : ComponentActivity() {
-
-    // Native SSO bridge — handles the runicgateway://auth/callback deep link (M9,
-    // §4.2). Field-injected because the callback can arrive independent of any
-    // ViewModel; a successful exchange flips the SessionManager the whole app
-    // observes, and the login screen consumes SsoAuthManager.outcome.
-    @Inject
-    lateinit var ssoAuthManager: SsoAuthManager
-
-    // The stream a tapped push notification wants to open (§11, M7 Part 2 item 7).
-    // Set from the launching intent and from onNewIntent (the activity is singleTop),
-    // consumed once by RunicApp which navigates to the stream's screen.
-    private var pendingStream by mutableStateOf<String?>(null)
-
     override fun onCreate(savedInstanceState: Bundle?) {
         super.onCreate(savedInstanceState)
-        pendingStream = intent?.getStringExtra(PushNotifier.EXTRA_STREAM)
-        handleSsoCallback(intent)
         // Dark-only app (M5): force light system-bar icons over the transparent bars so
         // they stay legible on the deep blue-black surfaces regardless of system theme.
         val barStyle = SystemBarStyle.dark(Color.TRANSPARENT)
@@ -82,47 +58,11 @@ class MainActivity : ComponentActivity() {
                             AppState.NeedsConnection ->
                                 ConnectScreen(onConnected = appViewModel::onConnected)
                             is AppState.Ready ->
-                                RunicApp(
+                                RunicApp(brand = s.brand, onChangeServer = appViewModel::changeServer)
-                                    brand = s.brand,
-                                    onChangeServer = appViewModel::changeServer,
-                                    deepLinkStream = pendingStream,
-                                    onDeepLinkConsumed = { pendingStream = null },
-                                )
                         }
                     }
                 }
             }
         }
     }
-
-    /**
-     * A notification tap or an SSO callback arriving while the activity is already
-     * running (singleTop) — the common case, since the Custom Tab overlays the live
-     * app during sign-in.
-     */
-    override fun onNewIntent(intent: Intent) {
-        super.onNewIntent(intent)
-        setIntent(intent)
-        intent.getStringExtra(PushNotifier.EXTRA_STREAM)?.let { pendingStream = it }
-        handleSsoCallback(intent)
-    }
-
-    /**
-     * Route an SSO callback VIEW intent into the bridge (M9, §4.2): either the
-     * custom-scheme `runicgateway://auth/callback` (always) or the verified https
-     * App Link `https://<paired-host>/mobile/callback` (opt-in hardening —
-     * docs/android/APP_LINKS.md). Both feed the *same* exchange; the result surfaces
-     * on `SsoAuthManager.outcome` (success signs the session in; failure shows on the
-     * login screen). Non-callback intents are ignored.
-     */
-    private fun handleSsoCallback(intent: Intent?) {
-        val data: Uri = intent?.takeIf { it.action == Intent.ACTION_VIEW }?.data ?: return
-        val isCallback = ssoAuthManager.matchesCallback(data.scheme, data.host, data.path) ||
-            ssoAuthManager.matchesAppLinkCallback(data.scheme, data.host, data.path)
-        if (!isCallback) return
-        val state = data.getQueryParameter("state")
-        val code = data.getQueryParameter("code")
-        val error = data.getQueryParameter("error")
-        lifecycleScope.launch { ssoAuthManager.complete(state = state, code = code, error = error) }
-    }
 }

app/src/main/java/com/runicgateway/app/core/auth/DeviceNameProvider.kt

@@ -1,34 +0,0 @@
-/*
- * SPDX-License-Identifier: GPL-3.0-or-later
- */
-package com.runicgateway.app.core.auth
-
-import android.os.Build
-import javax.inject.Inject
-import javax.inject.Singleton
-
-/**
- * Supplies a friendly label for this device, sent as `device_name` at login so a
- * trusted-device / active-session row is recognizable in the account lists
- * (TRUSTED_DEVICES_MFA.md). Behind an interface so the auth repository stays free of
- * `android.os.Build` and unit-testable on the JVM.
- */
-fun interface DeviceNameProvider {
-    /** A human label like "Google Pixel 8", or null if nothing meaningful is available. */
-    fun deviceName(): String?
-}
-
-/** Production impl: manufacturer + model from [Build] (e.g. "Samsung SM-S918B"). */
-@Singleton
-class BuildDeviceNameProvider @Inject constructor() : DeviceNameProvider {
-    override fun deviceName(): String? {
-        val manufacturer = Build.MANUFACTURER?.trim().orEmpty()
-        val model = Build.MODEL?.trim().orEmpty()
-        val label = when {
-            model.isEmpty() -> manufacturer
-            manufacturer.isEmpty() || model.startsWith(manufacturer, ignoreCase = true) -> model
-            else -> "$manufacturer $model"
-        }.replaceFirstChar { if (it.isLowerCase()) it.titlecase() else it.toString() }
-        return label.take(100).ifBlank { null }
-    }
-}

app/src/main/java/com/runicgateway/app/core/auth/EncryptedTrustTokenStore.kt

@@ -1,65 +0,0 @@
-/*
- * SPDX-License-Identifier: GPL-3.0-or-later
- */
-package com.runicgateway.app.core.auth
-
-import android.content.Context
-import android.content.SharedPreferences
-import androidx.security.crypto.EncryptedSharedPreferences
-import androidx.security.crypto.MasterKey
-import dagger.hilt.android.qualifiers.ApplicationContext
-import javax.inject.Inject
-import javax.inject.Singleton
-
-/**
- * [TrustTokenStore] backed by its **own** EncryptedSharedPreferences file
- * (Tink/AES-256-GCM), distinct from the session store so it is never wiped by
- * [SessionManager.onSignedOut] — the trust token must outlive a logout to do its
- * job (TRUSTED_DEVICES_MFA.md). The token is stored alongside the username it was
- * minted for so [tokenFor] only returns it for a matching login.
- *
- * The prefs handle is lazy so a device that never trusts pays the keystore cost
- * only if a token is actually stored or read.
- */
-@Singleton
-class EncryptedTrustTokenStore @Inject constructor(
-    @param:ApplicationContext private val context: Context,
-) : TrustTokenStore {
-
-    private val prefs: SharedPreferences by lazy {
-        val masterKey = MasterKey.Builder(context)
-            .setKeyScheme(MasterKey.KeyScheme.AES256_GCM)
-            .build()
-        EncryptedSharedPreferences.create(
-            context,
-            PREFS_NAME,
-            masterKey,
-            EncryptedSharedPreferences.PrefKeyEncryptionScheme.AES256_SIV,
-            EncryptedSharedPreferences.PrefValueEncryptionScheme.AES256_GCM,
-        )
-    }
-
-    override fun tokenFor(username: String): String? {
-        val token = prefs.getString(KEY_TOKEN, null) ?: return null
-        val owner = prefs.getString(KEY_USERNAME, null) ?: return null
-        // Case-insensitive: usernames are matched case-insensitively server-side.
-        return if (owner.equals(username, ignoreCase = true)) token else null
-    }
-
-    override fun save(username: String, token: String) {
-        prefs.edit()
-            .putString(KEY_TOKEN, token)
-            .putString(KEY_USERNAME, username)
-            .apply()
-    }
-
-    override fun clear() {
-        prefs.edit().clear().apply()
-    }
-
-    private companion object {
-        const val PREFS_NAME = "runic_trust"
-        const val KEY_TOKEN = "trust_token"
-        const val KEY_USERNAME = "trust_username"
-    }
-}

app/src/main/java/com/runicgateway/app/core/auth/Session.kt

@@ -16,15 +16,6 @@ data class SessionUser(
     val role: Role,
 ) {
     val isPlayer: Boolean get() = role == Role.PLAYER
-
-    /** Any staff role (moderator/editor/admin) — the staff-operations surface (§1, M10). */
-    val isStaff: Boolean get() = role.isStaff
-
-    /** Admin or moderator — moderation actions + the support queue (`modAccess`). */
-    val isModerator: Boolean get() = role == Role.ADMIN || role == Role.MODERATOR
-
-    /** Admin only — site-mode and other `adminOnly` controls. */
-    val isAdmin: Boolean get() = role == Role.ADMIN
 }
 
 /**

app/src/main/java/com/runicgateway/app/core/auth/TrustTokenStore.kt

@@ -1,31 +0,0 @@
-/*
- * SPDX-License-Identifier: GPL-3.0-or-later
- */
-package com.runicgateway.app.core.auth
-
-/**
- * At-rest home for the opaque trusted-device token (TRUSTED_DEVICES_MFA.md). It is
- * the native analogue of the web `rg_trust` cookie: a device that holds a valid
- * token skips the TOTP step on its next login (never the password).
- *
- * Deliberately **separate** from [TokenStore] and untouched by session teardown —
- * the token must **survive logout and a dead-refresh sign-out**, because it is only
- * ever consulted at a *fresh* login (exactly the moment after the session is gone).
- * Clearing it there would make the feature a no-op. It is scoped to the username it
- * was minted for so it is never replayed for a different account on a shared device,
- * and is cleared only by an explicit untrust, a Settings → Server switch, or a
- * server-side revocation (password change/reset, TOTP disable) that renders it dead.
- *
- * Tokens are sensitive, so the production impl uses EncryptedSharedPreferences —
- * never plain prefs or logs. Kept behind an interface for an in-memory test fake.
- */
-interface TrustTokenStore {
-    /** The stored trust token for [username], or null if this device isn't trusted for them. */
-    fun tokenFor(username: String): String?
-
-    /** Persist [token] as the trust token for [username] (overwrites any prior one). */
-    fun save(username: String, token: String)
-
-    /** Drop the trust token — untrust-all and the Settings → Server hard reset. */
-    fun clear()
-}

app/src/main/java/com/runicgateway/app/core/auth/sso/EncryptedPendingSsoStore.kt

@@ -1,61 +0,0 @@
-/*
- * SPDX-License-Identifier: GPL-3.0-or-later
- */
-package com.runicgateway.app.core.auth.sso
-
-import android.content.Context
-import android.content.SharedPreferences
-import androidx.security.crypto.EncryptedSharedPreferences
-import androidx.security.crypto.MasterKey
-import dagger.hilt.android.qualifiers.ApplicationContext
-import javax.inject.Inject
-import javax.inject.Singleton
-
-/**
- * [PendingSsoStore] backed by Jetpack Security's [EncryptedSharedPreferences]
- * (Tink/AES-256-GCM), so the PKCE verifier is encrypted at rest for the brief
- * window a flow is in progress. Separate prefs file from the session token store —
- * this holds only the transient SSO handshake, cleared as soon as the callback is
- * consumed. Lazy, so a device that never signs in via SSO pays no keystore cost.
- */
-@Singleton
-class EncryptedPendingSsoStore @Inject constructor(
-    @param:ApplicationContext private val context: Context,
-) : PendingSsoStore {
-
-    private val prefs: SharedPreferences by lazy {
-        val masterKey = MasterKey.Builder(context)
-            .setKeyScheme(MasterKey.KeyScheme.AES256_GCM)
-            .build()
-        EncryptedSharedPreferences.create(
-            context,
-            PREFS_NAME,
-            masterKey,
-            EncryptedSharedPreferences.PrefKeyEncryptionScheme.AES256_SIV,
-            EncryptedSharedPreferences.PrefValueEncryptionScheme.AES256_GCM,
-        )
-    }
-
-    override fun save(state: String, verifier: String) {
-        prefs.edit()
-            .putString(KEY_STATE, state)
-            .putString(KEY_VERIFIER, verifier)
-            .apply()
-    }
-
-    override fun load(): PendingSso? {
-        val state = prefs.getString(KEY_STATE, null) ?: return null
-        val verifier = prefs.getString(KEY_VERIFIER, null) ?: return null
-        return PendingSso(state = state, verifier = verifier)
-    }
-
-    override fun clear() {
-        prefs.edit().clear().apply()
-    }
-
-    private companion object {
-        const val PREFS_NAME = "runic_sso_pending"
-        const val KEY_STATE = "state"
-        const val KEY_VERIFIER = "verifier"
-    }
-}

app/src/main/java/com/runicgateway/app/core/auth/sso/PendingSsoStore.kt

@@ -1,24 +0,0 @@
-/*
- * SPDX-License-Identifier: GPL-3.0-or-later
- */
-package com.runicgateway.app.core.auth.sso
-
-/**
- * Persists the in-flight SSO `{state, verifier}` (PKCE Layer B + CSRF state) across
- * the Custom-Tab round trip so the exchange survives process death — a low-memory
- * device can evict the app while the Custom Tab is foreground, and the callback then
- * returns to a fresh process (PLAN.md §4.2). Kept behind an interface so
- * [SsoAuthManager] stays framework-free and unit-tests on the JVM with a fake.
- *
- * Exactly one flow is pending at a time; [save] overwrites any prior. The verifier
- * is a bearer-equivalent secret for the one-time code, so the production impl
- * ([EncryptedPendingSsoStore]) encrypts it at rest, mirroring the token store.
- */
-interface PendingSsoStore {
-    fun save(state: String, verifier: String)
-    fun load(): PendingSso?
-    fun clear()
-}
-
-/** The stashed CSRF state + PKCE verifier for the current SSO attempt. */
-data class PendingSso(val state: String, val verifier: String)

app/src/main/java/com/runicgateway/app/core/auth/sso/Pkce.kt

@@ -1,50 +0,0 @@
-/*
- * SPDX-License-Identifier: GPL-3.0-or-later
- */
-package com.runicgateway.app.core.auth.sso
-
-import java.security.MessageDigest
-import java.security.SecureRandom
-import java.util.Base64
-
-/**
- * PKCE + CSRF-state primitives for the Mobile SSO Authorization Bridge — "Layer B"
- * of the two PKCE layers (app ↔ website; PLAN.md §4.2, BACKEND_DESIGN "Two PKCE
- * layers"). The app proves at `/exchange` that it holds the verifier for the
- * challenge it registered at `/start`, so an intercepted callback code is useless
- * to anyone but this app.
- *
- * Pure JVM (no Android framework types) so it unit-tests on the plain test runner.
- * The encoding mirrors the backend exactly (RFC 7636 S256): the challenge is
- * `base64url(SHA-256(verifier))` with no padding, matching Node's
- * `crypto.createHash('sha256').update(verifier).digest('base64url')`.
- */
-object Pkce {
-
-    private val random = SecureRandom()
-
-    // RFC 4648 §5 URL-safe base64 without padding — the base64url the backend uses.
-    private val encoder = Base64.getUrlEncoder().withoutPadding()
-
-    /**
-     * A fresh high-entropy `code_verifier`: 32 random bytes → 43 base64url chars,
-     * comfortably inside RFC 7636's 43–128 range and identical in form to the
-     * verifier the website generates for its own IdP layer.
-     */
-    fun newVerifier(): String = randomToken()
-
-    /** A fresh opaque CSRF `state` (same entropy/shape as a verifier). */
-    fun newState(): String = randomToken()
-
-    /** `code_challenge` for [verifier] using the S256 method. */
-    fun challengeOf(verifier: String): String {
-        val digest = MessageDigest.getInstance("SHA-256").digest(verifier.toByteArray(Charsets.US_ASCII))
-        return encoder.encodeToString(digest)
-    }
-
-    private fun randomToken(): String {
-        val bytes = ByteArray(32)
-        random.nextBytes(bytes)
-        return encoder.encodeToString(bytes)
-    }
-}

app/src/main/java/com/runicgateway/app/core/auth/sso/SsoAuthManager.kt

@@ -1,246 +0,0 @@
-/*
- * SPDX-License-Identifier: GPL-3.0-or-later
- */
-package com.runicgateway.app.core.auth.sso
-
-import com.runicgateway.app.BuildConfig
-import com.runicgateway.app.core.auth.SessionManager
-import com.runicgateway.app.core.auth.TrustTokenStore
-import com.runicgateway.app.core.net.BaseUrlHolder
-import com.runicgateway.app.data.api.SsoApi
-import com.runicgateway.app.data.api.dto.MobileSsoExchangeRequest
-import kotlinx.coroutines.CancellationException
-import kotlinx.coroutines.flow.MutableStateFlow
-import kotlinx.coroutines.flow.StateFlow
-import kotlinx.coroutines.flow.asStateFlow
-import java.io.IOException
-import javax.inject.Inject
-import javax.inject.Singleton
-
-/**
- * Orchestrates the native "Sign in with Google/Discord" flow — the app half of the
- * Mobile SSO Authorization Bridge (PLAN.md §4.2, BACKEND_DESIGN "Mobile SSO
- * Authorization Bridge"). It never adds a parallel auth path: a successful exchange
- * drives the *same* [SessionManager.onSignedIn] the password login uses, so the
- * menu, push registration, and re-validation all react identically.
- *
- * The flow:
- *  1. [buildStartUrl] mints PKCE (Layer B) + a CSRF `state`, stashes them, and
- *     returns the `/auth/mobile/sso/start` URL the caller opens in a Custom Tab.
- *  2. The website bounces through the IdP and deep-links back to
- *     [REDIRECT_URI] with `?code&state` (success) or `?error&state` (failure).
- *  3. [complete] verifies `state`, exchanges the `code` with the stashed verifier,
- *     and signs the user in — publishing the result on [outcome]. `MainActivity`
- *     parses the callback `Uri` (the Android edge) and hands the raw params here,
- *     so this class stays free of framework types and unit-tests on the JVM.
- *
- * The pending `{state, verifier}` is persisted via [PendingSsoStore] (encrypted at
- * rest), so the exchange survives the process being evicted while the Custom Tab is
- * foreground — the callback can land in a fresh process and still complete. It is
- * cleared the moment [complete] consumes it, so a lost/duplicate callback still
- * **fails closed** as [Failure.STATE_MISMATCH] rather than double-exchanging.
- *
- * Threading: [buildStartUrl] runs on the UI thread; [complete] runs on the
- * activity's coroutine scope after a deep link. [outcome] is a [StateFlow], so a
- * ViewModel/activity recreation while the Custom Tab is open cannot drop a result.
- */
-@Singleton
-class SsoAuthManager @Inject constructor(
-    private val ssoApi: SsoApi,
-    private val sessionManager: SessionManager,
-    private val baseUrlHolder: BaseUrlHolder,
-    private val pendingStore: PendingSsoStore,
-    private val trustTokenStore: TrustTokenStore,
-) {
-
-    /** Why an SSO attempt ended, for a friendly inline message on the login screen. */
-    enum class Failure {
-        /** The user cancelled or the IdP/website refused (e.g. no linked account). */
-        DENIED,
-
-        /** The callback `state` didn't match — CSRF guard, or the pending flow was lost. */
-        STATE_MISMATCH,
-
-        /** The one-time code was unknown / expired / already used, or PKCE failed. */
-        EXPIRED_CODE,
-
-        /** Offline / DNS / TLS / timeout during the exchange. */
-        NETWORK,
-
-        /** Any other server failure, or a missing base URL / malformed callback. */
-        SERVER,
-    }
-
-    /** The observable result of the most recent flow; the login screen consumes it. */
-    sealed interface Outcome {
-        data object Idle : Outcome
-        data object Success : Outcome
-        data class Failed(val reason: Failure) : Outcome
-    }
-
-    /**
-     * The host this build baked an App Link intent-filter for (`BuildConfig.APP_LINK_HOST`,
-     * empty on the generic multi-tenant build — see docs/android/APP_LINKS.md).
-     * `internal var` only so unit tests can exercise the App Link path without a build
-     * flavor; production never reassigns it.
-     */
-    internal var appLinkHost: String = BuildConfig.APP_LINK_HOST
-
-    private val _outcome = MutableStateFlow<Outcome>(Outcome.Idle)
-    val outcome: StateFlow<Outcome> = _outcome.asStateFlow()
-
-    /** Ack a delivered [outcome] so it isn't re-handled after a recomposition. */
-    fun consumeOutcome() {
-        _outcome.value = Outcome.Idle
-    }
-
-    /**
-     * Build the `/auth/mobile/sso/start` URL for [providerId] and stash the pending
-     * PKCE verifier + CSRF state (persisted so it survives process death). Returns
-     * null when no shard site is configured yet. Also resets [outcome] to
-     * [Outcome.Idle] so a stale prior result can't fire against the new attempt.
-     */
-    fun buildStartUrl(providerId: String): String? {
-        val base = baseUrlHolder.current ?: return null
-        val verifier = Pkce.newVerifier()
-        val challenge = Pkce.challengeOf(verifier)
-        val state = Pkce.newState()
-        pendingStore.save(state = state, verifier = verifier)
-        _outcome.value = Outcome.Idle
-        return base.newBuilder()
-            .addPathSegments("api/v1/auth/mobile/sso/start")
-            .addQueryParameter("provider", providerId)
-            .addQueryParameter("code_challenge", challenge)
-            .addQueryParameter("state", state)
-            .addQueryParameter("redirect_uri", redirectUriFor(base.host))
-            .build()
-            .toString()
-    }
-
-    /**
-     * The `redirect_uri` to request for a shard on [pairedHost]: the verified https
-     * App Link callback **iff** this build baked an App Link host that matches the
-     * paired host (a white-label/first-party build for exactly this shard — which is
-     * also responsible for enabling `mobile_app_links_enabled` server-side); otherwise
-     * the fixed custom-scheme callback, which every build/shard always supports.
-     */
-    private fun redirectUriFor(pairedHost: String): String =
-        if (appLinkHost.isNotBlank() && appLinkHost.equals(pairedHost, ignoreCase = true)) {
-            "https://$pairedHost$APP_LINK_CALLBACK_PATH"
-        } else {
-            REDIRECT_URI
-        }
-
-    /** True if a deep link's scheme/host/path are our fixed custom-scheme SSO callback. */
-    fun matchesCallback(scheme: String?, host: String?, path: String?): Boolean =
-        scheme == CALLBACK_SCHEME && host == CALLBACK_HOST && path == CALLBACK_PATH
-
-    /**
-     * True if a deep link is a verified https App Link callback for the shard we are
-     * **currently paired to**. The `host == pairedHost` check is defense-in-depth:
-     * `autoVerify` already means only a real, opted-in shard domain can route here,
-     * but the app still refuses an https callback whose host isn't the paired shard.
-     * Returns false before a shard is configured (no paired host to trust).
-     */
-    fun matchesAppLinkCallback(scheme: String?, host: String?, path: String?): Boolean {
-        val pairedHost = baseUrlHolder.current?.host ?: return false
-        return scheme == "https" && path == APP_LINK_CALLBACK_PATH &&
-            host != null && host.equals(pairedHost, ignoreCase = true)
-    }
-
-    /**
-     * Handle the parsed callback params from a returned [REDIRECT_URI] deep link:
-     * verify `state`, map an `error`, else exchange the `code` and sign in.
-     * Publishes the result on [outcome]. Idempotent-safe: the pending is cleared on
-     * entry, so a duplicate delivery of the same callback finds no pending and fails
-     * as [Failure.STATE_MISMATCH] rather than double-exchanging (the backend also
-     * single-uses the code).
-     */
-    suspend fun complete(state: String?, code: String?, error: String?) {
-        val stashed = pendingStore.load()
-        pendingStore.clear()
-
-        // CSRF: the callback must echo the exact state we generated at /start.
-        if (stashed == null || state.isNullOrEmpty() || state != stashed.state) {
-            _outcome.value = Outcome.Failed(Failure.STATE_MISMATCH)
-            return
-        }
-
-        // A website/IdP-side failure comes back as ?error=… (never with a code).
-        if (!error.isNullOrEmpty()) {
-            _outcome.value = Outcome.Failed(mapError(error))
-            return
-        }
-
-        if (code.isNullOrBlank()) {
-            _outcome.value = Outcome.Failed(Failure.SERVER)
-            return
-        }
-
-        val response = try {
-            ssoApi.exchange(MobileSsoExchangeRequest(code = code, codeVerifier = stashed.verifier))
-        } catch (e: CancellationException) {
-            throw e
-        } catch (_: IOException) {
-            _outcome.value = Outcome.Failed(Failure.NETWORK)
-            return
-        } catch (_: Exception) {
-            _outcome.value = Outcome.Failed(Failure.SERVER)
-            return
-        }
-
-        if (response.isSuccessful) {
-            val body = response.body()
-            if (body == null) {
-                _outcome.value = Outcome.Failed(Failure.SERVER)
-                return
-            }
-            // The user ticked "trust this device" on the TOTP form inside the Custom
-            // Tab. That tab's cookie already covers future SSO sign-ins; persisting
-            // the token the exchange handed back is what lets a native PASSWORD login
-            // on this device skip the code too (TRUSTED_DEVICES_MFA.md). Scoped to the
-            // username exactly like the password path, so it is never replayed for a
-            // different account on a shared device. Saved BEFORE onSignedIn so a
-            // process death mid-callback can't lose it.
-            body.trustToken?.let { trustTokenStore.save(body.user.username, it) }
-            sessionManager.onSignedIn(body.accessToken, body.refreshToken, body.user)
-            _outcome.value = Outcome.Success
-            return
-        }
-
-        _outcome.value = Outcome.Failed(if (response.code() == 401) Failure.EXPIRED_CODE else Failure.SERVER)
-    }
-
-    // The bridge's start + callback error codes → user-facing failure reasons.
-    // Start (mobileSso.controller): invalid_provider | provider_unavailable | server_error.
-    // Callback (sso.controller): not_linked | disabled | session_expired | error,
-    // plus a forwarded IdP access_denied.
-    private fun mapError(error: String): Failure = when (error) {
-        // Link-only policy refused, or the account is inactive, or the user declined.
-        "not_linked", "disabled", "access_denied" -> Failure.DENIED
-        // The bridge session aged out mid-flow — start over.
-        "session_expired" -> Failure.EXPIRED_CODE
-        // invalid_provider / provider_unavailable / server_error / error / anything else.
-        else -> Failure.SERVER
-    }
-
-    companion object {
-        const val CALLBACK_SCHEME = "runicgateway"
-        const val CALLBACK_HOST = "auth"
-        const val CALLBACK_PATH = "/callback"
-
-        /**
-         * The one fixed, application-owned callback the bridge redirects to. Must
-         * match the `MOBILE_AUTH_REDIRECT_URIS` allowlist entry on the backend and
-         * the intent-filter in `AndroidManifest.xml` exactly (PLAN.md §4.2).
-         */
-        const val REDIRECT_URI = "$CALLBACK_SCHEME://$CALLBACK_HOST$CALLBACK_PATH"
-
-        /**
-         * Path of the verified https App Link callback (`https://<shard-host>/mobile/callback`).
-         * Must match the app's `autoVerify` intent-filter in `AndroidManifest.xml` and the
-         * backend's self-origin allowlist entry (docs/android/APP_LINKS.md §3.2/§4.2).
-         */
-        const val APP_LINK_CALLBACK_PATH = "/mobile/callback"
-    }
-}

app/src/main/java/com/runicgateway/app/core/net/ShardStream.kt

@@ -1,16 +0,0 @@
-/*
- * SPDX-License-Identifier: GPL-3.0-or-later
- */
-package com.runicgateway.app.core.net
-
-import kotlinx.coroutines.flow.Flow
-
-/**
- * The live shard SSE feed as a cold flow of lifecycle + frame events (PLAN.md §6.2,
- * §7). Extracted as an interface so consumers (e.g. [com.runicgateway.app.data.repository.ShardRepository])
- * depend on the capability, not the OkHttp-backed [ShardStreamClient] — the boards
- * can then be unit-tested against a fake stream instead of a real network connection.
- */
-interface ShardStream {
-    fun events(): Flow<ShardStreamEvent>
-}

app/src/main/java/com/runicgateway/app/core/net/ShardStreamClient.kt

@@ -40,7 +40,7 @@ class ShardStreamClient @Inject constructor(
     baseClient: OkHttpClient,
     private val baseUrlHolder: BaseUrlHolder,
     private val json: Json,
-) : ShardStream {
+) {
     // SSE is a long-lived, mostly-idle connection (keepalive comments every ~25s),
     // so the read timeout must be disabled or the idle stream would be killed.
     private val sseClient: OkHttpClient = baseClient.newBuilder()
@@ -56,7 +56,7 @@ class ShardStreamClient @Inject constructor(
      * drive a live/offline indicator; [ShardStreamEvent.Frame] carries a decoded
      * `{ kind, … }` payload the boards merge in place.
      */
-    override fun events(): Flow<ShardStreamEvent> = channelFlow {
+    fun events(): Flow<ShardStreamEvent> = channelFlow {
         var backoffMs = INITIAL_BACKOFF_MS
         while (isActive) {
             val url = baseUrlHolder.current?.resolve(STREAM_PATH)

app/src/main/java/com/runicgateway/app/core/push/NtfyStreamClient.kt

@@ -1,116 +0,0 @@
-/*
- * SPDX-License-Identifier: GPL-3.0-or-later
- */
-package com.runicgateway.app.core.push
-
-import kotlinx.coroutines.CompletableDeferred
-import kotlinx.coroutines.delay
-import kotlinx.coroutines.flow.Flow
-import kotlinx.coroutines.flow.channelFlow
-import kotlinx.coroutines.isActive
-import kotlinx.serialization.json.Json
-import okhttp3.OkHttpClient
-import okhttp3.Request
-import okhttp3.Response
-import okhttp3.sse.EventSource
-import okhttp3.sse.EventSourceListener
-import okhttp3.sse.EventSources
-import java.util.concurrent.TimeUnit
-import java.util.concurrent.atomic.AtomicBoolean
-import javax.inject.Inject
-import javax.inject.Singleton
-
-/**
- * The embedded distributor's transport (PLAN.md §11, M7 Part 2 work item 1/3):
- * a persistent connection to the shard's self-hosted ntfy that subscribes to the
- * app's own topic and re-emits each content-free tickle. It reuses the same
- * OkHttp-SSE + reconnect/backoff shape as [com.runicgateway.app.core.net.ShardStreamClient],
- * but on a **bare** client — no host-retargeting or bearer interceptors — because it
- * talks straight to ntfy (`<ntfy>/<topic>/sse`), not the website API. Held open by
- * [PushService]'s foreground service so tickles arrive in the background without
- * Google Play Services.
- */
-@Singleton
-class NtfyStreamClient @Inject constructor(
-    private val json: Json,
-) {
-    // A dedicated client with the read timeout disabled for the mostly-idle stream
-    // (ntfy sends keepalive frames); no interceptors so nothing rewrites the host or
-    // attaches a bearer to the relay.
-    private val client: OkHttpClient = OkHttpClient.Builder()
-        .readTimeout(0, TimeUnit.MILLISECONDS)
-        .retryOnConnectionFailure(true)
-        .build()
-
-    private val factory = EventSources.createFactory(client)
-
-    /** Connection lifecycle + decoded tickles for a subscribed topic. */
-    sealed interface Event {
-        data object Open : Event
-        data object Closed : Event
-        data class Message(val tickle: PushTickle) : Event
-    }
-
-    /**
-     * A cold flow subscribing to `<ntfyBaseUrl>/<topic>/sse`, reconnecting with
-     * backoff until the collector cancels. A dropped relay simply reconnects; a bad
-     * config (null URL) idles rather than spinning.
-     */
-    fun events(ntfyBaseUrl: String?, topic: String): Flow<Event> = channelFlow {
-        var backoffMs = INITIAL_BACKOFF_MS
-        while (isActive) {
-            val url = NtfyTopic.sseUrl(ntfyBaseUrl, topic)
-            if (url == null) {
-                trySend(Event.Closed)
-                delay(backoffMs)
-                backoffMs = grow(backoffMs)
-                continue
-            }
-
-            val request = Request.Builder()
-                .url(url)
-                .header("Accept", "text/event-stream")
-                .build()
-
-            val opened = AtomicBoolean(false)
-            val ended = CompletableDeferred<Unit>()
-            val listener = object : EventSourceListener() {
-                override fun onOpen(eventSource: EventSource, response: Response) {
-                    opened.set(true)
-                    trySend(Event.Open)
-                }
-
-                override fun onEvent(eventSource: EventSource, id: String?, type: String?, data: String) {
-                    parseNtfyTickle(json, data)?.let { trySend(Event.Message(it)) }
-                }
-
-                override fun onClosed(eventSource: EventSource) {
-                    trySend(Event.Closed)
-                    ended.complete(Unit)
-                }
-
-                override fun onFailure(eventSource: EventSource, t: Throwable?, response: Response?) {
-                    trySend(Event.Closed)
-                    ended.complete(Unit)
-                }
-            }
-
-            val source = factory.newEventSource(request, listener)
-            try {
-                ended.await()
-            } finally {
-                source.cancel()
-            }
-
-            backoffMs = if (opened.get()) INITIAL_BACKOFF_MS else grow(backoffMs)
-            delay(backoffMs)
-        }
-    }
-
-    private fun grow(current: Long): Long = (current * 2).coerceAtMost(MAX_BACKOFF_MS)
-
-    private companion object {
-        const val INITIAL_BACKOFF_MS = 2_000L
-        const val MAX_BACKOFF_MS = 30_000L
-    }
-}

app/src/main/java/com/runicgateway/app/core/push/NtfyTopic.kt

@@ -1,48 +0,0 @@
-/*
- * SPDX-License-Identifier: GPL-3.0-or-later
- */
-package com.runicgateway.app.core.push
-
-import java.security.SecureRandom
-
-/**
- * The app's own ntfy topic — the heart of the embedded-distributor design
- * (PLAN.md §11, M7 Part 2 work item 1). The app mints a **random, unguessable**
- * topic and registers its public URL (`https://<ntfy-host>/<topic>`) as the device
- * endpoint the backend POSTs tickles to; the app subscribes to the same topic's SSE
- * stream to receive them. Security rests on the topic being unguessable plus the
- * content-free tickle — a leaked topic name reveals nothing.
- */
-object NtfyTopic {
-
-    // ntfy topic names allow [A-Za-z0-9_-]; keep to that set. The "up" prefix mirrors
-    // the UnifiedPush convention and makes topics recognizable in logs/relay.
-    private const val ALPHABET = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789"
-    private const val TOPIC_LEN = 24
-    private const val PREFIX = "up"
-
-    private val secureRandom by lazy { SecureRandom() }
-
-    /** Mint a fresh unguessable topic, e.g. "up7Qk3…" (≈143 bits of entropy). */
-    fun generate(random: java.util.Random = secureRandom): String {
-        val sb = StringBuilder(PREFIX.length + TOPIC_LEN)
-        sb.append(PREFIX)
-        repeat(TOPIC_LEN) { sb.append(ALPHABET[random.nextInt(ALPHABET.length)]) }
-        return sb.toString()
-    }
-
-    /**
-     * The endpoint URL the backend publishes to: `<ntfyBaseUrl>/<topic>`. [ntfyBaseUrl]
-     * is the client-facing base from `/public/settings.push.ntfyUrl`; a trailing slash
-     * is tolerated. Returns null for a blank base or topic.
-     */
-    fun endpointUrl(ntfyBaseUrl: String?, topic: String): String? {
-        val base = ntfyBaseUrl?.trim()?.trimEnd('/').orEmpty()
-        if (base.isEmpty() || topic.isBlank()) return null
-        return "$base/$topic"
-    }
-
-    /** The SSE subscribe URL the app connects to: `<ntfyBaseUrl>/<topic>/sse`. */
-    fun sseUrl(ntfyBaseUrl: String?, topic: String): String? =
-        endpointUrl(ntfyBaseUrl, topic)?.let { "$it/sse" }
-}

app/src/main/java/com/runicgateway/app/core/push/PushManager.kt

@@ -1,156 +0,0 @@
-/*
- * SPDX-License-Identifier: GPL-3.0-or-later
- */
-package com.runicgateway.app.core.push
-
-import android.content.Context
-import com.runicgateway.app.core.auth.Session
-import com.runicgateway.app.core.auth.SessionManager
-import com.runicgateway.app.core.result.ApiResult
-import com.runicgateway.app.data.repository.NotificationsRepository
-import dagger.hilt.android.qualifiers.ApplicationContext
-import kotlinx.coroutines.CoroutineScope
-import kotlinx.coroutines.Dispatchers
-import kotlinx.coroutines.SupervisorJob
-import kotlinx.coroutines.flow.Flow
-import kotlinx.coroutines.flow.map
-import kotlinx.coroutines.launch
-import javax.inject.Inject
-import javax.inject.Singleton
-
-/**
- * Orchestrates the app's opt-in push lifecycle (PLAN.md §11, M7 Part 2 work item 5):
- * mint/keep the ntfy topic, register/unregister the device endpoint with the backend,
- * and start/stop the foreground [PushService] — all keyed to the user's opt-in and
- * the session. The endpoint the app registers is its own topic URL on the shard's
- * ntfy (the embedded-distributor design, work item 1).
- *
- * Lifecycle rules:
- *  - register only when **signed in** and the shard advertises a relay (`ntfyUrl`);
- *  - a **sign-out** stops the service and forgets the ephemeral registration but keeps
- *    the opt-in intent, so push re-registers on the next sign-in (mirrors the M3 token
- *    teardown, and covers logout / dead-refresh / server switch uniformly via the
- *    session-state observer);
- *  - a **relay/base-URL change** re-registers on the new host with a fresh topic.
- */
-@Singleton
-class PushManager @Inject constructor(
-    @param:ApplicationContext private val context: Context,
-    private val prefs: PushPreferences,
-    private val notifications: NotificationsRepository,
-    private val sessionManager: SessionManager,
-) {
-    private val scope = CoroutineScope(SupervisorJob() + Dispatchers.IO)
-
-    /** Whether the user has push turned on (drives the Notifications screen). */
-    val enabled: Flow<Boolean> = prefs.enabled
-
-    /** Whether this shard advertises a push relay at all (null ntfyUrl → unsupported). */
-    val supported: Flow<Boolean> = prefs.ntfyUrl.map { !it.isNullOrBlank() }
-
-    init {
-        // Uniform teardown/resume across every auth transition: logout, dead-refresh
-        // sign-out, and server switch all land on SignedOut; a fresh login re-asserts.
-        scope.launch {
-            sessionManager.state.collect { s ->
-                when (s) {
-                    is Session.SignedOut -> localTeardown()
-                    is Session.SignedIn -> maybeResume()
-                }
-            }
-        }
-    }
-
-    /** Record the shard's client-facing ntfy base URL (from `/public/settings`). */
-    suspend fun setNtfyUrl(url: String?) {
-        val previous = prefs.snapshot().ntfyUrl
-        prefs.setNtfyUrl(url)
-        // The relay host arriving (or changing) is what unblocks a pending resume.
-        if (!url.isNullOrBlank() && url != previous) maybeResume()
-    }
-
-    /**
-     * Turn push on (idempotent): ensure a topic on the current relay, register its
-     * endpoint with the backend, persist, and start the foreground service. Called
-     * when the user opts into ≥1 stream.
-     */
-    suspend fun enable(): PushResult = register(setIntent = true)
-
-    /** Turn push off (user opted out of every stream): clear intent + deregister. */
-    suspend fun disable() {
-        prefs.setEnabled(false)
-        deregisterDevice()
-    }
-
-    /**
-     * Deregister this device on an explicit sign-out / server switch, while the bearer
-     * is still valid, so no orphan device row is left behind. Keeps the opt-in intent
-     * (and ntfyUrl) so push re-registers on the next sign-in. Call this *before* the
-     * session is torn down.
-     */
-    suspend fun deregisterDevice() {
-        val snap = prefs.snapshot()
-        snap.deviceId?.let { notifications.deleteDevice(it) } // best-effort
-        stopService()
-        prefs.clearRegistration()
-    }
-
-    /** Re-assert registration if the user is opted in and the shard supports push. */
-    private suspend fun maybeResume() {
-        val snap = prefs.snapshot()
-        if (snap.enabled && sessionManager.isSignedIn && !snap.ntfyUrl.isNullOrBlank()) {
-            register(setIntent = false)
-        }
-    }
-
-    private suspend fun register(setIntent: Boolean): PushResult {
-        if (!sessionManager.isSignedIn) return PushResult.NotSignedIn
-        val snap = prefs.snapshot()
-        val ntfyUrl = snap.ntfyUrl
-        if (ntfyUrl.isNullOrBlank()) return PushResult.Unsupported
-
-        // Reuse an existing topic only if its endpoint still sits on the current relay
-        // origin; otherwise (first run, or a server switch) mint a fresh unguessable one.
-        val base = ntfyUrl.trimEnd('/')
-        val topic = snap.topic?.takeIf { snap.endpoint?.startsWith("$base/") == true }
-            ?: NtfyTopic.generate()
-        val endpoint = NtfyTopic.endpointUrl(ntfyUrl, topic) ?: return PushResult.Unsupported
-
-        return when (val res = notifications.registerDevice(endpoint, PLATFORM)) {
-            is ApiResult.Ok -> {
-                prefs.setRegistration(topic, endpoint, res.data.id)
-                if (setIntent) prefs.setEnabled(true)
-                startService()
-                PushResult.Enabled
-            }
-            // 400 = endpoint origin isn't on the shard's ntfy allow-set (misconfigured relay).
-            is ApiResult.HttpError -> PushResult.Failed(res.status)
-            is ApiResult.NetworkError -> PushResult.Failed(null)
-        }
-    }
-
-    /** Local-only teardown on sign-out — no backend DELETE (the bearer may be dead). */
-    private suspend fun localTeardown() {
-        stopService()
-        prefs.clearRegistration()
-    }
-
-    private fun startService() = runCatching { PushService.start(context) }
-    private fun stopService() = runCatching { PushService.stop(context) }
-
-    /** The outcome of enabling push, surfaced to the Notifications screen. */
-    sealed interface PushResult {
-        data object Enabled : PushResult
-
-        /** This shard advertises no push relay (`/public/settings.push.ntfyUrl` is null). */
-        data object Unsupported : PushResult
-        data object NotSignedIn : PushResult
-
-        /** Registration failed — [status] 400 = relay off the allow-set; null = network. */
-        data class Failed(val status: Int?) : PushResult
-    }
-
-    private companion object {
-        const val PLATFORM = "android"
-    }
-}

app/src/main/java/com/runicgateway/app/core/push/PushNotifier.kt

@@ -1,110 +0,0 @@
-/*
- * SPDX-License-Identifier: GPL-3.0-or-later
- */
-package com.runicgateway.app.core.push
-
-import android.app.Notification
-import android.app.NotificationChannel
-import android.app.NotificationManager
-import android.app.PendingIntent
-import android.content.Context
-import android.content.Intent
-import androidx.core.app.NotificationCompat
-import androidx.core.app.NotificationManagerCompat
-import com.runicgateway.app.MainActivity
-import com.runicgateway.app.R
-import dagger.hilt.android.qualifiers.ApplicationContext
-import java.util.concurrent.atomic.AtomicInteger
-import javax.inject.Inject
-import javax.inject.Singleton
-
-/**
- * Builds the notification channels and posts a notification for a received tickle
- * (PLAN.md §11, M7 Part 2 work items 2/3/7). v1 shows a **generic per-stream**
- * notification titled from the fixed [PushStreams] catalog — the content-free tickle
- * carries nothing to render, so nothing is fetched to display the notification; tapping
- * deep-links into [MainActivity] (which fetches fresh over the authenticated API).
- */
-@Singleton
-class PushNotifier @Inject constructor(
-    @param:ApplicationContext private val context: Context,
-) {
-    private val manager = NotificationManagerCompat.from(context)
-    private val nextId = AtomicInteger(1)
-
-    /** Create both channels; safe to call repeatedly (creation is idempotent). */
-    fun ensureChannels() {
-        val system = context.getSystemService(NotificationManager::class.java) ?: return
-        system.createNotificationChannel(
-            NotificationChannel(
-                CHANNEL_MESSAGES,
-                context.getString(R.string.push_channel_messages),
-                NotificationManager.IMPORTANCE_DEFAULT,
-            ).apply { description = context.getString(R.string.push_channel_messages_desc) },
-        )
-        system.createNotificationChannel(
-            NotificationChannel(
-                CHANNEL_SERVICE,
-                context.getString(R.string.push_channel_service),
-                NotificationManager.IMPORTANCE_LOW,
-            ).apply {
-                description = context.getString(R.string.push_channel_service_desc)
-                setShowBadge(false)
-            },
-        )
-    }
-
-    /** The persistent low-importance notification the foreground service runs under. */
-    fun serviceNotification(): Notification =
-        NotificationCompat.Builder(context, CHANNEL_SERVICE)
-            .setContentTitle(context.getString(R.string.push_service_title))
-            .setContentText(context.getString(R.string.push_service_text))
-            .setSmallIcon(R.drawable.ic_stat_name)
-            .setOngoing(true)
-            .setPriority(NotificationCompat.PRIORITY_LOW)
-            .setContentIntent(deepLinkIntent(stream = null, ref = null))
-            .build()
-
-    /** Post a notification for a tickle, deep-linking to the stream's screen on tap. */
-    fun notify(tickle: PushTickle) {
-        if (!manager.areNotificationsEnabled()) return // POST_NOTIFICATIONS not granted
-        val title = context.getString(PushStreams.titleRes(tickle.stream))
-        val notification = NotificationCompat.Builder(context, CHANNEL_MESSAGES)
-            .setContentTitle(title)
-            .setSmallIcon(R.drawable.ic_stat_name)
-            .setAutoCancel(true)
-            .setPriority(NotificationCompat.PRIORITY_DEFAULT)
-            .setContentIntent(deepLinkIntent(tickle.stream, tickle.ref))
-            .build()
-        try {
-            manager.notify(nextId.getAndIncrement(), notification)
-        } catch (_: SecurityException) {
-            // Racing a permission revoke — drop silently rather than crash.
-        }
-    }
-
-    private fun deepLinkIntent(stream: String?, ref: String?): PendingIntent {
-        val intent = Intent(context, MainActivity::class.java).apply {
-            flags = Intent.FLAG_ACTIVITY_SINGLE_TOP or Intent.FLAG_ACTIVITY_CLEAR_TOP
-            if (stream != null) putExtra(EXTRA_STREAM, stream)
-            if (ref != null) putExtra(EXTRA_REF, ref)
-        }
-        // A distinct request code per stream so PendingIntents don't collapse into one.
-        val requestCode = stream?.hashCode() ?: 0
-        return PendingIntent.getActivity(
-            context,
-            requestCode,
-            intent,
-            PendingIntent.FLAG_IMMUTABLE or PendingIntent.FLAG_UPDATE_CURRENT,
-        )
-    }
-
-    companion object {
-        const val CHANNEL_MESSAGES = "push_messages"
-        const val CHANNEL_SERVICE = "push_service"
-
-        /** Intent extras a tapped notification carries into [MainActivity] (§7 deep-links). */
-        const val EXTRA_STREAM = "com.runicgateway.app.push.STREAM"
-        const val EXTRA_REF = "com.runicgateway.app.push.REF"
-    }
-}

app/src/main/java/com/runicgateway/app/core/push/PushPreferences.kt

@@ -1,91 +0,0 @@
-/*
- * SPDX-License-Identifier: GPL-3.0-or-later
- */
-package com.runicgateway.app.core.push
-
-import android.content.Context
-import androidx.datastore.core.DataStore
-import androidx.datastore.preferences.core.Preferences
-import androidx.datastore.preferences.core.booleanPreferencesKey
-import androidx.datastore.preferences.core.edit
-import androidx.datastore.preferences.core.longPreferencesKey
-import androidx.datastore.preferences.core.stringPreferencesKey
-import androidx.datastore.preferences.preferencesDataStore
-import dagger.hilt.android.qualifiers.ApplicationContext
-import kotlinx.coroutines.flow.Flow
-import kotlinx.coroutines.flow.first
-import kotlinx.coroutines.flow.map
-import javax.inject.Inject
-import javax.inject.Singleton
-
-private val Context.pushDataStore: DataStore<Preferences> by preferencesDataStore(name = "push")
-
-/**
- * Persists the app's push state (PLAN.md §11, M7 Part 2 work item 5). None of it is
- * secret — the ntfy topic/endpoint's protection is being unguessable plus the
- * content-free tickle — so plain DataStore is fine (tokens stay in the encrypted
- * store). Holds the shard's ntfy base URL (from `/public/settings`), the minted
- * topic + its endpoint URL, the backend-assigned device id (to unregister), and the
- * user's opt-in flag (the source of truth for "push should be running").
- */
-@Singleton
-class PushPreferences @Inject constructor(
-    @param:ApplicationContext private val context: Context,
-) {
-    private val store = context.pushDataStore
-
-    val enabled: Flow<Boolean> = store.data.map { it[KEY_ENABLED] ?: false }
-    val ntfyUrl: Flow<String?> = store.data.map { it[KEY_NTFY_URL] }
-
-    suspend fun snapshot(): Snapshot {
-        val p = store.data.first()
-        return Snapshot(
-            enabled = p[KEY_ENABLED] ?: false,
-            ntfyUrl = p[KEY_NTFY_URL],
-            topic = p[KEY_TOPIC],
-            endpoint = p[KEY_ENDPOINT],
-            deviceId = p[KEY_DEVICE_ID],
-        )
-    }
-
-    suspend fun setNtfyUrl(url: String?) = store.edit {
-        if (url.isNullOrBlank()) it.remove(KEY_NTFY_URL) else it[KEY_NTFY_URL] = url
-    }
-
-    suspend fun setEnabled(value: Boolean) = store.edit { it[KEY_ENABLED] = value }
-
-    /** Record the minted topic + its endpoint URL and the assigned device id together. */
-    suspend fun setRegistration(topic: String, endpoint: String, deviceId: Long) = store.edit {
-        it[KEY_TOPIC] = topic
-        it[KEY_ENDPOINT] = endpoint
-        it[KEY_DEVICE_ID] = deviceId
-    }
-
-    /**
-     * Forget the ephemeral device registration (topic/endpoint/device id) — used on
-     * sign-out and on an explicit disable. Deliberately leaves [KEY_ENABLED] and
-     * [KEY_NTFY_URL] intact so the user's opt-in intent survives a sign-out and push
-     * re-registers on the next sign-in; an explicit disable also calls [setEnabled]`(false)`.
-     */
-    suspend fun clearRegistration() = store.edit {
-        it.remove(KEY_TOPIC)
-        it.remove(KEY_ENDPOINT)
-        it.remove(KEY_DEVICE_ID)
-    }
-
-    data class Snapshot(
-        val enabled: Boolean,
-        val ntfyUrl: String?,
-        val topic: String?,
-        val endpoint: String?,
-        val deviceId: Long?,
-    )
-
-    private companion object {
-        val KEY_ENABLED = booleanPreferencesKey("enabled")
-        val KEY_NTFY_URL = stringPreferencesKey("ntfy_url")
-        val KEY_TOPIC = stringPreferencesKey("topic")
-        val KEY_ENDPOINT = stringPreferencesKey("endpoint")
-        val KEY_DEVICE_ID = longPreferencesKey("device_id")
-    }
-}

app/src/main/java/com/runicgateway/app/core/push/PushService.kt

@@ -1,95 +0,0 @@
-/*
- * SPDX-License-Identifier: GPL-3.0-or-later
- */
-package com.runicgateway.app.core.push
-
-import android.app.Service
-import android.content.Context
-import android.content.Intent
-import android.content.pm.ServiceInfo
-import android.os.Build
-import android.os.IBinder
-import androidx.core.app.ServiceCompat
-import dagger.hilt.android.AndroidEntryPoint
-import kotlinx.coroutines.CoroutineScope
-import kotlinx.coroutines.Dispatchers
-import kotlinx.coroutines.Job
-import kotlinx.coroutines.SupervisorJob
-import kotlinx.coroutines.cancel
-import kotlinx.coroutines.flow.collectLatest
-import kotlinx.coroutines.launch
-import javax.inject.Inject
-
-/**
- * The always-connected foreground service that IS the embedded distributor
- * (PLAN.md §11, M7 Part 2 work item 1/3). It holds [NtfyStreamClient]'s persistent
- * connection to the shard's ntfy open in the background — the price of Google-free,
- * self-contained instant delivery — and posts a notification for each tickle. It runs
- * under a low-importance ongoing notification and restarts sticky; [PushManager] starts
- * and stops it as the user opts in/out or signs out.
- */
-@AndroidEntryPoint
-class PushService : Service() {
-
-    @Inject lateinit var streamClient: NtfyStreamClient
-    @Inject lateinit var notifier: PushNotifier
-    @Inject lateinit var prefs: PushPreferences
-
-    private val scope = CoroutineScope(SupervisorJob() + Dispatchers.IO)
-    private var connectionJob: Job? = null
-
-    override fun onCreate() {
-        super.onCreate()
-        notifier.ensureChannels()
-    }
-
-    override fun onStartCommand(intent: Intent?, flags: Int, startId: Int): Int {
-        startAsForeground()
-        if (connectionJob == null) connectionJob = scope.launch { run() }
-        return START_STICKY
-    }
-
-    private fun startAsForeground() {
-        val type = if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.UPSIDE_DOWN_CAKE) {
-            ServiceInfo.FOREGROUND_SERVICE_TYPE_DATA_SYNC
-        } else {
-            0
-        }
-        ServiceCompat.startForeground(this, NOTIFICATION_ID, notifier.serviceNotification(), type)
-    }
-
-    private suspend fun run() {
-        val snapshot = prefs.snapshot()
-        val topic = snapshot.topic
-        if (topic.isNullOrBlank() || snapshot.ntfyUrl.isNullOrBlank()) {
-            // Nothing to subscribe to (should not happen — PushManager starts us only
-            // once a topic exists) — stop rather than hold a dead connection open.
-            stopSelf()
-            return
-        }
-        streamClient.events(snapshot.ntfyUrl, topic).collectLatest { event ->
-            if (event is NtfyStreamClient.Event.Message) notifier.notify(event.tickle)
-        }
-    }
-
-    override fun onDestroy() {
-        connectionJob?.cancel()
-        scope.cancel()
-        super.onDestroy()
-    }
-
-    override fun onBind(intent: Intent?): IBinder? = null
-
-    companion object {
-        private const val NOTIFICATION_ID = 42
-
-        fun start(context: Context) {
-            val intent = Intent(context, PushService::class.java)
-            context.startForegroundService(intent)
-        }
-
-        fun stop(context: Context) {
-            context.stopService(Intent(context, PushService::class.java))
-        }
-    }
-}

app/src/main/java/com/runicgateway/app/core/push/PushStreams.kt

@@ -1,39 +0,0 @@
-/*
- * SPDX-License-Identifier: GPL-3.0-or-later
- */
-package com.runicgateway.app.core.push
-
-import androidx.annotation.StringRes
-import com.runicgateway.app.R
-
-/**
- * The known push stream ids (mirrors the backend catalog in
- * `config/notificationStreams.js`) and their localized notification titles.
- * The subscribable catalog itself is fetched from
- * `GET /auth/me/notifications/streams`; this fixed set is only what the receiver
- * needs to title a content-free tickle without a network round-trip (§11).
- */
-object PushStreams {
-    const val NEWS_POST = "news.post"
-    const val SERVER_STATUS = "server.status"
-    const val IDOC_WARNING = "idoc.warning"
-    const val CHAMP_START = "champ.start"
-    const val GOVERNOR_ELECTION = "governor.election"
-    const val VENDOR_SALE = "vendor.sale"
-    const val HOUSE_IDOC = "house.idoc"
-    const val ACCOUNT_LOGIN = "account.login"
-
-    /** A short, localized notification title for [streamId]; a generic fallback otherwise. */
-    @StringRes
-    fun titleRes(streamId: String): Int = when (streamId) {
-        NEWS_POST -> R.string.push_stream_news_post
-        SERVER_STATUS -> R.string.push_stream_server_status
-        IDOC_WARNING -> R.string.push_stream_idoc_warning
-        CHAMP_START -> R.string.push_stream_champ_start
-        GOVERNOR_ELECTION -> R.string.push_stream_governor_election
-        VENDOR_SALE -> R.string.push_stream_vendor_sale
-        HOUSE_IDOC -> R.string.push_stream_house_idoc
-        ACCOUNT_LOGIN -> R.string.push_stream_account_login
-        else -> R.string.push_stream_generic
-    }
-}

app/src/main/java/com/runicgateway/app/core/push/PushTickle.kt

@@ -1,54 +0,0 @@
-/*
- * SPDX-License-Identifier: GPL-3.0-or-later
- */
-package com.runicgateway.app.core.push
-
-import kotlinx.serialization.Serializable
-import kotlinx.serialization.json.Json
-import kotlinx.serialization.json.JsonNull
-import kotlinx.serialization.json.JsonObject
-import kotlinx.serialization.json.jsonPrimitive
-
-/**
- * The content-free push tickle the backend publishes (PLAN.md §11): `{ stream, ref }`
- * and nothing sensitive. [ref] is an opaque hint (a serial / city / timestamp) the
- * app *could* use to pull real content over the authenticated API; v1 just deep-links
- * to the stream's screen, so it is carried but not otherwise interpreted.
- */
-@Serializable
-data class PushTickle(
-    val stream: String,
-    val ref: String? = null,
-)
-
-/**
- * Parse a tickle out of an ntfy SSE `data:` frame. ntfy wraps our published body in
- * its own envelope — `{ event, topic, message, … }` — where `message` is the exact
- * string we POSTed (our `{ stream, ref }` JSON). Only `event == "message"` frames
- * carry a payload; `open` / `keepalive` frames return null, as does any malformed or
- * unrecognized body (dropped, never thrown — §7). Pure + `internal` for unit testing.
- */
-internal fun parseNtfyTickle(json: Json, data: String): PushTickle? {
-    val trimmed = data.trim()
-    if (trimmed.isEmpty() || trimmed.startsWith(":")) return null
-    return try {
-        val envelope = json.parseToJsonElement(trimmed) as? JsonObject ?: return null
-        val event = envelope["event"]?.jsonPrimitive?.content
-        // ntfy lifecycle frames ("open", "keepalive", "poll_request") carry no message.
-        if (event != null && event != "message") return null
-        val messageEl = envelope["message"] ?: return null
-        if (messageEl is JsonNull) return null
-        val message = messageEl.jsonPrimitive.content
-        decodeTickle(json, message)
-    } catch (_: Exception) {
-        null
-    }
-}
-
-/** Decode our own `{ stream, ref }` body; a blank/missing stream is not a tickle. */
-internal fun decodeTickle(json: Json, body: String): PushTickle? = try {
-    val tickle = json.decodeFromString(PushTickle.serializer(), body.trim())
-    tickle.takeIf { it.stream.isNotBlank() }
-} catch (_: Exception) {
-    null
-}

app/src/main/java/com/runicgateway/app/core/result/ApiResult.kt

@@ -4,7 +4,6 @@
 package com.runicgateway.app.core.result
 
 import kotlinx.coroutines.CancellationException
-import kotlinx.serialization.SerializationException
 import retrofit2.HttpException
 import java.io.IOException
 
@@ -38,16 +37,6 @@ inline fun <T, R> ApiResult<T>.map(transform: (T) -> R): ApiResult<R> = when (th
  * Run a suspending Retrofit call and normalize every outcome into an [ApiResult].
  * Coroutine cancellation is rethrown so structured concurrency still works — it
  * is control flow, not a network failure.
- *
- * A body the app can't decode (a field whose type/shape doesn't match its DTO, e.g.
- * a live-shaped `guild.update` snapshot carrying an unexpected value) throws a
- * [SerializationException] out of the Retrofit converter. That is a broken contract
- * with the backend, not a bug to crash on: the request completed but the response is
- * unusable — an invalid upstream response — so it is surfaced as a server-side error
- * (`502` → [ErrorKind.SERVER]) the screen renders as "something went wrong, retry",
- * exactly the graceful-degradation the layer promises (never throw for an expected
- * failure). Without this catch the exception escapes the collecting coroutine and
- * takes down the whole app.
  */
 suspend fun <T> safeApiCall(block: suspend () -> T): ApiResult<T> = try {
     ApiResult.Ok(block())
@@ -57,9 +46,4 @@ suspend fun <T> safeApiCall(block: suspend () -> T): ApiResult<T> = try {
     ApiResult.HttpError(e.code(), e.message())
 } catch (e: IOException) {
     ApiResult.NetworkError(e)
-} catch (e: SerializationException) {
-    ApiResult.HttpError(MALFORMED_RESPONSE_STATUS, e.message)
 }
-
-/** Synthetic status for a 2xx body the app couldn't decode — an invalid upstream response. */
-private const val MALFORMED_RESPONSE_STATUS = 502

app/src/main/java/com/runicgateway/app/core/web/WebsiteUrls.kt

@@ -26,8 +26,12 @@ class WebsiteUrls @Inject constructor(
     /** Forgot / reset password (the flow built on the backend before app work, §8). */
     fun forgotPassword(): String? = resolve(FORGOT)
 
+    /** The website login page — carries the SSO provider buttons (§4.2). */
+    fun login(): String? = resolve(LOGIN)
+
     private companion object {
         const val REGISTER = "account/register"
         const val FORGOT = "account/forgot"
+        const val LOGIN = "account/login"
     }
 }

app/src/main/java/com/runicgateway/app/data/api/AdminApi.kt

@@ -1,97 +0,0 @@
-/*
- * SPDX-License-Identifier: GPL-3.0-or-later
- */
-package com.runicgateway.app.data.api
-
-import com.runicgateway.app.data.api.dto.AdminDashboardDto
-import com.runicgateway.app.data.api.dto.AdminPostDto
-import com.runicgateway.app.data.api.dto.BanRequest
-import com.runicgateway.app.data.api.dto.BroadcastRequest
-import com.runicgateway.app.data.api.dto.KickRequest
-import com.runicgateway.app.data.api.dto.PageRespondRequest
-import com.runicgateway.app.data.api.dto.PostCreateRequest
-import com.runicgateway.app.data.api.dto.PublishRequest
-import com.runicgateway.app.data.api.dto.SiteModeRequest
-import com.runicgateway.app.data.api.dto.SiteModeStateDto
-import com.runicgateway.app.data.api.dto.SupportPageDto
-import com.runicgateway.app.data.api.dto.UnbanRequest
-import com.runicgateway.app.data.api.dto.AdminWikiCategoryDto
-import com.runicgateway.app.data.api.dto.WikiCategoryRequest
-import com.runicgateway.app.data.api.dto.AdminWikiTagDto
-import retrofit2.Response
-import retrofit2.http.Body
-import retrofit2.http.DELETE
-import retrofit2.http.GET
-import retrofit2.http.PATCH
-import retrofit2.http.PUT
-import retrofit2.http.POST
-import retrofit2.http.Path
-
-/**
- * The M10 staff-operations surface over `/api/v1/admin/…` (PLAN.md §1, §6.4). On
- * the authed client — every call carries the bearer, and the backend re-checks the
- * caller's role on every request (`staffOnly` / `modAccess` / `adminOnly`), so a
- * demoted user is refused server-side even if a stale menu still showed the entry.
- *
- * Grows one group at a time (dashboard first); moderation, support, and content
- * endpoints are added with their screens.
- */
-interface AdminApi {
-
-    /** `GET /admin/dashboard` — summary counts + site mode (any staff role). */
-    @GET("api/v1/admin/dashboard")
-    suspend fun dashboard(): AdminDashboardDto
-
-    /** `PUT /admin/site-mode` — switch live/maintenance (admin only; 403 otherwise). */
-    @PUT("api/v1/admin/site-mode")
-    suspend fun setSiteMode(@Body body: SiteModeRequest): SiteModeStateDto
-
-    // ── Content: news posts (any staff role) ──────────────────────────────
-    @GET("api/v1/admin/posts")
-    suspend fun posts(): List<AdminPostDto>
-
-    @POST("api/v1/admin/posts")
-    suspend fun createPost(@Body body: PostCreateRequest): AdminPostDto
-
-    @PATCH("api/v1/admin/posts/{id}/publish")
-    suspend fun publishPost(@Path("id") id: Long, @Body body: PublishRequest): AdminPostDto
-
-    @DELETE("api/v1/admin/posts/{id}")
-    suspend fun deletePost(@Path("id") id: Long): Response<Unit>
-
-    // ── Content: wiki taxonomy (any staff role) ───────────────────────────
-    @GET("api/v1/admin/wiki/categories")
-    suspend fun wikiCategories(): List<AdminWikiCategoryDto>
-
-    @POST("api/v1/admin/wiki/categories")
-    suspend fun createWikiCategory(@Body body: WikiCategoryRequest): AdminWikiCategoryDto
-
-    @DELETE("api/v1/admin/wiki/categories/{id}")
-    suspend fun deleteWikiCategory(@Path("id") id: Long): Response<Unit>
-
-    @GET("api/v1/admin/wiki/tags")
-    suspend fun wikiTags(): List<AdminWikiTagDto>
-
-    // ── Moderation: shard write plane (admin/moderator) ───────────────────
-    @POST("api/v1/admin/shard/kick")
-    suspend fun kick(@Body body: KickRequest): Response<Unit>
-
-    @POST("api/v1/admin/shard/ban")
-    suspend fun ban(@Body body: BanRequest): Response<Unit>
-
-    @POST("api/v1/admin/shard/unban")
-    suspend fun unban(@Body body: UnbanRequest): Response<Unit>
-
-    @POST("api/v1/admin/shard/broadcast")
-    suspend fun broadcast(@Body body: BroadcastRequest): Response<Unit>
-
-    // ── Support queue: help pages (admin/moderator) ───────────────────────
-    @GET("api/v1/admin/shard/pages")
-    suspend fun supportPages(): List<SupportPageDto>
-
-    @POST("api/v1/admin/shard/pages/{id}/respond")
-    suspend fun respondPage(@Path("id") id: String, @Body body: PageRespondRequest): Response<Unit>
-
-    @POST("api/v1/admin/shard/pages/{id}/close")
-    suspend fun closePage(@Path("id") id: String): Response<Unit>
-}

app/src/main/java/com/runicgateway/app/data/api/AuthApi.kt

@@ -10,7 +10,6 @@ import com.runicgateway.app.data.api.dto.MobileTokenResponse
 import retrofit2.Response
 import retrofit2.http.Body
 import retrofit2.http.GET
-import retrofit2.http.Header
 import retrofit2.http.Headers
 import retrofit2.http.POST
 
@@ -28,15 +27,9 @@ import retrofit2.http.POST
 interface AuthApi {
 
     // Literal header value required by Retrofit @Headers; matches Http.NO_SESSION_HEADER.
-    // [trustToken] rides the `X-Trust-Token` header (TRUSTED_DEVICES_MFA.md): a valid
-    // token bound to this user lets the server skip the TOTP step. Retrofit omits the
-    // header entirely when it is null, so an untrusted device sends nothing.
     @Headers("X-Runic-No-Session: 1")
     @POST("api/v1/auth/mobile/login")
-    suspend fun login(
+    suspend fun login(@Body body: MobileLoginRequest): Response<MobileTokenResponse>
-        @Body body: MobileLoginRequest,
-        @Header("X-Trust-Token") trustToken: String? = null,
-    ): Response<MobileTokenResponse>
 
     @POST("api/v1/auth/mobile/logout")
     suspend fun logout(@Body body: MobileLogoutRequest): Response<Unit>

app/src/main/java/com/runicgateway/app/data/api/MeApi.kt

@@ -7,21 +7,11 @@ import com.runicgateway.app.data.api.dto.ChangePasswordRequest
 import com.runicgateway.app.data.api.dto.ChangeUsernameRequest
 import com.runicgateway.app.data.api.dto.LinkedIdentityDto
 import com.runicgateway.app.data.api.dto.PlayerAccountDto
-import com.runicgateway.app.data.api.dto.RecoveryCodesDto
-import com.runicgateway.app.data.api.dto.RecoveryGenerateRequest
-import com.runicgateway.app.data.api.dto.RecoveryStatusDto
-import com.runicgateway.app.data.api.dto.RevokedCountDto
-import com.runicgateway.app.data.api.dto.RevokedFlagDto
 import com.runicgateway.app.data.api.dto.TotpCodeRequest
 import com.runicgateway.app.data.api.dto.TotpSetupDto
 import com.runicgateway.app.data.api.dto.TotpStateDto
-import com.runicgateway.app.data.api.dto.TrustDeviceRequest
-import com.runicgateway.app.data.api.dto.TrustDeviceResultDto
-import com.runicgateway.app.data.api.dto.TrustedDeviceDto
 import com.runicgateway.app.data.api.dto.UsernameResponse
-import retrofit2.Response
 import retrofit2.http.Body
-import retrofit2.http.DELETE
 import retrofit2.http.GET
 import retrofit2.http.HTTP
 import retrofit2.http.PATCH
@@ -62,28 +52,4 @@ interface MeApi {
     // path template explicit alongside the provider argument.
     @HTTP(method = "DELETE", path = "api/v1/auth/me/account/identities/{provider}")
     suspend fun unlinkIdentity(@Path("provider") provider: String): Unit
-
-    // ── Trusted devices (TRUSTED_DEVICES_MFA.md) — devices allowed to skip TOTP ──
-
-    @GET("api/v1/auth/me/trusted-devices")
-    suspend fun trustedDevices(): List<TrustedDeviceDto>
-
-    // Raw [Response] so the caller can read the `409 { error, devices }` cap body,
-    // which a thrown HttpException would discard.
-    @POST("api/v1/auth/me/trusted-devices")
-    suspend fun trustThisDevice(@Body body: TrustDeviceRequest): Response<TrustDeviceResultDto>
-
-    @DELETE("api/v1/auth/me/trusted-devices/{id}")
-    suspend fun revokeTrustedDevice(@Path("id") id: Long): RevokedFlagDto
-
-    @DELETE("api/v1/auth/me/trusted-devices")
-    suspend fun revokeAllTrustedDevices(): RevokedCountDto
-
-    // ── Recovery (backup) codes ──────────────────────────────────────────────
-
-    @GET("api/v1/auth/me/account/recovery-codes/status")
-    suspend fun recoveryCodesStatus(): RecoveryStatusDto
-
-    @POST("api/v1/auth/me/account/recovery-codes/generate")
-    suspend fun generateRecoveryCodes(@Body body: RecoveryGenerateRequest): RecoveryCodesDto
 }

app/src/main/java/com/runicgateway/app/data/api/NotificationsApi.kt

@@ -1,43 +0,0 @@
-/*
- * SPDX-License-Identifier: GPL-3.0-or-later
- */
-package com.runicgateway.app.data.api
-
-import com.runicgateway.app.data.api.dto.NotificationStreamsDto
-import com.runicgateway.app.data.api.dto.NotificationSubscriptionsDto
-import com.runicgateway.app.data.api.dto.PushDeviceDto
-import com.runicgateway.app.data.api.dto.RegisterDeviceRequest
-import retrofit2.http.Body
-import retrofit2.http.DELETE
-import retrofit2.http.GET
-import retrofit2.http.POST
-import retrofit2.http.PUT
-import retrofit2.http.Path
-
-/**
- * The opt-in push surface under `/auth/me` (PLAN.md §11, M7 Part 2): device
- * (endpoint) registration and per-user stream subscriptions. Every call rides the
- * main client, so [com.runicgateway.app.core.net.AuthInterceptor] attaches the
- * bearer and [com.runicgateway.app.core.net.TokenAuthenticator] refreshes on 401 —
- * registration only ever succeeds while signed in.
- */
-interface NotificationsApi {
-
-    @POST("api/v1/auth/me/devices")
-    suspend fun registerDevice(@Body body: RegisterDeviceRequest): PushDeviceDto
-
-    @GET("api/v1/auth/me/devices")
-    suspend fun listDevices(): List<PushDeviceDto>
-
-    @DELETE("api/v1/auth/me/devices/{id}")
-    suspend fun deleteDevice(@Path("id") id: Long): Unit
-
-    @GET("api/v1/auth/me/notifications/streams")
-    suspend fun streams(): NotificationStreamsDto
-
-    @GET("api/v1/auth/me/notifications/subscriptions")
-    suspend fun subscriptions(): NotificationSubscriptionsDto
-
-    @PUT("api/v1/auth/me/notifications/subscriptions")
-    suspend fun putSubscriptions(@Body body: NotificationSubscriptionsDto): NotificationSubscriptionsDto
-}

app/src/main/java/com/runicgateway/app/data/api/PublicApi.kt

@@ -3,9 +3,6 @@
  */
 package com.runicgateway.app.data.api
 
-import com.runicgateway.app.data.api.dto.AtlasCreatureDto
-import com.runicgateway.app.data.api.dto.AtlasCreaturePageDto
-import com.runicgateway.app.data.api.dto.AtlasMetaDto
 import com.runicgateway.app.data.api.dto.ChampDto
 import com.runicgateway.app.data.api.dto.ContactRequest
 import com.runicgateway.app.data.api.dto.ContactResponse
@@ -15,17 +12,11 @@ import com.runicgateway.app.data.api.dto.GovernorDto
 import com.runicgateway.app.data.api.dto.GovernorTermDto
 import com.runicgateway.app.data.api.dto.GuildDto
 import com.runicgateway.app.data.api.dto.HouseDto
-import com.runicgateway.app.data.api.dto.MarketMetaDto
-import com.runicgateway.app.data.api.dto.MarketPageDto
-import com.runicgateway.app.data.api.dto.MarketVendorDto
 import com.runicgateway.app.data.api.dto.OnlineStaffDto
 import com.runicgateway.app.data.api.dto.PageDto
-import com.runicgateway.app.data.api.dto.PointsBoardDto
 import com.runicgateway.app.data.api.dto.PostDto
 import com.runicgateway.app.data.api.dto.PresenceDto
-import com.runicgateway.app.data.api.dto.RulesetDto
 import com.runicgateway.app.data.api.dto.SettingsDto
-import com.runicgateway.app.data.api.dto.ShardFeaturesDto
 import com.runicgateway.app.data.api.dto.ShardStatusDto
 import com.runicgateway.app.data.api.dto.StatusDto
 import com.runicgateway.app.data.api.dto.WikiCategoryDto
@@ -102,14 +93,6 @@ interface PublicApi {
     suspend fun postContact(@Body body: ContactRequest): ContactResponse
 
     // ── Public shard widgets (§6.2) ──────────────────────────────────────
-    /**
-     * Which shard features this caller may reach, so the menu hides entries instead
-     * of rendering links that 404/403 (§5, M11). Answered per-viewer: an anonymous
-     * call and a signed-in one can differ.
-     */
-    @GET("api/v1/public/shard/features")
-    suspend fun getShardFeatures(): ShardFeaturesDto
-
     @GET("api/v1/public/shard/status")
     suspend fun getShardStatus(): ShardStatusDto
 
@@ -145,65 +128,4 @@ interface PublicApi {
 
     @GET("api/v1/public/shard/houses")
     suspend fun getShardHouses(): List<HouseDto>
-
-    // ── Protocol 3.0 shard content (§9 M11) ──────────────────────────────
-    //
-    // Each of these sits behind the website's `requireFeature` gate: a 404 means the
-    // shard doesn't publish it and a 403 means this viewer is below its audience rung,
-    // which `toShardUiState()` folds into one "not available here" state.
-
-    /** The shard's configured ruleset. A `null` body means "not published yet". */
-    @GET("api/v1/public/shard/ruleset")
-    suspend fun getShardRuleset(): RulesetDto?
-
-    /** Every points/loyalty leaderboard the shard publishes. */
-    @GET("api/v1/public/shard/points")
-    suspend fun getShardPoints(): List<PointsBoardDto>
-
-    @GET("api/v1/public/shard/points/{system}")
-    suspend fun getShardPointsBoard(@Path("system") system: String): PointsBoardDto
-
-    /**
-     * Search the player-vendor index. **Rate-limited** — the first genuinely expensive
-     * public endpoint on the site, so handle `429` (`ErrorKind.RATE_LIMITED`).
-     */
-    @GET("api/v1/public/shard/market")
-    suspend fun getShardMarket(
-        @Query("q") query: String? = null,
-        @Query("minPrice") minPrice: Long? = null,
-        @Query("maxPrice") maxPrice: Long? = null,
-        @Query("map") map: String? = null,
-        @Query("region") region: String? = null,
-        @Query("sort") sort: String? = null,
-        @Query("limit") limit: Int? = null,
-        @Query("offset") offset: Int? = null,
-    ): MarketPageDto
-
-    /** Index size, staleness, and which facets/regions actually hold vendors. */
-    @GET("api/v1/public/shard/market/meta")
-    suspend fun getShardMarketMeta(): MarketMetaDto
-
-    @GET("api/v1/public/shard/market/vendors/{serial}")
-    suspend fun getShardMarketVendor(
-        @Path("serial") serial: String,
-        @Query("limit") limit: Int? = null,
-        @Query("offset") offset: Int? = null,
-    ): MarketVendorDto
-
-    // The atlas lives under /public/atlas, NOT /public/shard: it is static shard
-    // content parsed from the server's data files, so it stays readable while the
-    // shard is down — but it IS site-mode gated, unlike the shard routes.
-    @GET("api/v1/public/atlas/creatures")
-    suspend fun getAtlasCreatures(
-        @Query("q") query: String? = null,
-        @Query("facet") facet: String? = null,
-        @Query("limit") limit: Int? = null,
-        @Query("offset") offset: Int? = null,
-    ): AtlasCreaturePageDto
-
-    @GET("api/v1/public/atlas/creatures/{slug}")
-    suspend fun getAtlasCreature(@Path("slug") slug: String): AtlasCreatureDto
-
-    @GET("api/v1/public/atlas/meta")
-    suspend fun getAtlasMeta(): AtlasMetaDto
 }

app/src/main/java/com/runicgateway/app/data/api/SsoApi.kt

@@ -1,40 +0,0 @@
-/*
- * SPDX-License-Identifier: GPL-3.0-or-later
- */
-package com.runicgateway.app.data.api
-
-import com.runicgateway.app.data.api.dto.MobileSsoExchangeRequest
-import com.runicgateway.app.data.api.dto.MobileTokenResponse
-import com.runicgateway.app.data.api.dto.SsoProviderDto
-import retrofit2.Response
-import retrofit2.http.Body
-import retrofit2.http.GET
-import retrofit2.http.Headers
-import retrofit2.http.POST
-
-/**
- * The native SSO bridge surface (PLAN.md §4.2, M9). Discovery lists the shard's
- * enabled providers; exchange trades a callback authorization code (+ its PKCE
- * verifier) for the same bearer pair as `/auth/mobile/login`.
- *
- * The redirect leg (`/auth/mobile/sso/start`) is **not** here — it is opened in a
- * Custom Tab as a URL (the browser follows the 302 through the IdP), not called as
- * an XHR. See [com.runicgateway.app.core.auth.sso.SsoAuthManager].
- *
- * Exchange is tagged [com.runicgateway.app.core.net.Http.NO_SESSION_HEADER]: it
- * carries no bearer (the user isn't signed in yet) and a `401` (bad/expired code or
- * PKCE mismatch) must never be misread as an expired session or trip the refresh
- * [com.runicgateway.app.core.net.TokenAuthenticator]. It returns a raw [Response]
- * so the caller can distinguish `401` from other failures.
- */
-interface SsoApi {
-
-    /** Public discovery — the enabled providers to render login buttons for. */
-    @GET("api/v1/auth/providers")
-    suspend fun providers(): List<SsoProviderDto>
-
-    // Literal header value required by Retrofit @Headers; matches Http.NO_SESSION_HEADER.
-    @Headers("X-Runic-No-Session: 1")
-    @POST("api/v1/auth/mobile/sso/exchange")
-    suspend fun exchange(@Body body: MobileSsoExchangeRequest): Response<MobileTokenResponse>
-}

app/src/main/java/com/runicgateway/app/data/api/dto/AccountDto.kt

@@ -55,78 +55,9 @@ data class TotpSetupDto(
 @Serializable
 data class TotpCodeRequest(val code: String)
 
-/**
+/** Result of enabling/disabling 2FA. */
- * Result of enabling/disabling 2FA. Enabling also returns the freshly generated
- * single-use [recoveryCodes] **once** (null on disable and for older backends) — the
- * app shows them for the user to save and never persists them.
- */
 @Serializable
-data class TotpStateDto(
+data class TotpStateDto(val totp_enabled: Boolean = false)
-    val totp_enabled: Boolean = false,
-    val recoveryCodes: List<String>? = null,
-)
-
-// ── Trusted devices & recovery codes (TRUSTED_DEVICES_MFA.md) ───────────────
-
-/**
- * An active trusted device (`GET /auth/me/trusted-devices`): a browser/app allowed
- * to skip the TOTP step at login. Never carries the token. Timestamps are ISO-8601
- * strings shown as-is (advisory display).
- */
-@Serializable
-data class TrustedDeviceDto(
-    val id: Long = 0,
-    val platform: String? = null,
-    val deviceName: String? = null,
-    val userAgent: String? = null,
-    val createdAt: String? = null,
-    val lastUsedAt: String? = null,
-    val expiresAt: String? = null,
-)
-
-/** `POST /auth/me/trusted-devices` body — an optional friendly label. */
-@Serializable
-data class TrustDeviceRequest(val deviceName: String? = null)
-
-/**
- * `POST /auth/me/trusted-devices` success (native): the opaque [trustToken] to store
- * and replay via `X-Trust-Token`. Web receives the token as a cookie and no body token.
- */
-@Serializable
-data class TrustDeviceResultDto(
-    val trusted: Boolean = false,
-    val trustToken: String? = null,
-)
-
-/**
- * `409 { error: "trusted_device_limit", devices }` from a trust attempt at the cap —
- * the app lists [devices] and asks the user to revoke one, then retry.
- */
-@Serializable
-data class TrustedDeviceLimitDto(
-    val error: String? = null,
-    val devices: List<TrustedDeviceDto> = emptyList(),
-)
-
-/** `DELETE /auth/me/trusted-devices/:id` — idempotent single-revoke result. */
-@Serializable
-data class RevokedFlagDto(val revoked: Boolean = false)
-
-/** `DELETE /auth/me/trusted-devices` — count of devices untrusted ("untrust all"). */
-@Serializable
-data class RevokedCountDto(val revoked: Int = 0)
-
-/** `GET /auth/me/account/recovery-codes/status` — remaining unused count only. */
-@Serializable
-data class RecoveryStatusDto(val remaining: Int = 0)
-
-/** `POST /auth/me/account/recovery-codes/generate` body — password step-up. */
-@Serializable
-data class RecoveryGenerateRequest(val currentPassword: String? = null)
-
-/** A fresh single-use recovery-code batch, returned **once** (generate + totp enable). */
-@Serializable
-data class RecoveryCodesDto(val recoveryCodes: List<String> = emptyList())
 
 /** A linked external identity (`GET /auth/me/account/identities`). */
 @Serializable

app/src/main/java/com/runicgateway/app/data/api/dto/AdminDto.kt

@@ -1,179 +0,0 @@
-/*
- * SPDX-License-Identifier: GPL-3.0-or-later
- */
-package com.runicgateway.app.data.api.dto
-
-import kotlinx.serialization.SerialName
-import kotlinx.serialization.Serializable
-import kotlinx.serialization.json.JsonElement
-
-/**
- * Wire shapes for the M10 staff-operations surface over `/api/v1/admin/…` (PLAN.md
- * §1, §6.4). These are consumed only by the staff screens (dashboard, moderation,
- * support, content); every DTO ignores unknown keys (NetworkModule's lenient Json)
- * so additive backend fields stay safe. Nothing here is auto-provisioned or secret.
- */
-
-/** `GET /admin/dashboard` — the staff landing summary. */
-@Serializable
-data class AdminDashboardDto(
-    @SerialName("site_mode") val siteMode: String = "live",
-    @SerialName("last_change") val lastChange: SiteModeChangeDto = SiteModeChangeDto(),
-    val counts: AdminCountsDto = AdminCountsDto(),
-    @SerialName("recent_activity") val recentActivity: List<AdminActivityDto> = emptyList(),
-)
-
-@Serializable
-data class SiteModeChangeDto(
-    val at: String? = null,
-    val by: String? = null,
-)
-
-@Serializable
-data class AdminCountsDto(
-    /** Post counts keyed by DB category (`news`, `five_on_friday`, …). */
-    val posts: Map<String, Int> = emptyMap(),
-    val users: Int = 0,
-)
-
-/** One row of the recent admin-activity log. `detail` is provider-shaped JSON. */
-@Serializable
-data class AdminActivityDto(
-    val id: Long = 0,
-    val username: String? = null,
-    val action: String = "",
-    val detail: JsonElement? = null,
-    @SerialName("created_at") val createdAt: String? = null,
-)
-
-/** `PUT /admin/site-mode` request + response. */
-@Serializable
-data class SiteModeRequest(val mode: String)
-
-@Serializable
-data class SiteModeStateDto(
-    @SerialName("site_mode") val siteMode: String = "live",
-    @SerialName("changed_at") val changedAt: String? = null,
-    @SerialName("changed_by") val changedBy: String? = null,
-)
-
-// ── Content: news posts ───────────────────────────────────────────────────
-
-/**
- * A post row from `GET /admin/posts` (all posts, incl. unpublished — unlike the
- * public feed). `published` is a 0/1 flag (MariaDB tinyint), exposed as [isPublished].
- */
-@Serializable
-data class AdminPostDto(
-    val id: Long,
-    val category: String = "",
-    val title: String = "",
-    val slug: String? = null,
-    val excerpt: String? = null,
-    val body: String? = null,
-    @SerialName("image_url") val imageUrl: String? = null,
-    val published: Int = 0,
-    @SerialName("published_at") val publishedAt: String? = null,
-    @SerialName("created_at") val createdAt: String? = null,
-) {
-    val isPublished: Boolean get() = published != 0
-}
-
-/** `POST/PUT /admin/posts` body. `category` is a URL category the backend maps
- *  (news | five-on-friday | newsletter | screenshots). */
-@Serializable
-data class PostCreateRequest(
-    val category: String,
-    val title: String,
-    val excerpt: String? = null,
-    val body: String? = null,
-    @SerialName("image_url") val imageUrl: String? = null,
-    val published: Boolean = false,
-)
-
-/** `PATCH /admin/posts/:id/publish` body. */
-@Serializable
-data class PublishRequest(val published: Boolean)
-
-// ── Content: wiki taxonomy ────────────────────────────────────────────────
-
-/** A wiki category from `GET /admin/wiki/categories` (with page counts). */
-@Serializable
-data class AdminWikiCategoryDto(
-    val id: Long,
-    val slug: String = "",
-    val title: String = "",
-    val description: String? = null,
-    @SerialName("sort_order") val sortOrder: Int? = null,
-    @SerialName("page_count") val pageCount: Int? = null,
-    @SerialName("published_count") val publishedCount: Int? = null,
-)
-
-/** `POST /admin/wiki/categories` body. */
-@Serializable
-data class WikiCategoryRequest(
-    val slug: String,
-    val title: String,
-    val description: String? = null,
-    @SerialName("sort_order") val sortOrder: Int? = null,
-)
-
-/** A wiki tag from `GET /admin/wiki/tags` (tags derive from pages; read-only here). */
-@Serializable
-data class AdminWikiTagDto(
-    val id: Long,
-    val slug: String = "",
-    val label: String = "",
-    @SerialName("published_count") val publishedCount: Int? = null,
-)
-
-// ── Moderation (admin/moderator; shard write plane) ───────────────────────
-
-/** `POST /admin/shard/kick` — at least one of account/serial. */
-@Serializable
-data class KickRequest(val account: String? = null, val serial: String? = null)
-
-/** `POST /admin/shard/ban` — account/serial + optional duration (0/absent = indefinite). */
-@Serializable
-data class BanRequest(
-    val account: String? = null,
-    val serial: String? = null,
-    @SerialName("durationSec") val durationSec: Long? = null,
-    val reason: String? = null,
-)
-
-/** `POST /admin/shard/unban`. */
-@Serializable
-data class UnbanRequest(val account: String)
-
-/** `POST /admin/shard/broadcast` — a system message to everyone online. */
-@Serializable
-data class BroadcastRequest(val text: String, val hue: Int? = null)
-
-// ── Support queue (admin/moderator; help pages) ───────────────────────────
-
-/**
- * One open help page from `GET /admin/shard/pages` (INTEGRATION.md §4). `pageId`
- * is the sender's in-game serial (the `:id` for respond/close). Permissive — the
- * shard-state fields beyond these (coords, timing) are ignored.
- */
-@Serializable
-data class SupportPageDto(
-    @SerialName("pageId") val pageId: String = "",
-    val type: String? = null,
-    val message: String? = null,
-    val handled: Boolean? = null,
-    val handler: String? = null,
-    val sender: SupportActorDto? = null,
-)
-
-/** The page's sender (actor object); [account] present when the character is linked. */
-@Serializable
-data class SupportActorDto(
-    val name: String? = null,
-    val account: String? = null,
-)
-
-/** `POST /admin/shard/pages/:id/respond` — reply, optionally closing the page. */
-@Serializable
-data class PageRespondRequest(val message: String, val close: Boolean = false)

app/src/main/java/com/runicgateway/app/data/api/dto/AuthDto.kt

@@ -12,23 +12,12 @@ import kotlinx.serialization.Serializable
  * safe (§8, recorded for M1).
  */
 
-/**
+/** `POST /auth/mobile/login` body. [code] is only sent on the 2FA retry. */
- * `POST /auth/mobile/login` body (trusted-devices contract, TRUSTED_DEVICES_MFA.md).
- * [code] is only sent on the 2FA retry; [recoveryCode] is its single-use fallback
- * (sent instead of [code]). [trustDevice] asks the server to remember this device so
- * future logins skip the second factor — on success the response carries a
- * [MobileTokenResponse.trustToken] the app stores and replays via `X-Trust-Token`.
- * [device_name] labels the resulting trusted-device / session row (snake_case to
- * match the backend field exactly).
- */
 @Serializable
 data class MobileLoginRequest(
     val username: String,
     val password: String,
     val code: String? = null,
-    val recoveryCode: String? = null,
-    val trustDevice: Boolean? = null,
-    val device_name: String? = null,
 )
 
 /** `POST /auth/mobile/refresh` body. */
@@ -45,11 +34,6 @@ data class MobileLogoutRequest(
 /**
  * Success payload from login and refresh: the token pair, the access lifetime
  * (a zeit/ms duration string, e.g. "15m"), and the safe (secret-stripped) user.
- *
- * Login additionally carries the trusted-device outcome when `trustDevice` was set:
- * [trustToken] is the opaque token to persist + replay (present only when the trust
- * was accepted), or [trustLimitReached] + [devices] when the per-user cap blocked it
- * (the login itself still succeeded). Refresh never sets these.
  */
 @Serializable
 data class MobileTokenResponse(
@@ -57,9 +41,6 @@ data class MobileTokenResponse(
     val refreshToken: String,
     val expiresIn: String? = null,
     val user: SafeUserDto,
-    val trustToken: String? = null,
-    val trustLimitReached: Boolean = false,
-    val devices: List<TrustedDeviceDto> = emptyList(),
 )
 
 /** The minimal, non-sensitive user the app needs to render + gate the menu (§5). */

app/src/main/java/com/runicgateway/app/data/api/dto/NotificationsDto.kt

@@ -1,74 +0,0 @@
-/*
- * SPDX-License-Identifier: GPL-3.0-or-later
- */
-package com.runicgateway.app.data.api.dto
-
-import kotlinx.serialization.Serializable
-
-/**
- * Wire shapes for the opt-in push surface under `/auth/me` (PLAN.md §11, M7
- * Part 2). Field names match the backend's `notifications.controller` /
- * `pushDevices.model` exactly; every DTO ignores unknown keys (NetworkModule's
- * lenient Json), so additive backend fields are safe (recorded for M1).
- */
-
-/**
- * `POST /auth/me/devices` body. [endpoint] is the ntfy topic URL the app's
- * embedded distributor owns (`https://<ntfy-host>/<topic>`); the backend
- * SSRF-validates it is HTTPS on the shard's allow-set before storing. [transport]
- * is `unifiedpush` for the direct-ntfy relay (fcm reserved for a future flavor).
- */
-@Serializable
-data class RegisterDeviceRequest(
-    val endpoint: String,
-    val transport: String = "unifiedpush",
-    val platform: String? = null,
-)
-
-/** `POST/GET /auth/me/devices` — one registered device (endpoint) for this user. */
-@Serializable
-data class PushDeviceDto(
-    val id: Long = 0,
-    val transport: String = "",
-    val endpoint: String = "",
-    val platform: String? = null,
-    val createdAt: String? = null,
-    val lastSeenAt: String? = null,
-)
-
-/**
- * One subscribable stream from `GET /auth/me/notifications/streams`. A [personal]
- * stream is delivered only to the owning user and [requiresLinkedAccount] — the app
- * greys its toggle until a game account is linked (§11).
- */
-@Serializable
-data class NotificationStreamDto(
-    val id: String = "",
-    val label: String = "",
-    val description: String = "",
-    val personal: Boolean = false,
-    val requiresLinkedAccount: Boolean = false,
-)
-
-/** `GET /auth/me/notifications/streams` — the catalog. */
-@Serializable
-data class NotificationStreamsDto(
-    val streams: List<NotificationStreamDto> = emptyList(),
-)
-
-/**
- * `GET/PUT /auth/me/notifications/subscriptions` — the user's opted-in stream ids.
- * PUT replaces the full set; unknown ids are dropped server-side and the stored set
- * echoed back.
- *
- * [streams] intentionally has NO default: this DTO doubles as the PUT body, and the
- * backend validator requires the `streams` field (`body('streams').isArray()`).
- * kotlinx omits a property equal to its default (encodeDefaults=false), so a default
- * of `emptyList()` would drop the field when the user clears their LAST subscription,
- * sending `{}` → 400 "Validation failed" (the "can't turn off the last one" bug). With
- * no default the empty list always serializes as `{"streams":[]}`. Do not re-add a default.
- */
-@Serializable
-data class NotificationSubscriptionsDto(
-    val streams: List<String>,
-)

app/src/main/java/com/runicgateway/app/data/api/dto/PlayerShardDto.kt

@@ -14,8 +14,8 @@ import kotlinx.serialization.json.JsonObject
  * `CharacterSheet.jsx` / `GameAccounts.jsx` and `docs/link/INTEGRATION.md` §5).
  * Presentation is text-only for v1 (no item icons / paperdoll).
  *
- * In-game serials are hex strings (e.g. "0x24C"), the same opaque-key form used on
+ * In-game serials are hex strings (e.g. "0x24C"), unlike the numeric serials on
- * the public boards (`ShardDto.ActorDto`/`ChampDto`/`HouseDto`) — never numbers.
+ * the public boards — these are separate endpoints with separate shapes.
  */
 
 // ── Game-account linking ─────────────────────────────────────────────────────
@@ -83,47 +83,8 @@ data class CharProfileDto(
     val titles: TitlesDto? = null,
     val guild: GuildRefDto? = null,
     val governorOf: List<String> = emptyList(),
-    /**
-     * Loyalty / points standings (Protocol 3.0 §7.3). Empty for a character that has
-     * earned nothing anywhere — the shard omits systems the character has no entry in
-     * — and empty on a shard whose plugin predates 3.0.
-     *
-     * Served **ungated**: a character's own standings are self-service data on
-     * `/player/shard/char/:serial` and do not depend on the public `leaderboards`
-     * feature being visible. Don't re-gate them app-side.
-     */
-    val points: List<CharPointsDto> = emptyList(),
 )
 
-/**
- * One point system a character holds a score in (Protocol 3.0 §7.3).
- *
- * Three shapes here are counter-intuitive, and all three are what a REAL shard sends
- * (`docs/link/v3.md` §7.5 — a fake shard emits whatever the spec says it should):
- *
- *  - **[maxPoints] `0` means UNCAPPED, and is the common case**, not an edge case.
- *    ServUO's idiom for an uncapped system is `double.MaxValue`, which the plugin
- *    normalises to `0` because the C# cast is unchecked and yielded `long.MinValue`.
- *    Nothing may divide by it, and a full-width progress bar for an uncapped score
- *    would imply a completion that doesn't exist.
- *  - **[nameString] is usually `null`.** Most systems name themselves with a cliloc
- *    rather than a literal, so humanising [system] (`QueensLoyalty` → "Queens
- *    Loyalty") is the PRIMARY display path, not a defensive fallback.
- *  - **[rank] is absent unless the shard runs `Bridge.cfg PointsProfileRank=true`.**
- *    Absent and "unranked" are different answers, so it renders only when sent.
- */
-@Serializable
-data class CharPointsDto(
-    val system: String? = null,
-    val nameString: String? = null,
-    val points: Long? = null,
-    val maxPoints: Long? = null,
-    val rank: Int? = null,
-) {
-    /** The cap, or null when the system is uncapped (see [maxPoints]). */
-    val cap: Long? get() = maxPoints?.takeIf { it > 0 }
-}
-
 @Serializable
 data class CharStatsDto(
     val str: Int? = null,
@@ -173,45 +134,17 @@ data class EquipmentDto(
     val itemId: Int? = null,
     val hue: Int? = null,
     val mods: JsonObject? = null,
-    /**
+)
-     * A player-given name — set for the minority of items someone has renamed, null
-     * for almost everything else. The shard sends the plain `Item.Name` field; it
-     * never builds a display name (that call is a packet builder, not a field read).
-     */
-    val name: String? = null,
-    /**
-     * The item's type name, resolved from its cliloc id **by the website** against
-     * its own table (`docs/website/CLILOCS.md`). Null on a shard that has no cliloc
-     * table configured, which is fully supported — the sheet then falls back to the
-     * layer, exactly as it did before the table existed.
-     */
-    val clilocName: String? = null,
-) {
-    /**
-     * What to call this item.
-     *
-     * A player-given [name] outranks the resolved type name — "Bob's lucky axe" must
-     * not be relabelled "hatchet" — and the server applies the same precedence, so
-     * this only re-states it for an item that arrived with both.
-     */
-    val label: String? get() = name ?: clilocName ?: layer
-}
 
 /**
- * Display titles (Protocol 2.0). `selected` is the index into [reward] currently
+ * Display titles (Protocol 2.0). `selected` is the index into `reward` currently
- * shown (-1 if none); [reward] entries may be a cliloc number-as-string or a literal.
+ * shown (-1 if none); `reward` entries may be a cliloc number-as-string or a
- *
+ * literal — numeric ones are skipped without a cliloc table (as the website does).
- * [rewardResolved] is the website's **parallel array** with the numeric entries turned
- * into words against its cliloc table — same length and order as [reward], with a null
- * where an id resolved to nothing. It is absent entirely when no entry was numeric or
- * the shard has no cliloc table, so read it positionally and tolerate it being short.
- * See `displayTitles` in the character sheet.
  */
 @Serializable
 data class TitlesDto(
     val selected: Int? = null,
     val reward: List<String> = emptyList(),
-    val rewardResolved: List<String?> = emptyList(),
     val fameKarma: String? = null,
     val skill: String? = null,
 )

app/src/main/java/com/runicgateway/app/data/api/dto/PublicDto.kt

@@ -55,17 +55,6 @@ data class RegistrationFlagsDto(
     val sso: Boolean = false,
 )
 
-/**
- * Push-notification relay config (M7). [ntfyUrl] is the client-facing ntfy base
- * URL the app's embedded distributor registers its device topic against; null (or
- * absent, on an older backend) means push isn't configured for this shard and the
- * Notifications screen shows it as unavailable.
- */
-@Serializable
-data class PushConfigDto(
-    val ntfyUrl: String? = null,
-)
-
 /**
  * `GET /public/settings` — whitelisted settings + branding. Only the keys the
  * app consumes are modeled; other whitelisted keys are ignored.
@@ -78,6 +67,4 @@ data class SettingsDto(
     val registration: RegistrationFlagsDto = RegistrationFlagsDto(),
     val gameAccountSignup: Boolean = false,
     val brand: BrandDto = BrandDto(),
-    /** Push relay config (M7); default (null ntfyUrl) on a backend that predates it. */
-    val push: PushConfigDto = PushConfigDto(),
 )

app/src/main/java/com/runicgateway/app/data/api/dto/ShardContentDto.kt

@@ -1,367 +0,0 @@
-/*
- * SPDX-License-Identifier: GPL-3.0-or-later
- */
-package com.runicgateway.app.data.api.dto
-
-import kotlinx.serialization.Serializable
-
-/**
- * DTOs for the four shard-content surfaces Protocol 3.0 added (PLAN.md §9 M11):
- * the ruleset, the points leaderboards, the player-vendor marketplace, and the spawn
- * atlas. Shapes mirror the website's `public/shard.controller.js` + `public/atlas.
- * controller.js` responses; see `docs/link/v3.md` §5–§8.
- *
- * Every field is nullable-with-a-default, which is load-bearing rather than merely
- * defensive here: an admin can gate individual fields away per audience rung
- * (`ownerName`, `location`, a board's `name`), so a response legitimately arrives
- * with them missing and must still decode.
- */
-
-// ── Ruleset (§5) ────────────────────────────────────────────────────────────
-
-/**
- * `GET /public/shard/ruleset` — what this shard's world is configured to do.
- *
- * Every block is optional and omitted when its system is off, so a null block means
- * "not applicable here", not "unknown". A `null` BODY (rather than an empty object)
- * means the shard has never published a ruleset — distinct from the feature being
- * switched off, which is a 404.
- */
-@Serializable
-data class RulesetDto(
-    val shard: String? = null,
-    val expansion: String? = null,
-    /**
-     * The public connect address, published only when the operator set one. It is
-     * also the ruleset's one admin-configurable field, so it can be present for a
-     * signed-in viewer and absent for an anonymous one.
-     */
-    val connect: String? = null,
-    /** A flat bag of on/off flags — `cityLoyalty`, `vvv`, `siege`, `chat`, … */
-    val systems: Map<String, Boolean> = emptyMap(),
-    val caps: RulesetCapsDto? = null,
-    val accounts: RulesetAccountsDto? = null,
-    val housing: RulesetHousingDto? = null,
-    val vetRewards: RulesetVetRewardsDto? = null,
-    val vendors: RulesetVendorsDto? = null,
-    val vvv: RulesetVvvDto? = null,
-    val store: RulesetStoreDto? = null,
-    val schedule: RulesetScheduleDto? = null,
-    val updatedAt: String? = null,
-)
-
-/**
- * Skill and stat caps.
- *
- * **[skill] and [totalSkill] are in TENTHS** — 1000 is 100.0 — the way ServUO stores
- * them, and the raw number is actively misleading rather than merely unhelpful (a
- * "1000 skill cap" reads as a shard with ten times the usual limit). Use [skillCap]
- * and [totalSkillCap]. The stat caps below them are plain values.
- */
-@Serializable
-data class RulesetCapsDto(
-    val skill: Int? = null,
-    val totalSkill: Int? = null,
-    val stat: Int? = null,
-    val str: Int? = null,
-    val dex: Int? = null,
-    val int: Int? = null,
-    val strMax: Int? = null,
-    val dexMax: Int? = null,
-    val intMax: Int? = null,
-) {
-    val skillCap: Double? get() = skill?.let { it / 10.0 }
-    val totalSkillCap: Double? get() = totalSkill?.let { it / 10.0 }
-}
-
-@Serializable
-data class RulesetAccountsDto(
-    val perIp: Int? = null,
-    val charSlots: Int? = null,
-    val autoCreate: Boolean? = null,
-)
-
-@Serializable
-data class RulesetHousingDto(val accountHouseLimit: Int? = null)
-
-@Serializable
-data class RulesetVetRewardsDto(
-    val enabled: Boolean? = null,
-    val rewardIntervalDays: Int? = null,
-)
-
-@Serializable
-data class RulesetVendorsDto(
-    val restockDelayMinutes: Int? = null,
-    val maxSell: Int? = null,
-    val economyStockAmount: Int? = null,
-)
-
-@Serializable
-data class RulesetVvvDto(
-    val enabled: Boolean? = null,
-    val startSilver: Int? = null,
-    val enhancedRules: Boolean? = null,
-)
-
-@Serializable
-data class RulesetStoreDto(
-    val enabled: Boolean? = null,
-    val currencyName: String? = null,
-)
-
-@Serializable
-data class RulesetScheduleDto(
-    val autoSaveFrequencyMinutes: Int? = null,
-    val autoRestartEnabled: Boolean? = null,
-    val autoRestartHour: Int? = null,
-    val autoRestartMinute: Int? = null,
-)
-
-// ── Leaderboards (§7) ───────────────────────────────────────────────────────
-
-/**
- * One point system's board (`GET /public/shard/points`, `/points/:system`).
- *
- * [maxPoints] `0` means **uncapped** and is the common case, and [nameString] is
- * usually null because most systems name themselves with a cliloc — the same two
- * traps as [CharPointsDto], documented in full there.
- *
- * [players] counts players actually *holding* points, not the entry count: ten of the
- * shard's systems auto-add a zero-point row for every character ever created, so the
- * raw count would report the whole census as one system's participants.
- */
-@Serializable
-data class PointsBoardDto(
-    val system: String? = null,
-    val nameString: String? = null,
-    val nameNumber: Int? = null,
-    val maxPoints: Long? = null,
-    val players: Int? = null,
-    val showOnGump: Boolean = true,
-    val top: List<PointsEntryDto> = emptyList(),
-    val t: Long? = null,
-    val updatedAt: String? = null,
-) {
-    /** The cap, or null when the system is uncapped. */
-    val cap: Long? get() = maxPoints?.takeIf { it > 0 }
-}
-
-/**
- * A ranked character on a board. [name] is admin-configurable (the `leaderboards`
- * feature's one field rule), so a shard can publish standings without naming who
- * holds them — a rank with no name is a valid row, not a broken one.
- */
-@Serializable
-data class PointsEntryDto(
-    val rank: Int? = null,
-    val serial: String? = null,
-    val name: String? = null,
-    val points: Long? = null,
-)
-
-// ── Marketplace (§8) ────────────────────────────────────────────────────────
-
-/**
- * Where a shop stands. **Nested, not flattened**, on the wire and in the read model
- * alike, so that ONE admin rule hides the facet, the coordinates, the region and the
- * house together — five flat keys would be five rules that drift apart (`v3.md` §8.8).
- * A null location means an admin gated it away; render that as an answer, not a blank.
- */
-@Serializable
-data class MarketLocationDto(
-    val map: String? = null,
-    val x: Int? = null,
-    val y: Int? = null,
-    val z: Int? = null,
-    val region: String? = null,
-    val house: String? = null,
-)
-
-/** The shop a listing belongs to, as embedded in a search result. */
-@Serializable
-data class MarketVendorRefDto(
-    val serial: String? = null,
-    val shopName: String? = null,
-    val ownerName: String? = null,
-    val location: MarketLocationDto? = null,
-)
-
-/**
- * One item for sale. [displayName] is resolved server-side against the site's cliloc
- * table, preferring a player-set [name]; a shard with no cliloc table configured sends
- * neither and the item renders by id.
- *
- * [child] marks an item priced by an enclosing container rather than itself, exactly
- * as the in-game Vendor Search reports it.
- */
-@Serializable
-data class MarketListingDto(
-    val serial: String? = null,
-    val itemId: Int? = null,
-    val hue: Int? = null,
-    val amount: Int? = null,
-    val price: Long? = null,
-    val name: String? = null,
-    val cliloc: Int? = null,
-    val displayName: String? = null,
-    val child: Boolean = false,
-    val vendor: MarketVendorRefDto? = null,
-) {
-    /** What to call this item; null when the shard publishes no name for it. */
-    val label: String? get() = name ?: displayName
-}
-
-/**
- * A page of search results (`GET /public/shard/market`).
- *
- * Returns **listings, not vendors**: "who sells a vanquishing kryss and for how much"
- * is the question, and a vendor-shaped result would make every caller flatten the
- * shops back out.
- *
- * [staleAt] is the oldest vendor timestamp in the index and **must be surfaced**. The
- * shard sweeps vendors round-robin, so a listing can legitimately be a full cycle old;
- * a page implying live prices sends someone to an item that sold twenty minutes ago.
- */
-@Serializable
-data class MarketPageDto(
-    val listings: List<MarketListingDto> = emptyList(),
-    val total: Int = 0,
-    val limit: Int? = null,
-    val offset: Int? = null,
-    val vendors: Int? = null,
-    val staleAt: String? = null,
-)
-
-/**
- * One shop and its stock (`GET /public/shard/market/vendors/:serial`).
- *
- * [truncated] means the shard publishes only the first `MarketMaxListings` of a larger
- * inventory — [count] is what is published, [total] what the shop holds. Saying so is
- * the point of this screen: a search result list cannot express it.
- */
-@Serializable
-data class MarketVendorDto(
-    val serial: String? = null,
-    val shopName: String? = null,
-    val ownerSerial: String? = null,
-    val ownerName: String? = null,
-    val location: MarketLocationDto? = null,
-    val count: Int? = null,
-    val total: Int? = null,
-    val truncated: Boolean = false,
-    val updatedAt: String? = null,
-    val items: List<MarketListingDto> = emptyList(),
-)
-
-/** Index size, staleness and the filter options that actually hold vendors. */
-@Serializable
-data class MarketMetaDto(
-    val vendors: Int = 0,
-    val items: Int = 0,
-    val staleAt: String? = null,
-    val freshAt: String? = null,
-    val maps: List<String> = emptyList(),
-    val regions: List<String> = emptyList(),
-)
-
-// ── Spawn atlas (§6) ────────────────────────────────────────────────────────
-
-/**
- * A creature in the bestiary. Served from `/public/atlas`, **not** `/public/shard`:
- * the atlas is static shard *content* parsed from the server's own data files, not
- * live shard *state*, so it does not go offline with the sidecar — but unlike the
- * shard routes it IS site-mode gated, like posts and the wiki.
- *
- * [points] is a **count** of spawners; [spawners] is the list, and only the
- * single-creature route sends it. The two names are one letter apart in meaning and
- * were deliberately separated (`v3.md` §6.3) — do not reuse one for the other.
- */
-@Serializable
-data class AtlasCreatureDto(
-    val slug: String? = null,
-    val name: String? = null,
-    /** How many can be alive at once, summed across every spawner. */
-    val total: Int? = null,
-    /** How many spawners mention this creature. */
-    val points: Int? = null,
-    /** Spawner count per facet. */
-    val facets: Map<String, Int> = emptyMap(),
-    /**
-     * Where it appears, aggregated per named place — the detail route only, and the
-     * answer the whole screen exists to give. **Objects, not strings:** the server
-     * sends `{facet, label, spawners, maxAlive}`, and typing this `List<String>`
-     * made the detail route fail to decode entirely.
-     */
-    val places: List<AtlasPlaceDto> = emptyList(),
-    /**
-     * Operator-supplied sprite file name under `/uploads/atlas/`, or null — which is
-     * the normal state, since no artwork ships. Neither client renders it yet; the
-     * field is carried so a decode never depends on that staying true.
-     */
-    val art: String? = null,
-    val spawners: List<AtlasSpawnerDto> = emptyList(),
-    val spawnersTruncated: Boolean = false,
-    /** Creatures sharing its spawners — the detail route only. */
-    val alsoHere: List<AtlasCreatureDto> = emptyList(),
-)
-
-/**
- * One named place a creature spawns in, already aggregated across its spawners.
- *
- * [label] is the server's point-in-rect resolution of raw coordinates ("Shrines",
- * "Isamu-Jima", "Yew"), falling back to the nearest landmark and finally
- * "Wilderness" — turning a list of coordinates into an answer.
- */
-@Serializable
-data class AtlasPlaceDto(
-    val facet: String? = null,
-    val label: String? = null,
-    /** Spawners in this place. */
-    val spawners: Int? = null,
-    /** How many can be alive at once here, summed across those spawners. */
-    val maxAlive: Int? = null,
-)
-
-/**
- * One spawn point.
- *
- * **[minDelay] / [maxDelay] are SECONDS**, normalised by the server's parser.
- * XmlSpawner writes them in minutes *except* when a delay doesn't divide into whole
- * minutes, flagging that per record — so the raw file has `5` meaning five minutes on
- * one spawner and five seconds on the next, both plausible. The API and this client
- * carry seconds throughout.
- */
-@Serializable
-data class AtlasSpawnerDto(
-    val id: Long? = null,
-    val facet: String? = null,
-    val name: String? = null,
-    val x: Int? = null,
-    val y: Int? = null,
-    val maxCount: Int? = null,
-    val minDelay: Int? = null,
-    val maxDelay: Int? = null,
-    val region: String? = null,
-    val landmark: String? = null,
-    /** The server's own "Despise, Felucca" style placement label. */
-    val label: String? = null,
-)
-
-/** A page of creature search results (`GET /public/atlas/creatures`). */
-@Serializable
-data class AtlasCreaturePageDto(
-    val creatures: List<AtlasCreatureDto> = emptyList(),
-    val total: Int = 0,
-    val limit: Int? = null,
-    val offset: Int? = null,
-)
-
-/** When the atlas was last derived from the shard's data files, and what it holds. */
-@Serializable
-data class AtlasMetaDto(
-    val importedAt: String? = null,
-    val generatedAt: String? = null,
-    val counts: Map<String, Int> = emptyMap(),
-    val facets: List<String> = emptyList(),
-)

app/src/main/java/com/runicgateway/app/data/api/dto/ShardDto.kt

@@ -15,43 +15,13 @@ import kotlinx.serialization.json.JsonObject
  * `*.update` frames on `/public/shard/stream` decode into these same DTOs.
  */
 
-/**
+/** A game actor (player/leader/governor) as embedded in board payloads. */
- * Which shard surfaces this caller may reach (`GET /public/shard/features`), plus
- * the audience rung they resolved to.
- *
- * Every shard-derived feature is admin-configurable — it can be switched off or
- * raised to a higher rung — so the menu cannot be a static list (PLAN.md §5, M11).
- * [level] is the SERVER's answer on the `anonymous → logged_in → player → staff →
- * admin` ladder and is authoritative: don't re-derive a rung from the session role,
- * since `player` means *a linked game account* and staff always satisfy it.
- *
- * The response reports only what the caller can see, so the list itself never
- * discloses a feature they're gated out of.
- */
-@Serializable
-data class ShardFeaturesDto(
-    val level: String? = null,
-    val features: List<String> = emptyList(),
-)
-
-/**
- * A game actor (player/leader/governor) as embedded in board payloads. Per the wire
- * spec (`docs/link/INTEGRATION.md` §1), in-game [serial]s are opaque hex-string keys
- * (e.g. `"0x1A2B"`), never numbers.
- *
- * [acct] and [webId] are **locked to the admin rung** by the visibility framework
- * (`docs/link/v3.md` §3.4 rule 1) — a game account name and a linked site-user id are
- * not in-game-visible the way a character name is, so they are stripped from every
- * response below `admin` and no admin setting can loosen that. The fields stay
- * declared because an admin session does receive them; nothing below one should
- * expect a value.
- */
 @Serializable
 data class ActorDto(
-    val serial: String? = null,
+    val serial: Long? = null,
     val name: String? = null,
     val acct: String? = null,
-    val webId: String? = null,
+    val webId: Long? = null,
 ) {
     /** Best display label for this actor. */
     val label: String get() = name ?: acct ?: "Someone"
@@ -103,7 +73,7 @@ data class FeedEventDto(
  */
 @Serializable
 data class OnlineStaffDto(
-    val serial: String? = null,
+    val serial: Long? = null,
     val name: String? = null,
     val map: String? = null,
     val x: Int? = null,
@@ -117,7 +87,7 @@ data class OnlineStaffDto(
  */
 @Serializable
 data class HouseDto(
-    val serial: String = "",
+    val serial: Long = 0,
     val name: String? = null,
     val region: String? = null,
     val map: String? = null,
@@ -134,7 +104,7 @@ data class HouseDto(
  */
 @Serializable
 data class ChampDto(
-    val serial: String = "",
+    val serial: Long = 0,
     val category: String? = null,
     val type: String? = null,
     val name: String? = null,

app/src/main/java/com/runicgateway/app/data/api/dto/SsoDto.kt

@@ -1,42 +0,0 @@
-/*
- * SPDX-License-Identifier: GPL-3.0-or-later
- */
-package com.runicgateway.app.data.api.dto
-
-import kotlinx.serialization.SerialName
-import kotlinx.serialization.Serializable
-
-/**
- * Wire shapes for the Mobile SSO Authorization Bridge (PLAN.md §4.2, M9). The
- * success payload of `/auth/mobile/sso/exchange` is the shared [MobileTokenResponse]
- * (same pair as `/auth/mobile/login`) — this file only adds the two shapes unique
- * to the bridge. Every DTO ignores unknown keys (NetworkModule's lenient Json), so
- * additive backend fields stay safe (§8).
- */
-
-/**
- * One entry of `GET /auth/providers` — public discovery, never secrets. [icon] is
- * the provider kind (`google` | `discord` | `oidc` | `oauth2`); the app renders a
- * button per provider from this list rather than hardcoding a set. [loginUrl] is
- * the *website* start path (unused by the app, which builds its own
- * `/auth/mobile/sso/start` URL); kept so the shape matches the backend exactly.
- */
-@Serializable
-data class SsoProviderDto(
-    val id: String,
-    val name: String,
-    val icon: String? = null,
-    val loginUrl: String? = null,
-    val priority: Int? = null,
-)
-
-/**
- * `POST /auth/mobile/sso/exchange` body — the one-time authorization code from the
- * callback deep link plus the PKCE verifier stashed at `/start` (Layer B). Wire
- * name is snake_case to match the backend's `{ code, code_verifier }`.
- */
-@Serializable
-data class MobileSsoExchangeRequest(
-    val code: String,
-    @SerialName("code_verifier") val codeVerifier: String,
-)

app/src/main/java/com/runicgateway/app/data/repository/AccountRepository.kt

@@ -10,19 +10,10 @@ import com.runicgateway.app.data.api.dto.ChangePasswordRequest
 import com.runicgateway.app.data.api.dto.ChangeUsernameRequest
 import com.runicgateway.app.data.api.dto.LinkedIdentityDto
 import com.runicgateway.app.data.api.dto.PlayerAccountDto
-import com.runicgateway.app.data.api.dto.RecoveryCodesDto
-import com.runicgateway.app.data.api.dto.RecoveryGenerateRequest
-import com.runicgateway.app.data.api.dto.RecoveryStatusDto
 import com.runicgateway.app.data.api.dto.TotpCodeRequest
 import com.runicgateway.app.data.api.dto.TotpSetupDto
 import com.runicgateway.app.data.api.dto.TotpStateDto
-import com.runicgateway.app.data.api.dto.TrustDeviceRequest
-import com.runicgateway.app.data.api.dto.TrustedDeviceDto
-import com.runicgateway.app.data.api.dto.TrustedDeviceLimitDto
 import com.runicgateway.app.data.api.dto.UsernameResponse
-import kotlinx.coroutines.CancellationException
-import kotlinx.serialization.json.Json
-import java.io.IOException
 import javax.inject.Inject
 import javax.inject.Singleton
 
@@ -35,7 +26,6 @@ import javax.inject.Singleton
 @Singleton
 class AccountRepository @Inject constructor(
     private val api: MeApi,
-    private val json: Json,
 ) {
     suspend fun getAccount(): ApiResult<PlayerAccountDto> = safeApiCall { api.getAccount() }
 
@@ -58,63 +48,4 @@ class AccountRepository @Inject constructor(
 
     suspend fun unlinkIdentity(provider: String): ApiResult<Unit> =
         safeApiCall { api.unlinkIdentity(provider) }
-
-    // ── Trusted devices (TRUSTED_DEVICES_MFA.md) ───────────────────────────
-
-    suspend fun trustedDevices(): ApiResult<List<TrustedDeviceDto>> =
-        safeApiCall { api.trustedDevices() }
-
-    /** The distinct outcomes of trusting the current device — the cap is a first-class case. */
-    sealed interface TrustOutcome {
-        /** Trusted; [trustToken] is the opaque token to persist (native). */
-        data class Trusted(val trustToken: String?) : TrustOutcome
-
-        /** At the per-user cap — [devices] must be pruned before retrying. */
-        data class LimitReached(val devices: List<TrustedDeviceDto>) : TrustOutcome
-        data object NetworkError : TrustOutcome
-        data object ServerError : TrustOutcome
-    }
-
-    /**
-     * Trust the current device. Reads the raw response so the `409 { error, devices }`
-     * cap body survives (a thrown [retrofit2.HttpException] would discard it).
-     */
-    suspend fun trustThisDevice(deviceName: String? = null): TrustOutcome {
-        val response = try {
-            api.trustThisDevice(TrustDeviceRequest(deviceName))
-        } catch (e: CancellationException) {
-            throw e
-        } catch (_: IOException) {
-            return TrustOutcome.NetworkError
-        } catch (_: Exception) {
-            return TrustOutcome.ServerError
-        }
-        if (response.isSuccessful) {
-            return TrustOutcome.Trusted(response.body()?.trustToken)
-        }
-        if (response.code() == 409) {
-            val devices = runCatching {
-                val raw = response.errorBody()?.string()
-                if (raw.isNullOrBlank()) emptyList()
-                else json.decodeFromString<TrustedDeviceLimitDto>(raw).devices
-            }.getOrDefault(emptyList())
-            return TrustOutcome.LimitReached(devices)
-        }
-        return TrustOutcome.ServerError
-    }
-
-    suspend fun revokeTrustedDevice(id: Long): ApiResult<Boolean> =
-        safeApiCall { api.revokeTrustedDevice(id).revoked }
-
-    suspend fun revokeAllTrustedDevices(): ApiResult<Int> =
-        safeApiCall { api.revokeAllTrustedDevices().revoked }
-
-    // ── Recovery (backup) codes ────────────────────────────────────────────
-
-    suspend fun recoveryCodesStatus(): ApiResult<RecoveryStatusDto> =
-        safeApiCall { api.recoveryCodesStatus() }
-
-    /** Regenerate the single-use codes (password step-up). Returned once — never stored. */
-    suspend fun generateRecoveryCodes(currentPassword: String?): ApiResult<RecoveryCodesDto> =
-        safeApiCall { api.generateRecoveryCodes(RecoveryGenerateRequest(currentPassword)) }
 }

app/src/main/java/com/runicgateway/app/data/repository/AdminRepository.kt

@@ -1,94 +0,0 @@
-/*
- * SPDX-License-Identifier: GPL-3.0-or-later
- */
-package com.runicgateway.app.data.repository
-
-import com.runicgateway.app.core.result.ApiResult
-import com.runicgateway.app.core.result.safeApiCall
-import com.runicgateway.app.data.api.AdminApi
-import com.runicgateway.app.data.api.dto.AdminDashboardDto
-import com.runicgateway.app.data.api.dto.AdminPostDto
-import com.runicgateway.app.data.api.dto.BanRequest
-import com.runicgateway.app.data.api.dto.BroadcastRequest
-import com.runicgateway.app.data.api.dto.KickRequest
-import com.runicgateway.app.data.api.dto.PageRespondRequest
-import com.runicgateway.app.data.api.dto.PostCreateRequest
-import com.runicgateway.app.data.api.dto.PublishRequest
-import com.runicgateway.app.data.api.dto.SiteModeRequest
-import com.runicgateway.app.data.api.dto.SiteModeStateDto
-import com.runicgateway.app.data.api.dto.SupportPageDto
-import com.runicgateway.app.data.api.dto.UnbanRequest
-import com.runicgateway.app.data.api.dto.AdminWikiCategoryDto
-import com.runicgateway.app.data.api.dto.WikiCategoryRequest
-import com.runicgateway.app.data.api.dto.AdminWikiTagDto
-import retrofit2.HttpException
-import retrofit2.Response
-import javax.inject.Inject
-import javax.inject.Singleton
-
-/**
- * The M10 staff-operations data source over `/api/v1/admin/…` (PLAN.md §1, §6.4).
- * Every call returns a typed [ApiResult] so a screen renders a clean error/retry
- * rather than crashing — a `403` (role lost since the menu rendered) and a `503`
- * (shard/sidecar offline for the shard-write actions) are both expected outcomes
- * the UI handles, never thrown. Role is authoritative on the server.
- */
-@Singleton
-class AdminRepository @Inject constructor(
-    private val api: AdminApi,
-) {
-    suspend fun dashboard(): ApiResult<AdminDashboardDto> = safeApiCall { api.dashboard() }
-
-    suspend fun setSiteMode(mode: String): ApiResult<SiteModeStateDto> =
-        safeApiCall { api.setSiteMode(SiteModeRequest(mode)) }
-
-    // ── Content: news posts ───────────────────────────────────────────────
-    suspend fun posts(): ApiResult<List<AdminPostDto>> = safeApiCall { api.posts() }
-
-    suspend fun createPost(body: PostCreateRequest): ApiResult<AdminPostDto> =
-        safeApiCall { api.createPost(body) }
-
-    suspend fun setPostPublished(id: Long, published: Boolean): ApiResult<AdminPostDto> =
-        safeApiCall { api.publishPost(id, PublishRequest(published)) }
-
-    suspend fun deletePost(id: Long): ApiResult<Unit> = safeApiCall { api.deletePost(id).requireOk() }
-
-    // ── Content: wiki taxonomy ────────────────────────────────────────────
-    suspend fun wikiCategories(): ApiResult<List<AdminWikiCategoryDto>> = safeApiCall { api.wikiCategories() }
-
-    suspend fun createWikiCategory(body: WikiCategoryRequest): ApiResult<AdminWikiCategoryDto> =
-        safeApiCall { api.createWikiCategory(body) }
-
-    suspend fun deleteWikiCategory(id: Long): ApiResult<Unit> =
-        safeApiCall { api.deleteWikiCategory(id).requireOk() }
-
-    suspend fun wikiTags(): ApiResult<List<AdminWikiTagDto>> = safeApiCall { api.wikiTags() }
-
-    // ── Moderation: shard write plane ─────────────────────────────────────
-    suspend fun kick(account: String?, serial: String?): ApiResult<Unit> =
-        safeApiCall { api.kick(KickRequest(account, serial)).requireOk() }
-
-    suspend fun ban(account: String?, serial: String?, durationSec: Long?, reason: String?): ApiResult<Unit> =
-        safeApiCall { api.ban(BanRequest(account, serial, durationSec, reason)).requireOk() }
-
-    suspend fun unban(account: String): ApiResult<Unit> =
-        safeApiCall { api.unban(UnbanRequest(account)).requireOk() }
-
-    suspend fun broadcast(text: String, hue: Int?): ApiResult<Unit> =
-        safeApiCall { api.broadcast(BroadcastRequest(text, hue)).requireOk() }
-
-    // ── Support queue: help pages ─────────────────────────────────────────
-    suspend fun supportPages(): ApiResult<List<SupportPageDto>> = safeApiCall { api.supportPages() }
-
-    suspend fun respondPage(id: String, message: String, close: Boolean): ApiResult<Unit> =
-        safeApiCall { api.respondPage(id, PageRespondRequest(message, close)).requireOk() }
-
-    suspend fun closePage(id: String): ApiResult<Unit> =
-        safeApiCall { api.closePage(id).requireOk() }
-
-    /** Turn a bodyless [Response] into a thrown [HttpException] on a non-2xx, so
-     *  [safeApiCall] can fold it into an [ApiResult.HttpError] like every other call. */
-    private fun Response<Unit>.requireOk() {
-        if (!isSuccessful) throw HttpException(this)
-    }
-}

app/src/main/java/com/runicgateway/app/data/repository/AuthRepository.kt

@@ -3,20 +3,13 @@
  */
 package com.runicgateway.app.data.repository
 
-import com.runicgateway.app.core.auth.DeviceNameProvider
 import com.runicgateway.app.core.auth.SessionManager
-import com.runicgateway.app.core.auth.TrustTokenStore
-import com.runicgateway.app.core.push.PushManager
 import com.runicgateway.app.data.api.AuthApi
-import com.runicgateway.app.data.api.SsoApi
 import com.runicgateway.app.data.api.dto.MobileLoginRequest
 import com.runicgateway.app.data.api.dto.MobileLogoutRequest
 import com.runicgateway.app.data.api.dto.MobileTokenResponse
-import com.runicgateway.app.data.api.dto.SsoProviderDto
 import com.runicgateway.app.data.api.dto.TotpRequiredError
-import com.runicgateway.app.data.api.dto.TrustedDeviceDto
 import kotlinx.coroutines.CancellationException
-import kotlinx.coroutines.delay
 import kotlinx.serialization.json.Json
 import retrofit2.Response
 import java.io.IOException
@@ -32,61 +25,13 @@ import javax.inject.Singleton
 @Singleton
 class AuthRepository @Inject constructor(
     private val authApi: AuthApi,
-    private val ssoApi: SsoApi,
     private val sessionManager: SessionManager,
-    private val pushManager: PushManager,
-    private val trustTokenStore: TrustTokenStore,
-    private val deviceNameProvider: DeviceNameProvider,
     private val json: Json,
 ) {
 
-    /** The three outcomes of SSO provider discovery, so the login screen can tell a
-     *  shard that offers no SSO ([None]) apart from a discovery that failed
-     *  ([Unavailable], offer a retry) — the old "empty on any failure" conflation hid
-     *  a broken call behind a dead website hand-off (§4.2). */
-    sealed interface SsoDiscovery {
-        /** At least one enabled provider — render a native button per entry. */
-        data class Available(val providers: List<SsoProviderDto>) : SsoDiscovery
-
-        /** Discovery succeeded but the shard has no SSO providers configured. */
-        data object None : SsoDiscovery
-
-        /** The discovery call failed (offline / server error) — surface a retry. */
-        data object Unavailable : SsoDiscovery
-    }
-
-    /**
-     * Discover the shard's enabled SSO providers for the native login buttons (§4.2).
-     * Public discovery, never secrets. Retries once before reporting [Unavailable],
-     * so a single transient blip doesn't strand the user.
-     */
-    suspend fun ssoProviders(): SsoDiscovery {
-        var lastFailed = false
-        repeat(2) { attempt ->
-            try {
-                val providers = ssoApi.providers()
-                return if (providers.isEmpty()) SsoDiscovery.None else SsoDiscovery.Available(providers)
-            } catch (e: CancellationException) {
-                throw e
-            } catch (_: Exception) {
-                lastFailed = true
-                if (attempt == 0) delay(DISCOVERY_RETRY_DELAY_MS)
-            }
-        }
-        return if (lastFailed) SsoDiscovery.Unavailable else SsoDiscovery.None
-    }
-
     /** Outcome of a login attempt (§4.1). */
     sealed interface LoginResult {
-        /**
+        data object Success : LoginResult
-         * Signed in. [trustLimitReached] is true when "trust this device" was asked
-         * for but the per-user cap blocked it (the login still succeeded, but no trust
-         * token was issued); [devices] then lists the trusted devices to manage.
-         */
-        data class Success(
-            val trustLimitReached: Boolean = false,
-            val devices: List<TrustedDeviceDto> = emptyList(),
-        ) : LoginResult
 
         /** The account has 2FA on — reveal the code field and resubmit with a code. */
         data object TotpRequired : LoginResult
@@ -102,32 +47,9 @@ class AuthRepository @Inject constructor(
         data object NetworkError : LoginResult
     }
 
-    /**
+    suspend fun login(username: String, password: String, code: String? = null): LoginResult {
-     * Native login (TRUSTED_DEVICES_MFA.md). A stored trust token bound to [username]
-     * rides the `X-Trust-Token` header so a trusted device skips the TOTP step. A
-     * second factor is either a [code] (TOTP) or a single-use [recoveryCode]. With
-     * [trustDevice], the server may return a fresh trust token to persist for next time.
-     */
-    suspend fun login(
-        username: String,
-        password: String,
-        code: String? = null,
-        recoveryCode: String? = null,
-        trustDevice: Boolean = false,
-    ): LoginResult {
-        val storedTrustToken = trustTokenStore.tokenFor(username)
         val response: Response<MobileTokenResponse> = try {
-            authApi.login(
+            authApi.login(MobileLoginRequest(username = username, password = password, code = code))
-                MobileLoginRequest(
-                    username = username,
-                    password = password,
-                    code = code,
-                    recoveryCode = recoveryCode,
-                    trustDevice = trustDevice.takeIf { it },
-                    device_name = if (trustDevice) deviceNameProvider.deviceName() else null,
-                ),
-                trustToken = storedTrustToken,
-            )
         } catch (e: CancellationException) {
             throw e
         } catch (_: IOException) {
@@ -136,14 +58,8 @@ class AuthRepository @Inject constructor(
 
         if (response.isSuccessful) {
             val body = response.body() ?: return LoginResult.ServerError
-            // Persist a freshly minted trust token (scoped to this account) so the next
-            // login skips the second factor — it deliberately outlives logout.
-            body.trustToken?.let { trustTokenStore.save(username, it) }
             sessionManager.onSignedIn(body.accessToken, body.refreshToken, body.user)
-            return LoginResult.Success(
+            return LoginResult.Success
-                trustLimitReached = body.trustLimitReached,
-                devices = body.devices,
-            )
         }
 
         return when (response.code()) {
@@ -153,36 +69,12 @@ class AuthRepository @Inject constructor(
         }
     }
 
-    /**
-     * Persist a trust token minted by the self-service "trust this device" action
-     * (Account → Trusted Devices), scoped to [username] exactly like the login path.
-     */
-    fun saveTrustToken(username: String, token: String) = trustTokenStore.save(username, token)
-
-    /**
-     * Drop the locally stored trust token so this device stops skipping the TOTP step
-     * (used after "untrust all" and on a Settings → Server switch). Server-side
-     * revocation makes any surviving token inert anyway — the next login just prompts
-     * for the code — so this is a client-side cleanliness step, never load-bearing.
-     */
-    fun clearTrustToken() = trustTokenStore.clear()
-
     /**
      * Revoke this session (or, with [allDevices], every session) and clear local
      * tokens (§4.3). Best-effort: the local session is torn down even if the
      * network call fails, so the user is always signed out locally.
      */
     suspend fun logout(allDevices: Boolean = false) {
-        // Deregister this device's push endpoint while the bearer is still valid, so
-        // no orphan device row is left behind (§11). Keeps the opt-in intent so push
-        // resumes on the next sign-in; best-effort, never blocks the logout.
-        try {
-            pushManager.deregisterDevice()
-        } catch (e: CancellationException) {
-            throw e
-        } catch (_: Exception) {
-            // Ignore — local session teardown proceeds regardless.
-        }
         val refreshToken = sessionManager.currentRefreshToken()
         try {
             authApi.logout(MobileLogoutRequest(refreshToken = refreshToken, all = allDevices))
@@ -220,8 +112,4 @@ class AuthRepository @Inject constructor(
     } catch (_: Exception) {
         false
     }
-
-    private companion object {
-        const val DISCOVERY_RETRY_DELAY_MS = 400L
-    }
 }

app/src/main/java/com/runicgateway/app/data/repository/ConnectionRepository.kt

@@ -4,7 +4,6 @@
 package com.runicgateway.app.data.repository
 
 import com.runicgateway.app.core.auth.SessionManager
-import com.runicgateway.app.core.auth.TrustTokenStore
 import com.runicgateway.app.core.net.BaseUrlHolder
 import com.runicgateway.app.core.net.ServerUrl
 import com.runicgateway.app.core.prefs.ServerPreferences
@@ -27,9 +26,6 @@ class ConnectionRepository @Inject constructor(
     private val prefs: ServerPreferences,
     private val baseUrlHolder: BaseUrlHolder,
     private val sessionManager: SessionManager,
-    private val trustTokenStore: TrustTokenStore,
-    private val shardFeaturesRepository: ShardFeaturesRepository,
-    private val pushManager: com.runicgateway.app.core.push.PushManager,
     private val config: com.runicgateway.app.core.AppConfig,
 ) {
 
@@ -100,22 +96,7 @@ class ConnectionRepository @Inject constructor(
      * signed-out state against the new host.
      */
     suspend fun disconnect() {
-        // Deregister the push endpoint on the current (old) host while still authed,
-        // then clear the shard's ntfy URL — the new host advertises its own (§11).
-        try {
-            pushManager.deregisterDevice()
-        } catch (_: Exception) {
-            // Best-effort; the reset proceeds regardless.
-        }
-        pushManager.setNtfyUrl(null)
         sessionManager.onSignedOut()
-        // The trust token is bound to the old host — drop it so we don't replay it
-        // against a different shard (it survives a plain logout, but not a host switch).
-        trustTokenStore.clear()
-        // Shard visibility is the OLD host's answer. Sign-out alone would not clear it:
-        // a switch between two signed-out hosts changes no session, so nothing else
-        // invalidates the cache and the new shard would inherit the old one's menu.
-        shardFeaturesRepository.invalidate()
         prefs.clear()
         baseUrlHolder.set(null)
     }

app/src/main/java/com/runicgateway/app/data/repository/NotificationsRepository.kt

@@ -1,40 +0,0 @@
-/*
- * SPDX-License-Identifier: GPL-3.0-or-later
- */
-package com.runicgateway.app.data.repository
-
-import com.runicgateway.app.core.result.ApiResult
-import com.runicgateway.app.core.result.safeApiCall
-import com.runicgateway.app.data.api.NotificationsApi
-import com.runicgateway.app.data.api.dto.NotificationStreamsDto
-import com.runicgateway.app.data.api.dto.NotificationSubscriptionsDto
-import com.runicgateway.app.data.api.dto.PushDeviceDto
-import com.runicgateway.app.data.api.dto.RegisterDeviceRequest
-import javax.inject.Inject
-import javax.inject.Singleton
-
-/**
- * Device registration + per-user stream subscriptions over the opt-in push surface
- * (PLAN.md §11, M7 Part 2). Every call returns a typed [ApiResult] so the screen
- * and the [com.runicgateway.app.core.push.PushManager] degrade gracefully — a `400`
- * (endpoint off the shard's allow-set) or a down backend never throws (§7).
- */
-@Singleton
-class NotificationsRepository @Inject constructor(
-    private val api: NotificationsApi,
-) {
-    suspend fun registerDevice(endpoint: String, platform: String?): ApiResult<PushDeviceDto> =
-        safeApiCall { api.registerDevice(RegisterDeviceRequest(endpoint = endpoint, platform = platform)) }
-
-    suspend fun listDevices(): ApiResult<List<PushDeviceDto>> = safeApiCall { api.listDevices() }
-
-    suspend fun deleteDevice(id: Long): ApiResult<Unit> = safeApiCall { api.deleteDevice(id) }
-
-    suspend fun streams(): ApiResult<NotificationStreamsDto> = safeApiCall { api.streams() }
-
-    suspend fun subscriptions(): ApiResult<NotificationSubscriptionsDto> =
-        safeApiCall { api.subscriptions() }
-
-    suspend fun setSubscriptions(streams: List<String>): ApiResult<NotificationSubscriptionsDto> =
-        safeApiCall { api.putSubscriptions(NotificationSubscriptionsDto(streams)) }
-}

app/src/main/java/com/runicgateway/app/data/repository/ShardFeaturesRepository.kt

@@ -1,111 +0,0 @@
-/*
- * SPDX-License-Identifier: GPL-3.0-or-later
- */
-package com.runicgateway.app.data.repository
-
-import com.runicgateway.app.core.result.ApiResult
-import com.runicgateway.app.core.result.safeApiCall
-import com.runicgateway.app.data.api.PublicApi
-import kotlinx.coroutines.flow.MutableStateFlow
-import kotlinx.coroutines.flow.StateFlow
-import kotlinx.coroutines.flow.asStateFlow
-import kotlinx.coroutines.sync.Mutex
-import kotlinx.coroutines.sync.withLock
-import javax.inject.Inject
-import javax.inject.Singleton
-
-/**
- * Which shard surfaces the current viewer may reach, from
- * `GET /public/shard/features` (PLAN.md §5, §9 M11).
- *
- * Every shard-derived feature is admin-configurable — it can be switched off, or its
- * audience raised above the caller's rung — so shard navigation can no longer be a
- * static list gated on the session role alone. [level] is the server's own answer on
- * the `anonymous → logged_in → player → staff → admin` ladder; the app does not
- * re-derive it.
- *
- * **This is presentation only.** The gate is server-side: a disabled feature `404`s
- * and an out-of-rung one `403`s whether or not the entry was rendered. That is why an
- * unknown answer deliberately **fails open** — see [ShardFeatures] and [canSee].
- */
-@Singleton
-class ShardFeaturesRepository @Inject constructor(
-    private val api: PublicApi,
-) {
-    private val _features = MutableStateFlow<ShardFeatures?>(null)
-
-    /** The current answer, or `null` while it is unknown (in flight, or the lookup failed). */
-    val features: StateFlow<ShardFeatures?> = _features.asStateFlow()
-
-    // Serializes concurrent refreshes: the shell refreshes on every session change,
-    // and two overlapping loads would race to publish.
-    private val mutex = Mutex()
-
-    /**
-     * Re-resolve the visible set. Called on every session change (sign-in, sign-out,
-     * a role revalidation that actually changed the user), because the answer is
-     * per-viewer.
-     *
-     * A failed lookup clears the cache rather than keeping a stale one: falling back
-     * to "show everything" is the safe direction here, since the server still gates
-     * every call.
-     */
-    suspend fun refresh() = mutex.withLock {
-        _features.value = when (val result = safeApiCall { api.getShardFeatures() }) {
-            is ApiResult.Ok -> ShardFeatures(
-                level = result.data.level,
-                visible = result.data.features.toSet(),
-            )
-            // Includes the 404 an older, pre-Protocol-3.0 website returns for this
-            // route — that site has no visibility framework, so "unknown" is exactly
-            // the right answer and the menu behaves as it did before M11.
-            else -> null
-        }
-    }
-
-    /**
-     * Drop the cached answer. Called on a Settings → Server switch: the features
-     * belong to the host that reported them, and a switch between two signed-out
-     * hosts changes no session, so nothing else would invalidate them.
-     */
-    fun invalidate() {
-        _features.value = null
-    }
-}
-
-/**
- * The resolved visibility answer for one viewer: the rung the server placed them on
- * and the shard features they may reach.
- */
-data class ShardFeatures(
-    val level: String?,
-    val visible: Set<String>,
-)
-
-/**
- * True when [feature] may be shown — **or when the answer isn't known yet**.
- *
- * The fail-open default is deliberate and matches the web client (`lib/useShardFeatures.js`):
- * the server gates every call regardless, so the cost of guessing wrong is a link that
- * briefly `403`s, while the cost of guessing the other way is a navigation drawer that
- * flickers its entries in on every cold start.
- */
-fun canSee(features: ShardFeatures?, feature: String): Boolean =
-    features == null || feature in features.visible
-
-/** Feature names as the website's `shardVisibility.js` `FEATURES` map spells them. */
-object ShardFeature {
-    const val STATUS = "status"
-    const val ACTIVITY = "activity"
-    const val CHAMPS = "champs"
-    const val GUILDS = "guilds"
-    const val GOVERNORS = "governors"
-    const val HOUSES = "houses"
-    const val PRESENCE = "presence"
-
-    // Added by Protocol 3.0.
-    const val RULESET = "ruleset"
-    const val ATLAS = "atlas"
-    const val LEADERBOARDS = "leaderboards"
-    const val MARKET = "market"
-}

app/src/main/java/com/runicgateway/app/data/repository/ShardRepository.kt

@@ -3,13 +3,11 @@
  */
 package com.runicgateway.app.data.repository
 
-import com.runicgateway.app.core.net.ShardStream
+import com.runicgateway.app.core.net.ShardStreamClient
 import com.runicgateway.app.core.net.ShardStreamEvent
 import com.runicgateway.app.core.result.ApiResult
 import com.runicgateway.app.core.result.safeApiCall
 import com.runicgateway.app.data.api.PublicApi
-import com.runicgateway.app.data.api.dto.AtlasCreatureDto
-import com.runicgateway.app.data.api.dto.AtlasCreaturePageDto
 import com.runicgateway.app.data.api.dto.ChampDto
 import com.runicgateway.app.data.api.dto.EconomySampleDto
 import com.runicgateway.app.data.api.dto.FeedEventDto
@@ -17,13 +15,8 @@ import com.runicgateway.app.data.api.dto.GovernorDto
 import com.runicgateway.app.data.api.dto.GovernorTermDto
 import com.runicgateway.app.data.api.dto.GuildDto
 import com.runicgateway.app.data.api.dto.HouseDto
-import com.runicgateway.app.data.api.dto.MarketMetaDto
-import com.runicgateway.app.data.api.dto.MarketPageDto
-import com.runicgateway.app.data.api.dto.MarketVendorDto
 import com.runicgateway.app.data.api.dto.OnlineStaffDto
-import com.runicgateway.app.data.api.dto.PointsBoardDto
 import com.runicgateway.app.data.api.dto.PresenceDto
-import com.runicgateway.app.data.api.dto.RulesetDto
 import com.runicgateway.app.data.api.dto.ShardStatusDto
 import kotlinx.coroutines.flow.Flow
 import kotlinx.serialization.KSerializer
@@ -42,7 +35,7 @@ import javax.inject.Singleton
 @Singleton
 class ShardRepository @Inject constructor(
     private val api: PublicApi,
-    private val stream: ShardStream,
+    private val stream: ShardStreamClient,
     private val json: Json,
 ) {
     // ── Snapshots ────────────────────────────────────────────────────────
@@ -69,59 +62,6 @@ class ShardRepository @Inject constructor(
 
     suspend fun houses(): ApiResult<List<HouseDto>> = safeApiCall { api.getShardHouses() }
 
-    // ── Protocol 3.0 shard content (§9 M11) ──────────────────────────────
-    //
-    // All four sit behind `requireFeature`, so a 404/403 here is "this shard doesn't
-    // publish it" rather than a fault — see `toShardUiState()`.
-
-    /** The shard ruleset, or `Ok(null)` when the shard has never published one. */
-    suspend fun ruleset(): ApiResult<RulesetDto?> = safeApiCall { api.getShardRuleset() }
-
-    suspend fun pointsBoards(): ApiResult<List<PointsBoardDto>> = safeApiCall { api.getShardPoints() }
-
-    suspend fun pointsBoard(system: String): ApiResult<PointsBoardDto> =
-        safeApiCall { api.getShardPointsBoard(system) }
-
-    suspend fun market(
-        query: String? = null,
-        map: String? = null,
-        region: String? = null,
-        sort: String = SORT_PRICE_ASC,
-        limit: Int = MARKET_PAGE,
-        offset: Int = 0,
-    ): ApiResult<MarketPageDto> = safeApiCall {
-        api.getShardMarket(
-            query = query?.takeIf { it.isNotBlank() },
-            map = map?.takeIf { it.isNotBlank() },
-            region = region?.takeIf { it.isNotBlank() },
-            sort = sort,
-            limit = limit,
-            offset = offset,
-        )
-    }
-
-    suspend fun marketMeta(): ApiResult<MarketMetaDto> = safeApiCall { api.getShardMarketMeta() }
-
-    suspend fun marketVendor(serial: String): ApiResult<MarketVendorDto> =
-        safeApiCall { api.getShardMarketVendor(serial) }
-
-    suspend fun atlasCreatures(
-        query: String? = null,
-        facet: String? = null,
-        limit: Int = ATLAS_PAGE,
-        offset: Int = 0,
-    ): ApiResult<AtlasCreaturePageDto> = safeApiCall {
-        api.getAtlasCreatures(
-            query = query?.takeIf { it.isNotBlank() },
-            facet = facet?.takeIf { it.isNotBlank() },
-            limit = limit,
-            offset = offset,
-        )
-    }
-
-    suspend fun atlasCreature(slug: String): ApiResult<AtlasCreatureDto> =
-        safeApiCall { api.getAtlasCreature(slug) }
-
     // ── Live stream ──────────────────────────────────────────────────────
     /** The shared public SSE feed (safe kinds only), reconnecting with backoff (§7). */
     fun liveEvents(): Flow<ShardStreamEvent> = stream.events()
@@ -133,27 +73,9 @@ class ShardRepository @Inject constructor(
     fun governorFrame(obj: JsonObject): GovernorDto? = decode(obj, GovernorDto.serializer())
     fun presenceFrame(obj: JsonObject): PresenceDto? = decode(obj, PresenceDto.serializer())
 
-    // Protocol 3.0 frames. `world.ruleset` and `points.board` ride the public stream by
-    // default; `vendor.listing` does NOT — the market feature ships with its SSE fan-out
-    // disabled (a live firehose of vendor inventories would be the site's biggest
-    // bandwidth consumer), so the market screen is a plain paginated read and must never
-    // wait on a frame.
-    fun rulesetFrame(obj: JsonObject): RulesetDto? = decode(obj, RulesetDto.serializer())
-    fun pointsBoardFrame(obj: JsonObject): PointsBoardDto? = decode(obj, PointsBoardDto.serializer())
-
     private fun <T> decode(obj: JsonObject, serializer: KSerializer<T>): T? = try {
         json.decodeFromJsonElement(serializer, obj)
     } catch (_: Exception) {
         null
     }
-
-    companion object {
-        const val SORT_PRICE_ASC = "price_asc"
-        const val SORT_PRICE_DESC = "price_desc"
-        const val SORT_RECENT = "recent"
-
-        /** The server caps `limit` at 100; stay well under it on a phone. */
-        const val MARKET_PAGE = 50
-        const val ATLAS_PAGE = 50
-    }
 }

app/src/main/java/com/runicgateway/app/di/NetworkModule.kt

@@ -9,18 +9,13 @@ import com.runicgateway.app.BuildConfig
 import com.runicgateway.app.core.net.AuthInterceptor
 import com.runicgateway.app.core.net.BaseUrlHolder
 import com.runicgateway.app.core.net.HostSelectionInterceptor
-import com.runicgateway.app.core.net.ShardStream
-import com.runicgateway.app.core.net.ShardStreamClient
 import com.runicgateway.app.core.net.TokenAuthenticator
 import com.runicgateway.app.core.net.UserAgentInterceptor
 import com.runicgateway.app.data.api.AuthApi
 import com.runicgateway.app.data.api.AuthRefreshApi
 import com.runicgateway.app.data.api.MeApi
-import com.runicgateway.app.data.api.AdminApi
-import com.runicgateway.app.data.api.NotificationsApi
 import com.runicgateway.app.data.api.PlayerShardApi
 import com.runicgateway.app.data.api.PublicApi
-import com.runicgateway.app.data.api.SsoApi
 import dagger.Module
 import dagger.Provides
 import dagger.hilt.InstallIn
@@ -96,21 +91,10 @@ object NetworkModule {
     @Singleton
     fun providePublicApi(retrofit: Retrofit): PublicApi = retrofit.create(PublicApi::class.java)
 
-    /** Expose the live SSE feed as the [ShardStream] capability so repositories depend
-     *  on the interface (unit-testable against a fake), not the OkHttp-backed client. */
-    @Provides
-    @Singleton
-    fun provideShardStream(client: ShardStreamClient): ShardStream = client
-
     @Provides
     @Singleton
     fun provideAuthApi(retrofit: Retrofit): AuthApi = retrofit.create(AuthApi::class.java)
 
-    /** Native SSO discovery + code exchange (§4.2, M9) — on the main client. */
-    @Provides
-    @Singleton
-    fun provideSsoApi(retrofit: Retrofit): SsoApi = retrofit.create(SsoApi::class.java)
-
     /** Role-agnostic self-service (§6.4) — bearer-authed on the main client. */
     @Provides
     @Singleton
@@ -122,17 +106,6 @@ object NetworkModule {
     fun providePlayerShardApi(retrofit: Retrofit): PlayerShardApi =
         retrofit.create(PlayerShardApi::class.java)
 
-    /** Opt-in push devices + subscriptions (§11, M7) — bearer-authed on the main client. */
-    @Provides
-    @Singleton
-    fun provideNotificationsApi(retrofit: Retrofit): NotificationsApi =
-        retrofit.create(NotificationsApi::class.java)
-
-    /** Staff operations (§1, §6.4, M10) — bearer-authed; the server re-checks role every call. */
-    @Provides
-    @Singleton
-    fun provideAdminApi(retrofit: Retrofit): AdminApi = retrofit.create(AdminApi::class.java)
-
     /**
      * Token refresh runs on its own **bare** client — UA + host retargeting only,
      * no auth interceptor and no authenticator — so a refresh can never recurse

app/src/main/java/com/runicgateway/app/di/StorageModule.kt

@@ -3,21 +3,15 @@
  */
 package com.runicgateway.app.di
 
-import com.runicgateway.app.core.auth.BuildDeviceNameProvider
-import com.runicgateway.app.core.auth.DeviceNameProvider
 import com.runicgateway.app.core.auth.EncryptedTokenStore
-import com.runicgateway.app.core.auth.EncryptedTrustTokenStore
 import com.runicgateway.app.core.auth.TokenStore
-import com.runicgateway.app.core.auth.TrustTokenStore
-import com.runicgateway.app.core.auth.sso.EncryptedPendingSsoStore
-import com.runicgateway.app.core.auth.sso.PendingSsoStore
 import dagger.Binds
 import dagger.Module
 import dagger.hilt.InstallIn
 import dagger.hilt.components.SingletonComponent
 import javax.inject.Singleton
 
-/** Binds the at-rest stores to their EncryptedSharedPreferences impls (§4.3). */
+/** Binds the at-rest token store to its EncryptedSharedPreferences impl (§4.3). */
 @Module
 @InstallIn(SingletonComponent::class)
 abstract class StorageModule {
@@ -25,17 +19,4 @@ abstract class StorageModule {
     @Binds
     @Singleton
     abstract fun bindTokenStore(impl: EncryptedTokenStore): TokenStore
-
-    @Binds
-    @Singleton
-    abstract fun bindPendingSsoStore(impl: EncryptedPendingSsoStore): PendingSsoStore
-
-    /** The trusted-device token store — its own encrypted file, outlives session teardown. */
-    @Binds
-    @Singleton
-    abstract fun bindTrustTokenStore(impl: EncryptedTrustTokenStore): TrustTokenStore
-
-    @Binds
-    @Singleton
-    abstract fun bindDeviceNameProvider(impl: BuildDeviceNameProvider): DeviceNameProvider
 }

app/src/main/java/com/runicgateway/app/ui/AppViewModel.kt

@@ -6,7 +6,6 @@ package com.runicgateway.app.ui
 import androidx.lifecycle.ViewModel
 import androidx.lifecycle.viewModelScope
 import com.runicgateway.app.core.net.BaseUrlHolder
-import com.runicgateway.app.core.push.PushManager
 import com.runicgateway.app.core.result.ApiResult
 import com.runicgateway.app.data.api.dto.BrandDto
 import com.runicgateway.app.data.repository.ConnectionRepository
@@ -28,7 +27,6 @@ class AppViewModel @Inject constructor(
     private val connectionRepository: ConnectionRepository,
     private val settingsRepository: SettingsRepository,
     private val baseUrlHolder: BaseUrlHolder,
-    private val pushManager: PushManager,
 ) : ViewModel() {
 
     sealed interface AppState {
@@ -68,16 +66,8 @@ class AppViewModel @Inject constructor(
         }
     }
 
-    /**
+    private suspend fun loadBrand(): BrandDto? =
-     * Load public settings for branding and feed the shard's push relay URL into the
+        (settingsRepository.getSettings() as? ApiResult.Ok)?.data?.brand
-     * [PushManager] (§11) — its arrival is what lets push re-register after a restart
-     * or sign-in. Returns the brand block (null if settings couldn't be loaded).
-     */
-    private suspend fun loadBrand(): BrandDto? {
-        val settings = (settingsRepository.getSettings() as? ApiResult.Ok)?.data
-        pushManager.setNtfyUrl(settings?.push?.ntfyUrl)
-        return settings?.brand
-    }
 
     /**
      * Resolve a possibly site-relative asset path (branding logos, post images)

app/src/main/java/com/runicgateway/app/ui/RunicApp.kt

@@ -3,12 +3,9 @@
  */
 package com.runicgateway.app.ui
 
-import androidx.compose.foundation.layout.Column
 import androidx.compose.foundation.layout.Spacer
 import androidx.compose.foundation.layout.height
 import androidx.compose.foundation.layout.padding
-import androidx.compose.foundation.rememberScrollState
-import androidx.compose.foundation.verticalScroll
 import androidx.compose.material.icons.Icons
 import androidx.compose.material.icons.automirrored.filled.ArrowBack
 import androidx.compose.material.icons.filled.Menu
@@ -51,8 +48,6 @@ import com.runicgateway.app.core.auth.Session
 import com.runicgateway.app.data.api.dto.BrandDto
 import com.runicgateway.app.ui.auth.AccountScreen
 import com.runicgateway.app.ui.auth.LoginScreen
-import com.runicgateway.app.ui.auth.RecoveryCodesScreen
-import com.runicgateway.app.ui.auth.TrustedDevicesScreen
 import com.runicgateway.app.ui.auth.roleLabelRes
 import com.runicgateway.app.ui.contact.ContactScreen
 import com.runicgateway.app.ui.home.HomeScreen
@@ -61,27 +56,16 @@ import com.runicgateway.app.ui.navigation.Routes
 import com.runicgateway.app.ui.navigation.visibleEntries
 import com.runicgateway.app.ui.news.NewsScreen
 import com.runicgateway.app.ui.news.PostScreen
-import com.runicgateway.app.ui.admin.AdminContentScreen
-import com.runicgateway.app.ui.admin.AdminDashboardScreen
-import com.runicgateway.app.ui.admin.AdminModerationScreen
-import com.runicgateway.app.ui.admin.AdminSupportScreen
-import com.runicgateway.app.ui.notifications.NotificationsScreen
 import com.runicgateway.app.ui.page.PageScreen
 import com.runicgateway.app.ui.player.CharacterSheetScreen
 import com.runicgateway.app.ui.player.CharactersScreen
 import com.runicgateway.app.ui.player.MyHousesScreen
 import com.runicgateway.app.ui.player.VendorsScreen
 import com.runicgateway.app.ui.session.SessionViewModel
-import com.runicgateway.app.ui.shard.AtlasCreatureScreen
-import com.runicgateway.app.ui.shard.AtlasScreen
 import com.runicgateway.app.ui.shard.ChampsScreen
 import com.runicgateway.app.ui.shard.GovernorsScreen
 import com.runicgateway.app.ui.shard.GuildsScreen
 import com.runicgateway.app.ui.shard.HousesScreen
-import com.runicgateway.app.ui.shard.LeaderboardsScreen
-import com.runicgateway.app.ui.shard.MarketScreen
-import com.runicgateway.app.ui.shard.MarketVendorScreen
-import com.runicgateway.app.ui.shard.RulesScreen
 import com.runicgateway.app.ui.shard.ShardBoard
 import com.runicgateway.app.ui.shard.ShardScreen
 import com.runicgateway.app.ui.wiki.WikiPageScreen
@@ -91,12 +75,7 @@ import kotlinx.coroutines.launch
 /** Destinations that show the drawer (hamburger); others show a back arrow. */
 private val TOP_LEVEL_ROUTES = setOf(
     Routes.HOME, Routes.NEWS, Routes.WIKI, Routes.SHARD, Routes.CONTACT, Routes.PAGE, Routes.ACCOUNT,
-    // Protocol 3.0 content screens are drawer destinations, so the drawer gesture works
-    // on them too (M11).
-    Routes.SHARD_RULES, Routes.SHARD_LEADERBOARDS, Routes.SHARD_MARKET, Routes.ATLAS,
-    Routes.NOTIFICATIONS,
     Routes.PLAYER_CHARACTERS, Routes.PLAYER_VENDORS, Routes.PLAYER_HOUSES,
-    Routes.ADMIN_DASHBOARD, Routes.ADMIN_CONTENT, Routes.ADMIN_MODERATION, Routes.ADMIN_SUPPORT,
 )
 
 /**
@@ -112,8 +91,6 @@ fun RunicApp(
     brand: BrandDto?,
     onChangeServer: () -> Unit,
     modifier: Modifier = Modifier,
-    deepLinkStream: String? = null,
-    onDeepLinkConsumed: () -> Unit = {},
     sessionViewModel: SessionViewModel = hiltViewModel(),
 ) {
     val navController = rememberNavController()
@@ -121,8 +98,6 @@ fun RunicApp(
     val scope = rememberCoroutineScope()
 
     val session by sessionViewModel.session.collectAsStateWithLifecycle()
-    // What this shard publishes, independently of who the caller is (§5, M11).
-    val shardFeatures by sessionViewModel.shardFeatures.collectAsStateWithLifecycle()
 
     // Re-validate the cached role each time the app returns to the foreground (§4.3).
     LifecycleResumeEffect(Unit) {
@@ -130,20 +105,10 @@ fun RunicApp(
         onPauseOrDispose { }
     }
 
-    // A tapped push notification deep-links to its stream's screen (§11, item 7).
-    LaunchedEffect(deepLinkStream) {
-        val stream = deepLinkStream ?: return@LaunchedEffect
-        navController.navigate(Routes.forStream(stream)) {
-            popUpTo(Routes.HOME) { saveState = true }
-            launchSingleTop = true
-        }
-        onDeepLinkConsumed()
-    }
-
     val backStackEntry by navController.currentBackStackEntryAsState()
     val currentRoute = backStackEntry?.destination?.route
     val isTopLevel = currentRoute in TOP_LEVEL_ROUTES
-    val entries = visibleEntries(APP_MENU, session, shardFeatures)
+    val entries = visibleEntries(APP_MENU, session)
 
     ModalNavigationDrawer(
         drawerState = drawerState,
@@ -155,11 +120,6 @@ fun RunicApp(
                     selectedTextColor = MaterialTheme.colorScheme.onSecondaryContainer,
                     unselectedTextColor = MaterialTheme.colorScheme.onSurface,
                 )
-                // Scroll the drawer: a signed-in session adds Account, Notifications, and
-                // the player groups, and the full list overflows a phone's drawer height —
-                // without this the lower entries (Notifications included) are clipped and
-                // unreachable. See RunicGateway M10.
-                Column(Modifier.verticalScroll(rememberScrollState())) {
                 Spacer(Modifier.height(12.dp))
                 Text(
                     text = brand?.name?.takeIf { it.isNotBlank() } ?: stringResource(R.string.app_name),
@@ -215,7 +175,6 @@ fun RunicApp(
                     colors = drawerItemColors,
                     modifier = Modifier.padding(NavigationDrawerItemDefaults.ItemPadding),
                 )
-                }
             }
         },
     ) {
@@ -314,30 +273,6 @@ private fun RunicNavHost(
         composable(Routes.SHARD_GUILDS) { GuildsScreen() }
         composable(Routes.SHARD_GOVERNORS) { GovernorsScreen() }
         composable(Routes.SHARD_HOUSES) { HousesScreen() }
-
-        // Protocol 3.0 shard content (M11). Each screen self-reports "not published
-        // here" from its own 404/403, so a deep link to a gated feature still lands on
-        // an honest answer even though the menu hides the entry.
-        composable(Routes.SHARD_RULES) { RulesScreen() }
-        composable(Routes.SHARD_LEADERBOARDS) { LeaderboardsScreen(brand = brand) }
-        composable(Routes.SHARD_MARKET) {
-            MarketScreen(onOpenVendor = { serial -> navController.navigate(Routes.marketVendor(serial)) })
-        }
-        composable(
-            route = Routes.SHARD_MARKET_VENDOR,
-            arguments = listOf(navArgument(Routes.Args.SERIAL) { type = NavType.StringType }),
-        ) { entry ->
-            MarketVendorScreen(serial = entry.arguments?.getString(Routes.Args.SERIAL).orEmpty())
-        }
-        composable(Routes.ATLAS) {
-            AtlasScreen(onOpenCreature = { slug -> navController.navigate(Routes.atlasCreature(slug)) })
-        }
-        composable(
-            route = Routes.ATLAS_CREATURE,
-            arguments = listOf(navArgument(Routes.Args.SLUG) { type = NavType.StringType }),
-        ) { entry ->
-            AtlasCreatureScreen(slug = entry.arguments?.getString(Routes.Args.SLUG).orEmpty())
-        }
         composable(Routes.WIKI) {
             WikiScreen(onOpenPage = { slug -> navController.navigate(Routes.wikiPage(slug)) })
         }
@@ -357,15 +292,7 @@ private fun RunicNavHost(
             ContactScreen()
         }
         composable(Routes.LOGIN) {
-            // Leave the login screen as soon as the session is established — whether by
+            LoginScreen(onSignedIn = { navController.popBackStack() })
-            // password or the SSO bridge. Keying off the shared session (not just the
-            // login VM's local flag) makes this robust to the deep-link/recomposition
-            // timing of the Custom-Tab return, which the LoginScreen callback alone can miss.
-            if (session is Session.SignedIn) {
-                LaunchedEffect(Unit) { navController.popBackStack(Routes.LOGIN, inclusive = true) }
-            } else {
-                LoginScreen(onSignedIn = { navController.popBackStack() })
-            }
         }
         composable(Routes.ACCOUNT) {
             // Only meaningful while signed in; a sign-out (here or from the drawer)
@@ -376,35 +303,12 @@ private fun RunicNavHost(
                     roleLabel = stringResource(roleLabelRes(s.user.role)),
                     onSignOut = onSignOut,
                     onSignOutEverywhere = onSignOutEverywhere,
-                    onOpenTrustedDevices = { navController.navigate(Routes.ACCOUNT_TRUSTED_DEVICES) },
-                    onOpenRecoveryCodes = { navController.navigate(Routes.ACCOUNT_RECOVERY_CODES) },
                 )
                 Session.SignedOut -> LaunchedEffect(Unit) {
                     navController.navigateTopLevel(Routes.HOME)
                 }
             }
         }
-        composable(Routes.ACCOUNT_TRUSTED_DEVICES) {
-            // Signed-in only; a drop (sign-out/demotion) sends the user home (§4.3).
-            when (session) {
-                is Session.SignedIn -> TrustedDevicesScreen()
-                Session.SignedOut -> LaunchedEffect(Unit) { navController.navigateTopLevel(Routes.HOME) }
-            }
-        }
-        composable(Routes.ACCOUNT_RECOVERY_CODES) {
-            when (session) {
-                is Session.SignedIn -> RecoveryCodesScreen()
-                Session.SignedOut -> LaunchedEffect(Unit) { navController.navigateTopLevel(Routes.HOME) }
-            }
-        }
-        composable(Routes.NOTIFICATIONS) {
-            // Signed-in only; a sign-out (or demotion) sends the user home rather than
-            // leaving stale settings up. The backend gates every call regardless (§5).
-            when (session) {
-                is Session.SignedIn -> NotificationsScreen()
-                Session.SignedOut -> LaunchedEffect(Unit) { navController.navigateTopLevel(Routes.HOME) }
-            }
-        }
 
         // ── Player game data (§6.3) — reached from the player-only menu groups.
         // The server enforces the player gate on every call; these screens simply
@@ -426,24 +330,6 @@ private fun RunicNavHost(
         composable(Routes.PLAYER_HOUSES) {
             PlayerGate(session, navController) { MyHousesScreen() }
         }
-
-        // ── Staff operations (§1, §6.4, M10) — reached from the staff menu section.
-        // The backend re-checks role on every /admin/… call; these gates only mirror
-        // the menu's visibility so a signed-out/demoted user isn't left on a stale screen.
-        composable(Routes.ADMIN_DASHBOARD) {
-            StaffGate(session, navController) {
-                AdminDashboardScreen(isAdmin = (session as? Session.SignedIn)?.user?.isAdmin == true)
-            }
-        }
-        composable(Routes.ADMIN_CONTENT) {
-            StaffGate(session, navController) { AdminContentScreen() }
-        }
-        composable(Routes.ADMIN_MODERATION) {
-            StaffGate(session, navController, require = { it.isModerator }) { AdminModerationScreen() }
-        }
-        composable(Routes.ADMIN_SUPPORT) {
-            StaffGate(session, navController, require = { it.isModerator }) { AdminSupportScreen() }
-        }
     }
 }
 
@@ -465,23 +351,6 @@ private fun PlayerGate(
     }
 }
 
-/**
- * The staff-operations analogue of [PlayerGate] (§1, M10): render [content] only for
- * a signed-in staff account; a signed-out/demoted session (caught on resume, §4.3) is
- * sent home rather than left on a stale admin screen. The backend is the authority —
- * every `/admin/…` call re-checks role — so this only mirrors the menu's visibility.
- */
-@Composable
-private fun StaffGate(
-    session: Session,
-    navController: NavHostController,
-    require: (com.runicgateway.app.core.auth.SessionUser) -> Boolean = { it.isStaff },
-    content: @Composable () -> Unit,
-) {
-    val ok = (session as? Session.SignedIn)?.user?.let(require) == true
-    if (ok) content() else LaunchedEffect(Unit) { navController.navigateTopLevel(Routes.HOME) }
-}
-
 /** Navigate to a top-level menu destination: single instance, reset to it. */
 private fun NavHostController.navigateTopLevel(route: String) {
     navigate(route) {

app/src/main/java/com/runicgateway/app/ui/UiState.kt

@@ -34,13 +34,6 @@ enum class ErrorKind {
     /** Shard/sidecar down (503) — shard reads only; render as offline (§6.3). */
     SHARD_OFFLINE,
 
-    /**
-     * This shard doesn't publish the surface, or doesn't publish it to this viewer
-     * (M11). Distinct from [NOT_FOUND] and [SHARD_OFFLINE]: the site is up, the shard
-     * may well be up, and retrying changes nothing — an admin decides this.
-     */
-    FEATURE_UNAVAILABLE,
-
     /** Any other non-2xx server response. */
     SERVER,
 }
@@ -59,27 +52,3 @@ fun <T> ApiResult<T>.toUiState(): UiState<T> = when (this) {
         httpStatus = status,
     )
 }
-
-/**
- * [toUiState] for a **shard-derived** read, where `404` carries a second meaning.
- *
- * The website's `requireFeature` gate answers `404` when a feature is switched off —
- * deliberately, so the response doesn't disclose that the surface exists — and `403`
- * when it's on but the caller is below its audience rung (`docs/link/v3.md` §3.6).
- * On these routes a `404` therefore almost never means "no such thing"; it means this
- * shard doesn't publish it. Rendering "couldn't be found" with a retry button would
- * invite the user to retry something an admin controls.
- *
- * Kept as a separate mapper rather than folded into [toUiState] because both statuses
- * mean something else off the shard surface: `404` is a genuinely missing item (a
- * deleted post, an unknown wiki slug) and `403` is an ownership or role refusal on a
- * player or admin route, which is not an admin's visibility setting.
- */
-fun <T> ApiResult<T>.toShardUiState(): UiState<T> = when (this) {
-    is ApiResult.HttpError -> if (status == 403 || status == 404) {
-        UiState.Error(ErrorKind.FEATURE_UNAVAILABLE, httpStatus = status)
-    } else {
-        toUiState()
-    }
-    else -> toUiState()
-}

app/src/main/java/com/runicgateway/app/ui/admin/AdminContentScreen.kt

@@ -1,291 +0,0 @@
-/*
- * SPDX-License-Identifier: GPL-3.0-or-later
- */
-package com.runicgateway.app.ui.admin
-
-import androidx.compose.foundation.layout.Arrangement
-import androidx.compose.foundation.layout.Column
-import androidx.compose.foundation.layout.Row
-import androidx.compose.foundation.layout.Spacer
-import androidx.compose.foundation.layout.fillMaxSize
-import androidx.compose.foundation.layout.fillMaxWidth
-import androidx.compose.foundation.layout.height
-import androidx.compose.foundation.layout.padding
-import androidx.compose.foundation.layout.width
-import androidx.compose.foundation.lazy.LazyColumn
-import androidx.compose.foundation.lazy.items
-import androidx.compose.material3.AlertDialog
-import androidx.compose.material3.Card
-import androidx.compose.material3.FilterChip
-import androidx.compose.material3.HorizontalDivider
-import androidx.compose.material3.MaterialTheme
-import androidx.compose.material3.OutlinedButton
-import androidx.compose.material3.OutlinedTextField
-import androidx.compose.material3.Switch
-import androidx.compose.material3.Tab
-import androidx.compose.material3.TabRow
-import androidx.compose.material3.Text
-import androidx.compose.material3.TextButton
-import androidx.compose.runtime.Composable
-import androidx.compose.runtime.getValue
-import androidx.compose.runtime.mutableIntStateOf
-import androidx.compose.runtime.mutableStateOf
-import androidx.compose.runtime.saveable.rememberSaveable
-import androidx.compose.runtime.setValue
-import androidx.compose.ui.Alignment
-import androidx.compose.ui.Modifier
-import androidx.compose.ui.res.stringResource
-import androidx.compose.ui.unit.dp
-import androidx.hilt.navigation.compose.hiltViewModel
-import androidx.lifecycle.compose.collectAsStateWithLifecycle
-import com.runicgateway.app.R
-import com.runicgateway.app.data.api.dto.AdminPostDto
-import com.runicgateway.app.data.api.dto.AdminWikiCategoryDto
-import com.runicgateway.app.data.api.dto.AdminWikiTagDto
-import com.runicgateway.app.ui.UiState
-import com.runicgateway.app.ui.components.ErrorView
-import com.runicgateway.app.ui.components.LoadingView
-import com.runicgateway.app.ui.components.PillTone
-import com.runicgateway.app.ui.components.StatusPill
-
-/**
- * The staff content screen (PLAN.md §1, M10): news posts and wiki taxonomy, in two
- * tabs. Create/publish/delete over the existing `/admin/posts` + `/admin/wiki/…`
- * routes; the CMS block/hero editor stays out of scope. Any staff role; the server
- * re-checks on every call.
- */
-@Composable
-fun AdminContentScreen(
-    modifier: Modifier = Modifier,
-    viewModel: AdminContentViewModel = hiltViewModel(),
-) {
-    val state by viewModel.state.collectAsStateWithLifecycle()
-    var tab by rememberSaveable { mutableIntStateOf(0) }
-    var showNewPost by rememberSaveable { mutableStateOf(false) }
-    var showNewCategory by rememberSaveable { mutableStateOf(false) }
-
-    Column(modifier.fillMaxSize()) {
-        TabRow(selectedTabIndex = tab) {
-            Tab(selected = tab == 0, onClick = { tab = 0 }, text = { Text(stringResource(R.string.admin_content_tab_posts)) })
-            Tab(selected = tab == 1, onClick = { tab = 1 }, text = { Text(stringResource(R.string.admin_content_tab_wiki)) })
-        }
-
-        state.feedback?.let {
-            Text(
-                text = stringResource(it.messageRes),
-                style = MaterialTheme.typography.bodySmall,
-                color = if (it.ok) MaterialTheme.colorScheme.onSurfaceVariant else MaterialTheme.colorScheme.error,
-                modifier = Modifier.fillMaxWidth().padding(horizontal = 16.dp, vertical = 6.dp),
-            )
-        }
-
-        when (tab) {
-            0 -> PostsTab(
-                state = state.posts,
-                busy = state.busy,
-                onNew = { showNewPost = true },
-                onToggle = viewModel::togglePublish,
-                onDelete = viewModel::deletePost,
-                onRetry = viewModel::loadPosts,
-            )
-            else -> WikiTab(
-                state = state.categories,
-                tags = state.tags,
-                busy = state.busy,
-                onNew = { showNewCategory = true },
-                onDelete = viewModel::deleteCategory,
-                onRetry = viewModel::loadWiki,
-            )
-        }
-    }
-
-    if (showNewPost) {
-        NewPostDialog(
-            categories = viewModel.postCategories,
-            onDismiss = { showNewPost = false },
-            onCreate = { cat, title, excerpt, body, published ->
-                viewModel.createPost(cat, title, excerpt, body, published)
-                showNewPost = false
-            },
-        )
-    }
-    if (showNewCategory) {
-        NewCategoryDialog(
-            onDismiss = { showNewCategory = false },
-            onCreate = { slug, title, desc, sort ->
-                viewModel.createCategory(slug, title, desc, sort)
-                showNewCategory = false
-            },
-        )
-    }
-}
-
-@Composable
-private fun PostsTab(
-    state: UiState<List<AdminPostDto>>,
-    busy: Boolean,
-    onNew: () -> Unit,
-    onToggle: (AdminPostDto) -> Unit,
-    onDelete: (Long) -> Unit,
-    onRetry: () -> Unit,
-) {
-    when (state) {
-        is UiState.Loading -> LoadingView()
-        is UiState.Error -> ErrorView(state.kind, onRetry = onRetry)
-        is UiState.Success -> LazyColumn(Modifier.fillMaxSize().padding(16.dp)) {
-            item {
-                OutlinedButton(onClick = onNew, enabled = !busy, modifier = Modifier.fillMaxWidth().padding(bottom = 8.dp)) {
-                    Text(stringResource(R.string.admin_content_new_post))
-                }
-            }
-            items(state.data, key = { it.id }) { post ->
-                Card(Modifier.fillMaxWidth().padding(vertical = 6.dp)) {
-                    Column(Modifier.padding(12.dp)) {
-                        Text(post.title, style = MaterialTheme.typography.bodyLarge)
-                        Spacer(Modifier.height(4.dp))
-                        Row(verticalAlignment = Alignment.CenterVertically) {
-                            StatusPill(
-                                text = if (post.isPublished) stringResource(R.string.admin_content_published)
-                                else stringResource(R.string.admin_content_draft),
-                                tone = if (post.isPublished) PillTone.Success else PillTone.Neutral,
-                            )
-                            Spacer(Modifier.width(8.dp))
-                            Text(post.category, style = MaterialTheme.typography.bodySmall, color = MaterialTheme.colorScheme.onSurfaceVariant)
-                        }
-                        Row(Modifier.fillMaxWidth().padding(top = 8.dp), horizontalArrangement = Arrangement.End) {
-                            TextButton(onClick = { onToggle(post) }, enabled = !busy) {
-                                Text(
-                                    stringResource(
-                                        if (post.isPublished) R.string.admin_content_unpublish else R.string.admin_content_publish,
-                                    ),
-                                )
-                            }
-                            TextButton(onClick = { onDelete(post.id) }, enabled = !busy) {
-                                Text(stringResource(R.string.admin_content_delete), color = MaterialTheme.colorScheme.error)
-                            }
-                        }
-                    }
-                }
-            }
-        }
-    }
-}
-
-@Composable
-private fun WikiTab(
-    state: UiState<List<AdminWikiCategoryDto>>,
-    tags: List<AdminWikiTagDto>,
-    busy: Boolean,
-    onNew: () -> Unit,
-    onDelete: (Long) -> Unit,
-    onRetry: () -> Unit,
-) {
-    when (state) {
-        is UiState.Loading -> LoadingView()
-        is UiState.Error -> ErrorView(state.kind, onRetry = onRetry)
-        is UiState.Success -> LazyColumn(Modifier.fillMaxSize().padding(16.dp)) {
-            item {
-                OutlinedButton(onClick = onNew, enabled = !busy, modifier = Modifier.fillMaxWidth().padding(bottom = 8.dp)) {
-                    Text(stringResource(R.string.admin_content_new_category))
-                }
-            }
-            items(state.data, key = { it.id }) { cat ->
-                Card(Modifier.fillMaxWidth().padding(vertical = 6.dp)) {
-                    Column(Modifier.padding(12.dp)) {
-                        Text(cat.title, style = MaterialTheme.typography.bodyLarge)
-                        Text(
-                            text = stringResource(R.string.admin_content_cat_meta, cat.slug, cat.pageCount ?: 0),
-                            style = MaterialTheme.typography.bodySmall,
-                            color = MaterialTheme.colorScheme.onSurfaceVariant,
-                        )
-                        Row(Modifier.fillMaxWidth().padding(top = 8.dp), horizontalArrangement = Arrangement.End) {
-                            TextButton(onClick = { onDelete(cat.id) }, enabled = !busy) {
-                                Text(stringResource(R.string.admin_content_delete), color = MaterialTheme.colorScheme.error)
-                            }
-                        }
-                    }
-                }
-            }
-            if (tags.isNotEmpty()) {
-                item {
-                    HorizontalDivider(Modifier.padding(vertical = 12.dp))
-                    Text(
-                        stringResource(R.string.admin_content_tags, tags.joinToString(", ") { it.label }),
-                        style = MaterialTheme.typography.bodySmall,
-                        color = MaterialTheme.colorScheme.onSurfaceVariant,
-                    )
-                }
-            }
-        }
-    }
-}
-
-@Composable
-private fun NewPostDialog(
-    categories: List<String>,
-    onDismiss: () -> Unit,
-    onCreate: (category: String, title: String, excerpt: String, body: String, published: Boolean) -> Unit,
-) {
-    var category by rememberSaveable { mutableStateOf(categories.first()) }
-    var title by rememberSaveable { mutableStateOf("") }
-    var excerpt by rememberSaveable { mutableStateOf("") }
-    var body by rememberSaveable { mutableStateOf("") }
-    var published by rememberSaveable { mutableStateOf(false) }
-
-    AlertDialog(
-        onDismissRequest = onDismiss,
-        confirmButton = {
-            TextButton(onClick = { onCreate(category, title, excerpt, body, published) }) {
-                Text(stringResource(R.string.admin_content_create))
-            }
-        },
-        dismissButton = { TextButton(onClick = onDismiss) { Text(stringResource(R.string.action_cancel)) } },
-        title = { Text(stringResource(R.string.admin_content_new_post)) },
-        text = {
-            Column {
-                Row(horizontalArrangement = Arrangement.spacedBy(6.dp)) {
-                    categories.forEach { c ->
-                        FilterChip(selected = category == c, onClick = { category = c }, label = { Text(c) })
-                    }
-                }
-                OutlinedTextField(value = title, onValueChange = { title = it }, singleLine = true, label = { Text(stringResource(R.string.admin_content_field_title)) }, modifier = Modifier.fillMaxWidth().padding(top = 8.dp))
-                OutlinedTextField(value = excerpt, onValueChange = { excerpt = it }, label = { Text(stringResource(R.string.admin_content_field_excerpt)) }, modifier = Modifier.fillMaxWidth().padding(top = 8.dp))
-                OutlinedTextField(value = body, onValueChange = { body = it }, label = { Text(stringResource(R.string.admin_content_field_body)) }, modifier = Modifier.fillMaxWidth().padding(top = 8.dp))
-                Row(Modifier.fillMaxWidth().padding(top = 8.dp), verticalAlignment = Alignment.CenterVertically) {
-                    Text(stringResource(R.string.admin_content_publish_now), modifier = Modifier.weight(1f))
-                    Switch(checked = published, onCheckedChange = { published = it })
-                }
-            }
-        },
-    )
-}
-
-@Composable
-private fun NewCategoryDialog(
-    onDismiss: () -> Unit,
-    onCreate: (slug: String, title: String, description: String, sortOrder: Int?) -> Unit,
-) {
-    var slug by rememberSaveable { mutableStateOf("") }
-    var title by rememberSaveable { mutableStateOf("") }
-    var description by rememberSaveable { mutableStateOf("") }
-    var sort by rememberSaveable { mutableStateOf("") }
-
-    AlertDialog(
-        onDismissRequest = onDismiss,
-        confirmButton = {
-            TextButton(onClick = { onCreate(slug, title, description, sort.toIntOrNull()) }) {
-                Text(stringResource(R.string.admin_content_create))
-            }
-        },
-        dismissButton = { TextButton(onClick = onDismiss) { Text(stringResource(R.string.action_cancel)) } },
-        title = { Text(stringResource(R.string.admin_content_new_category)) },
-        text = {
-            Column {
-                OutlinedTextField(value = slug, onValueChange = { slug = it }, singleLine = true, label = { Text(stringResource(R.string.admin_content_field_slug)) }, modifier = Modifier.fillMaxWidth())
-                OutlinedTextField(value = title, onValueChange = { title = it }, singleLine = true, label = { Text(stringResource(R.string.admin_content_field_title)) }, modifier = Modifier.fillMaxWidth().padding(top = 8.dp))
-                OutlinedTextField(value = description, onValueChange = { description = it }, label = { Text(stringResource(R.string.admin_content_field_description)) }, modifier = Modifier.fillMaxWidth().padding(top = 8.dp))
-                OutlinedTextField(value = sort, onValueChange = { sort = it.filter(Char::isDigit) }, singleLine = true, label = { Text(stringResource(R.string.admin_content_field_sort)) }, modifier = Modifier.fillMaxWidth().padding(top = 8.dp))
-            }
-        },
-    )
-}

app/src/main/java/com/runicgateway/app/ui/admin/AdminContentViewModel.kt

@@ -1,140 +0,0 @@
-/*
- * SPDX-License-Identifier: GPL-3.0-or-later
- */
-package com.runicgateway.app.ui.admin
-
-import androidx.annotation.StringRes
-import androidx.lifecycle.ViewModel
-import androidx.lifecycle.viewModelScope
-import com.runicgateway.app.R
-import com.runicgateway.app.core.result.ApiResult
-import com.runicgateway.app.data.api.dto.AdminPostDto
-import com.runicgateway.app.data.api.dto.PostCreateRequest
-import com.runicgateway.app.data.api.dto.AdminWikiCategoryDto
-import com.runicgateway.app.data.api.dto.WikiCategoryRequest
-import com.runicgateway.app.data.api.dto.AdminWikiTagDto
-import com.runicgateway.app.data.repository.AdminRepository
-import com.runicgateway.app.ui.UiState
-import com.runicgateway.app.ui.toUiState
-import dagger.hilt.android.lifecycle.HiltViewModel
-import kotlinx.coroutines.flow.MutableStateFlow
-import kotlinx.coroutines.flow.StateFlow
-import kotlinx.coroutines.flow.asStateFlow
-import kotlinx.coroutines.flow.update
-import kotlinx.coroutines.launch
-import javax.inject.Inject
-
-/**
- * Drives the staff content screen (PLAN.md §1, M10): news posts (list, create,
- * publish/unpublish, delete) and wiki taxonomy (list categories/tags, create/delete
- * category). Any staff role reaches these (`staffOnly`); the full CMS block/hero
- * editor stays out of scope. Reads go through the typed [AdminRepository] (§7).
- */
-@HiltViewModel
-class AdminContentViewModel @Inject constructor(
-    private val admin: AdminRepository,
-) : ViewModel() {
-
-    /** The valid URL categories the backend maps (posts.model CATEGORY_MAP keys). */
-    val postCategories = listOf("news", "five-on-friday", "newsletter", "screenshots")
-
-    data class Feedback(val ok: Boolean, @param:StringRes val messageRes: Int)
-
-    data class State(
-        val posts: UiState<List<AdminPostDto>> = UiState.Loading,
-        val categories: UiState<List<AdminWikiCategoryDto>> = UiState.Loading,
-        val tags: List<AdminWikiTagDto> = emptyList(),
-        val busy: Boolean = false,
-        val feedback: Feedback? = null,
-    )
-
-    private val _state = MutableStateFlow(State())
-    val state: StateFlow<State> = _state.asStateFlow()
-
-    init {
-        loadPosts()
-        loadWiki()
-    }
-
-    fun clearFeedback() = _state.update { it.copy(feedback = null) }
-
-    fun loadPosts() {
-        _state.update { it.copy(posts = UiState.Loading) }
-        viewModelScope.launch { _state.update { it.copy(posts = admin.posts().toUiState()) } }
-    }
-
-    fun loadWiki() {
-        _state.update { it.copy(categories = UiState.Loading) }
-        viewModelScope.launch {
-            _state.update { it.copy(categories = admin.wikiCategories().toUiState()) }
-            when (val tags = admin.wikiTags()) {
-                is ApiResult.Ok -> _state.update { it.copy(tags = tags.data) }
-                else -> Unit // tags are secondary; leave the last list on a failure
-            }
-        }
-    }
-
-    fun togglePublish(post: AdminPostDto) = mutate(onSuccess = ::loadPosts) {
-        admin.setPostPublished(post.id, !post.isPublished).asFeedback(R.string.admin_content_post_updated)
-    }
-
-    fun deletePost(id: Long) = mutate(onSuccess = ::loadPosts) {
-        admin.deletePost(id).asFeedback(R.string.admin_content_post_deleted)
-    }
-
-    fun createPost(category: String, title: String, excerpt: String, body: String, published: Boolean) {
-        if (title.isBlank()) {
-            _state.update { it.copy(feedback = Feedback(false, R.string.admin_content_title_required)) }
-            return
-        }
-        mutate(onSuccess = ::loadPosts) {
-            admin.createPost(
-                PostCreateRequest(
-                    category = category,
-                    title = title.trim(),
-                    excerpt = excerpt.ifBlank { null },
-                    body = body.ifBlank { null },
-                    published = published,
-                ),
-            ).asFeedback(R.string.admin_content_post_created)
-        }
-    }
-
-    fun createCategory(slug: String, title: String, description: String, sortOrder: Int?) {
-        if (slug.isBlank() || title.isBlank()) {
-            _state.update { it.copy(feedback = Feedback(false, R.string.admin_content_cat_fields_required)) }
-            return
-        }
-        mutate(onSuccess = ::loadWiki) {
-            admin.createWikiCategory(
-                WikiCategoryRequest(slug.trim(), title.trim(), description.ifBlank { null }, sortOrder),
-            ).asFeedback(R.string.admin_content_cat_created)
-        }
-    }
-
-    fun deleteCategory(id: Long) = mutate(onSuccess = ::loadWiki) {
-        admin.deleteWikiCategory(id).asFeedback(R.string.admin_content_cat_deleted)
-    }
-
-    // ── Shared mutation plumbing ──────────────────────────────────────────
-
-    /** Run a write: set busy + clear feedback, then on completion set the feedback
-     *  banner and, only if it succeeded, run [onSuccess] (a targeted reload). */
-    private fun mutate(onSuccess: () -> Unit = {}, block: suspend () -> Feedback) {
-        if (_state.value.busy) return
-        _state.update { it.copy(busy = true, feedback = null) }
-        viewModelScope.launch {
-            val feedback = block()
-            if (feedback.ok) onSuccess()
-            _state.update { it.copy(busy = false, feedback = feedback) }
-        }
-    }
-
-    /** Map an [ApiResult] to a [Feedback], with role/permission-aware failure copy. */
-    private fun ApiResult<*>.asFeedback(@StringRes okRes: Int): Feedback = when (this) {
-        is ApiResult.Ok -> Feedback(true, okRes)
-        is ApiResult.HttpError ->
-            Feedback(false, if (status == 403) R.string.admin_forbidden else R.string.admin_action_failed)
-        is ApiResult.NetworkError -> Feedback(false, R.string.error_network)
-    }
-}

app/src/main/java/com/runicgateway/app/ui/admin/AdminDashboardScreen.kt

@@ -1,169 +0,0 @@
-/*
- * SPDX-License-Identifier: GPL-3.0-or-later
- */
-package com.runicgateway.app.ui.admin
-
-import androidx.compose.foundation.layout.Arrangement
-import androidx.compose.foundation.layout.Column
-import androidx.compose.foundation.layout.Row
-import androidx.compose.foundation.layout.Spacer
-import androidx.compose.foundation.layout.fillMaxSize
-import androidx.compose.foundation.layout.fillMaxWidth
-import androidx.compose.foundation.layout.height
-import androidx.compose.foundation.layout.padding
-import androidx.compose.foundation.layout.width
-import androidx.compose.foundation.rememberScrollState
-import androidx.compose.foundation.verticalScroll
-import androidx.compose.material3.Button
-import androidx.compose.material3.CircularProgressIndicator
-import androidx.compose.material3.MaterialTheme
-import androidx.compose.material3.Text
-import androidx.compose.runtime.Composable
-import androidx.compose.runtime.getValue
-import androidx.compose.ui.Alignment
-import androidx.compose.ui.Modifier
-import androidx.compose.ui.res.stringResource
-import androidx.compose.ui.unit.dp
-import androidx.hilt.navigation.compose.hiltViewModel
-import androidx.lifecycle.compose.collectAsStateWithLifecycle
-import com.runicgateway.app.R
-import com.runicgateway.app.data.api.dto.AdminDashboardDto
-import com.runicgateway.app.ui.UiState
-import com.runicgateway.app.ui.components.ErrorView
-import com.runicgateway.app.ui.components.LoadingView
-import com.runicgateway.app.ui.components.PillTone
-import com.runicgateway.app.ui.components.SectionLabel
-import com.runicgateway.app.ui.components.StatusPill
-
-/**
- * The staff dashboard (PLAN.md §1, M10): site mode + a site-mode toggle (admins
- * only), summary counts, and recent admin activity. Read-only for moderators/editors;
- * only [isAdmin] callers see the maintenance switch, and the server enforces it too.
- */
-@Composable
-fun AdminDashboardScreen(
-    isAdmin: Boolean,
-    modifier: Modifier = Modifier,
-    viewModel: AdminDashboardViewModel = hiltViewModel(),
-) {
-    val state by viewModel.state.collectAsStateWithLifecycle()
-
-    when (val ds = state.dashboard) {
-        is UiState.Loading -> LoadingView(modifier)
-        is UiState.Error -> ErrorView(ds.kind, onRetry = viewModel::load, modifier = modifier)
-        is UiState.Success -> DashboardContent(
-            data = ds.data,
-            isAdmin = isAdmin,
-            switching = state.switching,
-            feedbackRes = state.feedback?.messageRes,
-            onSetMode = viewModel::setSiteMode,
-            modifier = modifier,
-        )
-    }
-}
-
-@Composable
-private fun DashboardContent(
-    data: AdminDashboardDto,
-    isAdmin: Boolean,
-    switching: Boolean,
-    feedbackRes: Int?,
-    onSetMode: (String) -> Unit,
-    modifier: Modifier = Modifier,
-) {
-    val live = data.siteMode.equals("live", ignoreCase = true)
-    Column(
-        modifier = modifier
-            .fillMaxSize()
-            .verticalScroll(rememberScrollState())
-            .padding(20.dp),
-    ) {
-        // ── Site status ──────────────────────────────────────────────
-        SectionLabel(stringResource(R.string.admin_dashboard_site))
-        Spacer(Modifier.height(8.dp))
-        Row(verticalAlignment = Alignment.CenterVertically) {
-            StatusPill(
-                text = if (live) stringResource(R.string.admin_site_live) else stringResource(R.string.admin_site_maintenance),
-                tone = if (live) PillTone.Success else PillTone.Warning,
-            )
-            data.lastChange.by?.takeIf { it.isNotBlank() }?.let { by ->
-                Spacer(Modifier.width(12.dp))
-                Text(
-                    text = stringResource(R.string.admin_site_changed_by, by),
-                    style = MaterialTheme.typography.bodySmall,
-                    color = MaterialTheme.colorScheme.onSurfaceVariant,
-                )
-            }
-        }
-
-        if (isAdmin) {
-            Spacer(Modifier.height(12.dp))
-            Button(
-                onClick = { onSetMode(if (live) "maintenance" else "live") },
-                enabled = !switching,
-                modifier = Modifier.fillMaxWidth(),
-            ) {
-                if (switching) {
-                    CircularProgressIndicator(strokeWidth = 2.dp, modifier = Modifier.height(20.dp))
-                } else {
-                    Text(
-                        stringResource(
-                            if (live) R.string.admin_site_switch_maintenance else R.string.admin_site_switch_live,
-                        ),
-                    )
-                }
-            }
-        }
-
-        feedbackRes?.let {
-            Spacer(Modifier.height(8.dp))
-            Text(
-                text = stringResource(it),
-                style = MaterialTheme.typography.bodySmall,
-                color = MaterialTheme.colorScheme.onSurfaceVariant,
-            )
-        }
-
-        // ── Counts ───────────────────────────────────────────────────
-        Spacer(Modifier.height(24.dp))
-        SectionLabel(stringResource(R.string.admin_dashboard_counts))
-        Spacer(Modifier.height(8.dp))
-        StatRow(stringResource(R.string.admin_count_users), data.counts.users.toString())
-        val totalPosts = data.counts.posts.values.sum()
-        StatRow(stringResource(R.string.admin_count_posts), totalPosts.toString())
-        data.counts.posts.forEach { (category, count) ->
-            StatRow("· $category", count.toString())
-        }
-
-        // ── Recent activity ──────────────────────────────────────────
-        if (data.recentActivity.isNotEmpty()) {
-            Spacer(Modifier.height(24.dp))
-            SectionLabel(stringResource(R.string.admin_dashboard_recent_activity))
-            Spacer(Modifier.height(8.dp))
-            data.recentActivity.forEach { row ->
-                Column(Modifier.fillMaxWidth().padding(vertical = 6.dp)) {
-                    Text(row.action, style = MaterialTheme.typography.bodyMedium)
-                    val meta = listOfNotNull(row.username, row.createdAt).joinToString(" · ")
-                    if (meta.isNotBlank()) {
-                        Text(
-                            text = meta,
-                            style = MaterialTheme.typography.bodySmall,
-                            color = MaterialTheme.colorScheme.onSurfaceVariant,
-                        )
-                    }
-                }
-            }
-        }
-    }
-}
-
-@Composable
-private fun StatRow(label: String, value: String) {
-    Row(
-        modifier = Modifier.fillMaxWidth().padding(vertical = 4.dp),
-        horizontalArrangement = Arrangement.SpaceBetween,
-    ) {
-        Text(label, style = MaterialTheme.typography.bodyMedium)
-        Text(value, style = MaterialTheme.typography.bodyMedium, color = MaterialTheme.colorScheme.onSurfaceVariant)
-    }
-}

app/src/main/java/com/runicgateway/app/ui/admin/AdminDashboardViewModel.kt

@@ -1,91 +0,0 @@
-/*
- * SPDX-License-Identifier: GPL-3.0-or-later
- */
-package com.runicgateway.app.ui.admin
-
-import androidx.annotation.StringRes
-import androidx.lifecycle.ViewModel
-import androidx.lifecycle.viewModelScope
-import com.runicgateway.app.R
-import com.runicgateway.app.core.result.ApiResult
-import com.runicgateway.app.data.api.dto.AdminDashboardDto
-import com.runicgateway.app.data.repository.AdminRepository
-import com.runicgateway.app.ui.UiState
-import com.runicgateway.app.ui.toUiState
-import dagger.hilt.android.lifecycle.HiltViewModel
-import kotlinx.coroutines.flow.MutableStateFlow
-import kotlinx.coroutines.flow.StateFlow
-import kotlinx.coroutines.flow.asStateFlow
-import kotlinx.coroutines.flow.update
-import kotlinx.coroutines.launch
-import javax.inject.Inject
-
-/**
- * Drives the staff dashboard (PLAN.md §1, M10): summary counts + the site-mode
- * toggle. The mode switch is admin-only server-side (`adminOnly`); the screen only
- * offers it to admins, but a `403` is still handled cleanly if a moderator reaches
- * it. Everything is read through the typed [AdminRepository] (§7).
- */
-@HiltViewModel
-class AdminDashboardViewModel @Inject constructor(
-    private val admin: AdminRepository,
-) : ViewModel() {
-
-    data class Feedback(val ok: Boolean, @param:StringRes val messageRes: Int)
-
-    data class State(
-        val dashboard: UiState<AdminDashboardDto> = UiState.Loading,
-        /** True while a site-mode switch is in flight (disables the control). */
-        val switching: Boolean = false,
-        val feedback: Feedback? = null,
-    )
-
-    private val _state = MutableStateFlow(State())
-    val state: StateFlow<State> = _state.asStateFlow()
-
-    init {
-        load()
-    }
-
-    fun load() {
-        _state.update { it.copy(dashboard = UiState.Loading) }
-        viewModelScope.launch {
-            _state.update { it.copy(dashboard = admin.dashboard().toUiState()) }
-        }
-    }
-
-    fun clearFeedback() = _state.update { it.copy(feedback = null) }
-
-    /** Switch the site between "live" and "maintenance" (admin only). */
-    fun setSiteMode(mode: String) {
-        if (_state.value.switching) return
-        _state.update { it.copy(switching = true, feedback = null) }
-        viewModelScope.launch {
-            when (val result = admin.setSiteMode(mode)) {
-                is ApiResult.Ok -> {
-                    // Reflect the new mode locally, then refresh the full summary.
-                    val current = _state.value.dashboard
-                    if (current is UiState.Success) {
-                        _state.update {
-                            it.copy(dashboard = UiState.Success(current.data.copy(siteMode = result.data.siteMode)))
-                        }
-                    }
-                    _state.update { it.copy(switching = false, feedback = Feedback(true, R.string.admin_site_mode_updated)) }
-                    load()
-                }
-                is ApiResult.HttpError ->
-                    _state.update {
-                        it.copy(
-                            switching = false,
-                            feedback = Feedback(
-                                false,
-                                if (result.status == 403) R.string.admin_forbidden else R.string.admin_action_failed,
-                            ),
-                        )
-                    }
-                is ApiResult.NetworkError ->
-                    _state.update { it.copy(switching = false, feedback = Feedback(false, R.string.error_network)) }
-            }
-        }
-    }
-}

app/src/main/java/com/runicgateway/app/ui/admin/AdminModerationScreen.kt

@@ -1,92 +0,0 @@
-/*
- * SPDX-License-Identifier: GPL-3.0-or-later
- */
-package com.runicgateway.app.ui.admin
-
-import androidx.compose.foundation.layout.Arrangement
-import androidx.compose.foundation.layout.Column
-import androidx.compose.foundation.layout.Row
-import androidx.compose.foundation.layout.Spacer
-import androidx.compose.foundation.layout.fillMaxSize
-import androidx.compose.foundation.layout.fillMaxWidth
-import androidx.compose.foundation.layout.height
-import androidx.compose.foundation.layout.padding
-import androidx.compose.foundation.rememberScrollState
-import androidx.compose.foundation.verticalScroll
-import androidx.compose.material3.Button
-import androidx.compose.material3.MaterialTheme
-import androidx.compose.material3.OutlinedButton
-import androidx.compose.material3.OutlinedTextField
-import androidx.compose.material3.Text
-import androidx.compose.runtime.Composable
-import androidx.compose.runtime.getValue
-import androidx.compose.runtime.mutableStateOf
-import androidx.compose.runtime.saveable.rememberSaveable
-import androidx.compose.runtime.setValue
-import androidx.compose.ui.Modifier
-import androidx.compose.ui.res.stringResource
-import androidx.compose.ui.unit.dp
-import androidx.hilt.navigation.compose.hiltViewModel
-import androidx.lifecycle.compose.collectAsStateWithLifecycle
-import com.runicgateway.app.R
-import com.runicgateway.app.ui.components.SectionLabel
-
-/**
- * The moderation screen (PLAN.md §1, M10): kick / ban / unban an account and
- * broadcast, over `/admin/shard/…` (admin/moderator). A live sidecar is required;
- * offline, actions return a clean "shard offline" message. Fields are entered here;
- * the [AdminModerationViewModel] performs the guarded action.
- */
-@Composable
-fun AdminModerationScreen(
-    modifier: Modifier = Modifier,
-    viewModel: AdminModerationViewModel = hiltViewModel(),
-) {
-    val state by viewModel.state.collectAsStateWithLifecycle()
-    var account by rememberSaveable { mutableStateOf("") }
-    var serial by rememberSaveable { mutableStateOf("") }
-    var reason by rememberSaveable { mutableStateOf("") }
-    var duration by rememberSaveable { mutableStateOf("") }
-    var broadcast by rememberSaveable { mutableStateOf("") }
-    val busy = state.busy
-
-    Column(
-        modifier = modifier.fillMaxSize().verticalScroll(rememberScrollState()).padding(20.dp),
-    ) {
-        state.feedback?.let {
-            Text(
-                text = stringResource(it.messageRes),
-                style = MaterialTheme.typography.bodySmall,
-                color = if (it.ok) MaterialTheme.colorScheme.onSurfaceVariant else MaterialTheme.colorScheme.error,
-                modifier = Modifier.fillMaxWidth().padding(bottom = 8.dp),
-            )
-        }
-
-        // ── Account actions ──────────────────────────────────────────────
-        SectionLabel(stringResource(R.string.admin_mod_account_action))
-        OutlinedTextField(value = account, onValueChange = { account = it }, singleLine = true, label = { Text(stringResource(R.string.admin_mod_account)) }, modifier = Modifier.fillMaxWidth().padding(top = 8.dp))
-        OutlinedTextField(value = serial, onValueChange = { serial = it }, singleLine = true, label = { Text(stringResource(R.string.admin_mod_serial)) }, modifier = Modifier.fillMaxWidth().padding(top = 8.dp))
-        OutlinedTextField(value = reason, onValueChange = { reason = it }, label = { Text(stringResource(R.string.admin_mod_reason)) }, modifier = Modifier.fillMaxWidth().padding(top = 8.dp))
-        OutlinedTextField(value = duration, onValueChange = { duration = it.filter(Char::isDigit) }, singleLine = true, label = { Text(stringResource(R.string.admin_mod_duration)) }, modifier = Modifier.fillMaxWidth().padding(top = 8.dp))
-
-        Row(Modifier.fillMaxWidth().padding(top = 12.dp), horizontalArrangement = Arrangement.spacedBy(8.dp)) {
-            OutlinedButton(onClick = { viewModel.kick(account, serial) }, enabled = !busy, modifier = Modifier.weight(1f)) {
-                Text(stringResource(R.string.admin_mod_kick))
-            }
-            Button(onClick = { viewModel.ban(account, serial, duration.toLongOrNull(), reason) }, enabled = !busy, modifier = Modifier.weight(1f)) {
-                Text(stringResource(R.string.admin_mod_ban))
-            }
-            OutlinedButton(onClick = { viewModel.unban(account) }, enabled = !busy, modifier = Modifier.weight(1f)) {
-                Text(stringResource(R.string.admin_mod_unban))
-            }
-        }
-
-        // ── Broadcast ────────────────────────────────────────────────────
-        Spacer(Modifier.height(24.dp))
-        SectionLabel(stringResource(R.string.admin_mod_broadcast_section))
-        OutlinedTextField(value = broadcast, onValueChange = { broadcast = it }, label = { Text(stringResource(R.string.admin_mod_broadcast_text)) }, modifier = Modifier.fillMaxWidth().padding(top = 8.dp))
-        Button(onClick = { viewModel.broadcast(broadcast, null) }, enabled = !busy, modifier = Modifier.fillMaxWidth().padding(top = 12.dp)) {
-            Text(stringResource(R.string.admin_mod_broadcast))
-        }
-    }
-}

app/src/main/java/com/runicgateway/app/ui/admin/AdminModerationViewModel.kt

@@ -1,89 +0,0 @@
-/*
- * SPDX-License-Identifier: GPL-3.0-or-later
- */
-package com.runicgateway.app.ui.admin
-
-import androidx.annotation.StringRes
-import androidx.lifecycle.ViewModel
-import androidx.lifecycle.viewModelScope
-import com.runicgateway.app.R
-import com.runicgateway.app.core.result.ApiResult
-import com.runicgateway.app.data.repository.AdminRepository
-import dagger.hilt.android.lifecycle.HiltViewModel
-import kotlinx.coroutines.flow.MutableStateFlow
-import kotlinx.coroutines.flow.StateFlow
-import kotlinx.coroutines.flow.asStateFlow
-import kotlinx.coroutines.flow.update
-import kotlinx.coroutines.launch
-import javax.inject.Inject
-
-/**
- * Drives the moderation actions (PLAN.md §1, M10): kick / ban / unban an account
- * and broadcast a system message, over the shard write plane (`/admin/shard/…`,
- * admin/moderator). These need a live sidecar — when the shard is offline the call
- * fails and the screen shows a clean error, never a crash (§7). The form fields live
- * in the screen; this VM owns only the busy + feedback state and the actions.
- */
-@HiltViewModel
-class AdminModerationViewModel @Inject constructor(
-    private val admin: AdminRepository,
-) : ViewModel() {
-
-    data class Feedback(val ok: Boolean, @param:StringRes val messageRes: Int)
-
-    data class State(val busy: Boolean = false, val feedback: Feedback? = null)
-
-    private val _state = MutableStateFlow(State())
-    val state: StateFlow<State> = _state.asStateFlow()
-
-    fun clearFeedback() = _state.update { it.copy(feedback = null) }
-
-    fun kick(account: String, serial: String) {
-        if (account.isBlank() && serial.isBlank()) return badTarget()
-        run(R.string.admin_mod_kicked) { admin.kick(account.ifBlank { null }, serial.ifBlank { null }) }
-    }
-
-    fun ban(account: String, serial: String, durationSec: Long?, reason: String) {
-        if (account.isBlank() && serial.isBlank()) return badTarget()
-        run(R.string.admin_mod_banned) {
-            admin.ban(account.ifBlank { null }, serial.ifBlank { null }, durationSec, reason.ifBlank { null })
-        }
-    }
-
-    fun unban(account: String) {
-        if (account.isBlank()) return badTarget()
-        run(R.string.admin_mod_unbanned) { admin.unban(account.trim()) }
-    }
-
-    fun broadcast(text: String, hue: Int?) {
-        if (text.isBlank()) {
-            _state.update { it.copy(feedback = Feedback(false, R.string.admin_mod_text_required)) }
-            return
-        }
-        run(R.string.admin_mod_broadcasted) { admin.broadcast(text.trim(), hue) }
-    }
-
-    private fun badTarget() {
-        _state.update { it.copy(feedback = Feedback(false, R.string.admin_mod_target_required)) }
-    }
-
-    private fun run(@StringRes okRes: Int, block: suspend () -> ApiResult<Unit>) {
-        if (_state.value.busy) return
-        _state.update { it.copy(busy = true, feedback = null) }
-        viewModelScope.launch {
-            val feedback = when (val r = block()) {
-                is ApiResult.Ok -> Feedback(true, okRes)
-                is ApiResult.HttpError -> Feedback(
-                    false,
-                    when (r.status) {
-                        403 -> R.string.admin_forbidden
-                        503 -> R.string.admin_mod_shard_offline
-                        else -> R.string.admin_action_failed
-                    },
-                )
-                is ApiResult.NetworkError -> Feedback(false, R.string.error_network)
-            }
-            _state.update { it.copy(busy = false, feedback = feedback) }
-        }
-    }
-}

app/src/main/java/com/runicgateway/app/ui/admin/AdminSupportScreen.kt

@@ -1,145 +0,0 @@
-/*
- * SPDX-License-Identifier: GPL-3.0-or-later
- */
-package com.runicgateway.app.ui.admin
-
-import androidx.compose.foundation.layout.Arrangement
-import androidx.compose.foundation.layout.Column
-import androidx.compose.foundation.layout.Row
-import androidx.compose.foundation.layout.Spacer
-import androidx.compose.foundation.layout.fillMaxSize
-import androidx.compose.foundation.layout.fillMaxWidth
-import androidx.compose.foundation.layout.height
-import androidx.compose.foundation.layout.padding
-import androidx.compose.foundation.lazy.LazyColumn
-import androidx.compose.foundation.lazy.items
-import androidx.compose.material3.AlertDialog
-import androidx.compose.material3.Card
-import androidx.compose.material3.Checkbox
-import androidx.compose.material3.MaterialTheme
-import androidx.compose.material3.OutlinedTextField
-import androidx.compose.material3.Text
-import androidx.compose.material3.TextButton
-import androidx.compose.runtime.Composable
-import androidx.compose.runtime.getValue
-import androidx.compose.runtime.mutableStateOf
-import androidx.compose.runtime.remember
-import androidx.compose.runtime.saveable.rememberSaveable
-import androidx.compose.runtime.setValue
-import androidx.compose.ui.Alignment
-import androidx.compose.ui.Modifier
-import androidx.compose.ui.res.stringResource
-import androidx.compose.ui.unit.dp
-import androidx.hilt.navigation.compose.hiltViewModel
-import androidx.lifecycle.compose.collectAsStateWithLifecycle
-import com.runicgateway.app.R
-import com.runicgateway.app.data.api.dto.SupportPageDto
-import com.runicgateway.app.ui.UiState
-import com.runicgateway.app.ui.components.EmptyView
-import com.runicgateway.app.ui.components.ErrorView
-import com.runicgateway.app.ui.components.LoadingView
-
-/**
- * The support (help-page) queue (PLAN.md §1, M10): open tickets with reply/close,
- * over `/admin/shard/pages…` (admin/moderator). Empty when there are no open pages
- * (or the shard is offline); every read/write degrades cleanly (§7).
- */
-@Composable
-fun AdminSupportScreen(
-    modifier: Modifier = Modifier,
-    viewModel: AdminSupportViewModel = hiltViewModel(),
-) {
-    val state by viewModel.state.collectAsStateWithLifecycle()
-    var replyTo by remember { mutableStateOf<SupportPageDto?>(null) }
-
-    Column(modifier.fillMaxSize()) {
-        state.feedback?.let {
-            Text(
-                text = stringResource(it.messageRes),
-                style = MaterialTheme.typography.bodySmall,
-                color = if (it.ok) MaterialTheme.colorScheme.onSurfaceVariant else MaterialTheme.colorScheme.error,
-                modifier = Modifier.fillMaxWidth().padding(horizontal = 16.dp, vertical = 6.dp),
-            )
-        }
-        when (val s = state.pages) {
-            is UiState.Loading -> LoadingView()
-            is UiState.Error -> ErrorView(s.kind, onRetry = viewModel::load)
-            is UiState.Success ->
-                if (s.data.isEmpty()) {
-                    EmptyView(stringResource(R.string.admin_support_empty))
-                } else {
-                    LazyColumn(Modifier.fillMaxSize().padding(16.dp)) {
-                        items(s.data, key = { it.pageId }) { page ->
-                            SupportPageCard(
-                                page = page,
-                                busy = state.busy,
-                                onReply = { replyTo = page },
-                                onClose = { viewModel.close(page.pageId) },
-                            )
-                        }
-                    }
-                }
-        }
-    }
-
-    replyTo?.let { page ->
-        RespondDialog(
-            onDismiss = { replyTo = null },
-            onSend = { message, close ->
-                viewModel.respond(page.pageId, message, close)
-                replyTo = null
-            },
-        )
-    }
-}
-
-@Composable
-private fun SupportPageCard(
-    page: SupportPageDto,
-    busy: Boolean,
-    onReply: () -> Unit,
-    onClose: () -> Unit,
-) {
-    Card(Modifier.fillMaxWidth().padding(vertical = 6.dp)) {
-        Column(Modifier.padding(12.dp)) {
-            val who = page.sender?.name ?: page.sender?.account ?: page.pageId
-            Text(
-                text = listOfNotNull(page.type, who).joinToString(" · "),
-                style = MaterialTheme.typography.bodyLarge,
-            )
-            page.message?.takeIf { it.isNotBlank() }?.let {
-                Spacer(Modifier.height(4.dp))
-                Text(it, style = MaterialTheme.typography.bodyMedium, color = MaterialTheme.colorScheme.onSurfaceVariant)
-            }
-            Row(Modifier.fillMaxWidth().padding(top = 8.dp), horizontalArrangement = Arrangement.End) {
-                TextButton(onClick = onReply, enabled = !busy) { Text(stringResource(R.string.admin_support_reply)) }
-                TextButton(onClick = onClose, enabled = !busy) { Text(stringResource(R.string.admin_support_close)) }
-            }
-        }
-    }
-}
-
-@Composable
-private fun RespondDialog(
-    onDismiss: () -> Unit,
-    onSend: (message: String, close: Boolean) -> Unit,
-) {
-    var message by rememberSaveable { mutableStateOf("") }
-    var alsoClose by rememberSaveable { mutableStateOf(true) }
-
-    AlertDialog(
-        onDismissRequest = onDismiss,
-        confirmButton = { TextButton(onClick = { onSend(message, alsoClose) }) { Text(stringResource(R.string.admin_support_send)) } },
-        dismissButton = { TextButton(onClick = onDismiss) { Text(stringResource(R.string.action_cancel)) } },
-        title = { Text(stringResource(R.string.admin_support_reply)) },
-        text = {
-            Column {
-                OutlinedTextField(value = message, onValueChange = { message = it }, label = { Text(stringResource(R.string.admin_support_message)) }, modifier = Modifier.fillMaxWidth())
-                Row(Modifier.fillMaxWidth().padding(top = 8.dp), verticalAlignment = Alignment.CenterVertically) {
-                    Checkbox(checked = alsoClose, onCheckedChange = { alsoClose = it })
-                    Text(stringResource(R.string.admin_support_close_after))
-                }
-            }
-        },
-    )
-}

app/src/main/java/com/runicgateway/app/ui/admin/AdminSupportViewModel.kt

@@ -1,87 +0,0 @@
-/*
- * SPDX-License-Identifier: GPL-3.0-or-later
- */
-package com.runicgateway.app.ui.admin
-
-import androidx.annotation.StringRes
-import androidx.lifecycle.ViewModel
-import androidx.lifecycle.viewModelScope
-import com.runicgateway.app.R
-import com.runicgateway.app.core.result.ApiResult
-import com.runicgateway.app.data.api.dto.SupportPageDto
-import com.runicgateway.app.data.repository.AdminRepository
-import com.runicgateway.app.ui.UiState
-import com.runicgateway.app.ui.toUiState
-import dagger.hilt.android.lifecycle.HiltViewModel
-import kotlinx.coroutines.flow.MutableStateFlow
-import kotlinx.coroutines.flow.StateFlow
-import kotlinx.coroutines.flow.asStateFlow
-import kotlinx.coroutines.flow.update
-import kotlinx.coroutines.launch
-import javax.inject.Inject
-
-/**
- * Drives the support (help-page) queue (PLAN.md §1, M10): list open pages, reply
- * (optionally closing), and close, over `/admin/shard/pages…` (admin/moderator).
- * The list is served from shard state — empty when no tickets (or the shard is
- * offline); writes need a live sidecar and fail cleanly otherwise (§7).
- */
-@HiltViewModel
-class AdminSupportViewModel @Inject constructor(
-    private val admin: AdminRepository,
-) : ViewModel() {
-
-    data class Feedback(val ok: Boolean, @param:StringRes val messageRes: Int)
-
-    data class State(
-        val pages: UiState<List<SupportPageDto>> = UiState.Loading,
-        val busy: Boolean = false,
-        val feedback: Feedback? = null,
-    )
-
-    private val _state = MutableStateFlow(State())
-    val state: StateFlow<State> = _state.asStateFlow()
-
-    init {
-        load()
-    }
-
-    fun clearFeedback() = _state.update { it.copy(feedback = null) }
-
-    fun load() {
-        _state.update { it.copy(pages = UiState.Loading) }
-        viewModelScope.launch { _state.update { it.copy(pages = admin.supportPages().toUiState()) } }
-    }
-
-    fun respond(id: String, message: String, close: Boolean) {
-        if (message.isBlank()) {
-            _state.update { it.copy(feedback = Feedback(false, R.string.admin_support_message_required)) }
-            return
-        }
-        mutate(R.string.admin_support_responded) { admin.respondPage(id, message.trim(), close) }
-    }
-
-    fun close(id: String) = mutate(R.string.admin_support_closed) { admin.closePage(id) }
-
-    private fun mutate(@StringRes okRes: Int, block: suspend () -> ApiResult<Unit>) {
-        if (_state.value.busy) return
-        _state.update { it.copy(busy = true, feedback = null) }
-        viewModelScope.launch {
-            val feedback = when (val r = block()) {
-                is ApiResult.Ok -> Feedback(true, okRes)
-                is ApiResult.HttpError -> Feedback(
-                    false,
-                    when (r.status) {
-                        403 -> R.string.admin_forbidden
-                        404 -> R.string.admin_support_unknown_page
-                        503 -> R.string.admin_mod_shard_offline
-                        else -> R.string.admin_action_failed
-                    },
-                )
-                is ApiResult.NetworkError -> Feedback(false, R.string.error_network)
-            }
-            if (feedback.ok) load()
-            _state.update { it.copy(busy = false, feedback = feedback) }
-        }
-    }
-}

app/src/main/java/com/runicgateway/app/ui/auth/AccountScreen.kt

@@ -65,8 +65,6 @@ fun AccountScreen(
     roleLabel: String,
     onSignOut: () -> Unit,
     onSignOutEverywhere: () -> Unit,
-    onOpenTrustedDevices: () -> Unit,
-    onOpenRecoveryCodes: () -> Unit,
     modifier: Modifier = Modifier,
     viewModel: AccountViewModel = hiltViewModel(),
 ) {
@@ -80,15 +78,10 @@ fun AccountScreen(
     ) {
         IdentityCard(username = username, roleLabel = roleLabel)
 
-        // One-time recovery codes surfaced right after enabling 2FA — save them now.
-        state.recoveryCodesOnce?.let { codes ->
-            RecoveryCodesShowOnceCard(codes, onDismiss = viewModel::dismissRecoveryCodes)
-        }
-
         when (val account = state.account) {
             is UiState.Loading -> LoadingView(Modifier.padding(top = 32.dp))
             is UiState.Error -> ErrorView(account.kind, onRetry = viewModel::load, modifier = Modifier.padding(top = 32.dp))
-            is UiState.Success -> AccountSections(account.data, state, viewModel, onOpenTrustedDevices, onOpenRecoveryCodes)
+            is UiState.Success -> AccountSections(account.data, state, viewModel)
         }
 
         HorizontalDivider(Modifier.padding(vertical = 20.dp))
@@ -124,34 +117,13 @@ private fun AccountSections(
     account: PlayerAccountDto,
     state: AccountViewModel.State,
     viewModel: AccountViewModel,
-    onOpenTrustedDevices: () -> Unit,
-    onOpenRecoveryCodes: () -> Unit,
 ) {
     UsernameSection(account, state, viewModel)
     PasswordSection(account, state, viewModel)
     TwoFactorSection(account, state, viewModel)
-    SecuritySection(onOpenTrustedDevices, onOpenRecoveryCodes)
     IdentitiesSection(state, viewModel)
 }
 
-/**
- * Links to the dedicated trusted-device and recovery-code screens
- * (TRUSTED_DEVICES_MFA.md). Kept simple — the management UX lives on those screens.
- */
-@Composable
-private fun SecuritySection(onOpenTrustedDevices: () -> Unit, onOpenRecoveryCodes: () -> Unit) {
-    SectionCard(R.string.account_security_title) {
-        OutlinedButton(
-            onClick = onOpenTrustedDevices,
-            modifier = Modifier.fillMaxWidth().padding(top = 12.dp),
-        ) { Text(stringResource(R.string.account_security_trusted_devices)) }
-        OutlinedButton(
-            onClick = onOpenRecoveryCodes,
-            modifier = Modifier.fillMaxWidth().padding(top = 8.dp),
-        ) { Text(stringResource(R.string.account_security_recovery_codes)) }
-    }
-}
-
 @Composable
 private fun SectionCard(@StringRes titleRes: Int, content: @Composable () -> Unit) {
     Card(Modifier.fillMaxWidth().padding(top = 12.dp)) {

app/src/main/java/com/runicgateway/app/ui/auth/AccountViewModel.kt

@@ -49,8 +49,6 @@ class AccountViewModel @Inject constructor(
         val busy: Boolean = false,
         /** The pending TOTP enrollment (QR shown) between setup and enable. */
         val totpSetup: TotpSetupDto? = null,
-        /** The single-use recovery codes returned once when 2FA was just enabled. */
-        val recoveryCodesOnce: List<String>? = null,
         val feedback: Feedback? = null,
     )
 
@@ -124,12 +122,9 @@ class AccountViewModel @Inject constructor(
         if (_state.value.busy) return
         _state.update { it.copy(busy = true, feedback = null) }
         viewModelScope.launch {
-            when (val result = accountRepository.totpEnable(code.trim())) {
+            when (accountRepository.totpEnable(code.trim())) {
                 is ApiResult.Ok -> {
-                    // 2FA enable returns the fresh recovery-code batch once — surface it.
+                    _state.update { it.copy(totpSetup = null) }
-                    _state.update {
-                        it.copy(totpSetup = null, recoveryCodesOnce = result.data.recoveryCodes?.takeIf(List<String>::isNotEmpty))
-                    }
                     finish(Section.TOTP, true, R.string.account_totp_enabled)
                     reloadAccount()
                 }
@@ -139,9 +134,6 @@ class AccountViewModel @Inject constructor(
         }
     }
 
-    /** Dismiss the one-time recovery-code batch shown after enabling 2FA. */
-    fun dismissRecoveryCodes() = _state.update { it.copy(recoveryCodesOnce = null) }
-
     fun disableTotp(code: String) {
         if (_state.value.busy) return
         _state.update { it.copy(busy = true, feedback = null) }

app/src/main/java/com/runicgateway/app/ui/auth/LoginScreen.kt

@@ -5,11 +5,8 @@ package com.runicgateway.app.ui.auth
 
 import androidx.compose.foundation.layout.Arrangement
 import androidx.compose.foundation.layout.Column
-import androidx.compose.foundation.layout.Row
-import androidx.compose.foundation.layout.Spacer
 import androidx.compose.foundation.layout.fillMaxSize
 import androidx.compose.foundation.layout.fillMaxWidth
-import androidx.compose.foundation.layout.height
 import androidx.compose.foundation.layout.padding
 import androidx.compose.foundation.layout.size
 import androidx.compose.foundation.rememberScrollState
@@ -17,22 +14,14 @@ import androidx.compose.foundation.text.KeyboardActions
 import androidx.compose.foundation.text.KeyboardOptions
 import androidx.compose.foundation.verticalScroll
 import androidx.compose.material3.Button
-import androidx.compose.material3.Checkbox
 import androidx.compose.material3.CircularProgressIndicator
-import androidx.compose.material3.ExperimentalMaterial3Api
 import androidx.compose.material3.MaterialTheme
-import androidx.compose.material3.ModalBottomSheet
-import androidx.compose.material3.OutlinedButton
 import androidx.compose.material3.OutlinedTextField
 import androidx.compose.material3.Text
 import androidx.compose.material3.TextButton
-import androidx.compose.material3.rememberModalBottomSheetState
 import androidx.compose.runtime.Composable
 import androidx.compose.runtime.LaunchedEffect
 import androidx.compose.runtime.getValue
-import androidx.compose.runtime.mutableStateOf
-import androidx.compose.runtime.remember
-import androidx.compose.runtime.setValue
 import androidx.compose.ui.Alignment
 import androidx.compose.ui.Modifier
 import androidx.compose.ui.platform.LocalContext
@@ -67,13 +56,6 @@ fun LoginScreen(
         if (state.signedIn) onSignedIn()
     }
 
-    // Open a freshly-minted SSO /start URL in a Custom Tab, exactly once (§4.2).
-    LaunchedEffect(state.ssoLaunchUrl) {
-        val url = state.ssoLaunchUrl ?: return@LaunchedEffect
-        WebHandoff.open(context, url)
-        viewModel.onSsoLaunchConsumed()
-    }
-
     Column(
         modifier = modifier
             .fillMaxSize()
@@ -125,73 +107,22 @@ fun LoginScreen(
         )
 
         if (state.totpRequired) {
-            if (state.useRecoveryCode) {
+            OutlinedTextField(
-                OutlinedTextField(
+                value = state.code,
-                    value = state.recoveryCode,
+                onValueChange = viewModel::onCodeChange,
-                    onValueChange = viewModel::onRecoveryCodeChange,
+                singleLine = true,
-                    singleLine = true,
-                    enabled = !state.submitting,
-                    label = { Text(stringResource(R.string.login_recovery_code)) },
-                    supportingText = { Text(stringResource(R.string.login_recovery_hint)) },
-                    keyboardOptions = KeyboardOptions(
-                        keyboardType = KeyboardType.Password,
-                        imeAction = ImeAction.Go,
-                    ),
-                    keyboardActions = KeyboardActions(onGo = { viewModel.submit() }),
-                    modifier = Modifier
-                        .fillMaxWidth()
-                        .padding(top = 12.dp),
-                )
-            } else {
-                OutlinedTextField(
-                    value = state.code,
-                    onValueChange = viewModel::onCodeChange,
-                    singleLine = true,
-                    enabled = !state.submitting,
-                    label = { Text(stringResource(R.string.login_totp_code)) },
-                    supportingText = { Text(stringResource(R.string.login_totp_hint)) },
-                    keyboardOptions = KeyboardOptions(
-                        keyboardType = KeyboardType.NumberPassword,
-                        imeAction = ImeAction.Go,
-                    ),
-                    keyboardActions = KeyboardActions(onGo = { viewModel.submit() }),
-                    modifier = Modifier
-                        .fillMaxWidth()
-                        .padding(top = 12.dp),
-                )
-            }
-
-            // Toggle between authenticator code and a single-use recovery code.
-            TextButton(
-                onClick = { viewModel.onUseRecoveryCodeChange(!state.useRecoveryCode) },
                 enabled = !state.submitting,
-                modifier = Modifier.align(Alignment.Start),
+                label = { Text(stringResource(R.string.login_totp_code)) },
-            ) {
+                supportingText = { Text(stringResource(R.string.login_totp_hint)) },
-                Text(
+                keyboardOptions = KeyboardOptions(
-                    stringResource(
+                    keyboardType = KeyboardType.NumberPassword,
-                        if (state.useRecoveryCode) R.string.login_use_totp_instead
+                    imeAction = ImeAction.Go,
-                        else R.string.login_use_recovery_instead,
+                ),
-                    ),
+                keyboardActions = KeyboardActions(onGo = { viewModel.submit() }),
-                )
-            }
-
-            // "Trust this device" → skip the 2FA step on future logins here.
-            Row(
-                verticalAlignment = Alignment.CenterVertically,
                 modifier = Modifier
                     .fillMaxWidth()
-                    .padding(top = 4.dp),
+                    .padding(top = 12.dp),
-            ) {
+            )
-                Checkbox(
-                    checked = state.trustDevice,
-                    onCheckedChange = viewModel::onTrustDeviceChange,
-                    enabled = !state.submitting,
-                )
-                Text(
-                    text = stringResource(R.string.login_trust_device),
-                    style = MaterialTheme.typography.bodyMedium,
-                )
-            }
         }
 
         state.error?.let { err ->
@@ -224,48 +155,6 @@ fun LoginScreen(
             }
         }
 
-        // ── Native SSO (§4.2, M9): a single "Sign in with SSO" button that opens the
-        // Custom-Tab bridge. With one provider it launches straight through; with
-        // several it presents a native picker (below). No website-login fallback —
-        // that page can't deep-link the session back; a failed discovery offers a retry.
-        var showSsoPicker by remember { mutableStateOf(false) }
-        when {
-            state.ssoProviders.isNotEmpty() -> {
-                OutlinedButton(
-                    onClick = {
-                        val providers = state.ssoProviders
-                        if (providers.size == 1) viewModel.onSsoProviderClick(providers.first())
-                        else showSsoPicker = true
-                    },
-                    enabled = !state.submitting,
-                    modifier = Modifier
-                        .fillMaxWidth()
-                        .padding(top = 12.dp),
-                ) {
-                    Text(stringResource(R.string.login_sso_button))
-                }
-            }
-
-            state.ssoDiscovering -> {
-                Text(
-                    text = stringResource(R.string.login_sso_loading),
-                    style = MaterialTheme.typography.bodySmall,
-                    color = MaterialTheme.colorScheme.onSurfaceVariant,
-                    modifier = Modifier.padding(top = 12.dp),
-                )
-            }
-
-            state.ssoUnavailable -> {
-                TextButton(
-                    onClick = { viewModel.discoverSsoProviders() },
-                    modifier = Modifier.padding(top = 4.dp),
-                ) {
-                    Text(stringResource(R.string.login_sso_retry))
-                }
-            }
-            // else: discovery succeeded with no providers — this shard offers no SSO.
-        }
-
         // ── Website hand-offs (§4.2): open the site's own pages in a Custom Tab ──
         viewModel.registerUrl?.let { url ->
             TextButton(
@@ -278,53 +167,11 @@ fun LoginScreen(
                 Text(stringResource(R.string.login_forgot))
             }
         }
-
+        viewModel.ssoLoginUrl?.let { url ->
-        if (showSsoPicker) {
+            TextButton(onClick = { WebHandoff.open(context, url) }) {
-            SsoProviderPicker(
+                Text(stringResource(R.string.login_sso))
-                providers = state.ssoProviders,
-                onDismiss = { showSsoPicker = false },
-                onPick = { provider ->
-                    showSsoPicker = false
-                    viewModel.onSsoProviderClick(provider)
-                },
-            )
-        }
-    }
-}
-
-/**
- * The native provider picker (§4.2): a bottom sheet listing the shard's enabled SSO
- * providers so a single "Sign in with SSO" button can serve several IdPs without a
- * website chooser page. Each row opens the Custom-Tab bridge for that provider.
- */
-@OptIn(ExperimentalMaterial3Api::class)
-@Composable
-private fun SsoProviderPicker(
-    providers: List<com.runicgateway.app.data.api.dto.SsoProviderDto>,
-    onDismiss: () -> Unit,
-    onPick: (com.runicgateway.app.data.api.dto.SsoProviderDto) -> Unit,
-) {
-    ModalBottomSheet(onDismissRequest = onDismiss, sheetState = rememberModalBottomSheetState()) {
-        Text(
-            text = stringResource(R.string.login_sso_pick_title),
-            style = MaterialTheme.typography.titleMedium,
-            modifier = Modifier.padding(horizontal = 24.dp, vertical = 8.dp),
-        )
-        providers.forEach { provider ->
-            TextButton(
-                onClick = { onPick(provider) },
-                modifier = Modifier
-                    .fillMaxWidth()
-                    .padding(horizontal = 12.dp, vertical = 2.dp),
-            ) {
-                Text(
-                    text = stringResource(R.string.login_sso_provider, provider.name),
-                    modifier = Modifier.fillMaxWidth(),
-                    textAlign = TextAlign.Start,
-                )
             }
         }
-        Spacer(Modifier.height(24.dp)) // clears the gesture inset at the sheet's bottom
     }
 }
 
@@ -334,5 +181,4 @@ private fun loginErrorRes(error: LoginError): Int = when (error) {
     LoginError.RATE_LIMITED -> R.string.login_error_rate_limited
     LoginError.SERVER -> R.string.login_error_server
     LoginError.NETWORK -> R.string.login_error_network
-    LoginError.SSO -> R.string.login_error_sso
 }

app/src/main/java/com/runicgateway/app/ui/auth/LoginViewModel.kt

@@ -5,12 +5,9 @@ package com.runicgateway.app.ui.auth
 
 import androidx.lifecycle.ViewModel
 import androidx.lifecycle.viewModelScope
-import com.runicgateway.app.core.auth.sso.SsoAuthManager
 import com.runicgateway.app.core.web.WebsiteUrls
-import com.runicgateway.app.data.api.dto.SsoProviderDto
 import com.runicgateway.app.data.repository.AuthRepository
 import com.runicgateway.app.data.repository.AuthRepository.LoginResult
-import com.runicgateway.app.data.repository.AuthRepository.SsoDiscovery
 import dagger.hilt.android.lifecycle.HiltViewModel
 import kotlinx.coroutines.flow.MutableStateFlow
 import kotlinx.coroutines.flow.StateFlow
@@ -28,193 +25,77 @@ import javax.inject.Inject
 @HiltViewModel
 class LoginViewModel @Inject constructor(
     private val authRepository: AuthRepository,
-    private val ssoAuthManager: SsoAuthManager,
     private val websiteUrls: WebsiteUrls,
 ) : ViewModel() {
 
     /** The transient error surfaced under the form after a failed attempt. */
-    enum class LoginError { INVALID_CREDENTIALS, BAD_CODE, RATE_LIMITED, SERVER, NETWORK, SSO }
+    enum class LoginError { INVALID_CREDENTIALS, BAD_CODE, RATE_LIMITED, SERVER, NETWORK }
 
     data class UiState(
         val username: String = "",
         val password: String = "",
         val code: String = "",
-        /** A single-use recovery code, entered instead of [code] when [useRecoveryCode]. */
-        val recoveryCode: String = "",
         /** True once the account is known to have 2FA on — reveal the code field. */
         val totpRequired: Boolean = false,
-        /** "Enter a recovery code instead" — swap the TOTP field for the recovery field. */
-        val useRecoveryCode: Boolean = false,
-        /** "Trust this device" — skip the 2FA step on future logins (TRUSTED_DEVICES_MFA.md). */
-        val trustDevice: Boolean = false,
         val submitting: Boolean = false,
         val error: LoginError? = null,
         val signedIn: Boolean = false,
-        /** The shard's enabled SSO providers (§4.2); empty until discovery resolves. */
-        val ssoProviders: List<SsoProviderDto> = emptyList(),
-        /** True while discovery is in flight — the screen shows a spinner, not an empty gap. */
-        val ssoDiscovering: Boolean = true,
-        /** True when discovery failed (offline/server) — offer a retry rather than a dead end. */
-        val ssoUnavailable: Boolean = false,
-        /** A `/auth/mobile/sso/start` URL the screen should open in a Custom Tab, once. */
-        val ssoLaunchUrl: String? = null,
     )
 
     private val _state = MutableStateFlow(UiState())
     val state: StateFlow<UiState> = _state.asStateFlow()
 
-    init {
-        discoverSsoProviders()
-        // Consume the SSO bridge outcome: a returned callback completes here even if
-        // this ViewModel was recreated while the Custom Tab was foreground (§4.2).
-        viewModelScope.launch {
-            ssoAuthManager.outcome.collect { outcome ->
-                when (outcome) {
-                    SsoAuthManager.Outcome.Success -> {
-                        ssoAuthManager.consumeOutcome()
-                        _state.update { it.copy(submitting = false, signedIn = true) }
-                    }
-                    is SsoAuthManager.Outcome.Failed -> {
-                        ssoAuthManager.consumeOutcome()
-                        _state.update { it.copy(submitting = false, error = mapSsoError(outcome.reason)) }
-                    }
-                    SsoAuthManager.Outcome.Idle -> Unit
-                }
-            }
-        }
-    }
-
     fun onUsernameChange(value: String) = _state.update { it.copy(username = value, error = null) }
     fun onPasswordChange(value: String) = _state.update { it.copy(password = value, error = null) }
     fun onCodeChange(value: String) =
         _state.update { it.copy(code = value.filter(Char::isDigit).take(8), error = null) }
 
-    /** Recovery codes are alphanumeric; keep it permissive, just trim length + noise. */
-    fun onRecoveryCodeChange(value: String) =
-        _state.update { it.copy(recoveryCode = value.filterNot(Char::isWhitespace).take(32), error = null) }
-
-    fun onTrustDeviceChange(value: Boolean) = _state.update { it.copy(trustDevice = value) }
-
-    /** Toggle between the TOTP field and the recovery-code field on the 2FA step. */
-    fun onUseRecoveryCodeChange(value: Boolean) =
-        _state.update { it.copy(useRecoveryCode = value, error = null) }
-
     val registerUrl: String? get() = websiteUrls.register()
     val forgotPasswordUrl: String? get() = websiteUrls.forgotPassword()
-
+    val ssoLoginUrl: String? get() = websiteUrls.login()
-    /**
-     * Discover the shard's native SSO providers (§4.2). A failure surfaces a retry
-     * affordance instead of the old dead website-login hand-off, which was never
-     * mobile-formatted and could not deep-link the session back.
-     */
-    fun discoverSsoProviders() {
-        _state.update { it.copy(ssoDiscovering = true, ssoUnavailable = false) }
-        viewModelScope.launch {
-            when (val result = authRepository.ssoProviders()) {
-                is SsoDiscovery.Available ->
-                    _state.update {
-                        it.copy(ssoProviders = result.providers, ssoDiscovering = false, ssoUnavailable = false)
-                    }
-                SsoDiscovery.None ->
-                    _state.update {
-                        it.copy(ssoProviders = emptyList(), ssoDiscovering = false, ssoUnavailable = false)
-                    }
-                SsoDiscovery.Unavailable ->
-                    _state.update {
-                        it.copy(ssoProviders = emptyList(), ssoDiscovering = false, ssoUnavailable = true)
-                    }
-            }
-        }
-    }
-
-    /**
-     * Begin a native SSO flow for [provider]: mint PKCE + state and surface the
-     * `/start` URL for the screen to open in a Custom Tab. No-op (leaves a SERVER
-     * error) if the base URL isn't set yet — the website fallback still shows.
-     */
-    fun onSsoProviderClick(provider: SsoProviderDto) {
-        if (_state.value.submitting) return
-        val url = ssoAuthManager.buildStartUrl(provider.id)
-        if (url == null) {
-            _state.update { it.copy(error = LoginError.SSO) }
-            return
-        }
-        _state.update { it.copy(error = null, ssoLaunchUrl = url) }
-    }
-
-    /** The screen has opened the Custom Tab; clear so it isn't re-launched on recompose. */
-    fun onSsoLaunchConsumed() = _state.update { it.copy(ssoLaunchUrl = null) }
-
-    private fun mapSsoError(reason: SsoAuthManager.Failure): LoginError = when (reason) {
-        SsoAuthManager.Failure.NETWORK -> LoginError.NETWORK
-        else -> LoginError.SSO
-    }
 
     fun submit() {
         val s = _state.value
         if (s.submitting) return
-        val validationError = validateForSubmit(s)
+        if (s.username.isBlank() || s.password.isBlank()) {
-        if (validationError != null) {
+            _state.update { it.copy(error = LoginError.INVALID_CREDENTIALS) }
-            _state.update { it.copy(error = validationError) }
+            return
+        }
+        // If 2FA is being requested, a code must accompany the resubmit.
+        if (s.totpRequired && s.code.isBlank()) {
+            _state.update { it.copy(error = LoginError.BAD_CODE) }
             return
         }
 
         _state.update { it.copy(submitting = true, error = null) }
         viewModelScope.launch {
-            // Only one second factor is sent; the recovery toggle picks which.
+            val code = s.code.trim().takeIf { it.isNotBlank() }
-            val code = s.code.trim().takeIf { it.isNotBlank() && !s.useRecoveryCode }
+            when (authRepository.login(s.username.trim(), s.password, code)) {
-            val recoveryCode = s.recoveryCode.trim().takeIf { it.isNotBlank() && s.useRecoveryCode }
+                LoginResult.Success ->
-            val result = authRepository.login(
+                    _state.update { it.copy(submitting = false, signedIn = true) }
-                username = s.username.trim(),
-                password = s.password,
-                code = code,
-                recoveryCode = recoveryCode,
-                trustDevice = s.trustDevice,
-            )
-            applyLoginResult(result)
-        }
-    }
 
-    /** Pre-flight form checks for [submit]; returns the error to surface, or null if ready to send. */
+                LoginResult.TotpRequired ->
-    private fun validateForSubmit(s: UiState): LoginError? {
+                    // Reveal the code field; a wrong code re-lands here as BAD_CODE.
-        if (s.username.isBlank() || s.password.isBlank()) return LoginError.INVALID_CREDENTIALS
+                    _state.update {
-        // If 2FA is being requested, the chosen second factor must accompany the resubmit.
+                        it.copy(
-        if (s.totpRequired) {
+                            submitting = false,
-            val factor = if (s.useRecoveryCode) s.recoveryCode else s.code
+                            totpRequired = true,
-            if (factor.isBlank()) return LoginError.BAD_CODE
+                            error = if (it.code.isNotBlank()) LoginError.BAD_CODE else null,
-        }
+                        )
-        return null
+                    }
-    }
 
-    /** Folds a [LoginResult] back into the UI state (clears [UiState.submitting] on every path). */
+                LoginResult.InvalidCredentials ->
-    private fun applyLoginResult(result: LoginResult) = when (result) {
+                    _state.update { it.copy(submitting = false, error = LoginError.INVALID_CREDENTIALS) }
-        is LoginResult.Success ->
-            // The trusted-device cap (result.trustLimitReached) is an edge case:
-            // login succeeded but the device wasn't remembered. It's surfaced +
-            // managed on the Trusted Devices screen rather than blocking sign-in.
-            _state.update { it.copy(submitting = false, signedIn = true) }
 
-        LoginResult.TotpRequired ->
+                LoginResult.RateLimited ->
-            // Reveal the 2FA fields; a wrong code/recovery code re-lands here as BAD_CODE.
+                    _state.update { it.copy(submitting = false, error = LoginError.RATE_LIMITED) }
-            _state.update {
+
-                val hadFactor = if (it.useRecoveryCode) it.recoveryCode.isNotBlank() else it.code.isNotBlank()
+                LoginResult.ServerError ->
-                it.copy(
+                    _state.update { it.copy(submitting = false, error = LoginError.SERVER) }
-                    submitting = false,
+
-                    totpRequired = true,
+                LoginResult.NetworkError ->
-                    error = if (hadFactor) LoginError.BAD_CODE else null,
+                    _state.update { it.copy(submitting = false, error = LoginError.NETWORK) }
-                )
             }
-
+        }
-        LoginResult.InvalidCredentials ->
-            _state.update { it.copy(submitting = false, error = LoginError.INVALID_CREDENTIALS) }
-
-        LoginResult.RateLimited ->
-            _state.update { it.copy(submitting = false, error = LoginError.RATE_LIMITED) }
-
-        LoginResult.ServerError ->
-            _state.update { it.copy(submitting = false, error = LoginError.SERVER) }
-
-        LoginResult.NetworkError ->
-            _state.update { it.copy(submitting = false, error = LoginError.NETWORK) }
     }
 }

app/src/main/java/com/runicgateway/app/ui/auth/RecoveryCodesScreen.kt

@@ -1,153 +0,0 @@
-/*
- * SPDX-License-Identifier: GPL-3.0-or-later
- */
-package com.runicgateway.app.ui.auth
-
-import android.content.Intent
-import androidx.compose.foundation.layout.Arrangement
-import androidx.compose.foundation.layout.Column
-import androidx.compose.foundation.layout.Row
-import androidx.compose.foundation.layout.fillMaxSize
-import androidx.compose.foundation.layout.fillMaxWidth
-import androidx.compose.foundation.layout.padding
-import androidx.compose.foundation.rememberScrollState
-import androidx.compose.foundation.text.KeyboardOptions
-import androidx.compose.foundation.verticalScroll
-import androidx.compose.material3.Button
-import androidx.compose.material3.Card
-import androidx.compose.material3.MaterialTheme
-import androidx.compose.material3.OutlinedButton
-import androidx.compose.material3.OutlinedTextField
-import androidx.compose.material3.Text
-import androidx.compose.runtime.Composable
-import androidx.compose.runtime.getValue
-import androidx.compose.runtime.mutableStateOf
-import androidx.compose.runtime.remember
-import androidx.compose.runtime.saveable.rememberSaveable
-import androidx.compose.runtime.setValue
-import androidx.compose.ui.Modifier
-import androidx.compose.ui.platform.LocalClipboardManager
-import androidx.compose.ui.platform.LocalContext
-import androidx.compose.ui.res.stringResource
-import androidx.compose.ui.text.AnnotatedString
-import androidx.compose.ui.text.font.FontFamily
-import androidx.compose.ui.text.input.KeyboardType
-import androidx.compose.ui.text.input.PasswordVisualTransformation
-import androidx.compose.ui.unit.dp
-import androidx.hilt.navigation.compose.hiltViewModel
-import androidx.lifecycle.compose.collectAsStateWithLifecycle
-import com.runicgateway.app.R
-import com.runicgateway.app.ui.UiState
-
-/**
- * Account → Recovery Codes (TRUSTED_DEVICES_MFA.md): shows the remaining count and a
- * password-stepped regenerate that reveals a fresh single-use batch **once**. The
- * codes are shown only in memory — copy or share them before leaving; they are never
- * stored on the device.
- */
-@Composable
-fun RecoveryCodesScreen(
-    modifier: Modifier = Modifier,
-    viewModel: RecoveryCodesViewModel = hiltViewModel(),
-) {
-    val state by viewModel.state.collectAsStateWithLifecycle()
-    var currentPassword by rememberSaveable { mutableStateOf("") }
-
-    Column(
-        modifier = modifier
-            .fillMaxSize()
-            .verticalScroll(rememberScrollState())
-            .padding(16.dp),
-    ) {
-        Text(stringResource(R.string.recovery_codes_title), style = MaterialTheme.typography.titleLarge)
-        Text(
-            stringResource(R.string.recovery_codes_subtitle),
-            style = MaterialTheme.typography.bodyMedium,
-            color = MaterialTheme.colorScheme.onSurfaceVariant,
-            modifier = Modifier.padding(top = 4.dp),
-        )
-
-        val remainingText = when (val r = state.remaining) {
-            is UiState.Success -> stringResource(R.string.recovery_codes_remaining, r.data)
-            is UiState.Error -> stringResource(R.string.recovery_codes_remaining_unknown)
-            UiState.Loading -> stringResource(R.string.recovery_codes_remaining_loading)
-        }
-        Text(remainingText, style = MaterialTheme.typography.bodyLarge, modifier = Modifier.padding(top = 16.dp))
-
-        state.freshCodes?.let { codes ->
-            RecoveryCodesShowOnceCard(codes, onDismiss = { viewModel.dismissFreshCodes(); currentPassword = "" })
-        }
-
-        OutlinedTextField(
-            value = currentPassword,
-            onValueChange = { currentPassword = it },
-            singleLine = true,
-            enabled = !state.busy,
-            label = { Text(stringResource(R.string.account_password_current)) },
-            supportingText = { Text(stringResource(R.string.recovery_codes_password_hint)) },
-            visualTransformation = PasswordVisualTransformation(),
-            keyboardOptions = KeyboardOptions(keyboardType = KeyboardType.Password),
-            modifier = Modifier.fillMaxWidth().padding(top = 20.dp),
-        )
-
-        state.error?.let { err ->
-            Text(
-                text = stringResource(err),
-                color = MaterialTheme.colorScheme.error,
-                style = MaterialTheme.typography.bodyMedium,
-                modifier = Modifier.padding(top = 12.dp),
-            )
-        }
-
-        Button(
-            onClick = { viewModel.regenerate(currentPassword) },
-            enabled = !state.busy,
-            modifier = Modifier.fillMaxWidth().padding(top = 16.dp),
-        ) { Text(stringResource(R.string.recovery_codes_regenerate)) }
-    }
-}
-
-/**
- * A show-once display of a freshly generated recovery-code batch, with copy/share and
- * a dismiss. Shared by this screen and the "2FA just enabled" surface on AccountScreen.
- */
-@Composable
-fun RecoveryCodesShowOnceCard(codes: List<String>, onDismiss: () -> Unit) {
-    val context = LocalContext.current
-    val clipboard = LocalClipboardManager.current
-    val joined = remember(codes) { codes.joinToString("\n") }
-
-    Card(Modifier.fillMaxWidth().padding(top = 16.dp)) {
-        Column(Modifier.padding(16.dp)) {
-            Text(stringResource(R.string.recovery_codes_new_title), style = MaterialTheme.typography.titleMedium)
-            Text(
-                stringResource(R.string.recovery_codes_new_hint),
-                style = MaterialTheme.typography.bodySmall,
-                color = MaterialTheme.colorScheme.onSurfaceVariant,
-                modifier = Modifier.padding(top = 4.dp),
-            )
-            codes.forEach { code ->
-                Text(
-                    code,
-                    style = MaterialTheme.typography.bodyLarge.copy(fontFamily = FontFamily.Monospace),
-                    modifier = Modifier.padding(top = 8.dp),
-                )
-            }
-            Row(Modifier.fillMaxWidth().padding(top = 16.dp), horizontalArrangement = Arrangement.spacedBy(8.dp)) {
-                OutlinedButton(
-                    onClick = { clipboard.setText(AnnotatedString(joined)) },
-                ) { Text(stringResource(R.string.recovery_codes_copy)) }
-                OutlinedButton(
-                    onClick = {
-                        val send = Intent(Intent.ACTION_SEND).apply {
-                            type = "text/plain"
-                            putExtra(Intent.EXTRA_TEXT, joined)
-                        }
-                        context.startActivity(Intent.createChooser(send, null))
-                    },
-                ) { Text(stringResource(R.string.recovery_codes_share)) }
-                Button(onClick = onDismiss) { Text(stringResource(R.string.recovery_codes_done)) }
-            }
-        }
-    }
-}

app/src/main/java/com/runicgateway/app/ui/auth/RecoveryCodesViewModel.kt

@@ -1,84 +0,0 @@
-/*
- * SPDX-License-Identifier: GPL-3.0-or-later
- */
-package com.runicgateway.app.ui.auth
-
-import androidx.annotation.StringRes
-import androidx.lifecycle.ViewModel
-import androidx.lifecycle.viewModelScope
-import com.runicgateway.app.R
-import com.runicgateway.app.core.result.ApiResult
-import com.runicgateway.app.data.repository.AccountRepository
-import com.runicgateway.app.ui.UiState
-import com.runicgateway.app.ui.toUiState
-import dagger.hilt.android.lifecycle.HiltViewModel
-import kotlinx.coroutines.flow.MutableStateFlow
-import kotlinx.coroutines.flow.StateFlow
-import kotlinx.coroutines.flow.asStateFlow
-import kotlinx.coroutines.flow.update
-import kotlinx.coroutines.launch
-import javax.inject.Inject
-
-/**
- * Drives Account → Recovery Codes (TRUSTED_DEVICES_MFA.md): the remaining-count
- * status and a password-stepped regenerate that surfaces a fresh single-use batch
- * **once** (never persisted). The freshly generated codes live only in memory until
- * the user leaves the screen or dismisses them.
- */
-@HiltViewModel
-class RecoveryCodesViewModel @Inject constructor(
-    private val accountRepository: AccountRepository,
-) : ViewModel() {
-
-    data class State(
-        /** Remaining unused codes (the status endpoint). */
-        val remaining: UiState<Int> = UiState.Loading,
-        /** A just-generated batch to show once, or null. Cleared on dismiss/leave. */
-        val freshCodes: List<String>? = null,
-        val busy: Boolean = false,
-        @param:StringRes val error: Int? = null,
-    )
-
-    private val _state = MutableStateFlow(State())
-    val state: StateFlow<State> = _state.asStateFlow()
-
-    init {
-        load()
-    }
-
-    fun load() {
-        _state.update { it.copy(remaining = UiState.Loading) }
-        viewModelScope.launch {
-            _state.update { it.copy(remaining = accountRepository.recoveryCodesStatus().toUiState().map { s -> s.remaining }) }
-        }
-    }
-
-    /** Regenerate the codes; [currentPassword] is required for accounts that have one. */
-    fun regenerate(currentPassword: String?) {
-        if (_state.value.busy) return
-        _state.update { it.copy(busy = true, error = null, freshCodes = null) }
-        viewModelScope.launch {
-            when (val result = accountRepository.generateRecoveryCodes(currentPassword?.takeIf { it.isNotBlank() })) {
-                is ApiResult.Ok -> {
-                    _state.update { it.copy(busy = false, freshCodes = result.data.recoveryCodes) }
-                    // Refresh the remaining count to reflect the new batch.
-                    _state.update { it.copy(remaining = accountRepository.recoveryCodesStatus().toUiState().map { s -> s.remaining }) }
-                }
-                is ApiResult.HttpError ->
-                    _state.update { it.copy(busy = false, error = R.string.recovery_codes_error) }
-                is ApiResult.NetworkError ->
-                    _state.update { it.copy(busy = false, error = R.string.error_network) }
-            }
-        }
-    }
-
-    /** Drop the shown-once batch from memory (user saved them / navigated away). */
-    fun dismissFreshCodes() = _state.update { it.copy(freshCodes = null) }
-}
-
-/** Map an [UiState] success value (local helper mirroring ApiResult.map). */
-private inline fun <T, R> UiState<T>.map(transform: (T) -> R): UiState<R> = when (this) {
-    is UiState.Success -> UiState.Success(transform(data))
-    is UiState.Loading -> UiState.Loading
-    is UiState.Error -> this
-}

app/src/main/java/com/runicgateway/app/ui/auth/TrustedDevicesScreen.kt

@@ -1,136 +0,0 @@
-/*
- * SPDX-License-Identifier: GPL-3.0-or-later
- */
-package com.runicgateway.app.ui.auth
-
-import androidx.compose.foundation.layout.Column
-import androidx.compose.foundation.layout.Row
-import androidx.compose.foundation.layout.fillMaxSize
-import androidx.compose.foundation.layout.fillMaxWidth
-import androidx.compose.foundation.layout.padding
-import androidx.compose.foundation.rememberScrollState
-import androidx.compose.foundation.verticalScroll
-import androidx.compose.material3.Button
-import androidx.compose.material3.Card
-import androidx.compose.material3.HorizontalDivider
-import androidx.compose.material3.MaterialTheme
-import androidx.compose.material3.OutlinedButton
-import androidx.compose.material3.Text
-import androidx.compose.material3.TextButton
-import androidx.compose.runtime.Composable
-import androidx.compose.runtime.getValue
-import androidx.compose.ui.Alignment
-import androidx.compose.ui.Modifier
-import androidx.compose.ui.res.stringResource
-import androidx.compose.ui.unit.dp
-import androidx.hilt.navigation.compose.hiltViewModel
-import androidx.lifecycle.compose.collectAsStateWithLifecycle
-import com.runicgateway.app.R
-import com.runicgateway.app.data.api.dto.TrustedDeviceDto
-import com.runicgateway.app.ui.UiState
-import com.runicgateway.app.ui.components.ErrorView
-import com.runicgateway.app.ui.components.LoadingView
-
-/**
- * Account → Trusted Devices (TRUSTED_DEVICES_MFA.md): the devices allowed to skip
- * the TOTP step at login. Trust the current device, revoke one, or untrust all. The
- * server re-checks ownership on every call; this screen just renders the outcomes.
- */
-@Composable
-fun TrustedDevicesScreen(
-    modifier: Modifier = Modifier,
-    viewModel: TrustedDevicesViewModel = hiltViewModel(),
-) {
-    val state by viewModel.state.collectAsStateWithLifecycle()
-
-    Column(
-        modifier = modifier
-            .fillMaxSize()
-            .verticalScroll(rememberScrollState())
-            .padding(16.dp),
-    ) {
-        Text(
-            stringResource(R.string.trusted_devices_title),
-            style = MaterialTheme.typography.titleLarge,
-        )
-        Text(
-            stringResource(R.string.trusted_devices_subtitle),
-            style = MaterialTheme.typography.bodyMedium,
-            color = MaterialTheme.colorScheme.onSurfaceVariant,
-            modifier = Modifier.padding(top = 4.dp),
-        )
-
-        state.feedback?.let { fb ->
-            Text(
-                text = stringResource(fb.messageRes),
-                color = if (fb.ok) MaterialTheme.colorScheme.primary else MaterialTheme.colorScheme.error,
-                style = MaterialTheme.typography.bodyMedium,
-                modifier = Modifier.padding(top = 12.dp),
-            )
-        }
-
-        when (val devices = state.devices) {
-            is UiState.Loading -> LoadingView(Modifier.padding(top = 32.dp))
-            is UiState.Error -> ErrorView(devices.kind, onRetry = viewModel::load, modifier = Modifier.padding(top = 32.dp))
-            is UiState.Success -> {
-                if (devices.data.isEmpty()) {
-                    Text(
-                        stringResource(R.string.trusted_devices_empty),
-                        style = MaterialTheme.typography.bodyMedium,
-                        color = MaterialTheme.colorScheme.onSurfaceVariant,
-                        modifier = Modifier.padding(top = 24.dp),
-                    )
-                } else {
-                    devices.data.forEach { device ->
-                        TrustedDeviceRow(device, state.busy, onRevoke = { viewModel.revoke(device.id) })
-                    }
-                }
-
-                HorizontalDivider(Modifier.padding(vertical = 20.dp))
-
-                Button(
-                    onClick = viewModel::trustThisDevice,
-                    enabled = !state.busy,
-                    modifier = Modifier.fillMaxWidth(),
-                ) { Text(stringResource(R.string.trusted_devices_trust_this)) }
-
-                if (devices.data.isNotEmpty()) {
-                    OutlinedButton(
-                        onClick = viewModel::revokeAll,
-                        enabled = !state.busy,
-                        modifier = Modifier.fillMaxWidth().padding(top = 8.dp),
-                    ) { Text(stringResource(R.string.trusted_devices_untrust_all)) }
-                }
-            }
-        }
-    }
-}
-
-@Composable
-private fun TrustedDeviceRow(device: TrustedDeviceDto, busy: Boolean, onRevoke: () -> Unit) {
-    Card(Modifier.fillMaxWidth().padding(top = 12.dp)) {
-        Row(
-            Modifier.fillMaxWidth().padding(16.dp),
-            verticalAlignment = Alignment.CenterVertically,
-        ) {
-            Column(Modifier.weight(1f)) {
-                Text(
-                    text = device.deviceName?.takeIf { it.isNotBlank() }
-                        ?: device.platform?.replaceFirstChar { it.uppercase() }
-                        ?: stringResource(R.string.trusted_devices_unknown),
-                    style = MaterialTheme.typography.bodyLarge,
-                )
-                device.lastUsedAt?.let {
-                    Text(
-                        stringResource(R.string.trusted_devices_last_used, it),
-                        style = MaterialTheme.typography.bodySmall,
-                        color = MaterialTheme.colorScheme.onSurfaceVariant,
-                    )
-                }
-            }
-            TextButton(onClick = onRevoke, enabled = !busy) {
-                Text(stringResource(R.string.trusted_devices_revoke))
-            }
-        }
-    }
-}

app/src/main/java/com/runicgateway/app/ui/auth/TrustedDevicesViewModel.kt

@@ -1,125 +0,0 @@
-/*
- * SPDX-License-Identifier: GPL-3.0-or-later
- */
-package com.runicgateway.app.ui.auth
-
-import androidx.annotation.StringRes
-import androidx.lifecycle.ViewModel
-import androidx.lifecycle.viewModelScope
-import com.runicgateway.app.R
-import com.runicgateway.app.core.auth.DeviceNameProvider
-import com.runicgateway.app.core.result.ApiResult
-import com.runicgateway.app.data.api.dto.TrustedDeviceDto
-import com.runicgateway.app.data.repository.AccountRepository
-import com.runicgateway.app.data.repository.AccountRepository.TrustOutcome
-import com.runicgateway.app.data.repository.AuthRepository
-import com.runicgateway.app.ui.UiState
-import com.runicgateway.app.ui.toUiState
-import dagger.hilt.android.lifecycle.HiltViewModel
-import kotlinx.coroutines.flow.MutableStateFlow
-import kotlinx.coroutines.flow.StateFlow
-import kotlinx.coroutines.flow.asStateFlow
-import kotlinx.coroutines.flow.update
-import kotlinx.coroutines.launch
-import javax.inject.Inject
-
-/**
- * Drives the Trusted Devices screen (TRUSTED_DEVICES_MFA.md): list the devices
- * allowed to skip the TOTP step, trust the current one (persisting the returned
- * token via [AuthRepository]), revoke one, and untrust all. The trust action folds
- * the `409` cap into a first-class [Feedback] telling the user to revoke one first.
- */
-@HiltViewModel
-class TrustedDevicesViewModel @Inject constructor(
-    private val accountRepository: AccountRepository,
-    private val authRepository: AuthRepository,
-    private val sessionManager: com.runicgateway.app.core.auth.SessionManager,
-    private val deviceNameProvider: DeviceNameProvider,
-) : ViewModel() {
-
-    /** A one-shot result banner shown above the list. */
-    data class Feedback(val ok: Boolean, @param:StringRes val messageRes: Int)
-
-    data class State(
-        val devices: UiState<List<TrustedDeviceDto>> = UiState.Loading,
-        val busy: Boolean = false,
-        val feedback: Feedback? = null,
-    )
-
-    private val _state = MutableStateFlow(State())
-    val state: StateFlow<State> = _state.asStateFlow()
-
-    init {
-        load()
-    }
-
-    fun load() {
-        _state.update { it.copy(devices = UiState.Loading) }
-        viewModelScope.launch {
-            _state.update { it.copy(devices = accountRepository.trustedDevices().toUiState()) }
-        }
-    }
-
-    /** Trust the current device; persist the returned token so future logins skip 2FA. */
-    fun trustThisDevice() {
-        if (_state.value.busy) return
-        _state.update { it.copy(busy = true, feedback = null) }
-        viewModelScope.launch {
-            when (val outcome = accountRepository.trustThisDevice(deviceNameProvider.deviceName())) {
-                is TrustOutcome.Trusted -> {
-                    // Bind the fresh token to the signed-in username (mirrors the login path).
-                    val username = sessionManager.state.value.let {
-                        (it as? com.runicgateway.app.core.auth.Session.SignedIn)?.user?.username
-                    }
-                    if (outcome.trustToken != null && username != null) {
-                        authRepository.saveTrustToken(username, outcome.trustToken)
-                    }
-                    finish(true, R.string.trusted_devices_trusted)
-                    reload()
-                }
-                is TrustOutcome.LimitReached -> finish(false, R.string.trusted_devices_limit)
-                TrustOutcome.NetworkError -> finish(false, R.string.error_network)
-                TrustOutcome.ServerError -> finish(false, R.string.trusted_devices_error)
-            }
-        }
-    }
-
-    fun revoke(id: Long) {
-        if (_state.value.busy) return
-        _state.update { it.copy(busy = true, feedback = null) }
-        viewModelScope.launch {
-            when (accountRepository.revokeTrustedDevice(id)) {
-                is ApiResult.Ok -> {
-                    finish(true, R.string.trusted_devices_revoked)
-                    reload()
-                }
-                else -> finish(false, R.string.trusted_devices_error)
-            }
-        }
-    }
-
-    fun revokeAll() {
-        if (_state.value.busy) return
-        _state.update { it.copy(busy = true, feedback = null) }
-        viewModelScope.launch {
-            when (accountRepository.revokeAllTrustedDevices()) {
-                is ApiResult.Ok -> {
-                    // Every device is untrusted now, including this one — drop the local token.
-                    authRepository.clearTrustToken()
-                    finish(true, R.string.trusted_devices_revoked_all)
-                    reload()
-                }
-                else -> finish(false, R.string.trusted_devices_error)
-            }
-        }
-    }
-
-    fun clearFeedback() = _state.update { it.copy(feedback = null) }
-
-    private suspend fun reload() {
-        _state.update { it.copy(devices = accountRepository.trustedDevices().toUiState()) }
-    }
-
-    private fun finish(ok: Boolean, @StringRes messageRes: Int) =
-        _state.update { it.copy(busy = false, feedback = Feedback(ok, messageRes)) }
-}

app/src/main/java/com/runicgateway/app/ui/components/StateViews.kt

@@ -36,10 +36,6 @@ fun LoadingView(modifier: Modifier = Modifier) {
 /**
  * Whole-screen error state with a friendly, kind-specific message and a Retry
  * button (§7). Copy is resolved from string resources so it stays localizable.
- *
- * [ErrorKind.FEATURE_UNAVAILABLE] renders **without** the button: an admin decides
- * whether the shard publishes that surface, so retrying cannot change the answer and
- * offering it would read as a transient failure the user could wait out (M11).
  */
 @Composable
 fun ErrorView(
@@ -57,20 +53,15 @@ fun ErrorView(
             style = MaterialTheme.typography.bodyLarge,
             textAlign = TextAlign.Center,
         )
-        if (isRetryable(kind)) {
+        Button(
-            Button(
+            onClick = onRetry,
-                onClick = onRetry,
+            modifier = Modifier.padding(top = 16.dp).width(160.dp),
-                modifier = Modifier.padding(top = 16.dp).width(160.dp),
+        ) {
-            ) {
+            Text(stringResource(R.string.action_retry))
-                Text(stringResource(R.string.action_retry))
-            }
         }
     }
 }
 
-/** Whether retrying this failure could plausibly succeed. Pure, so it is unit-tested. */
-fun isRetryable(kind: ErrorKind): Boolean = kind != ErrorKind.FEATURE_UNAVAILABLE
-
 /** Centered informational message for an empty list (§7). */
 @Composable
 fun EmptyView(message: String, modifier: Modifier = Modifier) {
@@ -92,6 +83,5 @@ private fun errorMessageRes(kind: ErrorKind): Int = when (kind) {
     ErrorKind.NOT_FOUND -> R.string.error_not_found
     ErrorKind.RATE_LIMITED -> R.string.error_rate_limited
     ErrorKind.SHARD_OFFLINE -> R.string.error_shard_offline
-    ErrorKind.FEATURE_UNAVAILABLE -> R.string.error_feature_unavailable
     ErrorKind.SERVER -> R.string.error_server
 }

app/src/main/java/com/runicgateway/app/ui/navigation/Menu.kt

@@ -6,9 +6,6 @@ package com.runicgateway.app.ui.navigation
 import androidx.annotation.StringRes
 import com.runicgateway.app.R
 import com.runicgateway.app.core.auth.Session
-import com.runicgateway.app.data.repository.ShardFeature
-import com.runicgateway.app.data.repository.ShardFeatures
-import com.runicgateway.app.data.repository.canSee
 
 /**
  * One shared, declarative, access-level navigation definition (PLAN.md §5): a
@@ -24,34 +21,14 @@ enum class MenuAccess {
     /** Visible to any signed-in account (§5, "My Account"). */
     SIGNED_IN,
 
-    /**
+    /** Visible only to a player — the linked game-data groups (§6.3). */
-     * The linked game-data groups (§6.3). Visible to any player **or** staff:
-     * staff are a superset of players (all player abilities plus their staff
-     * tools), and the backend's player self-service surface is role-agnostic, so
-     * a signed-in admin/editor/moderator sees + uses their own characters too.
-     */
     PLAYER,
-
-    /** Visible to any staff role (admin/editor/moderator) — the M10 staff surface (§1). */
-    STAFF,
-
-    /** Visible to admin/moderator — moderation actions + the support queue (§1, M10). */
-    MODERATOR,
 }
 
 data class MenuEntry(
     val route: String,
     @param:StringRes val labelRes: Int,
     val access: MenuAccess = MenuAccess.PUBLIC,
-    /**
-     * For a shard-derived surface, the visibility feature it belongs to (M11).
-     *
-     * Session role is not the only gate on these: an admin can switch a feature off
-     * or raise its audience above the caller's rung, so the entry is filtered by
-     * `GET /public/shard/features` as well as by [access]. `null` means the entry
-     * isn't shard-derived and only [access] applies.
-     */
-    val feature: String? = null,
 )
 
 /**
@@ -63,50 +40,24 @@ val APP_MENU: List<MenuEntry> = listOf(
     MenuEntry(Routes.HOME, R.string.menu_home),
     MenuEntry(Routes.NEWS, R.string.menu_news),
     MenuEntry(Routes.WIKI, R.string.menu_wiki),
-    MenuEntry(Routes.SHARD, R.string.menu_shard, feature = ShardFeature.STATUS),
+    MenuEntry(Routes.SHARD, R.string.menu_shard),
-    // Protocol 3.0 shard content (M11). Each hides when the shard doesn't publish it,
-    // which for a brand-new install is every one of them until the plugin has swept.
-    MenuEntry(Routes.SHARD_RULES, R.string.menu_rules, feature = ShardFeature.RULESET),
-    MenuEntry(Routes.ATLAS, R.string.menu_atlas, feature = ShardFeature.ATLAS),
-    MenuEntry(Routes.SHARD_LEADERBOARDS, R.string.menu_leaderboards, feature = ShardFeature.LEADERBOARDS),
-    MenuEntry(Routes.SHARD_MARKET, R.string.menu_market, feature = ShardFeature.MARKET),
     MenuEntry(Routes.page("about"), R.string.menu_about),
     MenuEntry(Routes.CONTACT, R.string.menu_contact),
     MenuEntry(Routes.ACCOUNT, R.string.menu_account, MenuAccess.SIGNED_IN),
-    MenuEntry(Routes.NOTIFICATIONS, R.string.menu_notifications, MenuAccess.SIGNED_IN),
     MenuEntry(Routes.PLAYER_CHARACTERS, R.string.menu_my_characters, MenuAccess.PLAYER),
     MenuEntry(Routes.PLAYER_VENDORS, R.string.menu_my_vendors, MenuAccess.PLAYER),
     MenuEntry(Routes.PLAYER_HOUSES, R.string.menu_my_houses, MenuAccess.PLAYER),
-    // Staff operations (§1, M10) — revealed for staff roles; the backend re-checks every call.
-    MenuEntry(Routes.ADMIN_DASHBOARD, R.string.menu_admin_dashboard, MenuAccess.STAFF),
-    MenuEntry(Routes.ADMIN_CONTENT, R.string.menu_admin_content, MenuAccess.STAFF),
-    MenuEntry(Routes.ADMIN_MODERATION, R.string.menu_admin_moderation, MenuAccess.MODERATOR),
-    MenuEntry(Routes.ADMIN_SUPPORT, R.string.menu_admin_support, MenuAccess.MODERATOR),
 )
 
 /**
- * The entries the given [session] may see, given the shard [features] it may reach.
+ * The entries the given [session] may see. Pure + side-effect-free so the access
- * Pure + side-effect-free so the gating is unit-tested without Compose.
+ * gating is unit-tested without Compose.
- *
- * Two independent filters, and both must pass:
- *
- *  - [MenuEntry.access] against the session — who the caller is.
- *  - [MenuEntry.feature] against the shard's live visibility config — what this shard
- *    publishes at all (M11). `null` [features] means the answer isn't known yet and
- *    every shard entry shows; see [canSee] for why that direction is deliberate.
  */
-fun visibleEntries(
+fun visibleEntries(entries: List<MenuEntry>, session: Session): List<MenuEntry> =
-    entries: List<MenuEntry>,
-    session: Session,
-    features: ShardFeatures? = null,
-): List<MenuEntry> =
     entries.filter { entry ->
-        val allowedByRole = when (entry.access) {
+        when (entry.access) {
             MenuAccess.PUBLIC -> true
             MenuAccess.SIGNED_IN -> session is Session.SignedIn
-            MenuAccess.PLAYER -> session is Session.SignedIn && (session.user.isPlayer || session.user.isStaff)
+            MenuAccess.PLAYER -> session is Session.SignedIn && session.user.isPlayer
-            MenuAccess.STAFF -> session is Session.SignedIn && session.user.isStaff
-            MenuAccess.MODERATOR -> session is Session.SignedIn && session.user.isModerator
         }
-        allowedByRole && (entry.feature == null || canSee(features, entry.feature))
     }

app/src/main/java/com/runicgateway/app/ui/navigation/Routes.kt

@@ -18,13 +18,6 @@ object Routes {
     const val LOGIN = "login"
     const val ACCOUNT = "account"
 
-    /** MFA management, reached from Account (TRUSTED_DEVICES_MFA.md). Signed-in only. */
-    const val ACCOUNT_TRUSTED_DEVICES = "account/trusted-devices"
-    const val ACCOUNT_RECOVERY_CODES = "account/recovery-codes"
-
-    /** Opt-in push notification settings (§11, signed-in). */
-    const val NOTIFICATIONS = "notifications"
-
     /** Public shard hub (§6.2). */
     const val SHARD = "shard"
 
@@ -34,18 +27,6 @@ object Routes {
     const val SHARD_GOVERNORS = "shard/governors"
     const val SHARD_HOUSES = "shard/houses"
 
-    /**
-     * Protocol 3.0 shard content (M11), each gated by its own visibility feature. The
-     * atlas is not under `shard/` on the wire (`/public/atlas`) because it is static
-     * content rather than live state, but it is a peer of these in the app's nav.
-     */
-    const val SHARD_RULES = "shard/rules"
-    const val SHARD_LEADERBOARDS = "shard/leaderboards"
-    const val SHARD_MARKET = "shard/market"
-    const val SHARD_MARKET_VENDOR = "shard/market/{serial}"
-    const val ATLAS = "atlas"
-    const val ATLAS_CREATURE = "atlas/{slug}"
-
     /** Player game-data groups (§6.3, player-only). Distinct from the public shard boards. */
     const val PLAYER_CHARACTERS = "player/characters"
     const val PLAYER_VENDORS = "player/vendors"
@@ -54,13 +35,6 @@ object Routes {
     /** A single character sheet by in-game (hex) serial. */
     const val PLAYER_CHAR = "player/char/{serial}"
 
-    /** Staff operations (§1, §6.4, M10). Gated to staff roles by the menu access level;
-     *  the backend re-checks role on every `/admin/…` call. */
-    const val ADMIN_DASHBOARD = "admin/dashboard"
-    const val ADMIN_MODERATION = "admin/moderation"
-    const val ADMIN_SUPPORT = "admin/support"
-    const val ADMIN_CONTENT = "admin/content"
-
     /** CMS page by slug (e.g. the conventional "about" page, mirrored from the site nav). */
     const val PAGE = "page/{slug}"
 
@@ -83,29 +57,4 @@ object Routes {
 
     /** The character-sheet route for an in-game serial (e.g. "0x24C"). */
     fun playerChar(serial: String) = "player/char/$serial"
-
-    /** One player vendor's shop, by in-game (hex) serial. */
-    fun marketVendor(serial: String) = "shard/market/$serial"
-
-    /** One creature's atlas page, by slug. */
-    fun atlasCreature(slug: String) = "atlas/$slug"
-
-    /**
-     * The in-app destination a tapped push notification deep-links to (§11, M7
-     * Part 2 work item 7). Maps a stream id to the screen that shows its content;
-     * unknown streams land on Home. Personal streams route to the player groups
-     * (a signed-out/demoted tap is caught by [com.runicgateway.app.ui.PlayerGate]).
-     */
-    fun forStream(streamId: String): String = when (streamId) {
-        com.runicgateway.app.core.push.PushStreams.NEWS_POST -> NEWS
-        com.runicgateway.app.core.push.PushStreams.SERVER_STATUS,
-        com.runicgateway.app.core.push.PushStreams.CHAMP_START,
-        com.runicgateway.app.core.push.PushStreams.IDOC_WARNING,
-        com.runicgateway.app.core.push.PushStreams.GOVERNOR_ELECTION,
-        -> SHARD
-        com.runicgateway.app.core.push.PushStreams.VENDOR_SALE -> PLAYER_VENDORS
-        com.runicgateway.app.core.push.PushStreams.HOUSE_IDOC -> PLAYER_HOUSES
-        com.runicgateway.app.core.push.PushStreams.ACCOUNT_LOGIN -> ACCOUNT
-        else -> HOME
-    }
 }

app/src/main/java/com/runicgateway/app/ui/notifications/NotificationsScreen.kt

@@ -1,182 +0,0 @@
-/*
- * SPDX-License-Identifier: GPL-3.0-or-later
- */
-package com.runicgateway.app.ui.notifications
-
-import android.Manifest
-import android.os.Build
-import androidx.activity.compose.rememberLauncherForActivityResult
-import androidx.activity.result.contract.ActivityResultContracts
-import androidx.compose.foundation.layout.Column
-import androidx.compose.foundation.layout.Row
-import androidx.compose.foundation.layout.Spacer
-import androidx.compose.foundation.layout.fillMaxSize
-import androidx.compose.foundation.layout.fillMaxWidth
-import androidx.compose.foundation.layout.height
-import androidx.compose.foundation.layout.padding
-import androidx.compose.foundation.rememberScrollState
-import androidx.compose.foundation.verticalScroll
-import androidx.compose.material3.HorizontalDivider
-import androidx.compose.material3.MaterialTheme
-import androidx.compose.material3.Switch
-import androidx.compose.material3.Text
-import androidx.compose.runtime.Composable
-import androidx.compose.runtime.getValue
-import androidx.compose.ui.Alignment
-import androidx.compose.ui.Modifier
-import androidx.compose.ui.platform.LocalContext
-import androidx.compose.ui.res.stringResource
-import androidx.compose.ui.text.font.FontStyle
-import androidx.compose.ui.unit.dp
-import androidx.hilt.navigation.compose.hiltViewModel
-import androidx.lifecycle.compose.collectAsStateWithLifecycle
-import com.runicgateway.app.R
-import com.runicgateway.app.data.api.dto.NotificationStreamDto
-import com.runicgateway.app.ui.UiState
-import com.runicgateway.app.ui.components.EmptyView
-import com.runicgateway.app.ui.components.ErrorView
-import com.runicgateway.app.ui.components.LoadingView
-import com.runicgateway.app.ui.components.SectionLabel
-
-/**
- * The Notifications settings screen (PLAN.md §11, M7 Part 2 work item 6): the
- * subscribable catalog with per-stream toggles. Personal streams are greyed until a
- * game account is linked; turning a stream on requests the POST_NOTIFICATIONS
- * permission (API 33+) and registers the device, turning them all off unregisters it.
- */
-@Composable
-fun NotificationsScreen(
-    modifier: Modifier = Modifier,
-    viewModel: NotificationsViewModel = hiltViewModel(),
-) {
-    val state by viewModel.state.collectAsStateWithLifecycle()
-    val context = LocalContext.current
-
-    // Ask once for POST_NOTIFICATIONS when the user first enables a stream (API 33+).
-    val permissionLauncher = rememberLauncherForActivityResult(
-        ActivityResultContracts.RequestPermission(),
-    ) { /* granted or not, the subscription is already saved server-side */ }
-
-    fun ensureNotificationPermission() {
-        if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.TIRAMISU) {
-            permissionLauncher.launch(Manifest.permission.POST_NOTIFICATIONS)
-        }
-    }
-
-    Column(
-        modifier = modifier
-            .fillMaxSize()
-            .verticalScroll(rememberScrollState())
-            .padding(16.dp),
-    ) {
-        Text(
-            text = stringResource(R.string.notifications_title),
-            style = MaterialTheme.typography.titleLarge,
-        )
-        Spacer(Modifier.height(4.dp))
-        Text(
-            text = stringResource(R.string.notifications_subtitle),
-            style = MaterialTheme.typography.bodyMedium,
-            color = MaterialTheme.colorScheme.onSurfaceVariant,
-        )
-        Spacer(Modifier.height(16.dp))
-
-        if (!state.supported) {
-            EmptyView(message = stringResource(R.string.notifications_unsupported))
-            return@Column
-        }
-
-        state.feedback?.let { fb ->
-            Text(
-                text = stringResource(fb.messageRes),
-                style = MaterialTheme.typography.bodyMedium,
-                color = if (fb.ok) MaterialTheme.colorScheme.primary else MaterialTheme.colorScheme.error,
-                modifier = Modifier.padding(bottom = 12.dp),
-            )
-        }
-
-        when (val catalog = state.catalog) {
-            is UiState.Loading -> LoadingView()
-            is UiState.Error -> ErrorView(kind = catalog.kind, onRetry = viewModel::load)
-            is UiState.Success -> StreamList(
-                streams = catalog.data,
-                subscribed = state.subscribed,
-                hasLinkedAccount = state.hasLinkedAccount,
-                busy = state.busy,
-                onToggle = { stream, on ->
-                    if (on) ensureNotificationPermission()
-                    viewModel.setSubscribed(stream, on)
-                },
-            )
-        }
-    }
-}
-
-@Composable
-private fun StreamList(
-    streams: List<NotificationStreamDto>,
-    subscribed: Set<String>,
-    hasLinkedAccount: Boolean,
-    busy: Boolean,
-    onToggle: (NotificationStreamDto, Boolean) -> Unit,
-) {
-    if (streams.isEmpty()) {
-        EmptyView(message = stringResource(R.string.notifications_empty))
-        return
-    }
-    val (personal, general) = streams.partition { it.personal }
-
-    if (general.isNotEmpty()) {
-        SectionLabel(stringResource(R.string.notifications_section_general))
-        Spacer(Modifier.height(8.dp))
-        general.forEach { stream ->
-            StreamRow(stream, subscribed.contains(stream.id), enabled = !busy, hint = null) { on ->
-                onToggle(stream, on)
-            }
-            HorizontalDivider()
-        }
-        Spacer(Modifier.height(20.dp))
-    }
-
-    if (personal.isNotEmpty()) {
-        SectionLabel(stringResource(R.string.notifications_section_personal))
-        Spacer(Modifier.height(8.dp))
-        personal.forEach { stream ->
-            val selectable = streamSelectable(stream, hasLinkedAccount)
-            val hint = if (!selectable) stringResource(R.string.notifications_requires_link) else null
-            StreamRow(stream, subscribed.contains(stream.id) && selectable, enabled = !busy && selectable, hint = hint) { on ->
-                onToggle(stream, on)
-            }
-            HorizontalDivider()
-        }
-    }
-}
-
-@Composable
-private fun StreamRow(
-    stream: NotificationStreamDto,
-    checked: Boolean,
-    enabled: Boolean,
-    hint: String?,
-    onToggle: (Boolean) -> Unit,
-) {
-    Row(
-        modifier = Modifier.fillMaxWidth().padding(vertical = 12.dp),
-        verticalAlignment = Alignment.CenterVertically,
-    ) {
-        Column(modifier = Modifier.weight(1f).padding(end = 12.dp)) {
-            Text(
-                text = stream.label,
-                style = MaterialTheme.typography.bodyLarge,
-                color = if (enabled) MaterialTheme.colorScheme.onSurface else MaterialTheme.colorScheme.onSurfaceVariant,
-            )
-            Text(
-                text = hint ?: stream.description,
-                style = MaterialTheme.typography.bodySmall,
-                color = MaterialTheme.colorScheme.onSurfaceVariant,
-                fontStyle = if (hint != null) FontStyle.Italic else FontStyle.Normal,
-            )
-        }
-        Switch(checked = checked, onCheckedChange = onToggle, enabled = enabled)
-    }
-}

app/src/main/java/com/runicgateway/app/ui/notifications/NotificationsViewModel.kt

@@ -1,135 +0,0 @@
-/*
- * SPDX-License-Identifier: GPL-3.0-or-later
- */
-package com.runicgateway.app.ui.notifications
-
-import androidx.annotation.StringRes
-import androidx.lifecycle.ViewModel
-import androidx.lifecycle.viewModelScope
-import com.runicgateway.app.R
-import com.runicgateway.app.core.push.PushManager
-import com.runicgateway.app.core.result.ApiResult
-import com.runicgateway.app.data.api.dto.NotificationStreamDto
-import com.runicgateway.app.data.repository.NotificationsRepository
-import com.runicgateway.app.data.repository.PlayerShardRepository
-import com.runicgateway.app.ui.UiState
-import com.runicgateway.app.ui.toUiState
-import dagger.hilt.android.lifecycle.HiltViewModel
-import kotlinx.coroutines.flow.MutableStateFlow
-import kotlinx.coroutines.flow.StateFlow
-import kotlinx.coroutines.flow.asStateFlow
-import kotlinx.coroutines.flow.update
-import kotlinx.coroutines.launch
-import javax.inject.Inject
-
-/**
- * Drives the Notifications settings screen (PLAN.md §11, M7 Part 2 work item 6):
- * the stream catalog with per-stream toggles bound to
- * `GET/PUT /auth/me/notifications/subscriptions`. A **personal** stream is greyed
- * until the user has a linked game account (§11), and turning the opt-in set
- * non-empty/empty drives the [PushManager] to register/unregister the device.
- */
-@HiltViewModel
-class NotificationsViewModel @Inject constructor(
-    private val notifications: NotificationsRepository,
-    private val playerShard: PlayerShardRepository,
-    private val pushManager: PushManager,
-) : ViewModel() {
-
-    data class Feedback(val ok: Boolean, @param:StringRes val messageRes: Int)
-
-    data class State(
-        val catalog: UiState<List<NotificationStreamDto>> = UiState.Loading,
-        val subscribed: Set<String> = emptySet(),
-        /** Whether the user has ≥1 linked game account — personal streams need it. */
-        val hasLinkedAccount: Boolean = false,
-        /** Whether this shard advertises a push relay at all (else the screen says so). */
-        val supported: Boolean = true,
-        val busy: Boolean = false,
-        val feedback: Feedback? = null,
-    )
-
-    private val _state = MutableStateFlow(State())
-    val state: StateFlow<State> = _state.asStateFlow()
-
-    init {
-        viewModelScope.launch {
-            pushManager.supported.collect { supported -> _state.update { it.copy(supported = supported) } }
-        }
-        load()
-    }
-
-    fun load() {
-        _state.update { it.copy(catalog = UiState.Loading) }
-        viewModelScope.launch {
-            val catalog = notifications.streams().let { result ->
-                when (result) {
-                    is ApiResult.Ok -> ApiResult.Ok(result.data.streams)
-                    is ApiResult.HttpError -> result
-                    is ApiResult.NetworkError -> result
-                }
-            }
-            _state.update { it.copy(catalog = catalog.toUiState()) }
-
-            when (val subs = notifications.subscriptions()) {
-                is ApiResult.Ok -> _state.update { it.copy(subscribed = subs.data.streams.toSet()) }
-                else -> Unit
-            }
-            // A linked game account gates the personal streams; failure → treat as none.
-            val linked = (playerShard.accounts() as? ApiResult.Ok)?.data?.isNotEmpty() == true
-            _state.update { it.copy(hasLinkedAccount = linked) }
-        }
-    }
-
-    fun clearFeedback() = _state.update { it.copy(feedback = null) }
-
-    /** Toggle [stream]; refuses a personal stream with no linked account. */
-    fun setSubscribed(stream: NotificationStreamDto, on: Boolean) {
-        val s = _state.value
-        if (s.busy) return
-        if (on && !streamSelectable(stream, s.hasLinkedAccount)) return
-        val next = if (on) s.subscribed + stream.id else s.subscribed - stream.id
-
-        _state.update { it.copy(busy = true, feedback = null) }
-        viewModelScope.launch {
-            when (val result = notifications.setSubscriptions(next.toList())) {
-                is ApiResult.Ok -> {
-                    val stored = result.data.streams.toSet()
-                    _state.update { it.copy(subscribed = stored) }
-                    reconcilePush(stored)
-                }
-                is ApiResult.NetworkError -> finish(false, R.string.error_network)
-                is ApiResult.HttpError -> finish(false, R.string.notifications_save_error)
-            }
-        }
-    }
-
-    /**
-     * Register or unregister the device to match the opted-in set (PLAN.md §11:
-     * register when signed-in + subscribed, unregister when the set empties).
-     */
-    private suspend fun reconcilePush(subscribed: Set<String>) {
-        if (subscribed.isEmpty()) {
-            pushManager.disable()
-            finish(true, R.string.notifications_all_off)
-            return
-        }
-        when (val res = pushManager.enable()) {
-            is PushManager.PushResult.Enabled -> finish(true, R.string.notifications_saved)
-            is PushManager.PushResult.Unsupported -> finish(false, R.string.notifications_unsupported)
-            is PushManager.PushResult.NotSignedIn -> finish(false, R.string.notifications_save_error)
-            is PushManager.PushResult.Failed ->
-                finish(false, if (res.status == 400) R.string.notifications_relay_error else R.string.notifications_save_error)
-        }
-    }
-
-    private fun finish(ok: Boolean, @StringRes messageRes: Int) =
-        _state.update { it.copy(busy = false, feedback = Feedback(ok, messageRes)) }
-}
-
-/**
- * Whether a stream's toggle is selectable for a user: a personal stream needs a
- * linked game account (PLAN.md §11). Pure so the gating is unit-tested without Compose.
- */
-fun streamSelectable(stream: NotificationStreamDto, hasLinkedAccount: Boolean): Boolean =
-    !stream.requiresLinkedAccount || hasLinkedAccount

app/src/main/java/com/runicgateway/app/ui/player/CharacterSheetScreen.kt

@@ -26,7 +26,6 @@ import androidx.compose.ui.unit.dp
 import androidx.hilt.navigation.compose.hiltViewModel
 import androidx.lifecycle.compose.collectAsStateWithLifecycle
 import com.runicgateway.app.R
-import com.runicgateway.app.data.api.dto.CharPointsDto
 import com.runicgateway.app.data.api.dto.CharProfileDto
 import com.runicgateway.app.data.api.dto.CharStatsDto
 import com.runicgateway.app.data.api.dto.EquipmentDto
@@ -72,7 +71,6 @@ private fun CharacterSheet(char: CharProfileDto, modifier: Modifier = Modifier)
         char.stats?.let { AttributesBlock(it) }
         char.stats?.resist?.let { ResistancesBlock(it) }
         SkillsBlock(char.skills)
-        PointsBlock(displayPoints(char))
         EquipmentBlock(char.equipment)
     }
 }
@@ -217,47 +215,6 @@ private fun SkillsBlock(skills: List<SkillDto>) {
     }
 }
 
-/**
- * Loyalty & points standings (Protocol 3.0 §7.3). Renders nothing at all for a
- * character that has earned nothing anywhere, which is a normal state.
- *
- * Only a system with a real cap gets a meter: an uncapped score
- * ([CharPointsDto.maxPoints] `0`, the common case on a real shard) has nothing to be
- * a fraction of, and a full-width bar would imply a completion that doesn't exist.
- */
-@Composable
-private fun PointsBlock(points: List<CharPointsDto>) {
-    if (points.isEmpty()) return
-    SheetCard(R.string.player_char_points) {
-        points.forEach { entry ->
-            val cap = entry.cap
-            val score = entry.points ?: 0L
-            Column(Modifier.padding(vertical = 5.dp)) {
-                Row(
-                    Modifier.fillMaxWidth().padding(bottom = 4.dp),
-                    horizontalArrangement = Arrangement.SpaceBetween,
-                ) {
-                    Text(
-                        // `rank` is absent unless the shard opts in; absent and
-                        // "unranked" are different, so the suffix only appears when sent.
-                        entry.rank?.let { stringResource(R.string.player_char_points_ranked, pointsLabel(entry), it) }
-                            ?: pointsLabel(entry),
-                        style = MaterialTheme.typography.labelMedium,
-                        color = MaterialTheme.colorScheme.onSurfaceVariant,
-                    )
-                    Text(
-                        cap?.let { stringResource(R.string.player_char_points_of, score, it) } ?: score.toString(),
-                        style = MaterialTheme.typography.labelMedium,
-                        color = MaterialTheme.colorScheme.onSurfaceVariant,
-                        fontWeight = FontWeight.Medium,
-                    )
-                }
-                if (cap != null) StatBar((score.toDouble() / cap).coerceIn(0.0, 1.0).toFloat())
-            }
-        }
-    }
-}
-
 @OptIn(ExperimentalLayoutApi::class)
 @Composable
 private fun EquipmentBlock(equipment: List<EquipmentDto>) {
@@ -266,7 +223,7 @@ private fun EquipmentBlock(equipment: List<EquipmentDto>) {
         equipment.forEach { item ->
             Column(Modifier.fillMaxWidth().padding(vertical = 6.dp)) {
                 Text(
-                    item.label ?: stringResource(R.string.player_char_item),
+                    item.layer ?: stringResource(R.string.player_char_item),
                     style = MaterialTheme.typography.bodyLarge,
                 )
                 val meta = listOfNotNull(
@@ -309,58 +266,23 @@ internal fun formatSkill(value: Double): String =
 /**
  * The human-readable title chips for a [TitlesDto] (parity with the website's
  * `CharacterSheet.jsx#displayTitles`): fame/karma, skill title, and the selected
- * reward title.
+ * reward title — but only if it is a literal string, not a bare cliloc number
- *
+ * (the app ships no cliloc table). De-duplicated, blanks dropped.
- * Reward entries arrive as either a literal or a cliloc number in string form. The
- * server now resolves the numeric ones into `rewardResolved`, a **parallel** array
- * (see `docs/website/CLILOCS.md`), so the mapping below is index-preserving: an entry
- * that didn't resolve becomes null and is skipped, but must not shift the `selected`
- * index onto its neighbour. A number with no resolution is still skipped rather than
- * rendered as a raw id, which is also the whole behavior on a shard that configures
- * no cliloc table.
- *
- * Falling back to the first title that resolved (rather than showing nothing) matters
- * when the *selected* one is the unresolved entry. De-duplicated, blanks dropped.
  */
 internal fun displayTitles(titles: TitlesDto?): List<String> {
     if (titles == null) return emptyList()
     val out = mutableListOf<String>()
     titles.fameKarma?.let { out.add(it) }
     titles.skill?.let { out.add(it) }
-    val reward = titles.reward.mapIndexed { i, raw ->
+    val reward = titles.reward
-        titles.rewardResolved.getOrNull(i)
+    val sel = titles.selected ?: -1
-            ?: raw.takeUnless { it.isBlank() || it.all(Char::isDigit) }
+    val candidate = when {
+        sel in reward.indices -> reward[sel]
+        else -> reward.firstOrNull { it.isNotBlank() && !it.all(Char::isDigit) }
     }
-    val candidate = reward.getOrNull(titles.selected ?: -1) ?: reward.firstNotNullOfOrNull { it }
+    if (candidate != null && candidate.isNotBlank() && !candidate.all(Char::isDigit)) out.add(candidate)
-    if (!candidate.isNullOrBlank()) out.add(candidate)
     return out.filter { it.isNotBlank() }.distinct()
 }
 
-/**
- * A point system's display name: the shard's own [CharPointsDto.nameString] when it
- * has one, else the humanised `PointsType` key.
- *
- * The fallback is the PRIMARY path, not a defensive nicety — most systems name
- * themselves with a cliloc, so `nameString` comes back null for four of five boards
- * on a real shard (`docs/link/v3.md` §7.5). Parity with the website's
- * `humanisePoints`.
- */
-internal fun pointsLabel(entry: CharPointsDto): String {
-    entry.nameString?.takeIf { it.isNotBlank() }?.let { return it }
-    val key = entry.system.orEmpty()
-    return key
-        .replace(Regex("([a-z0-9])([A-Z])"), "$1 $2")
-        .replaceFirstChar { it.uppercaseChar() }
-}
-
-/**
- * The points block, best standing first, dropping systems the character has no score
- * in. Guarded for an older shard plugin that sends no `points` block at all.
- */
-internal fun displayPoints(char: CharProfileDto): List<CharPointsDto> =
-    char.points
-        .filter { (it.points ?: 0L) > 0L }
-        .sortedByDescending { it.points ?: 0L }
-
 private fun jsonText(element: kotlinx.serialization.json.JsonElement): String =
     runCatching { element.jsonPrimitive.content }.getOrElse { element.toString() }

app/src/main/java/com/runicgateway/app/ui/session/SessionViewModel.kt

@@ -8,8 +8,6 @@ import androidx.lifecycle.viewModelScope
 import com.runicgateway.app.core.auth.Session
 import com.runicgateway.app.core.auth.SessionManager
 import com.runicgateway.app.data.repository.AuthRepository
-import com.runicgateway.app.data.repository.ShardFeatures
-import com.runicgateway.app.data.repository.ShardFeaturesRepository
 import dagger.hilt.android.lifecycle.HiltViewModel
 import kotlinx.coroutines.flow.StateFlow
 import kotlinx.coroutines.launch
@@ -25,28 +23,10 @@ import javax.inject.Inject
 class SessionViewModel @Inject constructor(
     sessionManager: SessionManager,
     private val authRepository: AuthRepository,
-    shardFeaturesRepository: ShardFeaturesRepository,
 ) : ViewModel() {
 
     val session: StateFlow<Session> = sessionManager.state
 
-    /**
-     * Which shard features this viewer may reach (M11). Held here beside [session]
-     * because it answers the same question for the same consumer: what the shared
-     * menu reveals. Role and feature config are independent gates — see
-     * [com.runicgateway.app.ui.navigation.visibleEntries].
-     */
-    val shardFeatures: StateFlow<ShardFeatures?> = shardFeaturesRepository.features
-
-    init {
-        // The answer is per-viewer, so it is re-resolved on every session change.
-        // A StateFlow conflates equal values, so a resume revalidation that returns
-        // the same user does not refetch — only a real sign-in/out/role change does.
-        viewModelScope.launch {
-            session.collect { shardFeaturesRepository.refresh() }
-        }
-    }
-
     /** Re-validate the cached role against the backend on app resume. */
     fun revalidate() {
         viewModelScope.launch { authRepository.revalidate() }

app/src/main/java/com/runicgateway/app/ui/shard/AtlasScreen.kt

@@ -1,301 +0,0 @@
-/*
- * SPDX-License-Identifier: GPL-3.0-or-later
- */
-package com.runicgateway.app.ui.shard
-
-import androidx.compose.foundation.clickable
-import androidx.compose.foundation.layout.Arrangement
-import androidx.compose.foundation.layout.Column
-import androidx.compose.foundation.layout.ExperimentalLayoutApi
-import androidx.compose.foundation.layout.FlowRow
-import androidx.compose.foundation.layout.Row
-import androidx.compose.foundation.layout.fillMaxSize
-import androidx.compose.foundation.layout.fillMaxWidth
-import androidx.compose.foundation.layout.padding
-import androidx.compose.foundation.lazy.LazyColumn
-import androidx.compose.foundation.lazy.items
-import androidx.compose.foundation.text.KeyboardActions
-import androidx.compose.foundation.text.KeyboardOptions
-import androidx.compose.material3.Card
-import androidx.compose.material3.MaterialTheme
-import androidx.compose.material3.OutlinedTextField
-import androidx.compose.material3.Text
-import androidx.compose.runtime.Composable
-import androidx.compose.runtime.LaunchedEffect
-import androidx.compose.runtime.getValue
-import androidx.compose.ui.Modifier
-import androidx.compose.ui.res.pluralStringResource
-import androidx.compose.ui.res.stringResource
-import androidx.compose.ui.text.input.ImeAction
-import androidx.compose.ui.text.style.TextOverflow
-import androidx.compose.ui.unit.dp
-import androidx.hilt.navigation.compose.hiltViewModel
-import androidx.lifecycle.compose.collectAsStateWithLifecycle
-import com.runicgateway.app.R
-import com.runicgateway.app.data.api.dto.AtlasCreatureDto
-import com.runicgateway.app.data.api.dto.AtlasPlaceDto
-import com.runicgateway.app.data.api.dto.AtlasSpawnerDto
-import com.runicgateway.app.ui.UiState
-import com.runicgateway.app.ui.components.EmptyView
-import com.runicgateway.app.ui.components.ErrorView
-import com.runicgateway.app.ui.components.LoadingView
-import com.runicgateway.app.ui.components.PillTone
-import com.runicgateway.app.ui.components.SectionLabel
-import com.runicgateway.app.ui.components.StatusPill
-
-/**
- * The spawn atlas / bestiary (PLAN.md §9 M11): "where do I find X".
- *
- * The whole point of the feature is the placement transform the server does — a spawn
- * at 5411,1234 becomes *"Despise, Felucca"* — so a row leads with where a creature is
- * found, not with coordinates.
- */
-@Composable
-fun AtlasScreen(
-    onOpenCreature: (String) -> Unit,
-    modifier: Modifier = Modifier,
-    viewModel: AtlasViewModel = hiltViewModel(),
-) {
-    val state by viewModel.state.collectAsStateWithLifecycle()
-    val query by viewModel.query.collectAsStateWithLifecycle()
-
-    Column(modifier.fillMaxSize()) {
-        OutlinedTextField(
-            value = query,
-            onValueChange = viewModel::onQueryChange,
-            label = { Text(stringResource(R.string.atlas_search_label)) },
-            singleLine = true,
-            keyboardOptions = KeyboardOptions(imeAction = ImeAction.Search),
-            keyboardActions = KeyboardActions(onSearch = { viewModel.search() }),
-            modifier = Modifier.fillMaxWidth().padding(horizontal = 16.dp, vertical = 8.dp),
-        )
-
-        when (val s = state) {
-            is UiState.Loading -> LoadingView()
-            is UiState.Error -> ErrorView(s.kind, onRetry = viewModel::load)
-            is UiState.Success -> {
-                if (s.data.creatures.isEmpty()) {
-                    EmptyView(stringResource(R.string.atlas_empty))
-                } else {
-                    LazyColumn(
-                        modifier = Modifier.fillMaxSize().padding(horizontal = 16.dp),
-                        verticalArrangement = Arrangement.spacedBy(8.dp),
-                        contentPadding = androidx.compose.foundation.layout.PaddingValues(bottom = 16.dp),
-                    ) {
-                        items(s.data.creatures, key = { it.slug.orEmpty() }) { creature ->
-                            CreatureCard(creature, onOpenCreature)
-                        }
-                    }
-                }
-            }
-        }
-    }
-}
-
-@Composable
-private fun CreatureCard(creature: AtlasCreatureDto, onOpenCreature: (String) -> Unit) {
-    val slug = creature.slug
-    Card(
-        Modifier
-            .fillMaxWidth()
-            .then(if (slug != null) Modifier.clickable { onOpenCreature(slug) } else Modifier),
-    ) {
-        Column(Modifier.padding(16.dp)) {
-            Row(Modifier.fillMaxWidth(), horizontalArrangement = Arrangement.SpaceBetween) {
-                Text(
-                    text = creature.name ?: slug.orEmpty(),
-                    style = MaterialTheme.typography.titleSmall,
-                    maxLines = 1,
-                    overflow = TextOverflow.Ellipsis,
-                    modifier = Modifier.weight(1f),
-                )
-                // `points` is a COUNT of spawners on this route; `spawners` is the list,
-                // and only the detail route sends it.
-                creature.points?.let {
-                    Text(
-                        text = pluralStringResource(R.plurals.atlas_spawner_count, it, it),
-                        style = MaterialTheme.typography.labelSmall,
-                        color = MaterialTheme.colorScheme.onSurfaceVariant,
-                    )
-                }
-            }
-            facetSummary(creature)?.let {
-                Text(
-                    text = it,
-                    style = MaterialTheme.typography.bodySmall,
-                    color = MaterialTheme.colorScheme.onSurfaceVariant,
-                )
-            }
-        }
-    }
-}
-
-/** One creature: every spawner, where it stands, and what shares its spawns. */
-@OptIn(ExperimentalLayoutApi::class)
-@Composable
-fun AtlasCreatureScreen(
-    slug: String,
-    modifier: Modifier = Modifier,
-    viewModel: AtlasCreatureViewModel = hiltViewModel(),
-) {
-    LaunchedEffect(slug) { viewModel.load(slug) }
-    val state by viewModel.state.collectAsStateWithLifecycle()
-
-    when (val s = state) {
-        is UiState.Loading -> LoadingView(modifier)
-        is UiState.Error -> ErrorView(s.kind, onRetry = viewModel::retry, modifier = modifier)
-        is UiState.Success -> {
-            val creature = s.data
-            LazyColumn(
-                modifier = modifier.fillMaxSize().padding(horizontal = 16.dp),
-                verticalArrangement = Arrangement.spacedBy(8.dp),
-                contentPadding = androidx.compose.foundation.layout.PaddingValues(vertical = 16.dp),
-            ) {
-                item {
-                    Column {
-                        Text(
-                            creature.name ?: creature.slug.orEmpty(),
-                            style = MaterialTheme.typography.titleLarge,
-                        )
-                        creature.total?.let {
-                            Text(
-                                stringResource(R.string.atlas_total_alive, it),
-                                style = MaterialTheme.typography.bodyMedium,
-                                color = MaterialTheme.colorScheme.onSurfaceVariant,
-                            )
-                        }
-                        if (creature.facets.isNotEmpty()) {
-                            FlowRow(
-                                Modifier.padding(top = 8.dp),
-                                horizontalArrangement = Arrangement.spacedBy(6.dp),
-                                verticalArrangement = Arrangement.spacedBy(6.dp),
-                            ) {
-                                creature.facets.entries.sortedBy { it.key }.forEach { (facet, count) ->
-                                    StatusPill(
-                                        text = stringResource(R.string.atlas_facet_count, facet, count),
-                                        tone = PillTone.Neutral,
-                                    )
-                                }
-                            }
-                        }
-                    }
-                }
-                // The aggregate comes first: "where is it" is the question, and the
-                // individual coordinates below are the follow-up. Same ordering as web.
-                if (creature.places.isNotEmpty()) {
-                    item { SectionLabel(stringResource(R.string.atlas_section_places)) }
-                    items(
-                        creature.places,
-                        key = { "${it.facet.orEmpty()}:${it.label.orEmpty()}" },
-                    ) { place ->
-                        PlaceRow(place)
-                    }
-                }
-                if (creature.spawners.isNotEmpty()) {
-                    item { SectionLabel(stringResource(R.string.atlas_section_spawners)) }
-                    items(creature.spawners, key = { it.id ?: it.hashCode().toLong() }) { spawner ->
-                        SpawnerRow(spawner)
-                    }
-                    if (creature.spawnersTruncated) {
-                        item {
-                            Text(
-                                stringResource(R.string.atlas_spawners_truncated),
-                                style = MaterialTheme.typography.labelSmall,
-                                color = MaterialTheme.colorScheme.onSurfaceVariant,
-                            )
-                        }
-                    }
-                }
-                if (creature.alsoHere.isNotEmpty()) {
-                    item { SectionLabel(stringResource(R.string.atlas_section_also_here)) }
-                    item {
-                        Text(
-                            creature.alsoHere.mapNotNull { it.name ?: it.slug }.joinToString(", "),
-                            style = MaterialTheme.typography.bodySmall,
-                            color = MaterialTheme.colorScheme.onSurfaceVariant,
-                        )
-                    }
-                }
-            }
-        }
-    }
-}
-
-@Composable
-private fun PlaceRow(place: AtlasPlaceDto) {
-    Column(Modifier.fillMaxWidth().padding(vertical = 4.dp)) {
-        Text(
-            text = placeLabel(place),
-            style = MaterialTheme.typography.bodyMedium,
-        )
-        val meta = listOfNotNull(
-            place.facet,
-            place.spawners?.let { pluralStringResource(R.plurals.atlas_spawner_count, it, it) },
-            place.maxAlive?.let { stringResource(R.string.atlas_place_max_alive, it) },
-        ).joinToString("  ·  ")
-        if (meta.isNotBlank()) {
-            Text(meta, style = MaterialTheme.typography.labelSmall, color = MaterialTheme.colorScheme.onSurfaceVariant)
-        }
-    }
-}
-
-@Composable
-private fun SpawnerRow(spawner: AtlasSpawnerDto) {
-    Column(Modifier.fillMaxWidth().padding(vertical = 4.dp)) {
-        Text(
-            text = spawnerPlace(spawner),
-            style = MaterialTheme.typography.bodyMedium,
-        )
-        val meta = listOfNotNull(
-            spawner.maxCount?.let { stringResource(R.string.atlas_max_count, it) },
-            // Seconds, normalised server-side — the raw XmlSpawner values are minutes
-            // OR seconds per record.
-            formatRespawn(spawner.minDelay, spawner.maxDelay)
-                ?.let { stringResource(R.string.atlas_respawn, it) },
-        ).joinToString("  ·  ")
-        if (meta.isNotBlank()) {
-            Text(meta, style = MaterialTheme.typography.labelSmall, color = MaterialTheme.colorScheme.onSurfaceVariant)
-        }
-    }
-}
-
-// ── Pure helpers (unit-tested) ───────────────────────────────────────────────
-
-/**
- * Where a spawner stands, preferring the server's own placement label — the
- * point-in-rect transform is what turns a coordinate into "Despise, Felucca" and is
- * the reason this feature exists. Falls back through region, landmark, and finally the
- * raw coordinates, which is honest rather than useless for the ~17% of spawns that
- * resolve to no named place.
- */
-internal fun spawnerPlace(spawner: AtlasSpawnerDto): String {
-    spawner.label?.takeIf { it.isNotBlank() }?.let { return it }
-    val place = spawner.region ?: spawner.landmark
-    val facet = spawner.facet
-    return when {
-        place != null && facet != null -> "$place, $facet"
-        place != null -> place
-        spawner.x != null && spawner.y != null ->
-            listOfNotNull(facet, "${spawner.x}, ${spawner.y}").joinToString(" ")
-        else -> facet.orEmpty()
-    }
-}
-
-/**
- * The name of an aggregated place. [AtlasPlaceDto.label] is already the server's
- * resolved answer and falls back to "Wilderness" there, so the only case left here is
- * a place that carried no label at all — then the facet is better than nothing.
- */
-internal fun placeLabel(place: AtlasPlaceDto): String =
-    place.label?.takeIf { it.isNotBlank() } ?: place.facet.orEmpty()
-
-/**
- * A creature's facets as one line, most spawners first — "where is it *mostly*" is the
- * question a search result answers.
- */
-internal fun facetSummary(creature: AtlasCreatureDto): String? {
-    if (creature.facets.isEmpty()) return null
-    return creature.facets.entries
-        .sortedByDescending { it.value }
-        .joinToString(", ") { it.key }
-}

app/src/main/java/com/runicgateway/app/ui/shard/AtlasViewModel.kt

@@ -1,125 +0,0 @@
-/*
- * SPDX-License-Identifier: GPL-3.0-or-later
- */
-package com.runicgateway.app.ui.shard
-
-import androidx.lifecycle.ViewModel
-import androidx.lifecycle.viewModelScope
-import com.runicgateway.app.core.result.ApiResult
-import com.runicgateway.app.data.api.dto.AtlasCreatureDto
-import com.runicgateway.app.data.api.dto.AtlasCreaturePageDto
-import com.runicgateway.app.data.repository.ShardRepository
-import com.runicgateway.app.ui.UiState
-import com.runicgateway.app.ui.toShardUiState
-import dagger.hilt.android.lifecycle.HiltViewModel
-import kotlinx.coroutines.flow.MutableStateFlow
-import kotlinx.coroutines.flow.StateFlow
-import kotlinx.coroutines.flow.asStateFlow
-import kotlinx.coroutines.launch
-import javax.inject.Inject
-
-/**
- * The spawn atlas / bestiary (PLAN.md §9 M11, `docs/link/v3.md` §6): where each
- * creature spawns, derived server-side from the shard's own data files.
- *
- * Static shard **content**, not live state — it does not go offline with the sidecar,
- * and it lives under `/public/atlas`, not `/public/shard`. Unlike the shard routes it
- * IS site-mode gated, so a site in maintenance withholds it independently.
- */
-@HiltViewModel
-class AtlasViewModel @Inject constructor(
-    private val repository: ShardRepository,
-) : ViewModel() {
-
-    private val _state = MutableStateFlow<UiState<AtlasCreaturePageDto>>(UiState.Loading)
-    val state: StateFlow<UiState<AtlasCreaturePageDto>> = _state.asStateFlow()
-
-    private val _query = MutableStateFlow("")
-    val query: StateFlow<String> = _query.asStateFlow()
-
-    private val _facet = MutableStateFlow<String?>(null)
-    val facet: StateFlow<String?> = _facet.asStateFlow()
-
-    /**
-     * The facets this shard actually has. Discovered from the atlas itself — a shard
-     * may add, replace or rename facets when its maps change, so nothing here may name
-     * one (`v3.md` §6.1 R2).
-     */
-    private val _facets = MutableStateFlow<List<String>>(emptyList())
-    val facets: StateFlow<List<String>> = _facets.asStateFlow()
-
-    init {
-        load()
-    }
-
-    fun onQueryChange(value: String) {
-        _query.value = value
-    }
-
-    fun onFacetChange(value: String?) {
-        if (value == _facet.value) return
-        _facet.value = value
-        search()
-    }
-
-    fun search() = load()
-
-    fun load() {
-        _state.value = UiState.Loading
-        viewModelScope.launch {
-            val page = repository.atlasCreatures(query = _query.value, facet = _facet.value)
-            if (page is ApiResult.Ok && _facets.value.isEmpty()) {
-                // Only the first successful page needs to establish the filter options;
-                // a filtered page would otherwise narrow them to its own results.
-                _facets.value = page.data.creatures
-                    .flatMap { it.facets.keys }
-                    .distinct()
-                    .sorted()
-            }
-            _state.value = page.toShardUiState()
-        }
-    }
-}
-
-/** One creature's detail page: every spawner, and what else shares them. */
-@HiltViewModel
-class AtlasCreatureViewModel @Inject constructor(
-    private val repository: ShardRepository,
-) : ViewModel() {
-
-    private val _state = MutableStateFlow<UiState<AtlasCreatureDto>>(UiState.Loading)
-    val state: StateFlow<UiState<AtlasCreatureDto>> = _state.asStateFlow()
-
-    private var slug: String? = null
-
-    fun load(slug: String) {
-        this.slug = slug
-        _state.value = UiState.Loading
-        viewModelScope.launch {
-            _state.value = repository.atlasCreature(slug).toShardUiState()
-        }
-    }
-
-    fun retry() {
-        slug?.let { load(it) }
-    }
-}
-
-/**
- * A respawn delay as text. **The API carries SECONDS** — XmlSpawner stores minutes
- * except when a delay doesn't divide into whole minutes, and the server's parser
- * normalises the two spellings so a `5` is never ambiguous here (`v3.md` §6.3).
- *
- * Pure, so the unit conversion is unit-tested rather than eyeballed on a page.
- */
-internal fun formatRespawn(minSeconds: Int?, maxSeconds: Int?): String? {
-    val lo = minSeconds ?: maxSeconds ?: return null
-    val hi = maxSeconds ?: minSeconds ?: return null
-    return if (lo == hi) humaniseSeconds(lo) else "${humaniseSeconds(lo)}–${humaniseSeconds(hi)}"
-}
-
-private fun humaniseSeconds(seconds: Int): String = when {
-    seconds < 60 -> "${seconds}s"
-    seconds % 60 == 0 -> "${seconds / 60}m"
-    else -> "${seconds / 60}m ${seconds % 60}s"
-}

app/src/main/java/com/runicgateway/app/ui/shard/ChampsViewModel.kt

@@ -10,7 +10,7 @@ import com.runicgateway.app.core.result.ApiResult
 import com.runicgateway.app.data.api.dto.ChampDto
 import com.runicgateway.app.data.repository.ShardRepository
 import com.runicgateway.app.ui.UiState
-import com.runicgateway.app.ui.toShardUiState
+import com.runicgateway.app.ui.toUiState
 import dagger.hilt.android.lifecycle.HiltViewModel
 import kotlinx.coroutines.flow.MutableStateFlow
 import kotlinx.coroutines.flow.StateFlow
@@ -49,7 +49,7 @@ class ChampsViewModel @Inject constructor(
                     board.seed(result.data)
                     publish()
                 }
-                else -> _state.value = result.toShardUiState()
+                else -> _state.value = result.toUiState()
             }
         }
     }
@@ -69,9 +69,7 @@ class ChampsViewModel @Inject constructor(
     private fun applyFrame(frame: ShardStreamEvent.Frame) {
         when (frame.kind) {
             "champ.update" -> repository.champFrame(frame.data)?.let { board.upsert(it) }
-            // Serial is an opaque hex-string key ("0x…"), not a number — read as a
+            "champ.remove" -> FrameFields.longField(frame.data, "serial")?.let { board.remove(it.toString()) }
-            // string (reading it as a Long silently dropped every champ.remove).
-            "champ.remove" -> FrameFields.stringField(frame.data, "serial")?.let { board.remove(it) }
             else -> return
         }
         // Only republish when the board actually changed (Success state only).

app/src/main/java/com/runicgateway/app/ui/shard/GovernorsViewModel.kt

@@ -11,7 +11,7 @@ import com.runicgateway.app.data.api.dto.GovernorDto
 import com.runicgateway.app.data.api.dto.GovernorTermDto
 import com.runicgateway.app.data.repository.ShardRepository
 import com.runicgateway.app.ui.UiState
-import com.runicgateway.app.ui.toShardUiState
+import com.runicgateway.app.ui.toUiState
 import dagger.hilt.android.lifecycle.HiltViewModel
 import kotlinx.coroutines.flow.MutableStateFlow
 import kotlinx.coroutines.flow.StateFlow
@@ -55,7 +55,7 @@ class GovernorsViewModel @Inject constructor(
                     board.seed(result.data)
                     publish()
                 }
-                else -> _state.value = result.toShardUiState()
+                else -> _state.value = result.toUiState()
             }
         }
     }

app/src/main/java/com/runicgateway/app/ui/shard/GuildsViewModel.kt

@@ -10,7 +10,7 @@ import com.runicgateway.app.core.result.ApiResult
 import com.runicgateway.app.data.api.dto.GuildDto
 import com.runicgateway.app.data.repository.ShardRepository
 import com.runicgateway.app.ui.UiState
-import com.runicgateway.app.ui.toShardUiState
+import com.runicgateway.app.ui.toUiState
 import dagger.hilt.android.lifecycle.HiltViewModel
 import kotlinx.coroutines.flow.MutableStateFlow
 import kotlinx.coroutines.flow.StateFlow
@@ -50,7 +50,7 @@ class GuildsViewModel @Inject constructor(
                     board.seed(result.data)
                     publish()
                 }
-                else -> _state.value = result.toShardUiState()
+                else -> _state.value = result.toUiState()
             }
         }
     }

app/src/main/java/com/runicgateway/app/ui/shard/HousesViewModel.kt

@@ -10,7 +10,7 @@ import com.runicgateway.app.core.result.ApiResult
 import com.runicgateway.app.data.api.dto.HouseDto
 import com.runicgateway.app.data.repository.ShardRepository
 import com.runicgateway.app.ui.UiState
-import com.runicgateway.app.ui.toShardUiState
+import com.runicgateway.app.ui.toUiState
 import dagger.hilt.android.lifecycle.HiltViewModel
 import kotlinx.coroutines.flow.MutableStateFlow
 import kotlinx.coroutines.flow.StateFlow
@@ -50,7 +50,7 @@ class HousesViewModel @Inject constructor(
                     board.seed(result.data)
                     publish()
                 }
-                else -> _state.value = result.toShardUiState()
+                else -> _state.value = result.toUiState()
             }
         }
     }
@@ -69,9 +69,7 @@ class HousesViewModel @Inject constructor(
 
     private fun applyFrame(frame: ShardStreamEvent.Frame) {
         if (frame.kind != "house.decay") return
-        // Serials are opaque hex-string keys ("0x…"), not numbers — read as a string
+        val serial = FrameFields.longField(frame.data, "serial") ?: return
-        // (reading it as a Long silently dropped every live IDOC update).
-        val serial = FrameFields.stringField(frame.data, "serial") ?: return
         // `to` is the new decay stage; only IDOC belongs on the public board.
         val stage = FrameFields.stringField(frame.data, "to")
             ?: FrameFields.stringField(frame.data, "stage")

app/src/main/java/com/runicgateway/app/ui/shard/LeaderboardsScreen.kt

@@ -1,169 +0,0 @@
-/*
- * SPDX-License-Identifier: GPL-3.0-or-later
- */
-package com.runicgateway.app.ui.shard
-
-import androidx.compose.foundation.layout.Arrangement
-import androidx.compose.foundation.layout.Column
-import androidx.compose.foundation.layout.Row
-import androidx.compose.foundation.layout.fillMaxWidth
-import androidx.compose.foundation.layout.padding
-import androidx.compose.material3.Card
-import androidx.compose.material3.HorizontalDivider
-import androidx.compose.material3.MaterialTheme
-import androidx.compose.material3.Text
-import androidx.compose.runtime.Composable
-import androidx.compose.runtime.getValue
-import androidx.compose.ui.Modifier
-import androidx.compose.ui.res.stringResource
-import androidx.compose.ui.text.font.FontWeight
-import androidx.compose.ui.text.style.TextOverflow
-import androidx.compose.ui.unit.dp
-import androidx.hilt.navigation.compose.hiltViewModel
-import androidx.lifecycle.compose.collectAsStateWithLifecycle
-import com.runicgateway.app.R
-import com.runicgateway.app.data.api.dto.BrandDto
-import com.runicgateway.app.data.api.dto.PointsBoardDto
-import com.runicgateway.app.data.api.dto.PointsEntryDto
-import com.runicgateway.app.ui.components.SectionLabel
-
-/**
- * The points/loyalty leaderboards (PLAN.md §9 M11), one card per system, live via
- * `points.board` frames.
- */
-@Composable
-fun LeaderboardsScreen(
-    brand: BrandDto? = null,
-    modifier: Modifier = Modifier,
-    viewModel: LeaderboardsViewModel = hiltViewModel(),
-) {
-    val state by viewModel.state.collectAsStateWithLifecycle()
-    val connected by viewModel.connected.collectAsStateWithLifecycle()
-
-    LiveBoardScreen(
-        emptyMessage = stringResource(R.string.leaderboards_empty),
-        state = state,
-        connected = connected,
-        onRetry = viewModel::load,
-        key = { it.system.orEmpty() },
-        modifier = modifier,
-    ) { board -> BoardCard(board, placeholderName(brand)) }
-}
-
-@Composable
-private fun BoardCard(board: PointsBoardDto, placeholderName: String) {
-    Card(Modifier.fillMaxWidth()) {
-        Column(Modifier.padding(16.dp), verticalArrangement = Arrangement.spacedBy(2.dp)) {
-            Row(Modifier.fillMaxWidth(), horizontalArrangement = Arrangement.SpaceBetween) {
-                Text(
-                    text = boardLabel(board),
-                    style = MaterialTheme.typography.titleMedium,
-                    maxLines = 1,
-                    overflow = TextOverflow.Ellipsis,
-                    modifier = Modifier.weight(1f),
-                )
-                board.players?.let {
-                    Text(
-                        text = stringResource(R.string.leaderboards_players, it),
-                        style = MaterialTheme.typography.labelSmall,
-                        color = MaterialTheme.colorScheme.onSurfaceVariant,
-                    )
-                }
-            }
-            // A cap is worth stating only when there is one; most systems on a real
-            // shard are uncapped (maxPoints 0), and "/ 0" would be nonsense.
-            board.cap?.let {
-                SectionLabel(stringResource(R.string.leaderboards_cap, it))
-            }
-
-            if (board.top.isEmpty()) {
-                // A board nobody has scored on still gets a row, so the page reads as a
-                // set of standings waiting to be filled rather than a stack of blanks.
-                // It is deliberately NOT shaped like an entry — no rank, no score, the
-                // instance's own name — because a placeholder that looked like a real
-                // standing would be a fabricated one. The first real entry replaces it.
-                HorizontalDivider(Modifier.padding(vertical = 8.dp))
-                Row(
-                    Modifier.fillMaxWidth().padding(vertical = 3.dp),
-                    horizontalArrangement = Arrangement.SpaceBetween,
-                ) {
-                    Text(
-                        text = placeholderName,
-                        style = MaterialTheme.typography.bodyMedium,
-                        color = MaterialTheme.colorScheme.onSurfaceVariant,
-                        maxLines = 1,
-                        overflow = TextOverflow.Ellipsis,
-                        modifier = Modifier.weight(1f),
-                    )
-                    Text(
-                        text = stringResource(R.string.leaderboards_no_score),
-                        style = MaterialTheme.typography.bodyMedium,
-                        color = MaterialTheme.colorScheme.onSurfaceVariant,
-                    )
-                }
-                Text(
-                    stringResource(R.string.leaderboards_board_empty),
-                    style = MaterialTheme.typography.labelSmall,
-                    color = MaterialTheme.colorScheme.onSurfaceVariant,
-                    modifier = Modifier.padding(top = 6.dp),
-                )
-            } else {
-                HorizontalDivider(Modifier.padding(vertical = 8.dp))
-                board.top.forEach { entry -> EntryRow(entry) }
-            }
-        }
-    }
-}
-
-@Composable
-private fun EntryRow(entry: PointsEntryDto) {
-    Row(
-        Modifier.fillMaxWidth().padding(vertical = 3.dp),
-        horizontalArrangement = Arrangement.SpaceBetween,
-    ) {
-        Text(
-            text = stringResource(
-                R.string.leaderboards_rank_name,
-                entry.rank ?: 0,
-                // The character name is admin-configurable — a shard can publish
-                // standings without naming who holds them, so a nameless rank is a
-                // valid row rather than a broken one.
-                entry.name ?: stringResource(R.string.leaderboards_hidden_name),
-            ),
-            style = MaterialTheme.typography.bodyMedium,
-            maxLines = 1,
-            overflow = TextOverflow.Ellipsis,
-            modifier = Modifier.weight(1f),
-        )
-        Text(
-            text = (entry.points ?: 0L).toString(),
-            style = MaterialTheme.typography.bodyMedium,
-            fontWeight = FontWeight.Medium,
-            color = MaterialTheme.colorScheme.onSurfaceVariant,
-        )
-    }
-}
-
-/**
- * A board's display name: the shard's own literal when it has one, else the humanised
- * `PointsType` key. The fallback is the PRIMARY path — four of five boards on a real
- * shard name themselves with a cliloc and send `nameString: null`.
- */
-internal fun boardLabel(board: PointsBoardDto): String {
-    board.nameString?.takeIf { it.isNotBlank() }?.let { return it }
-    return board.system.orEmpty()
-        .replace(Regex("([a-z0-9])([A-Z])"), "$1 $2")
-        .replaceFirstChar { it.uppercaseChar() }
-}
-
-/**
- * The name to stand in for an empty board: this instance's, falling back to the app
- * name — the same resolution the app bar uses, so a shard that publishes no branding
- * still reads as *something* rather than as a blank row.
- *
- * Pure and separate so the fallback order is testable; [BrandDto.name] can be present
- * but blank, which is a shard that set the key and left it empty.
- */
-@Composable
-internal fun placeholderName(brand: BrandDto?): String =
-    brand?.name?.takeIf { it.isNotBlank() } ?: stringResource(R.string.app_name)

app/src/main/java/com/runicgateway/app/ui/shard/LeaderboardsViewModel.kt

@@ -1,101 +0,0 @@
-/*
- * SPDX-License-Identifier: GPL-3.0-or-later
- */
-package com.runicgateway.app.ui.shard
-
-import androidx.lifecycle.ViewModel
-import androidx.lifecycle.viewModelScope
-import com.runicgateway.app.core.net.ShardStreamEvent
-import com.runicgateway.app.core.result.ApiResult
-import com.runicgateway.app.data.api.dto.PointsBoardDto
-import com.runicgateway.app.data.repository.ShardRepository
-import com.runicgateway.app.ui.UiState
-import com.runicgateway.app.ui.toShardUiState
-import dagger.hilt.android.lifecycle.HiltViewModel
-import kotlinx.coroutines.flow.MutableStateFlow
-import kotlinx.coroutines.flow.StateFlow
-import kotlinx.coroutines.flow.asStateFlow
-import kotlinx.coroutines.launch
-import javax.inject.Inject
-
-/**
- * The points/loyalty leaderboards (PLAN.md §9 M11, `docs/link/v3.md` §7): one board
- * per point currency the shard publishes, each with its top ranks.
- *
- * Served from the website's own store, so the page renders while the shard is down —
- * which matters more here than for live state: these are standings accumulated over
- * months, and blanking them during a restart would look like data loss.
- *
- * Kept live by `points.board` frames, one per system, merged in place by [LiveBoard].
- */
-@HiltViewModel
-class LeaderboardsViewModel @Inject constructor(
-    private val repository: ShardRepository,
-) : ViewModel() {
-
-    private val board = LiveBoard<PointsBoardDto> { it.system.orEmpty() }
-
-    private val _state = MutableStateFlow<UiState<List<PointsBoardDto>>>(UiState.Loading)
-    val state: StateFlow<UiState<List<PointsBoardDto>>> = _state.asStateFlow()
-
-    private val _connected = MutableStateFlow(false)
-    val connected: StateFlow<Boolean> = _connected.asStateFlow()
-
-    init {
-        load()
-        collectLive()
-    }
-
-    fun load() {
-        _state.value = UiState.Loading
-        viewModelScope.launch {
-            when (val result = repository.pointsBoards()) {
-                is ApiResult.Ok -> {
-                    board.seed(result.data)
-                    publish()
-                }
-                else -> _state.value = result.toShardUiState()
-            }
-        }
-    }
-
-    private fun collectLive() {
-        viewModelScope.launch {
-            repository.liveEvents().collect { event ->
-                when (event) {
-                    is ShardStreamEvent.Open -> _connected.value = true
-                    is ShardStreamEvent.Closed -> _connected.value = false
-                    is ShardStreamEvent.Frame -> applyFrame(event)
-                }
-            }
-        }
-    }
-
-    private fun applyFrame(frame: ShardStreamEvent.Frame) {
-        // There is deliberately no `points.remove` on the wire: the system set is fixed
-        // for a given shard build, the same argument `city.update` makes.
-        if (frame.kind != "points.board") return
-        repository.pointsBoardFrame(frame.data)?.let { board.upsert(it) }
-        if (_state.value is UiState.Success) publish()
-    }
-
-    private fun publish() {
-        _state.value = UiState.Success(orderBoards(board.values()))
-    }
-}
-
-/**
- * Board display order: most-contested first, then by name, so the boards people
- * actually compete on lead. Pure, so the ordering is unit-tested.
- *
- * Boards the shard flags as not player-facing (`showOnGump = false`) are dropped —
- * that is the shard's own "is this for players?" signal and the plugin already filters
- * on it, so this only guards a shard configured to publish extras.
- */
-internal fun orderBoards(boards: Collection<PointsBoardDto>): List<PointsBoardDto> =
-    boards
-        .filter { it.showOnGump }
-        .sortedWith(
-            compareByDescending<PointsBoardDto> { it.players ?: 0 }
-                .thenBy { (it.nameString ?: it.system).orEmpty().lowercase() },
-        )

app/src/main/java/com/runicgateway/app/ui/shard/MarketScreen.kt

@@ -1,260 +0,0 @@
-/*
- * SPDX-License-Identifier: GPL-3.0-or-later
- */
-package com.runicgateway.app.ui.shard
-
-import androidx.compose.foundation.clickable
-import androidx.compose.foundation.layout.Arrangement
-import androidx.compose.foundation.layout.Column
-import androidx.compose.foundation.layout.Row
-import androidx.compose.foundation.layout.fillMaxSize
-import androidx.compose.foundation.layout.fillMaxWidth
-import androidx.compose.foundation.layout.padding
-import androidx.compose.foundation.lazy.LazyColumn
-import androidx.compose.foundation.lazy.items
-import androidx.compose.foundation.text.KeyboardActions
-import androidx.compose.foundation.text.KeyboardOptions
-import androidx.compose.material3.Card
-import androidx.compose.material3.MaterialTheme
-import androidx.compose.material3.OutlinedTextField
-import androidx.compose.material3.Text
-import androidx.compose.runtime.Composable
-import androidx.compose.runtime.getValue
-import androidx.compose.ui.Modifier
-import androidx.compose.ui.res.stringResource
-import androidx.compose.ui.text.font.FontWeight
-import androidx.compose.ui.text.input.ImeAction
-import androidx.compose.ui.text.style.TextOverflow
-import androidx.compose.ui.unit.dp
-import androidx.hilt.navigation.compose.hiltViewModel
-import androidx.lifecycle.compose.collectAsStateWithLifecycle
-import com.runicgateway.app.R
-import com.runicgateway.app.data.api.dto.MarketListingDto
-import com.runicgateway.app.data.api.dto.MarketLocationDto
-import com.runicgateway.app.data.api.dto.MarketVendorDto
-import com.runicgateway.app.ui.UiState
-import com.runicgateway.app.ui.components.EmptyView
-import com.runicgateway.app.ui.components.ErrorView
-import com.runicgateway.app.ui.components.LoadingView
-import com.runicgateway.app.ui.components.SectionLabel
-
-/**
- * The shard-wide marketplace (PLAN.md §9 M11): search every player vendor's stock.
- *
- * The staleness line under the search box is required, not decoration — see
- * [MarketViewModel]. Results are listings, so a row names both the item and the shop
- * that sells it, and tapping it opens that shop.
- */
-@Composable
-fun MarketScreen(
-    onOpenVendor: (String) -> Unit,
-    modifier: Modifier = Modifier,
-    viewModel: MarketViewModel = hiltViewModel(),
-) {
-    val state by viewModel.state.collectAsStateWithLifecycle()
-    val meta by viewModel.meta.collectAsStateWithLifecycle()
-    val query by viewModel.query.collectAsStateWithLifecycle()
-
-    Column(modifier.fillMaxSize()) {
-        OutlinedTextField(
-            value = query,
-            onValueChange = viewModel::onQueryChange,
-            label = { Text(stringResource(R.string.market_search_label)) },
-            singleLine = true,
-            // Searched on submit rather than per keystroke: this is the site's first
-            // rate-limited public endpoint.
-            keyboardOptions = KeyboardOptions(imeAction = ImeAction.Search),
-            keyboardActions = KeyboardActions(onSearch = { viewModel.search() }),
-            modifier = Modifier.fillMaxWidth().padding(horizontal = 16.dp, vertical = 8.dp),
-        )
-        meta?.staleAt?.let {
-            SectionLabel(
-                text = stringResource(R.string.market_staleness),
-                modifier = Modifier.padding(horizontal = 16.dp),
-            )
-        }
-
-        when (val s = state) {
-            is UiState.Loading -> LoadingView()
-            is UiState.Error -> ErrorView(s.kind, onRetry = viewModel::load)
-            is UiState.Success -> {
-                if (s.data.listings.isEmpty()) {
-                    EmptyView(stringResource(R.string.market_empty))
-                } else {
-                    LazyColumn(
-                        modifier = Modifier.fillMaxSize().padding(horizontal = 16.dp),
-                        verticalArrangement = Arrangement.spacedBy(8.dp),
-                        contentPadding = androidx.compose.foundation.layout.PaddingValues(bottom = 16.dp),
-                    ) {
-                        items(s.data.listings, key = { it.serial ?: it.hashCode().toString() }) { listing ->
-                            ListingCard(listing, onOpenVendor)
-                        }
-                    }
-                }
-            }
-        }
-    }
-}
-
-@Composable
-private fun ListingCard(listing: MarketListingDto, onOpenVendor: (String) -> Unit) {
-    val vendorSerial = listing.vendor?.serial
-    Card(
-        Modifier
-            .fillMaxWidth()
-            .then(if (vendorSerial != null) Modifier.clickable { onOpenVendor(vendorSerial) } else Modifier),
-    ) {
-        Column(Modifier.padding(16.dp)) {
-            Row(Modifier.fillMaxWidth(), horizontalArrangement = Arrangement.SpaceBetween) {
-                Text(
-                    text = listingTitle(listing)
-                        ?: stringResource(R.string.market_unnamed_item, listing.itemId ?: 0),
-                    style = MaterialTheme.typography.titleSmall,
-                    maxLines = 1,
-                    overflow = TextOverflow.Ellipsis,
-                    modifier = Modifier.weight(1f),
-                )
-                Text(
-                    text = stringResource(R.string.market_price, listing.price ?: 0L),
-                    style = MaterialTheme.typography.titleSmall,
-                    fontWeight = FontWeight.Medium,
-                )
-            }
-            val shop = listing.vendor?.shopName ?: listing.vendor?.ownerName
-            if (shop != null) {
-                Text(
-                    text = shop,
-                    style = MaterialTheme.typography.bodySmall,
-                    color = MaterialTheme.colorScheme.onSurfaceVariant,
-                    maxLines = 1,
-                    overflow = TextOverflow.Ellipsis,
-                )
-            }
-            locationLine(listing.vendor?.location)?.let {
-                Text(
-                    text = it,
-                    style = MaterialTheme.typography.labelSmall,
-                    color = MaterialTheme.colorScheme.onSurfaceVariant,
-                )
-            }
-        }
-    }
-}
-
-/**
- * One shop and its stock. The only surface that can answer the two questions a result
- * list can't: how much of a truncated shop is published, and where a shop is when the
- * shard doesn't say.
- */
-@Composable
-fun MarketVendorScreen(
-    serial: String,
-    modifier: Modifier = Modifier,
-    viewModel: MarketVendorViewModel = hiltViewModel(),
-) {
-    androidx.compose.runtime.LaunchedEffect(serial) { viewModel.load(serial) }
-    val state by viewModel.state.collectAsStateWithLifecycle()
-
-    when (val s = state) {
-        is UiState.Loading -> LoadingView(modifier)
-        is UiState.Error -> ErrorView(s.kind, onRetry = viewModel::retry, modifier = modifier)
-        is UiState.Success -> VendorContent(s.data, modifier)
-    }
-}
-
-@Composable
-private fun VendorContent(vendor: MarketVendorDto, modifier: Modifier = Modifier) {
-    LazyColumn(
-        modifier = modifier.fillMaxSize().padding(horizontal = 16.dp),
-        verticalArrangement = Arrangement.spacedBy(8.dp),
-        contentPadding = androidx.compose.foundation.layout.PaddingValues(vertical = 16.dp),
-    ) {
-        item {
-            Column {
-                Text(
-                    vendor.shopName ?: stringResource(R.string.market_unnamed_shop),
-                    style = MaterialTheme.typography.titleLarge,
-                )
-                vendor.ownerName?.let {
-                    Text(
-                        stringResource(R.string.market_owner, it),
-                        style = MaterialTheme.typography.bodyMedium,
-                        color = MaterialTheme.colorScheme.onSurfaceVariant,
-                    )
-                }
-                Text(
-                    // A gated location is a real answer, not a blank: the shard has
-                    // this shop, it just doesn't publish where it stands.
-                    text = locationLine(vendor.location) ?: stringResource(R.string.market_location_hidden),
-                    style = MaterialTheme.typography.bodySmall,
-                    color = MaterialTheme.colorScheme.onSurfaceVariant,
-                )
-                if (vendor.truncated) {
-                    Text(
-                        text = stringResource(
-                            R.string.market_truncated,
-                            vendor.count ?: vendor.items.size,
-                            vendor.total ?: 0,
-                        ),
-                        style = MaterialTheme.typography.labelSmall,
-                        color = MaterialTheme.colorScheme.onSurfaceVariant,
-                        modifier = Modifier.padding(top = 6.dp),
-                    )
-                }
-            }
-        }
-        if (vendor.items.isEmpty()) {
-            item { Text(stringResource(R.string.market_shop_empty), style = MaterialTheme.typography.bodyMedium) }
-        } else {
-            items(vendor.items, key = { it.serial ?: it.hashCode().toString() }) { item ->
-                Row(Modifier.fillMaxWidth().padding(vertical = 4.dp), horizontalArrangement = Arrangement.SpaceBetween) {
-                    Text(
-                        text = listingTitle(item) ?: stringResource(R.string.market_unnamed_item, item.itemId ?: 0),
-                        style = MaterialTheme.typography.bodyMedium,
-                        maxLines = 1,
-                        overflow = TextOverflow.Ellipsis,
-                        modifier = Modifier.weight(1f),
-                    )
-                    Text(
-                        text = stringResource(R.string.market_price, item.price ?: 0L),
-                        style = MaterialTheme.typography.bodyMedium,
-                        color = MaterialTheme.colorScheme.onSurfaceVariant,
-                    )
-                }
-            }
-        }
-    }
-}
-
-// ── Pure helpers (unit-tested) ───────────────────────────────────────────────
-
-/**
- * What to call a listing: a player-set name, else the server-resolved cliloc name,
- * else null so the caller can fall back to the item id. A shard with no cliloc table
- * configured legitimately publishes neither.
- *
- * A stack shows its count, since "12 × ingot" and "ingot" at the same price are very
- * different offers.
- */
-internal fun listingTitle(listing: MarketListingDto): String? {
-    val base = listing.label ?: return null
-    val amount = listing.amount ?: 1
-    return if (amount > 1) "$amount × $base" else base
-}
-
-/**
- * A shop's whereabouts as one line, or null when the shard publishes no location —
- * which happens both because an admin gated the field and because the nesting means
- * the WHOLE block goes at once, never a half-populated one.
- */
-internal fun locationLine(location: MarketLocationDto?): String? {
-    if (location == null) return null
-    val place = location.house ?: location.region
-    val facet = location.map
-    return when {
-        place != null && facet != null -> "$place, $facet"
-        place != null -> place
-        facet != null -> facet
-        else -> null
-    }
-}

app/src/main/java/com/runicgateway/app/ui/shard/MarketViewModel.kt

@@ -1,118 +0,0 @@
-/*
- * SPDX-License-Identifier: GPL-3.0-or-later
- */
-package com.runicgateway.app.ui.shard
-
-import androidx.lifecycle.ViewModel
-import androidx.lifecycle.viewModelScope
-import com.runicgateway.app.core.result.ApiResult
-import com.runicgateway.app.data.api.dto.MarketMetaDto
-import com.runicgateway.app.data.api.dto.MarketPageDto
-import com.runicgateway.app.data.api.dto.MarketVendorDto
-import com.runicgateway.app.data.repository.ShardRepository
-import com.runicgateway.app.ui.UiState
-import com.runicgateway.app.ui.toShardUiState
-import dagger.hilt.android.lifecycle.HiltViewModel
-import kotlinx.coroutines.flow.MutableStateFlow
-import kotlinx.coroutines.flow.StateFlow
-import kotlinx.coroutines.flow.asStateFlow
-import kotlinx.coroutines.launch
-import javax.inject.Inject
-
-/**
- * The shard-wide player-vendor marketplace (PLAN.md §9 M11, `docs/link/v3.md` §8):
- * search every shop's stock at once.
- *
- * **Not live, on purpose.** The `market` feature ships with its SSE fan-out disabled —
- * a firehose of full vendor inventories would be the site's biggest bandwidth consumer
- * and no screen needs it live — so this is a plain paginated read. It is also the
- * first genuinely **rate-limited** public endpoint, which is why the query is applied
- * on submit rather than on every keystroke.
- *
- * The staleness stamp from [meta] is not decoration: the shard sweeps vendors
- * round-robin, so a listing can legitimately be a full cycle behind, and a screen that
- * implied live prices would send someone to an item that sold twenty minutes ago.
- */
-@HiltViewModel
-class MarketViewModel @Inject constructor(
-    private val repository: ShardRepository,
-) : ViewModel() {
-
-    private val _state = MutableStateFlow<UiState<MarketPageDto>>(UiState.Loading)
-    val state: StateFlow<UiState<MarketPageDto>> = _state.asStateFlow()
-
-    private val _meta = MutableStateFlow<MarketMetaDto?>(null)
-    val meta: StateFlow<MarketMetaDto?> = _meta.asStateFlow()
-
-    private val _query = MutableStateFlow("")
-    val query: StateFlow<String> = _query.asStateFlow()
-
-    private val _sort = MutableStateFlow(ShardRepository.SORT_PRICE_ASC)
-    val sort: StateFlow<String> = _sort.asStateFlow()
-
-    init {
-        load()
-    }
-
-    fun onQueryChange(value: String) {
-        // Bounded to what the server accepts, so an over-long query is trimmed here
-        // rather than bounced as a 400.
-        _query.value = value.take(MAX_QUERY)
-    }
-
-    fun onSortChange(value: String) {
-        if (value == _sort.value) return
-        _sort.value = value
-        search()
-    }
-
-    /** Run the current query. Called on submit, not per keystroke — this endpoint is rate-limited. */
-    fun search() = load()
-
-    fun load() {
-        _state.value = UiState.Loading
-        viewModelScope.launch {
-            // Meta is secondary: the staleness banner and filter options are worth
-            // having, but a failure there must not blank the results.
-            _meta.value = (repository.marketMeta() as? ApiResult.Ok)?.data
-            _state.value = repository.market(
-                query = _query.value,
-                sort = _sort.value,
-            ).toShardUiState()
-        }
-    }
-
-    companion object {
-        /** The server rejects a longer `q`. */
-        const val MAX_QUERY = 60
-    }
-}
-
-/**
- * One shop and its stock. The only surface that can render the two states a result
- * list cannot: a [MarketVendorDto.truncated] shop, and a location an admin has gated
- * away — which is a real answer ("the shard doesn't publish where this is") rather
- * than an empty coordinate.
- */
-@HiltViewModel
-class MarketVendorViewModel @Inject constructor(
-    private val repository: ShardRepository,
-) : ViewModel() {
-
-    private val _state = MutableStateFlow<UiState<MarketVendorDto>>(UiState.Loading)
-    val state: StateFlow<UiState<MarketVendorDto>> = _state.asStateFlow()
-
-    private var serial: String? = null
-
-    fun load(serial: String) {
-        this.serial = serial
-        _state.value = UiState.Loading
-        viewModelScope.launch {
-            _state.value = repository.marketVendor(serial).toShardUiState()
-        }
-    }
-
-    fun retry() {
-        serial?.let { load(it) }
-    }
-}

app/src/main/java/com/runicgateway/app/ui/shard/RulesScreen.kt

@@ -1,207 +0,0 @@
-/*
- * SPDX-License-Identifier: GPL-3.0-or-later
- */
-package com.runicgateway.app.ui.shard
-
-import androidx.compose.foundation.layout.Arrangement
-import androidx.compose.foundation.layout.Column
-import androidx.compose.foundation.layout.ExperimentalLayoutApi
-import androidx.compose.foundation.layout.FlowRow
-import androidx.compose.foundation.layout.Row
-import androidx.compose.foundation.layout.fillMaxSize
-import androidx.compose.foundation.layout.fillMaxWidth
-import androidx.compose.foundation.layout.padding
-import androidx.compose.foundation.lazy.LazyColumn
-import androidx.compose.material3.Card
-import androidx.compose.material3.MaterialTheme
-import androidx.compose.material3.Text
-import androidx.compose.runtime.Composable
-import androidx.compose.runtime.getValue
-import androidx.compose.ui.Modifier
-import androidx.compose.ui.res.stringResource
-import androidx.compose.ui.unit.dp
-import androidx.hilt.navigation.compose.hiltViewModel
-import androidx.lifecycle.compose.collectAsStateWithLifecycle
-import com.runicgateway.app.R
-import com.runicgateway.app.data.api.dto.RulesetCapsDto
-import com.runicgateway.app.data.api.dto.RulesetDto
-import com.runicgateway.app.ui.UiState
-import com.runicgateway.app.ui.components.EmptyView
-import com.runicgateway.app.ui.components.ErrorView
-import com.runicgateway.app.ui.components.LoadingView
-import com.runicgateway.app.ui.components.PillTone
-import com.runicgateway.app.ui.components.StatusPill
-
-/**
- * The shard ruleset (PLAN.md §9 M11): what this world is configured to do.
- *
- * Every block renders only when the shard published it — an omitted block means the
- * system is off, not that the value is unknown, so an empty section would assert
- * something false.
- */
-@Composable
-fun RulesScreen(
-    modifier: Modifier = Modifier,
-    viewModel: RulesViewModel = hiltViewModel(),
-) {
-    val state by viewModel.state.collectAsStateWithLifecycle()
-
-    when (val s = state) {
-        is UiState.Loading -> LoadingView(modifier)
-        is UiState.Error -> ErrorView(s.kind, onRetry = viewModel::load, modifier = modifier)
-        is UiState.Success -> {
-            val ruleset = s.data
-            // A null body is a successful read of a shard that has never published its
-            // ruleset — distinct from the feature being switched off, which is an error
-            // state above.
-            if (ruleset == null) {
-                EmptyView(stringResource(R.string.rules_unpublished), modifier)
-            } else {
-                RulesetContent(ruleset, modifier)
-            }
-        }
-    }
-}
-
-@Composable
-private fun RulesetContent(ruleset: RulesetDto, modifier: Modifier = Modifier) {
-    LazyColumn(
-        modifier = modifier.fillMaxSize().padding(horizontal = 16.dp),
-        verticalArrangement = Arrangement.spacedBy(12.dp),
-        contentPadding = androidx.compose.foundation.layout.PaddingValues(vertical = 16.dp),
-    ) {
-        item {
-            RuleCard(stringResource(R.string.rules_section_shard)) {
-                RuleRow(stringResource(R.string.rules_name), ruleset.shard)
-                RuleRow(stringResource(R.string.rules_expansion), ruleset.expansion)
-                // `connect` is the ruleset's one admin-configurable field: an operator
-                // who published an address may still want it behind a login, so its
-                // absence here is a setting, not a missing value.
-                RuleRow(stringResource(R.string.rules_connect), ruleset.connect)
-            }
-        }
-        if (ruleset.systems.isNotEmpty()) {
-            item { SystemsCard(ruleset.systems) }
-        }
-        ruleset.caps?.let { caps -> item { CapsCard(caps) } }
-        item {
-            val accounts = ruleset.accounts
-            val housing = ruleset.housing
-            if (accounts != null || housing != null) {
-                RuleCard(stringResource(R.string.rules_section_accounts)) {
-                    RuleRow(stringResource(R.string.rules_char_slots), accounts?.charSlots?.toString())
-                    RuleRow(stringResource(R.string.rules_per_ip), accounts?.perIp?.toString())
-                    RuleRow(
-                        stringResource(R.string.rules_house_limit),
-                        housing?.accountHouseLimit?.toString(),
-                    )
-                }
-            }
-        }
-        ruleset.vendors?.let { vendors ->
-            item {
-                RuleCard(stringResource(R.string.rules_section_vendors)) {
-                    RuleRow(
-                        stringResource(R.string.rules_restock_delay),
-                        vendors.restockDelayMinutes?.let { stringResource(R.string.rules_minutes, it) },
-                    )
-                    RuleRow(stringResource(R.string.rules_max_sell), vendors.maxSell?.toString())
-                }
-            }
-        }
-        ruleset.schedule?.let { schedule ->
-            item {
-                RuleCard(stringResource(R.string.rules_section_schedule)) {
-                    RuleRow(
-                        stringResource(R.string.rules_autosave),
-                        schedule.autoSaveFrequencyMinutes?.let { stringResource(R.string.rules_minutes, it) },
-                    )
-                    RuleRow(
-                        stringResource(R.string.rules_autorestart),
-                        formatRestart(
-                            schedule.autoRestartEnabled,
-                            schedule.autoRestartHour,
-                            schedule.autoRestartMinute,
-                        ),
-                    )
-                }
-            }
-        }
-    }
-}
-
-@OptIn(ExperimentalLayoutApi::class)
-@Composable
-private fun SystemsCard(systems: Map<String, Boolean>) {
-    RuleCard(stringResource(R.string.rules_section_systems)) {
-        FlowRow(
-            Modifier.padding(top = 6.dp),
-            horizontalArrangement = Arrangement.spacedBy(6.dp),
-            verticalArrangement = Arrangement.spacedBy(6.dp),
-        ) {
-            // Sorted so the list is stable across reloads; the wire order is a config
-            // read order and carries no meaning.
-            systems.entries.sortedBy { it.key }.forEach { (key, on) ->
-                StatusPill(
-                    text = humaniseSystem(key),
-                    tone = if (on) PillTone.Success else PillTone.Neutral,
-                )
-            }
-        }
-    }
-}
-
-@Composable
-private fun CapsCard(caps: RulesetCapsDto) {
-    RuleCard(stringResource(R.string.rules_section_caps)) {
-        // Skill caps arrive in TENTHS (1000 = 100.0). Showing the raw number would read
-        // as a shard with ten times the usual limit.
-        RuleRow(stringResource(R.string.rules_skill_cap), caps.skillCap?.let { formatSkillCap(it) })
-        RuleRow(stringResource(R.string.rules_total_skill_cap), caps.totalSkillCap?.let { formatSkillCap(it) })
-        RuleRow(stringResource(R.string.rules_stat_cap), caps.stat?.toString())
-        RuleRow(stringResource(R.string.rules_str_cap), caps.str?.toString())
-        RuleRow(stringResource(R.string.rules_dex_cap), caps.dex?.toString())
-        RuleRow(stringResource(R.string.rules_int_cap), caps.int?.toString())
-    }
-}
-
-@Composable
-private fun RuleCard(title: String, content: @Composable () -> Unit) {
-    Card(Modifier.fillMaxWidth()) {
-        Column(Modifier.padding(16.dp)) {
-            Text(title, style = MaterialTheme.typography.titleMedium)
-            content()
-        }
-    }
-}
-
-/** One label/value line. Renders nothing when the shard published no value. */
-@Composable
-private fun RuleRow(label: String, value: String?) {
-    if (value.isNullOrBlank()) return
-    Row(
-        Modifier.fillMaxWidth().padding(top = 6.dp),
-        horizontalArrangement = Arrangement.SpaceBetween,
-    ) {
-        Text(label, style = MaterialTheme.typography.bodyMedium, color = MaterialTheme.colorScheme.onSurfaceVariant)
-        Text(value, style = MaterialTheme.typography.bodyMedium)
-    }
-}
-
-// ── Pure helpers (unit-tested) ───────────────────────────────────────────────
-
-/** `cityLoyalty` → "City loyalty". The systems block is a flat bag of config keys. */
-internal fun humaniseSystem(key: String): String = key
-    .replace(Regex("([a-z0-9])([A-Z])"), "$1 $2")
-    .replaceFirstChar { it.uppercaseChar() }
-
-/** A skill cap already converted out of tenths: drop the ".0" on whole values. */
-internal fun formatSkillCap(value: Double): String =
-    if (value % 1.0 == 0.0) value.toInt().toString() else "%.1f".format(value)
-
-/** The auto-restart schedule, or null when the shard doesn't run one. */
-internal fun formatRestart(enabled: Boolean?, hour: Int?, minute: Int?): String? {
-    if (enabled != true) return null
-    if (hour == null) return null
-    return "%02d:%02d".format(hour, minute ?: 0)
-}

app/src/main/java/com/runicgateway/app/ui/shard/RulesViewModel.kt

@@ -1,63 +0,0 @@
-/*
- * SPDX-License-Identifier: GPL-3.0-or-later
- */
-package com.runicgateway.app.ui.shard
-
-import androidx.lifecycle.ViewModel
-import androidx.lifecycle.viewModelScope
-import com.runicgateway.app.core.net.ShardStreamEvent
-import com.runicgateway.app.data.api.dto.RulesetDto
-import com.runicgateway.app.data.repository.ShardRepository
-import com.runicgateway.app.ui.UiState
-import com.runicgateway.app.ui.toShardUiState
-import dagger.hilt.android.lifecycle.HiltViewModel
-import kotlinx.coroutines.flow.MutableStateFlow
-import kotlinx.coroutines.flow.StateFlow
-import kotlinx.coroutines.flow.asStateFlow
-import kotlinx.coroutines.launch
-import javax.inject.Inject
-
-/**
- * The shard ruleset (PLAN.md §9 M11, `docs/link/v3.md` §5): what this world is
- * configured to do — systems on/off, caps, account and housing limits, the champion
- * and Felucca tables, the save/restart schedule.
- *
- * Two states the screen must tell apart, which is why the success type is nullable:
- * a `null` body means the shard has **never published** a ruleset (the plugin is old,
- * or `RulesetEnabled=false`), while the feature being switched off is a 404 folded
- * into `ErrorKind.FEATURE_UNAVAILABLE`.
- *
- * Kept live by the `world.ruleset` frame, which the shard re-emits on every sidecar
- * reconnect — so a shard that restarts with edited config updates the open screen.
- */
-@HiltViewModel
-class RulesViewModel @Inject constructor(
-    private val repository: ShardRepository,
-) : ViewModel() {
-
-    private val _state = MutableStateFlow<UiState<RulesetDto?>>(UiState.Loading)
-    val state: StateFlow<UiState<RulesetDto?>> = _state.asStateFlow()
-
-    init {
-        load()
-        collectLive()
-    }
-
-    fun load() {
-        _state.value = UiState.Loading
-        viewModelScope.launch {
-            _state.value = repository.ruleset().toShardUiState()
-        }
-    }
-
-    private fun collectLive() {
-        viewModelScope.launch {
-            repository.liveEvents().collect { event ->
-                if (event !is ShardStreamEvent.Frame || event.kind != "world.ruleset") return@collect
-                // The frame IS the whole ruleset — replace rather than merge. A frame the
-                // app can't decode is skipped, leaving the loaded copy in place.
-                repository.rulesetFrame(event.data)?.let { _state.value = UiState.Success(it) }
-            }
-        }
-    }
-}

app/src/main/java/com/runicgateway/app/ui/shard/ShardScreen.kt

@@ -32,33 +32,12 @@ import com.runicgateway.app.ui.UiState
 import com.runicgateway.app.ui.components.ErrorView
 import com.runicgateway.app.ui.components.FeatureCard
 import com.runicgateway.app.ui.components.LoadingView
-import com.runicgateway.app.data.repository.ShardFeature
-import com.runicgateway.app.data.repository.ShardFeatures
-import com.runicgateway.app.data.repository.canSee
 import com.runicgateway.app.ui.components.PillTone
 import com.runicgateway.app.ui.components.SectionLabel
 import com.runicgateway.app.ui.components.StatusPill
 
-/**
+/** Board destinations reachable from the hub. */
- * Board destinations reachable from the hub, each tagged with the visibility feature
+enum class ShardBoard { CHAMPS, GUILDS, GOVERNORS, HOUSES }
- * that governs it (M11). An admin can switch any of these off or raise its audience,
- * so the hub's board list is filtered the same way the drawer is — a tile whose
- * feature the caller can't see would only lead to a `404`/`403`.
- */
-enum class ShardBoard(val feature: String) {
-    CHAMPS(ShardFeature.CHAMPS),
-    GUILDS(ShardFeature.GUILDS),
-    GOVERNORS(ShardFeature.GOVERNORS),
-    HOUSES(ShardFeature.HOUSES),
-}
-
-/**
- * The boards this viewer may reach. Pure + side-effect-free so the gating is
- * unit-tested without Compose, exactly like `visibleEntries` for the drawer. An
- * unknown answer shows every board — the server gates regardless (see [canSee]).
- */
-fun visibleBoards(features: ShardFeatures?): List<ShardBoard> =
-    ShardBoard.entries.filter { canSee(features, it.feature) }
 
 /**
  * The Shard hub (PLAN.md §6.2): live connection status, online count + latest
@@ -75,7 +54,6 @@ fun ShardScreen(
     val state by viewModel.state.collectAsStateWithLifecycle()
     val feed by viewModel.feed.collectAsStateWithLifecycle()
     val connected by viewModel.connected.collectAsStateWithLifecycle()
-    val features by viewModel.shardFeatures.collectAsStateWithLifecycle()
 
     when (val s = state) {
         is UiState.Loading -> LoadingView(modifier)
@@ -84,7 +62,6 @@ fun ShardScreen(
             hub = s.data,
             feed = feed,
             connected = connected,
-            features = features,
             onOpenBoard = onOpenBoard,
             modifier = modifier,
         )
@@ -96,7 +73,6 @@ private fun HubContent(
     hub: ShardHub,
     feed: List<FeedLine>,
     connected: Boolean,
-    features: ShardFeatures?,
     onOpenBoard: (ShardBoard) -> Unit,
     modifier: Modifier = Modifier,
 ) {
@@ -106,7 +82,7 @@ private fun HubContent(
         contentPadding = androidx.compose.foundation.layout.PaddingValues(vertical = 16.dp),
     ) {
         item { StatusCard(hub.status, hub.presence?.count) }
-        item { BoardsCard(features, onOpenBoard) }
+        item { BoardsCard(onOpenBoard) }
 
         if (hub.online.isNotEmpty()) {
             item { SectionHeader(stringResource(R.string.shard_section_staff)) }
@@ -183,16 +159,13 @@ private fun StatusCard(status: ShardStatusDto, presenceCount: Int?) {
 }
 
 @Composable
-private fun BoardsCard(features: ShardFeatures?, onOpenBoard: (ShardBoard) -> Unit) {
+private fun BoardsCard(onOpenBoard: (ShardBoard) -> Unit) {
-    val boards = visibleBoards(features).map { board ->
+    val boards = listOf(
-        board to when (board) {
+        ShardBoard.CHAMPS to R.string.shard_nav_champs,
-            ShardBoard.CHAMPS -> R.string.shard_nav_champs
+        ShardBoard.GUILDS to R.string.shard_nav_guilds,
-            ShardBoard.GUILDS -> R.string.shard_nav_guilds
+        ShardBoard.GOVERNORS to R.string.shard_nav_governors,
-            ShardBoard.GOVERNORS -> R.string.shard_nav_governors
+        ShardBoard.HOUSES to R.string.shard_nav_houses,
-            ShardBoard.HOUSES -> R.string.shard_nav_houses
+    )
-        }
-    }
-    if (boards.isEmpty()) return
     Card(Modifier.fillMaxWidth()) {
         Column {
             boards.forEachIndexed { index, (board, labelRes) ->

app/src/main/java/com/runicgateway/app/ui/shard/ShardViewModel.kt

@@ -10,11 +10,9 @@ import com.runicgateway.app.core.result.ApiResult
 import com.runicgateway.app.data.api.dto.OnlineStaffDto
 import com.runicgateway.app.data.api.dto.PresenceDto
 import com.runicgateway.app.data.api.dto.ShardStatusDto
-import com.runicgateway.app.data.repository.ShardFeatures
-import com.runicgateway.app.data.repository.ShardFeaturesRepository
 import com.runicgateway.app.data.repository.ShardRepository
 import com.runicgateway.app.ui.UiState
-import com.runicgateway.app.ui.toShardUiState
+import com.runicgateway.app.ui.toUiState
 import dagger.hilt.android.lifecycle.HiltViewModel
 import kotlinx.coroutines.flow.MutableStateFlow
 import kotlinx.coroutines.flow.StateFlow
@@ -41,18 +39,11 @@ data class ShardHub(
 @HiltViewModel
 class ShardViewModel @Inject constructor(
     private val repository: ShardRepository,
-    shardFeaturesRepository: ShardFeaturesRepository,
 ) : ViewModel() {
 
     private val _state = MutableStateFlow<UiState<ShardHub>>(UiState.Loading)
     val state: StateFlow<UiState<ShardHub>> = _state.asStateFlow()
 
-    /**
-     * Which boards to offer (M11). Read-only here — the app shell refreshes this on
-     * every session change, and the hub only filters its tiles with it.
-     */
-    val shardFeatures: StateFlow<ShardFeatures?> = shardFeaturesRepository.features
-
     private val _feed = MutableStateFlow<List<FeedLine>>(emptyList())
     val feed: StateFlow<List<FeedLine>> = _feed.asStateFlow()
 
@@ -78,8 +69,8 @@ class ShardViewModel @Inject constructor(
                     seedFeed()
                 }
                 // Both error variants are ApiResult<Nothing>, so their UiState is Nothing-typed.
-                is ApiResult.HttpError -> _state.value = status.toShardUiState()
+                is ApiResult.HttpError -> _state.value = status.toUiState()
-                is ApiResult.NetworkError -> _state.value = status.toShardUiState()
+                is ApiResult.NetworkError -> _state.value = status.toUiState()
             }
         }
     }

app/src/main/res/values/strings.xml

@@ -16,7 +16,6 @@
     <string name="error_not_found">This content couldn\'t be found.</string>
     <string name="error_rate_limited">Too many requests. Please try again in a moment.</string>
     <string name="error_shard_offline">The shard is offline right now.</string>
-    <string name="error_feature_unavailable">This shard doesn\'t publish this here.</string>
     <string name="error_server">Something went wrong on the server. Please try again.</string>
 
     <!-- ── First-run connect (§3) ──────────────────────────────────────── -->
@@ -41,102 +40,16 @@
     <string name="menu_news">News</string>
     <string name="menu_wiki">Wiki</string>
     <string name="menu_shard">Shard</string>
-    <string name="menu_rules">Rules</string>
-    <string name="menu_atlas">Atlas</string>
-    <string name="menu_leaderboards">Leaderboards</string>
-    <string name="menu_market">Market</string>
     <string name="menu_about">About</string>
     <string name="menu_contact">Contact</string>
     <string name="menu_account">My account</string>
     <string name="menu_my_characters">My characters</string>
     <string name="menu_my_vendors">My vendors</string>
     <string name="menu_my_houses">My houses</string>
-    <string name="menu_admin_dashboard">Dashboard</string>
-    <string name="menu_admin_content">Content</string>
-    <string name="menu_admin_moderation">Moderation</string>
-    <string name="menu_admin_support">Support queue</string>
     <string name="menu_sign_in">Sign in</string>
     <string name="menu_sign_out">Sign out</string>
     <string name="menu_change_server">Change server</string>
 
-    <!-- ── Staff operations (§1, M10) ──────────────────────────────────── -->
-    <string name="admin_dashboard_site">Site</string>
-    <string name="admin_dashboard_counts">Counts</string>
-    <string name="admin_dashboard_recent_activity">Recent activity</string>
-    <string name="admin_site_live">Live</string>
-    <string name="admin_site_maintenance">Maintenance</string>
-    <string name="admin_site_switch_maintenance">Switch to maintenance</string>
-    <string name="admin_site_switch_live">Switch to live</string>
-    <string name="admin_site_changed_by">by %1$s</string>
-    <string name="admin_site_mode_updated">Site mode updated.</string>
-    <string name="admin_count_users">Users</string>
-    <string name="admin_count_posts">Posts</string>
-    <string name="admin_forbidden">You don\'t have permission for that action.</string>
-    <string name="admin_action_failed">That action couldn\'t be completed. Please try again.</string>
-    <string name="action_cancel">Cancel</string>
-
-    <!-- Staff content (posts + wiki) -->
-    <string name="admin_content_tab_posts">Posts</string>
-    <string name="admin_content_tab_wiki">Wiki</string>
-    <string name="admin_content_new_post">New post</string>
-    <string name="admin_content_new_category">New category</string>
-    <string name="admin_content_create">Create</string>
-    <string name="admin_content_published">Published</string>
-    <string name="admin_content_draft">Draft</string>
-    <string name="admin_content_publish">Publish</string>
-    <string name="admin_content_unpublish">Unpublish</string>
-    <string name="admin_content_delete">Delete</string>
-    <string name="admin_content_publish_now">Publish now</string>
-    <string name="admin_content_field_title">Title</string>
-    <string name="admin_content_field_excerpt">Excerpt</string>
-    <string name="admin_content_field_body">Body</string>
-    <string name="admin_content_field_slug">Slug</string>
-    <string name="admin_content_field_description">Description</string>
-    <string name="admin_content_field_sort">Sort order</string>
-    <!-- %1$s slug, %2$d page count -->
-    <string name="admin_content_cat_meta">%1$s · %2$d pages</string>
-    <!-- %1$s comma-separated tag labels -->
-    <string name="admin_content_tags">Tags: %1$s</string>
-    <string name="admin_content_post_created">Post created.</string>
-    <string name="admin_content_post_updated">Post updated.</string>
-    <string name="admin_content_post_deleted">Post deleted.</string>
-    <string name="admin_content_cat_created">Category created.</string>
-    <string name="admin_content_cat_deleted">Category deleted.</string>
-    <string name="admin_content_title_required">A title is required.</string>
-    <string name="admin_content_cat_fields_required">Slug and title are required.</string>
-
-    <!-- Staff moderation (shard write plane) -->
-    <string name="admin_mod_account_action">Account action</string>
-    <string name="admin_mod_account">Account</string>
-    <string name="admin_mod_serial">Serial (0x…)</string>
-    <string name="admin_mod_reason">Reason (ban)</string>
-    <string name="admin_mod_duration">Ban duration (seconds; blank = indefinite)</string>
-    <string name="admin_mod_kick">Kick</string>
-    <string name="admin_mod_ban">Ban</string>
-    <string name="admin_mod_unban">Unban</string>
-    <string name="admin_mod_broadcast_section">Broadcast</string>
-    <string name="admin_mod_broadcast_text">Message to everyone online</string>
-    <string name="admin_mod_broadcast">Broadcast</string>
-    <string name="admin_mod_kicked">Account kicked.</string>
-    <string name="admin_mod_banned">Account banned.</string>
-    <string name="admin_mod_unbanned">Ban cleared.</string>
-    <string name="admin_mod_broadcasted">Message broadcast.</string>
-    <string name="admin_mod_target_required">Enter an account or serial.</string>
-    <string name="admin_mod_text_required">Enter a message to broadcast.</string>
-    <string name="admin_mod_shard_offline">The shard is offline — the action couldn\'t be delivered.</string>
-
-    <!-- Staff support queue -->
-    <string name="admin_support_empty">No open help pages.</string>
-    <string name="admin_support_reply">Reply</string>
-    <string name="admin_support_close">Close</string>
-    <string name="admin_support_send">Send</string>
-    <string name="admin_support_message">Reply message</string>
-    <string name="admin_support_close_after">Close the page after replying</string>
-    <string name="admin_support_responded">Reply sent.</string>
-    <string name="admin_support_closed">Page closed.</string>
-    <string name="admin_support_message_required">Enter a reply message.</string>
-    <string name="admin_support_unknown_page">That page is no longer in the queue.</string>
-
     <!-- ── Auth: login (§4.1) ──────────────────────────────────────────── -->
     <string name="login_title">Sign in</string>
     <string name="login_subtitle">Sign in with your shard account.</string>
@@ -147,19 +60,12 @@
     <string name="login_button">Sign in</string>
     <string name="login_register">Create an account</string>
     <string name="login_forgot">Forgot your password?</string>
-    <!-- Single SSO entry point; the picker lists the shard's providers (native SSO, M9/M10). -->
+    <string name="login_sso">Sign in with Google or Discord (on the website)</string>
-    <string name="login_sso_button">Sign in with SSO</string>
-    <string name="login_sso_pick_title">Choose a sign-in provider</string>
-    <!-- %1$s is the provider name, e.g. "Google" or "Discord". -->
-    <string name="login_sso_provider">Sign in with %1$s</string>
-    <string name="login_sso_loading">Loading sign-in options…</string>
-    <string name="login_sso_retry">Couldn\'t load sign-in options. Tap to retry.</string>
     <string name="login_error_credentials">Incorrect username or password.</string>
     <string name="login_error_code">That code didn\'t match. Try the current code.</string>
     <string name="login_error_rate_limited">Too many attempts. Please try again shortly.</string>
     <string name="login_error_server">Something went wrong. Please try again.</string>
     <string name="login_error_network">Can\'t reach the site. Check your connection and try again.</string>
-    <string name="login_error_sso">Couldn\'t complete that sign-in. Please try again.</string>
 
     <!-- ── Auth: account (§5, §6.3) ────────────────────────────────────── -->
     <string name="account_title">My account</string>
@@ -206,49 +112,6 @@
     <string name="account_identity_unlinked">Account unlinked.</string>
     <string name="account_identity_error">Couldn\'t unlink that account.</string>
 
-    <!-- ── Trusted devices & recovery codes (TRUSTED_DEVICES_MFA.md) ─────── -->
-    <!-- Login 2FA step -->
-    <string name="login_recovery_code">Recovery code</string>
-    <string name="login_recovery_hint">Enter one of your single-use backup codes.</string>
-    <string name="login_use_recovery_instead">Use a recovery code instead</string>
-    <string name="login_use_totp_instead">Use your authenticator code instead</string>
-    <string name="login_trust_device">Trust this device (skip codes for 30 days)</string>
-
-    <!-- Account: security section -->
-    <string name="account_security_title">Security</string>
-    <string name="account_security_trusted_devices">Trusted devices</string>
-    <string name="account_security_recovery_codes">Recovery codes</string>
-
-    <!-- Trusted devices screen -->
-    <string name="trusted_devices_title">Trusted devices</string>
-    <string name="trusted_devices_subtitle">These devices can skip the authentication code at sign-in for 30 days.</string>
-    <string name="trusted_devices_empty">No trusted devices yet.</string>
-    <string name="trusted_devices_unknown">Unknown device</string>
-    <string name="trusted_devices_last_used">Last used %1$s</string>
-    <string name="trusted_devices_revoke">Revoke</string>
-    <string name="trusted_devices_trust_this">Trust this device</string>
-    <string name="trusted_devices_untrust_all">Untrust all devices</string>
-    <string name="trusted_devices_trusted">This device is now trusted.</string>
-    <string name="trusted_devices_revoked">Device revoked.</string>
-    <string name="trusted_devices_revoked_all">All devices untrusted.</string>
-    <string name="trusted_devices_limit">You\'ve reached the trusted-device limit. Revoke one, then try again.</string>
-    <string name="trusted_devices_error">Something went wrong. Please try again.</string>
-
-    <!-- Recovery codes screen -->
-    <string name="recovery_codes_title">Recovery codes</string>
-    <string name="recovery_codes_subtitle">Single-use backup codes let you sign in if you lose your authenticator.</string>
-    <string name="recovery_codes_remaining">%1$d codes remaining</string>
-    <string name="recovery_codes_remaining_loading">Checking remaining codes…</string>
-    <string name="recovery_codes_remaining_unknown">Couldn\'t load the remaining count.</string>
-    <string name="recovery_codes_password_hint">Enter your current password to generate a new set.</string>
-    <string name="recovery_codes_regenerate">Generate new codes</string>
-    <string name="recovery_codes_error">Couldn\'t generate codes. Check your password and that two-factor is on.</string>
-    <string name="recovery_codes_new_title">Your new recovery codes</string>
-    <string name="recovery_codes_new_hint">Save these now — they\'re shown only once and each works a single time.</string>
-    <string name="recovery_codes_copy">Copy</string>
-    <string name="recovery_codes_share">Share</string>
-    <string name="recovery_codes_done">Done</string>
-
     <!-- ── Player: game-account linking (§6.3) ─────────────────────────── -->
     <string name="player_link_title">Link your game account</string>
     <string name="player_link_hint">In game, type [link to get a one-time code, then enter it here to see your characters, vendors and houses.</string>
@@ -295,11 +158,6 @@
     <string name="player_char_pois">Poison</string>
     <string name="player_char_energy">Energy</string>
     <string name="player_char_skills">Skills</string>
-    <string name="player_char_points">Loyalty &amp; Points</string>
-    <!-- A point system's name followed by the character's rank on that board, e.g. "Queens Loyalty · #3". -->
-    <string name="player_char_points_ranked">%1$s · #%2$d</string>
-    <!-- A score against its cap. Only shown for capped systems; an uncapped score shows the number alone. -->
-    <string name="player_char_points_of">%1$d / %2$d</string>
     <string name="player_char_equipment">Equipment</string>
     <string name="player_char_item">Item</string>
     <string name="player_char_item_id">id %1$d</string>
@@ -386,85 +244,6 @@
     <string name="guilds_leader">Led by %1$s</string>
     <string name="guilds_alliance">Alliance: %1$s</string>
 
-    <!-- ── Rules / ruleset (Protocol 3.0 §5, M11) ──────────────────────── -->
-    <!-- A successful read of a shard that has never published its ruleset — NOT the same
-         as the feature being switched off, which renders as an error state. -->
-    <string name="rules_unpublished">This shard hasn\'t published its ruleset yet.</string>
-    <string name="rules_section_shard">Shard</string>
-    <string name="rules_section_systems">Systems</string>
-    <string name="rules_section_caps">Skill &amp; stat caps</string>
-    <string name="rules_section_accounts">Accounts &amp; housing</string>
-    <string name="rules_section_vendors">Vendors</string>
-    <string name="rules_section_schedule">Saves &amp; restarts</string>
-    <string name="rules_name">Name</string>
-    <string name="rules_expansion">Expansion</string>
-    <string name="rules_connect">Connect</string>
-    <string name="rules_skill_cap">Individual skill cap</string>
-    <string name="rules_total_skill_cap">Total skill cap</string>
-    <string name="rules_stat_cap">Total stat cap</string>
-    <string name="rules_str_cap">Strength cap</string>
-    <string name="rules_dex_cap">Dexterity cap</string>
-    <string name="rules_int_cap">Intelligence cap</string>
-    <string name="rules_char_slots">Character slots</string>
-    <string name="rules_per_ip">Accounts per IP</string>
-    <string name="rules_house_limit">Houses per account</string>
-    <string name="rules_restock_delay">Vendor restock delay</string>
-    <string name="rules_max_sell">Max sell quantity</string>
-    <string name="rules_autosave">Auto-save every</string>
-    <string name="rules_autorestart">Auto-restart at</string>
-    <string name="rules_minutes">%1$d min</string>
-
-    <!-- ── Leaderboards (Protocol 3.0 §7, M11) ─────────────────────────── -->
-    <string name="leaderboards_empty">This shard isn\'t publishing any leaderboards yet.</string>
-    <string name="leaderboards_board_empty">Nobody has scored here yet.</string>
-    <!-- Where a score would sit on the placeholder row of an unscored board. An em
-         dash, not "0" — nobody has scored zero, nobody has scored at all. -->
-    <string name="leaderboards_no_score">—</string>
-    <string name="leaderboards_players">%1$d players</string>
-    <!-- Only shown for capped systems; most systems on a real shard are uncapped. -->
-    <string name="leaderboards_cap">Cap: %1$d</string>
-    <string name="leaderboards_rank_name">#%1$d  %2$s</string>
-    <!-- A shard may publish standings without naming who holds them (the board's one
-         admin-configurable field). -->
-    <string name="leaderboards_hidden_name">Someone</string>
-
-    <!-- ── Market (Protocol 3.0 §8, M11) ───────────────────────────────── -->
-    <string name="market_search_label">Search every shop</string>
-    <string name="market_empty">No listings match that search.</string>
-    <string name="market_shop_empty">This shop has nothing for sale.</string>
-    <!-- Required, not decoration: the shard sweeps vendors round-robin, so a price can
-         legitimately be a full cycle old. -->
-    <string name="market_staleness">Prices are refreshed in rotation and may be out of date.</string>
-    <string name="market_price">%1$d gp</string>
-    <string name="market_unnamed_item">Item %1$d</string>
-    <string name="market_unnamed_shop">A shop</string>
-    <string name="market_owner">Kept by %1$s</string>
-    <!-- A gated location is a real answer: the shop exists, the shard just doesn't say
-         where it stands. -->
-    <string name="market_location_hidden">This shard doesn\'t publish shop locations.</string>
-    <string name="market_truncated">Showing %1$d of %2$d — this shop holds more than the shard publishes.</string>
-
-    <!-- ── Spawn atlas (Protocol 3.0 §6, M11) ──────────────────────────── -->
-    <string name="atlas_search_label">Search creatures</string>
-    <string name="atlas_empty">No creatures match that search.</string>
-    <!-- A place can legitimately hold a single spawner, and the aggregate list is full
-         of them — "1 spawners" on every other row is worth a plural for. -->
-    <plurals name="atlas_spawner_count">
-        <item quantity="one">%1$d spawner</item>
-        <item quantity="other">%1$d spawners</item>
-    </plurals>
-    <string name="atlas_total_alive">Up to %1$d alive at once</string>
-    <string name="atlas_facet_count">%1$s (%2$d)</string>
-    <!-- The aggregate: "where is it", as opposed to the raw coordinates below it. -->
-    <string name="atlas_section_places">Where it spawns</string>
-    <string name="atlas_place_max_alive">up to %1$d at once</string>
-    <string name="atlas_section_spawners">Spawn points</string>
-    <string name="atlas_section_also_here">Also spawns here</string>
-    <string name="atlas_spawners_truncated">More spawn points than shown.</string>
-    <string name="atlas_max_count">Up to %1$d</string>
-    <!-- The delay is already in seconds; the server normalizes XmlSpawner's mixed units. -->
-    <string name="atlas_respawn">Respawn %1$s</string>
-
     <!-- ── Governors (§6.2) ────────────────────────────────────────────── -->
     <string name="governors_empty">No governors — this shard may not run the City Loyalty system.</string>
     <string name="governor_current">Governed by %1$s</string>
@@ -478,37 +257,4 @@
     <string name="houses_empty">No houses are in danger right now.</string>
     <string name="houses_fallback_name">A house</string>
     <string name="houses_idoc_badge">IDOC</string>
-
-    <!-- ── Push notifications (§11, M7 Part 2) ─────────────────────────── -->
-    <string name="menu_notifications">Notifications</string>
-    <string name="notifications_title">Notifications</string>
-    <string name="notifications_subtitle">Choose what this shard notifies you about. Nothing is sent unless you turn it on.</string>
-    <string name="notifications_section_general">General</string>
-    <string name="notifications_section_personal">Your game account</string>
-    <string name="notifications_requires_link">Link a game account to enable this.</string>
-    <string name="notifications_empty">This shard offers no notification streams yet.</string>
-    <string name="notifications_unsupported">This shard hasn\'t set up push notifications yet.</string>
-    <string name="notifications_saved">Notification settings saved.</string>
-    <string name="notifications_all_off">Notifications turned off.</string>
-    <string name="notifications_save_error">Couldn\'t save your notification settings. Try again.</string>
-    <string name="notifications_relay_error">This shard\'s push relay isn\'t reachable right now.</string>
-
-    <!-- Notification channels + the ongoing foreground-service notification. -->
-    <string name="push_channel_messages">Shard notifications</string>
-    <string name="push_channel_messages_desc">Alerts you opted into from this shard.</string>
-    <string name="push_channel_service">Background connection</string>
-    <string name="push_channel_service_desc">Keeps the connection open to deliver notifications.</string>
-    <string name="push_service_title">Notifications active</string>
-    <string name="push_service_text">Listening for shard notifications.</string>
-
-    <!-- Per-stream notification titles (content-free tickle → generic title, §11). -->
-    <string name="push_stream_news_post">New post</string>
-    <string name="push_stream_server_status">Shard status changed</string>
-    <string name="push_stream_idoc_warning">A house is falling (IDOC)</string>
-    <string name="push_stream_champ_start">Champion spawn started</string>
-    <string name="push_stream_governor_election">New governor elected</string>
-    <string name="push_stream_vendor_sale">Your vendor made a sale</string>
-    <string name="push_stream_house_idoc">Your house entered IDOC</string>
-    <string name="push_stream_account_login">Login to your account</string>
-    <string name="push_stream_generic">New notification</string>
 </resources>

app/src/main/res/xml/network_security_config.xml

@@ -1,16 +0,0 @@
-<?xml version="1.0" encoding="utf-8"?>
-<!-- SPDX-License-Identifier: GPL-3.0-or-later -->
-<!--
-  The app is purely an HTTPS API client of a shard's website backend, so the base
-  posture forbids all cleartext (HTTP) traffic. This makes explicit what minSdk 29 /
-  targetSdk 35 already default to, satisfies the "usesCleartextTraffic implicitly
-  enabled" scanner finding, and stops any merged library manifest from re-enabling
-  cleartext. It also mirrors ServerUrl's release-build rule (HTTPS required) at the
-  platform socket layer — defense in depth.
-
-  The debug variant overrides this file (app/src/debug/res/xml/) to re-permit
-  cleartext to loopback only, for local dev against http://127.0.0.1:3000.
--->
-<network-security-config>
-    <base-config cleartextTrafficPermitted="false" />
-</network-security-config>

app/src/test/java/com/runicgateway/app/core/auth/sso/PkceTest.kt

@@ -1,49 +0,0 @@
-/*
- * SPDX-License-Identifier: GPL-3.0-or-later
- */
-package com.runicgateway.app.core.auth.sso
-
-import org.junit.Assert.assertEquals
-import org.junit.Assert.assertNotEquals
-import org.junit.Assert.assertTrue
-import org.junit.Test
-
-/**
- * PKCE Layer B primitives (PLAN.md §4.2). The challenge encoding must match the
- * backend byte-for-byte (`base64url(SHA-256(verifier))`, no padding) or `/exchange`
- * rejects every code — so it is pinned against the RFC 7636 test vector.
- */
-class PkceTest {
-
-    // RFC 4648 §5 URL-safe base64 alphabet, no padding.
-    private val base64UrlNoPad = Regex("^[A-Za-z0-9_-]+$")
-
-    @Test fun `challenge matches the RFC 7636 vector`() {
-        // RFC 7636 Appendix B.
-        val verifier = "dBjftJeZ4CVP-mB92K27uhbUJU1p1r_wW1gFWFOEjXk"
-        assertEquals("E9Melhoa2OwvFrEMTJguCHaoeK1t8URWbuGJSstw-cM", Pkce.challengeOf(verifier))
-    }
-
-    @Test fun `verifier is url-safe base64 without padding`() {
-        val verifier = Pkce.newVerifier()
-        assertTrue("verifier charset: $verifier", base64UrlNoPad.matches(verifier))
-        // 32 random bytes → 43 base64 chars (no padding), inside RFC 7636's 43–128.
-        assertEquals(43, verifier.length)
-    }
-
-    @Test fun `challenge is url-safe base64 without padding`() {
-        val challenge = Pkce.challengeOf(Pkce.newVerifier())
-        assertTrue("challenge charset: $challenge", base64UrlNoPad.matches(challenge))
-        // SHA-256 (32 bytes) → 43 base64 chars, no '=' padding.
-        assertEquals(43, challenge.length)
-    }
-
-    @Test fun `verifiers and states are unique per call`() {
-        assertNotEquals(Pkce.newVerifier(), Pkce.newVerifier())
-        assertNotEquals(Pkce.newState(), Pkce.newState())
-    }
-
-    @Test fun `state is url-safe base64 without padding`() {
-        assertTrue(base64UrlNoPad.matches(Pkce.newState()))
-    }
-}

app/src/test/java/com/runicgateway/app/core/auth/sso/SsoAuthManagerTest.kt

@@ -1,296 +0,0 @@
-/*
- * SPDX-License-Identifier: GPL-3.0-or-later
- */
-package com.runicgateway.app.core.auth.sso
-
-import com.runicgateway.app.core.auth.Session
-import com.runicgateway.app.core.auth.SessionManager
-import com.runicgateway.app.core.auth.StoredSession
-import com.runicgateway.app.core.auth.TokenStore
-import com.runicgateway.app.core.auth.TrustTokenStore
-import com.runicgateway.app.core.net.BaseUrlHolder
-import com.runicgateway.app.data.api.SsoApi
-import com.runicgateway.app.data.api.dto.MobileSsoExchangeRequest
-import com.runicgateway.app.data.api.dto.MobileTokenResponse
-import com.runicgateway.app.data.api.dto.SafeUserDto
-import com.runicgateway.app.data.api.dto.SsoProviderDto
-import kotlinx.coroutines.test.runTest
-import okhttp3.HttpUrl.Companion.toHttpUrl
-import okhttp3.MediaType.Companion.toMediaTypeOrNull
-import okhttp3.ResponseBody.Companion.toResponseBody
-import org.junit.Assert.assertEquals
-import org.junit.Assert.assertNull
-import org.junit.Assert.assertTrue
-import org.junit.Test
-import retrofit2.Response
-
-/**
- * The native SSO bridge orchestration (PLAN.md §4.2, M9): start-URL building, the
- * CSRF/state guard, the code→token exchange, and that a success drives the *same*
- * [SessionManager] the password login uses. Runs over a fake [SsoApi] + a real
- * [SessionManager] on a fake [TokenStore]; no Android framework types are touched.
- */
-class SsoAuthManagerTest {
-
-    private class FakeTokenStore(var stored: StoredSession? = null) : TokenStore {
-        override fun load(): StoredSession? = stored
-        override fun save(session: StoredSession) { stored = session }
-        override fun clear() { stored = null }
-    }
-
-    /** In-memory stand-in for the encrypted pending-SSO store (survives across
-     *  manager instances the way the on-disk store survives process death). */
-    private class FakePendingSsoStore(var pending: PendingSso? = null) : PendingSsoStore {
-        override fun save(state: String, verifier: String) { pending = PendingSso(state, verifier) }
-        override fun load(): PendingSso? = pending
-        override fun clear() { pending = null }
-    }
-
-    /** In-memory stand-in for the encrypted trust-token store, scoped by username
-     *  the same way the production impl is. */
-    private class FakeTrustTokenStore : TrustTokenStore {
-        var owner: String? = null
-        var token: String? = null
-        override fun tokenFor(username: String): String? =
-            if (owner.equals(username, ignoreCase = true)) token else null
-        override fun save(username: String, token: String) { owner = username; this.token = token }
-        override fun clear() { owner = null; token = null }
-    }
-
-    /** Records the exchange it was called with and returns a scripted response. */
-    private class FakeSsoApi(
-        private val exchangeResult: () -> Response<MobileTokenResponse>,
-    ) : SsoApi {
-        var exchangeCalls = 0
-        var lastRequest: MobileSsoExchangeRequest? = null
-
-        override suspend fun providers(): List<SsoProviderDto> = emptyList()
-
-        override suspend fun exchange(body: MobileSsoExchangeRequest): Response<MobileTokenResponse> {
-            exchangeCalls++
-            lastRequest = body
-            return exchangeResult()
-        }
-    }
-
-    private fun tokenPair() = MobileTokenResponse(
-        accessToken = "access-A",
-        refreshToken = "refresh-A",
-        expiresIn = "15m",
-        user = SafeUserDto(id = 7, username = "alice", role = "player"),
-    )
-
-    private fun error(code: Int): Response<MobileTokenResponse> =
-        Response.error(code, "".toResponseBody("application/json".toMediaTypeOrNull()))
-
-    private fun managerWith(
-        api: SsoApi,
-        session: SessionManager,
-        base: String? = "https://shard.example.com/",
-        store: PendingSsoStore = FakePendingSsoStore(),
-        trust: TrustTokenStore = FakeTrustTokenStore(),
-    ): SsoAuthManager {
-        val holder = BaseUrlHolder()
-        if (base != null) holder.set(base.toHttpUrl())
-        return SsoAuthManager(api, session, holder, store, trust)
-    }
-
-    /** Build a start URL and pull the generated `state` back out of it. */
-    private fun startAndState(mgr: SsoAuthManager, provider: String = "google"): String {
-        val url = mgr.buildStartUrl(SsoProviderDto(id = provider, name = "Google").id)!!
-        return url.toHttpUrl().queryParameter("state")!!
-    }
-
-    @Test fun `buildStartUrl carries provider, challenge, state and the fixed redirect`() {
-        val mgr = managerWith(FakeSsoApi { tokenPair().let { Response.success(it) } }, SessionManager(FakeTokenStore()))
-        val url = mgr.buildStartUrl("google")!!
-        val http = url.toHttpUrl()
-
-        assertTrue(url.startsWith("https://shard.example.com/api/v1/auth/mobile/sso/start"))
-        assertEquals("google", http.queryParameter("provider"))
-        assertEquals(SsoAuthManager.REDIRECT_URI, http.queryParameter("redirect_uri"))
-        assertTrue(!http.queryParameter("code_challenge").isNullOrBlank())
-        assertTrue(!http.queryParameter("state").isNullOrBlank())
-    }
-
-    @Test fun `buildStartUrl returns null when no base url is set`() {
-        val mgr = managerWith(FakeSsoApi { Response.success(tokenPair()) }, SessionManager(FakeTokenStore()), base = null)
-        assertNull(mgr.buildStartUrl("google"))
-    }
-
-    @Test fun `successful callback exchanges and signs in`() = runTest {
-        val api = FakeSsoApi { Response.success(tokenPair()) }
-        val session = SessionManager(FakeTokenStore())
-        val mgr = managerWith(api, session)
-
-        val state = startAndState(mgr)
-        mgr.complete(state = state, code = "auth-code-1", error = null)
-
-        assertEquals(1, api.exchangeCalls)
-        assertEquals("auth-code-1", api.lastRequest?.code)
-        assertTrue(session.state.value is Session.SignedIn)
-        assertEquals("access-A", session.currentAccessToken())
-        assertEquals(SsoAuthManager.Outcome.Success, mgr.outcome.value)
-    }
-
-    // Trusted devices over SSO (TRUSTED_DEVICES_MFA.md). Ticking "trust this device"
-    // on the TOTP form inside the Custom Tab trusts that browser via cookie; the
-    // exchange additionally hands the APP its own token so a native password login
-    // on this device skips the code too. Before this, SSO ignored trust entirely.
-    @Test fun `a trustToken on the exchange response is persisted for the signed-in user`() = runTest {
-        val api = FakeSsoApi { Response.success(tokenPair().copy(trustToken = "opaque-trust")) }
-        val session = SessionManager(FakeTokenStore())
-        val trust = FakeTrustTokenStore()
-        val mgr = managerWith(api, session, trust = trust)
-
-        val state = startAndState(mgr)
-        mgr.complete(state = state, code = "auth-code-1", error = null)
-
-        assertEquals(SsoAuthManager.Outcome.Success, mgr.outcome.value)
-        assertEquals("opaque-trust", trust.tokenFor("alice"))
-        // Scoped to the account that minted it — never replayed for someone else.
-        assertNull(trust.tokenFor("mallory"))
-    }
-
-    @Test fun `no trustToken on the response leaves the store untouched`() = runTest {
-        val api = FakeSsoApi { Response.success(tokenPair()) }
-        val session = SessionManager(FakeTokenStore())
-        val trust = FakeTrustTokenStore()
-        val mgr = managerWith(api, session, trust = trust)
-
-        val state = startAndState(mgr)
-        mgr.complete(state = state, code = "auth-code-1", error = null)
-
-        assertEquals(SsoAuthManager.Outcome.Success, mgr.outcome.value)
-        assertNull(trust.tokenFor("alice"))
-    }
-
-    @Test fun `state mismatch fails without exchanging`() = runTest {
-        val api = FakeSsoApi { Response.success(tokenPair()) }
-        val session = SessionManager(FakeTokenStore())
-        val mgr = managerWith(api, session)
-
-        startAndState(mgr) // establishes a pending with a different state
-        mgr.complete(state = "not-the-state", code = "auth-code-1", error = null)
-
-        assertEquals(0, api.exchangeCalls)
-        assertTrue(session.state.value is Session.SignedOut)
-        assertEquals(SsoAuthManager.Outcome.Failed(SsoAuthManager.Failure.STATE_MISMATCH), mgr.outcome.value)
-    }
-
-    @Test fun `missing pending flow (process death) fails closed`() = runTest {
-        val api = FakeSsoApi { Response.success(tokenPair()) }
-        val mgr = managerWith(api, SessionManager(FakeTokenStore()))
-
-        // No buildStartUrl → nothing stashed; a callback can't be trusted.
-        mgr.complete(state = "anything", code = "auth-code-1", error = null)
-
-        assertEquals(0, api.exchangeCalls)
-        assertEquals(SsoAuthManager.Outcome.Failed(SsoAuthManager.Failure.STATE_MISMATCH), mgr.outcome.value)
-    }
-
-    @Test fun `pending survives process death — a fresh manager on the same store completes`() = runTest {
-        // Persist the pending on one instance, then throw that instance away.
-        val store = FakePendingSsoStore()
-        val session = SessionManager(FakeTokenStore())
-        val started = managerWith(FakeSsoApi { Response.success(tokenPair()) }, session, store = store)
-        val state = startAndState(started)
-
-        // A brand-new manager (simulating the app relaunched after eviction) reads the
-        // persisted pending and completes the exchange — the old in-memory holder would
-        // have lost it and failed STATE_MISMATCH.
-        val api = FakeSsoApi { Response.success(tokenPair()) }
-        val revived = managerWith(api, session, store = store)
-        revived.complete(state = state, code = "auth-code-1", error = null)
-
-        assertEquals(1, api.exchangeCalls)
-        assertTrue(session.state.value is Session.SignedIn)
-        assertEquals(SsoAuthManager.Outcome.Success, revived.outcome.value)
-    }
-
-    @Test fun `error callback maps to a declined sign-in and does not exchange`() = runTest {
-        val api = FakeSsoApi { Response.success(tokenPair()) }
-        val mgr = managerWith(api, SessionManager(FakeTokenStore()))
-
-        val state = startAndState(mgr)
-        mgr.complete(state = state, code = null, error = "access_denied")
-
-        assertEquals(0, api.exchangeCalls)
-        assertEquals(SsoAuthManager.Outcome.Failed(SsoAuthManager.Failure.DENIED), mgr.outcome.value)
-    }
-
-    @Test fun `401 exchange maps to expired code`() = runTest {
-        val api = FakeSsoApi { error(401) }
-        val session = SessionManager(FakeTokenStore())
-        val mgr = managerWith(api, session)
-
-        val state = startAndState(mgr)
-        mgr.complete(state = state, code = "stale-code", error = null)
-
-        assertEquals(1, api.exchangeCalls)
-        assertTrue(session.state.value is Session.SignedOut)
-        assertEquals(SsoAuthManager.Outcome.Failed(SsoAuthManager.Failure.EXPIRED_CODE), mgr.outcome.value)
-    }
-
-    @Test fun `a second delivery of the same callback finds no pending`() = runTest {
-        val api = FakeSsoApi { Response.success(tokenPair()) }
-        val mgr = managerWith(api, SessionManager(FakeTokenStore()))
-
-        val state = startAndState(mgr)
-        mgr.complete(state = state, code = "auth-code-1", error = null)
-        mgr.complete(state = state, code = "auth-code-1", error = null) // replay
-
-        // Only the first delivery exchanged; the replay fails the state guard.
-        assertEquals(1, api.exchangeCalls)
-        assertEquals(SsoAuthManager.Outcome.Failed(SsoAuthManager.Failure.STATE_MISMATCH), mgr.outcome.value)
-    }
-
-    @Test fun `matchesCallback only accepts the fixed scheme host and path`() {
-        val mgr = managerWith(FakeSsoApi { Response.success(tokenPair()) }, SessionManager(FakeTokenStore()))
-        assertTrue(mgr.matchesCallback("runicgateway", "auth", "/callback"))
-        assertTrue(!mgr.matchesCallback("https", "auth", "/callback"))
-        assertTrue(!mgr.matchesCallback("runicgateway", "auth", "/other"))
-        assertTrue(!mgr.matchesCallback("runicgateway", "evil", "/callback"))
-    }
-
-    // ── App Links (docs/android/APP_LINKS.md) ────────────────────────────────
-
-    @Test fun `matchesAppLinkCallback accepts only https, the app-link path, and the paired host`() {
-        val mgr = managerWith(FakeSsoApi { Response.success(tokenPair()) }, SessionManager(FakeTokenStore()))
-        // Paired to shard.example.com (managerWith default base).
-        assertTrue(mgr.matchesAppLinkCallback("https", "shard.example.com", "/mobile/callback"))
-        // Host-trust: a foreign host is refused even over https + right path.
-        assertTrue(!mgr.matchesAppLinkCallback("https", "evil.example.com", "/mobile/callback"))
-        // Wrong scheme / wrong path.
-        assertTrue(!mgr.matchesAppLinkCallback("http", "shard.example.com", "/mobile/callback"))
-        assertTrue(!mgr.matchesAppLinkCallback("https", "shard.example.com", "/callback"))
-        // Host match is case-insensitive.
-        assertTrue(mgr.matchesAppLinkCallback("https", "SHARD.EXAMPLE.COM", "/mobile/callback"))
-    }
-
-    @Test fun `matchesAppLinkCallback is false before a shard is paired`() {
-        val mgr = managerWith(FakeSsoApi { Response.success(tokenPair()) }, SessionManager(FakeTokenStore()), base = null)
-        assertTrue(!mgr.matchesAppLinkCallback("https", "shard.example.com", "/mobile/callback"))
-    }
-
-    @Test fun `buildStartUrl requests the custom scheme when no app-link host is baked`() {
-        val mgr = managerWith(FakeSsoApi { Response.success(tokenPair()) }, SessionManager(FakeTokenStore()))
-        // Generic build: appLinkHost defaults to BuildConfig.APP_LINK_HOST ("" in tests).
-        val redirect = mgr.buildStartUrl("google")!!.toHttpUrl().queryParameter("redirect_uri")
-        assertEquals(SsoAuthManager.REDIRECT_URI, redirect)
-    }
-
-    @Test fun `buildStartUrl requests the https app-link callback when the baked host matches the paired host`() {
-        val mgr = managerWith(FakeSsoApi { Response.success(tokenPair()) }, SessionManager(FakeTokenStore()))
-        mgr.appLinkHost = "shard.example.com" // white-label build baked this shard's host
-        val redirect = mgr.buildStartUrl("google")!!.toHttpUrl().queryParameter("redirect_uri")
-        assertEquals("https://shard.example.com/mobile/callback", redirect)
-    }
-
-    @Test fun `buildStartUrl falls back to the custom scheme when the baked host does not match the paired shard`() {
-        val mgr = managerWith(FakeSsoApi { Response.success(tokenPair()) }, SessionManager(FakeTokenStore()))
-        mgr.appLinkHost = "other-shard.example.com" // built for a different shard than the paired one
-        val redirect = mgr.buildStartUrl("google")!!.toHttpUrl().queryParameter("redirect_uri")
-        assertEquals(SsoAuthManager.REDIRECT_URI, redirect)
-    }
-}

app/src/test/java/com/runicgateway/app/core/push/NtfyTopicTest.kt

@@ -1,42 +0,0 @@
-/*
- * SPDX-License-Identifier: GPL-3.0-or-later
- */
-package com.runicgateway.app.core.push
-
-import org.junit.Assert.assertEquals
-import org.junit.Assert.assertNotEquals
-import org.junit.Assert.assertNull
-import org.junit.Assert.assertTrue
-import org.junit.Test
-
-/**
- * Tests for the app's own ntfy topic + endpoint URL building (PLAN.md §11, work
- * item 1) — the heart of the embedded-distributor design.
- */
-class NtfyTopicTest {
-
-    @Test fun generatesUnguessableTopicsInTheAllowedCharset() {
-        val a = NtfyTopic.generate()
-        val b = NtfyTopic.generate()
-        assertNotEquals(a, b)
-        assertTrue("prefixed", a.startsWith("up"))
-        assertTrue("length", a.length >= 24)
-        assertTrue("charset", a.all { it.isLetterOrDigit() })
-    }
-
-    @Test fun buildsEndpointAndSseUrls() {
-        assertEquals("https://ntfy.tld/up7", NtfyTopic.endpointUrl("https://ntfy.tld", "up7"))
-        assertEquals("https://ntfy.tld/up7/sse", NtfyTopic.sseUrl("https://ntfy.tld", "up7"))
-    }
-
-    @Test fun toleratesTrailingSlashOnBase() {
-        assertEquals("https://ntfy.tld/up7", NtfyTopic.endpointUrl("https://ntfy.tld/", "up7"))
-    }
-
-    @Test fun nullOrBlankInputsYieldNull() {
-        assertNull(NtfyTopic.endpointUrl(null, "up7"))
-        assertNull(NtfyTopic.endpointUrl("", "up7"))
-        assertNull(NtfyTopic.endpointUrl("https://ntfy.tld", " "))
-        assertNull(NtfyTopic.sseUrl(null, "up7"))
-    }
-}

app/src/test/java/com/runicgateway/app/core/push/PushTickleTest.kt

@@ -1,52 +0,0 @@
-/*
- * SPDX-License-Identifier: GPL-3.0-or-later
- */
-package com.runicgateway.app.core.push
-
-import kotlinx.serialization.json.Json
-import org.junit.Assert.assertEquals
-import org.junit.Assert.assertNull
-import org.junit.Test
-
-/**
- * Parsing tests for the content-free push tickle over ntfy's SSE envelope
- * (PLAN.md §11). A `message` frame yields `{ stream, ref }`; lifecycle frames and
- * malformed bodies are dropped (never thrown, §7).
- */
-class PushTickleTest {
-
-    private val json = Json { ignoreUnknownKeys = true }
-
-    @Test fun parsesMessageFrame() {
-        // ntfy wraps our POSTed body in { event:"message", message:"<our json>" }.
-        val data = """{"id":"x","time":1,"event":"message","topic":"up1","message":"{\"stream\":\"vendor.sale\",\"ref\":\"0x40001\"}"}"""
-        val tickle = parseNtfyTickle(json, data)
-        assertEquals(PushTickle("vendor.sale", "0x40001"), tickle)
-    }
-
-    @Test fun parsesMessageWithoutRef() {
-        val data = """{"event":"message","message":"{\"stream\":\"server.status\"}"}"""
-        val tickle = parseNtfyTickle(json, data)
-        assertEquals("server.status", tickle?.stream)
-        assertNull(tickle?.ref)
-    }
-
-    @Test fun dropsOpenAndKeepaliveFrames() {
-        assertNull(parseNtfyTickle(json, """{"event":"open","topic":"up1"}"""))
-        assertNull(parseNtfyTickle(json, """{"event":"keepalive","topic":"up1"}"""))
-    }
-
-    @Test fun dropsMalformedOrEmpty() {
-        assertNull(parseNtfyTickle(json, ""))
-        assertNull(parseNtfyTickle(json, ": keepalive comment"))
-        assertNull(parseNtfyTickle(json, "not json"))
-        // A message whose inner body isn't our shape → no stream → dropped.
-        assertNull(parseNtfyTickle(json, """{"event":"message","message":"{}"}"""))
-        assertNull(parseNtfyTickle(json, """{"event":"message","message":"garbage"}"""))
-    }
-
-    @Test fun decodeTickleRejectsBlankStream() {
-        assertNull(decodeTickle(json, """{"stream":"","ref":"x"}"""))
-        assertEquals(PushTickle("news.post"), decodeTickle(json, """{"stream":"news.post"}"""))
-    }
-}

app/src/test/java/com/runicgateway/app/core/result/ApiResultExtrasTest.kt

@@ -1,41 +0,0 @@
-/*
- * SPDX-License-Identifier: GPL-3.0-or-later
- */
-package com.runicgateway.app.core.result
-
-import org.junit.Assert.assertEquals
-import org.junit.Assert.assertFalse
-import org.junit.Assert.assertSame
-import org.junit.Assert.assertTrue
-import org.junit.Test
-
-/**
- * The [ApiResult] helpers: [map] transforms an [ApiResult.Ok] and passes the two
- * failure variants through unchanged; [isShardUnavailable] is the 503 "shard down"
- * signal the player screens render as offline.
- */
-class ApiResultExtrasTest {
-
-    @Test fun mapTransformsOkBody() {
-        val mapped = ApiResult.Ok(listOf(1, 2, 3)).map { it.size }
-        assertEquals(ApiResult.Ok(3), mapped)
-    }
-
-    @Test fun mapPassesFailuresThroughUnchanged() {
-        val http: ApiResult<Int> = ApiResult.HttpError(500, "boom")
-        assertSame(http, http.map { it + 1 })
-
-        val cause = RuntimeException("offline")
-        val network: ApiResult<Int> = ApiResult.NetworkError(cause)
-        val out = network.map { it + 1 }
-        assertTrue(out is ApiResult.NetworkError)
-        assertSame(cause, (out as ApiResult.NetworkError).cause)
-    }
-
-    @Test fun isShardUnavailableOnlyForHttp503() {
-        assertTrue(ApiResult.HttpError(503).isShardUnavailable())
-        assertFalse(ApiResult.HttpError(500).isShardUnavailable())
-        assertFalse(ApiResult.Ok(Unit).isShardUnavailable())
-        assertFalse(ApiResult.NetworkError(RuntimeException()).isShardUnavailable())
-    }
-}

app/src/test/java/com/runicgateway/app/core/result/ApiResultTest.kt

@@ -35,20 +35,6 @@ class ApiResultTest {
         assertTrue(result is ApiResult.NetworkError)
     }
 
-    /**
-     * A body the app can't decode (a field whose type doesn't match its DTO) throws a
-     * [SerializationException] out of the Retrofit converter. It must degrade to a
-     * server-side error the UI renders, not escape and crash the app — the guild-board
-     * crash this fixes. `502` folds to [ui.ErrorKind.SERVER] via `toUiState`.
-     */
-    @Test fun serializationExceptionBecomesServerError() = runTest {
-        val result = safeApiCall {
-            throw kotlinx.serialization.SerializationException("Unexpected symbol 'm' at path: \$[0].members")
-        }
-        assertTrue(result is ApiResult.HttpError)
-        assertEquals(502, (result as ApiResult.HttpError).status)
-    }
-
     @Test fun cancellationIsRethrown() = runTest {
         assertThrows(CancellationException::class.java) {
             kotlinx.coroutines.runBlocking {