Fix perpetual sync loop and wrong delete decisions

Three bugs fixed:

1. catchupScan used raw dir.walk() with no filters, causing hidden/excluded
   files to appear as "new" every startup and trigger a catchup sync.
   Fixed by using LocalAccessor.walkFiles(pair) which applies the same
   filters and uses the same mtime source (SAF cursor) as SyncEngine.

2. catchupScan compared localModifiedAt.toEpochMilli() vs File.lastModified()
   (millisecond precision) while SyncEngine uses second precision. Every file
   appeared "modified" after a successful sync. Fixed by using epochSecond.

3. syncDecide() treated !localExists && remoteExists && known==null as
   "user deleted local copy → delete remote" even on files that were never
   synced. Fixed to treat unknown remote files as new (download them), which
   is safe because a genuinely-deleted file will always have a known state
   record from the previous sync.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

.gitea/workflows/release.yml

@@ -0,0 +1,52 @@
+name: Build & Release APK
+
+on:
+  push:
+    tags:
+      - 'v*'
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-java@v4
+        with:
+          java-version: '17'
+          distribution: 'temurin'
+          cache: gradle
+
+      - uses: android-actions/setup-android@v3
+
+      - name: Build debug APK
+        run: |
+          chmod +x gradlew
+          ./gradlew assembleDebug --no-daemon
+
+      - name: Get version name
+        id: ver
+        run: echo "name=$(grep VERSION_NAME version.properties | cut -d= -f2)" >> $GITHUB_OUTPUT
+
+      - name: Rename APK
+        run: |
+          mkdir dist
+          cp app/build/outputs/apk/debug/app-debug.apk \
+             dist/SyncFlow-v${{ steps.ver.outputs.name }}.apk
+
+      - name: Attach APK to release
+        env:
+          TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          TAG: ${{ github.ref_name }}
+          VERSION: ${{ steps.ver.outputs.name }}
+        run: |
+          RELEASE_ID=$(curl -sf \
+            "https://gitea.khodak.me/api/v1/repos/amir/SyncFlow/releases/tags/$TAG" \
+            -H "Authorization: token $TOKEN" \
+            | python3 -c "import sys,json; print(json.load(sys.stdin)['id'])")
+          curl -sf -X POST \
+            "https://gitea.khodak.me/api/v1/repos/amir/SyncFlow/releases/$RELEASE_ID/assets" \
+            -H "Authorization: token $TOKEN" \
+            -F "attachment=@dist/SyncFlow-v${VERSION}.apk"
+          echo "APK uploaded to release $TAG"

app/build.gradle.kts

@@ -13,6 +13,11 @@ val versionProps = Properties().apply {
     load(rootProject.file("version.properties").inputStream())
 }
 
+val localProps = Properties().apply {
+    val f = rootProject.file("local.properties")
+    if (f.exists()) load(f.inputStream())
+}
+
 android {
     namespace = "com.syncflow"
     compileSdk = 34
@@ -31,11 +36,21 @@ android {
         manifestPlaceholders["MSAL_REDIRECT_URI"] = "msauth://com.syncflow/YOUR_BASE64_SIGNATURE"
     }
 
+    signingConfigs {
+        create("release") {
+            storeFile = localProps["KEYSTORE_PATH"]?.toString()?.let { file(it) }
+            storePassword = localProps["KEYSTORE_PASSWORD"]?.toString()
+            keyAlias = localProps["KEY_ALIAS"]?.toString()
+            keyPassword = localProps["KEY_PASSWORD"]?.toString()
+        }
+    }
+
     buildTypes {
         release {
             isMinifyEnabled = true
             isShrinkResources = true
             proguardFiles(getDefaultProguardFile("proguard-android-optimize.txt"), "proguard-rules.pro")
+            signingConfig = signingConfigs.getByName("release")
         }
     }
 

app/proguard-rules.pro

@@ -6,3 +6,5 @@
 -dontwarn org.bouncycastle.**
 -dontwarn org.conscrypt.**
 -dontwarn org.openjsse.**
+-dontwarn com.google.errorprone.annotations.**
+-dontwarn sun.security.x509.X509Key

app/src/main/AndroidManifest.xml

@@ -8,6 +8,7 @@
     <uses-permission android:name="android.permission.MANAGE_EXTERNAL_STORAGE" tools:ignore="ScopedStorage" />
     <uses-permission android:name="android.permission.FOREGROUND_SERVICE" />
     <uses-permission android:name="android.permission.FOREGROUND_SERVICE_DATA_SYNC" />
+    <uses-permission android:name="android.permission.FOREGROUND_SERVICE_SHORT_SERVICE" />
     <uses-permission android:name="android.permission.RECEIVE_BOOT_COMPLETED" />
     <uses-permission android:name="android.permission.POST_NOTIFICATIONS" />
     <uses-permission android:name="android.permission.WAKE_LOCK" />
@@ -65,8 +66,35 @@
             android:exported="true">
             <intent-filter>
                 <action android:name="android.intent.action.BOOT_COMPLETED" />
+                <action android:name="android.intent.action.MY_PACKAGE_REPLACED" />
             </intent-filter>
         </receiver>
 
+        <!-- File watcher for ON_CHANGE sync pairs -->
+        <!-- stopWithTask=false keeps the service alive when the user swipes the app away -->
+        <service
+            android:name=".worker.FileWatchService"
+            android:foregroundServiceType="dataSync|shortService"
+            android:stopWithTask="false"
+            android:exported="false" />
+
+        <!-- Required on API 29+ so WorkManager can start a typed foreground service -->
+        <service
+            android:name="androidx.work.impl.foreground.SystemForegroundService"
+            android:foregroundServiceType="dataSync|shortService"
+            tools:node="merge" />
+
+        <!-- Remove WorkManager's default initializer — app uses on-demand init via Configuration.Provider -->
+        <provider
+            android:name="androidx.startup.InitializationProvider"
+            android:authorities="${applicationId}.androidx-startup"
+            android:exported="false"
+            tools:node="merge">
+            <meta-data
+                android:name="androidx.work.WorkManagerInitializer"
+                android:value="androidx.startup"
+                tools:node="remove" />
+        </provider>
+
     </application>
 </manifest>

app/src/main/kotlin/com/syncflow/MainActivity.kt

@@ -1,23 +1,37 @@
 package com.syncflow
 
+import android.Manifest
+import android.content.pm.PackageManager
 import android.os.Build
 import android.os.Bundle
 import androidx.activity.compose.setContent
 import androidx.activity.enableEdgeToEdge
+import androidx.activity.result.contract.ActivityResultContracts
 import androidx.appcompat.app.AppCompatActivity
 import androidx.biometric.BiometricManager
 import androidx.biometric.BiometricManager.Authenticators.BIOMETRIC_STRONG
+import androidx.biometric.BiometricManager.Authenticators.BIOMETRIC_WEAK
 import androidx.biometric.BiometricManager.Authenticators.DEVICE_CREDENTIAL
 import androidx.biometric.BiometricPrompt
 import androidx.compose.foundation.background
+import androidx.compose.foundation.layout.Arrangement
 import androidx.compose.foundation.layout.Box
+import androidx.compose.foundation.layout.Column
+import androidx.compose.foundation.layout.Spacer
 import androidx.compose.foundation.layout.fillMaxSize
-import androidx.compose.material3.CircularProgressIndicator
+import androidx.compose.foundation.layout.height
+import androidx.compose.foundation.layout.size
+import androidx.compose.material.icons.Icons
+import androidx.compose.material.icons.filled.Lock
+import androidx.compose.material3.Button
+import androidx.compose.material3.Icon
 import androidx.compose.material3.MaterialTheme
 import androidx.compose.material3.Surface
+import androidx.compose.material3.Text
 import androidx.compose.runtime.*
 import androidx.compose.ui.Alignment
 import androidx.compose.ui.Modifier
+import androidx.compose.ui.unit.dp
 import androidx.core.content.ContextCompat
 import androidx.core.splashscreen.SplashScreen.Companion.installSplashScreen
 import androidx.lifecycle.lifecycleScope
@@ -36,77 +50,132 @@ class MainActivity : AppCompatActivity() {
     @Inject lateinit var appPreferences: AppPreferences
 
     private var isLocked by mutableStateOf(false)
+    private var showRetry by mutableStateOf(false)
+
+    private val requestNotificationPermission =
+        registerForActivityResult(ActivityResultContracts.RequestPermission()) { /* proceed regardless */ }
 
     override fun onCreate(savedInstanceState: Bundle?) {
         installSplashScreen()
         super.onCreate(savedInstanceState)
         enableEdgeToEdge()
+        requestNotificationPermissionIfNeeded()
         setContent {
             SyncFlowTheme {
                 Surface(modifier = Modifier.fillMaxSize()) {
                     SyncFlowNavGraph(rememberNavController())
                 }
                 if (isLocked) {
-                    LockOverlay()
-                    LaunchedEffect(Unit) {
-                        showBiometricPrompt(onSuccess = { isLocked = false })
-                    }
+                    LockOverlay(
+                        showRetry = showRetry,
+                        onRetry = { triggerBiometric() },
+                    )
                 }
             }
         }
     }
 
+    override fun onResume() {
+        super.onResume()
+        if (isLocked) triggerBiometric()
+    }
+
     override fun onStop() {
         super.onStop()
         if (isChangingConfigurations) return
         lifecycleScope.launch {
             if (appPreferences.biometricLockEnabled.first() && canAuthenticate()) {
                 isLocked = true
+                showRetry = false
             }
         }
     }
 
-    private fun canAuthenticate(): Boolean {
-        val authenticators = if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.R)
-            BIOMETRIC_STRONG or DEVICE_CREDENTIAL
-        else
-            BIOMETRIC_STRONG
-        return BiometricManager.from(this).canAuthenticate(authenticators) ==
-            BiometricManager.BIOMETRIC_SUCCESS
-    }
-
-    private fun showBiometricPrompt(onSuccess: () -> Unit) {
+    private fun triggerBiometric() {
+        showRetry = false
+        val authenticators = bestAuthenticators()
         val executor = ContextCompat.getMainExecutor(this)
         val prompt = BiometricPrompt(this, executor, object : BiometricPrompt.AuthenticationCallback() {
             override fun onAuthenticationSucceeded(result: BiometricPrompt.AuthenticationResult) {
-                onSuccess()
+                isLocked = false
+                showRetry = false
+            }
+            override fun onAuthenticationError(errorCode: Int, errString: CharSequence) {
+                // Show the Unlock button so the user can tap to retry manually
+                showRetry = true
+            }
+            override fun onAuthenticationFailed() {
+                // Wrong biometric — BiometricPrompt retries automatically
             }
         })
         val promptInfo = if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.R) {
             BiometricPrompt.PromptInfo.Builder()
                 .setTitle("Unlock SyncFlow")
-                .setSubtitle("Confirm your identity to continue")
-                .setAllowedAuthenticators(BIOMETRIC_STRONG or DEVICE_CREDENTIAL)
+                .setSubtitle("Use fingerprint or PIN")
+                .setAllowedAuthenticators(authenticators)
                 .build()
         } else {
             BiometricPrompt.PromptInfo.Builder()
                 .setTitle("Unlock SyncFlow")
-                .setSubtitle("Confirm your identity to continue")
+                .setSubtitle("Use fingerprint")
                 .setNegativeButtonText("Cancel")
                 .build()
         }
         prompt.authenticate(promptInfo)
     }
+
+    private fun bestAuthenticators(): Int {
+        if (Build.VERSION.SDK_INT < Build.VERSION_CODES.R) return BIOMETRIC_STRONG
+        val bm = BiometricManager.from(this)
+        // Prefer strong+credential; fall back to weak+credential so side-sensor phones work
+        return if (bm.canAuthenticate(BIOMETRIC_STRONG or DEVICE_CREDENTIAL) == BiometricManager.BIOMETRIC_SUCCESS)
+            BIOMETRIC_STRONG or DEVICE_CREDENTIAL
+        else
+            BIOMETRIC_WEAK or DEVICE_CREDENTIAL
+    }
+
+    private fun requestNotificationPermissionIfNeeded() {
+        if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.TIRAMISU) {
+            if (ContextCompat.checkSelfPermission(this, Manifest.permission.POST_NOTIFICATIONS)
+                != PackageManager.PERMISSION_GRANTED
+            ) {
+                requestNotificationPermission.launch(Manifest.permission.POST_NOTIFICATIONS)
+            }
+        }
+    }
+
+    private fun canAuthenticate(): Boolean {
+        if (Build.VERSION.SDK_INT < Build.VERSION_CODES.R)
+            return BiometricManager.from(this).canAuthenticate(BIOMETRIC_STRONG) == BiometricManager.BIOMETRIC_SUCCESS
+        val bm = BiometricManager.from(this)
+        return bm.canAuthenticate(BIOMETRIC_STRONG or DEVICE_CREDENTIAL) == BiometricManager.BIOMETRIC_SUCCESS ||
+            bm.canAuthenticate(BIOMETRIC_WEAK or DEVICE_CREDENTIAL) == BiometricManager.BIOMETRIC_SUCCESS
+    }
 }
 
 @Composable
-private fun LockOverlay() {
+private fun LockOverlay(showRetry: Boolean, onRetry: () -> Unit) {
     Box(
         modifier = Modifier
             .fillMaxSize()
             .background(MaterialTheme.colorScheme.background),
         contentAlignment = Alignment.Center,
     ) {
-        CircularProgressIndicator()
+        Column(
+            horizontalAlignment = Alignment.CenterHorizontally,
+            verticalArrangement = Arrangement.spacedBy(12.dp),
+        ) {
+            Icon(Icons.Default.Lock, null, modifier = Modifier.size(56.dp), tint = MaterialTheme.colorScheme.primary)
+            Text("SyncFlow is locked", style = MaterialTheme.typography.titleMedium)
+            if (showRetry) {
+                Button(onClick = onRetry) { Text("Unlock") }
+            } else {
+                Text(
+                    "Use fingerprint or PIN to unlock",
+                    style = MaterialTheme.typography.bodySmall,
+                    color = MaterialTheme.colorScheme.onSurfaceVariant,
+                )
+            }
+        }
     }
 }

app/src/main/kotlin/com/syncflow/SyncFlowApp.kt

@@ -1,9 +1,18 @@
 package com.syncflow
 
 import android.app.Application
+import android.app.NotificationChannel
+import android.app.NotificationManager
+import android.content.Context
 import androidx.hilt.work.HiltWorkerFactory
 import androidx.work.Configuration
+import com.syncflow.data.db.SyncPairDao
+import com.syncflow.domain.model.ScheduleType
+import com.syncflow.worker.FileWatchService
 import dagger.hilt.android.HiltAndroidApp
+import kotlinx.coroutines.CoroutineScope
+import kotlinx.coroutines.Dispatchers
+import kotlinx.coroutines.launch
 import timber.log.Timber
 import javax.inject.Inject
 
@@ -11,10 +20,38 @@ import javax.inject.Inject
 class SyncFlowApp : Application(), Configuration.Provider {
 
     @Inject lateinit var workerFactory: HiltWorkerFactory
+    @Inject lateinit var syncPairDao: SyncPairDao
 
     override fun onCreate() {
         super.onCreate()
         if (BuildConfig.DEBUG) Timber.plant(Timber.DebugTree())
+        createNotificationChannels()
+        // Start file watcher on every app launch for any existing ON_CHANGE pairs
+        CoroutineScope(Dispatchers.IO).launch {
+            val hasOnChange = syncPairDao.getEnabled().any { it.scheduleType == ScheduleType.ON_CHANGE }
+            if (hasOnChange) FileWatchService.start(this@SyncFlowApp)
+        }
+    }
+
+    private fun createNotificationChannels() {
+        val nm = getSystemService(Context.NOTIFICATION_SERVICE) as NotificationManager
+        listOf(
+            NotificationChannel("sync_progress", "Sync progress", NotificationManager.IMPORTANCE_LOW).apply {
+                description = "Shown while a sync is running"
+            },
+            NotificationChannel("sync_complete", "Sync complete", NotificationManager.IMPORTANCE_LOW).apply {
+                description = "Summary after each successful sync"
+            },
+            NotificationChannel("sync_alerts", "Sync errors", NotificationManager.IMPORTANCE_DEFAULT).apply {
+                description = "Alerts for sync failures and conflicts"
+            },
+            NotificationChannel("sync_watching", "File watching", NotificationManager.IMPORTANCE_MIN).apply {
+                description = "Background service watching folders for changes"
+                setShowBadge(false)
+            },
+        ).forEach { channel ->
+            if (nm.getNotificationChannel(channel.id) == null) nm.createNotificationChannel(channel)
+        }
     }
 
     override val workManagerConfiguration: Configuration

app/src/main/kotlin/com/syncflow/data/db/DbConverters.kt

@@ -4,6 +4,6 @@ import androidx.room.TypeConverter
 import java.time.Instant
 
 class DbConverters {
-    @TypeConverter fun fromInstant(v: Instant?): Long? = v?.epochSecond
-    @TypeConverter fun toInstant(v: Long?): Instant? = v?.let { Instant.ofEpochSecond(it) }
+    @TypeConverter fun fromInstant(v: Instant?): Long? = v?.toEpochMilli()
+    @TypeConverter fun toInstant(v: Long?): Instant? = v?.let { Instant.ofEpochMilli(it) }
 }

app/src/main/kotlin/com/syncflow/data/db/SyncDatabase.kt

@@ -3,6 +3,8 @@ package com.syncflow.data.db
 import androidx.room.Database
 import androidx.room.RoomDatabase
 import androidx.room.TypeConverters
+import androidx.room.migration.Migration
+import androidx.sqlite.db.SupportSQLiteDatabase
 import com.syncflow.data.db.entities.*
 
 @Database(
@@ -13,11 +15,21 @@ import com.syncflow.data.db.entities.*
         SyncConflictEntity::class,
         SyncEventEntity::class,
     ],
-    version = 2,
+    version = 3,
     exportSchema = true,
 )
 @TypeConverters(DbConverters::class)
 abstract class SyncDatabase : RoomDatabase() {
+
+    companion object {
+        // Wipe file states: timestamps were stored as epoch-seconds, now epoch-millis.
+        // All previously saved states are wrong so we drop and re-learn on next sync.
+        val MIGRATION_2_3 = object : Migration(2, 3) {
+            override fun migrate(db: SupportSQLiteDatabase) {
+                db.execSQL("DELETE FROM sync_file_states")
+            }
+        }
+    }
     abstract fun cloudAccountDao(): CloudAccountDao
     abstract fun syncPairDao(): SyncPairDao
     abstract fun syncFileStateDao(): SyncFileStateDao

app/src/main/kotlin/com/syncflow/data/db/SyncEventDao.kt

@@ -9,6 +9,9 @@ interface SyncEventDao {
     @Query("SELECT * FROM sync_events WHERE syncPairId = :pairId ORDER BY timestamp DESC LIMIT :limit")
     fun observeRecent(pairId: Long, limit: Int = 200): Flow<List<SyncEventEntity>>
 
+    @Query("SELECT * FROM sync_events ORDER BY timestamp DESC LIMIT :limit")
+    fun observeAll(limit: Int = 500): Flow<List<SyncEventEntity>>
+
     @Insert
     suspend fun insert(entity: SyncEventEntity): Long
 

app/src/main/kotlin/com/syncflow/data/db/SyncFileStateDao.kt

@@ -2,9 +2,13 @@ package com.syncflow.data.db
 
 import androidx.room.*
 import com.syncflow.data.db.entities.SyncFileStateEntity
+import kotlinx.coroutines.flow.Flow
 
 @Dao
 interface SyncFileStateDao {
+    @Query("SELECT * FROM sync_file_states WHERE syncPairId = :pairId ORDER BY relativePath ASC")
+    fun observeForPair(pairId: Long): Flow<List<SyncFileStateEntity>>
+
     @Query("SELECT * FROM sync_file_states WHERE syncPairId = :pairId")
     suspend fun getForPair(pairId: Long): List<SyncFileStateEntity>
 

app/src/main/kotlin/com/syncflow/data/providers/ProviderFactory.kt

@@ -7,19 +7,20 @@ import com.syncflow.data.providers.owncloud.OwnCloudProvider
 import com.syncflow.data.providers.onedrive.OneDriveProvider
 import com.syncflow.data.providers.sftp.SftpProvider
 import com.syncflow.data.providers.webdav.WebDavProvider
+import com.syncflow.data.security.CredentialStore
 import com.syncflow.domain.model.CloudAccount
 import com.syncflow.domain.model.ProviderType
 import javax.inject.Inject
 import javax.inject.Singleton
 
 @Singleton
-class ProviderFactory @Inject constructor() {
+class ProviderFactory @Inject constructor(private val credentialStore: CredentialStore) {
     fun create(account: CloudAccount): CloudProvider = when (account.providerType) {
         ProviderType.GOOGLE_DRIVE -> GoogleDriveProvider(account)
         ProviderType.DROPBOX -> DropboxProvider(account)
         ProviderType.ONEDRIVE -> OneDriveProvider(account)
         ProviderType.WEBDAV -> WebDavProvider(account)
-        ProviderType.SFTP -> SftpProvider(account)
+        ProviderType.SFTP -> SftpProvider(account, credentialStore)
         ProviderType.NEXTCLOUD -> NextcloudProvider(account)
         ProviderType.OWNCLOUD -> OwnCloudProvider(account)
         ProviderType.SFTPGO -> WebDavProvider(account)     // SFTPGo exposes WebDAV

app/src/main/kotlin/com/syncflow/data/providers/dropbox/DropboxProvider.kt

@@ -18,9 +18,9 @@ class DropboxProvider(private val account: CloudAccount) : CloudProvider {
     }
     private val client = OkHttpClient()
 
-    private fun apiReq(url: String, bodyJson: String): Request =
+    private fun apiReq(url: String, argJson: JsonObject): Request =
         Request.Builder().url(url)
-            .post(bodyJson.toRequestBody("application/json".toMediaType()))
+            .post(argJson.toString().toRequestBody("application/json".toMediaType()))
             .header("Authorization", "Bearer $token")
             .build()
 
@@ -33,7 +33,8 @@ class DropboxProvider(private val account: CloudAccount) : CloudProvider {
 
     override suspend fun listFiles(remotePath: String): Result<List<RemoteFile>> = runCatching {
         val path = if (remotePath == "/" || remotePath.isBlank()) "" else remotePath
-        val req = apiReq("https://api.dropboxapi.com/2/files/list_folder", """{"path":"$path","recursive":false}""")
+        val arg = buildJsonObject { put("path", path); put("recursive", false) }
+        val req = apiReq("https://api.dropboxapi.com/2/files/list_folder", arg)
         client.newCall(req).execute().use { resp ->
             val body = resp.body?.string() ?: throw Exception("HTTP ${resp.code}")
             if (!resp.isSuccessful) throw Exception("HTTP ${resp.code}: $body")
@@ -44,11 +45,15 @@ class DropboxProvider(private val account: CloudAccount) : CloudProvider {
 
     override suspend fun uploadFile(localStream: InputStream, remotePath: String, sizeBytes: Long, onProgress: (Long) -> Unit): Result<RemoteFile> = runCatching {
         val bytes = localStream.readBytes()
-        val argHeader = """{"path":"${remotePath.normalizeDropbox()}","mode":"overwrite","autorename":false}"""
+        val arg = buildJsonObject {
+            put("path", remotePath.normalizeDropbox())
+            put("mode", "overwrite")
+            put("autorename", false)
+        }
         val req = Request.Builder().url("https://content.dropboxapi.com/2/files/upload")
             .post(bytes.toRequestBody("application/octet-stream".toMediaType()))
             .header("Authorization", "Bearer $token")
-            .header("Dropbox-API-Arg", argHeader).build()
+            .header("Dropbox-API-Arg", arg.toString()).build()
         client.newCall(req).execute().use { resp ->
             val body = resp.body?.string() ?: throw Exception("HTTP ${resp.code}")
             if (!resp.isSuccessful) throw Exception("HTTP ${resp.code}: $body")
@@ -58,11 +63,11 @@ class DropboxProvider(private val account: CloudAccount) : CloudProvider {
     }
 
     override suspend fun downloadFile(remotePath: String, destination: OutputStream, onProgress: (Long) -> Unit): Result<Unit> = runCatching {
-        val argHeader = """{"path":"${remotePath.normalizeDropbox()}"}"""
+        val arg = buildJsonObject { put("path", remotePath.normalizeDropbox()) }
         val req = Request.Builder().url("https://content.dropboxapi.com/2/files/download")
             .post("".toRequestBody())
             .header("Authorization", "Bearer $token")
-            .header("Dropbox-API-Arg", argHeader).build()
+            .header("Dropbox-API-Arg", arg.toString()).build()
         client.newCall(req).execute().use { resp ->
             if (!resp.isSuccessful) throw Exception("HTTP ${resp.code}")
             var total = 0L
@@ -75,17 +80,20 @@ class DropboxProvider(private val account: CloudAccount) : CloudProvider {
     }
 
     override suspend fun deleteFile(remotePath: String): Result<Unit> = runCatching {
-        val req = apiReq("https://api.dropboxapi.com/2/files/delete_v2", """{"path":"${remotePath.normalizeDropbox()}"}""")
+        val arg = buildJsonObject { put("path", remotePath.normalizeDropbox()) }
+        val req = apiReq("https://api.dropboxapi.com/2/files/delete_v2", arg)
         client.newCall(req).execute().use { resp -> if (!resp.isSuccessful) throw Exception("HTTP ${resp.code}") }
     }
 
     override suspend fun createDirectory(remotePath: String): Result<Unit> = runCatching {
-        val req = apiReq("https://api.dropboxapi.com/2/files/create_folder_v2", """{"path":"${remotePath.normalizeDropbox()}"}""")
+        val arg = buildJsonObject { put("path", remotePath.normalizeDropbox()) }
+        val req = apiReq("https://api.dropboxapi.com/2/files/create_folder_v2", arg)
         client.newCall(req).execute().use { resp -> if (!resp.isSuccessful && resp.code != 409) throw Exception("HTTP ${resp.code}") }
     }
 
     override suspend fun getFileMetadata(remotePath: String): Result<RemoteFile> = runCatching {
-        val req = apiReq("https://api.dropboxapi.com/2/files/get_metadata", """{"path":"${remotePath.normalizeDropbox()}"}""")
+        val arg = buildJsonObject { put("path", remotePath.normalizeDropbox()) }
+        val req = apiReq("https://api.dropboxapi.com/2/files/get_metadata", arg)
         client.newCall(req).execute().use { resp ->
             val body = resp.body?.string() ?: throw Exception("HTTP ${resp.code}")
             Json.parseToJsonElement(body).jsonObject.toRemoteFile()
@@ -93,8 +101,11 @@ class DropboxProvider(private val account: CloudAccount) : CloudProvider {
     }
 
     override suspend fun moveFile(fromPath: String, toPath: String): Result<Unit> = runCatching {
-        val req = apiReq("https://api.dropboxapi.com/2/files/move_v2",
-            """{"from_path":"${fromPath.normalizeDropbox()}","to_path":"${toPath.normalizeDropbox()}"}""")
+        val arg = buildJsonObject {
+            put("from_path", fromPath.normalizeDropbox())
+            put("to_path", toPath.normalizeDropbox())
+        }
+        val req = apiReq("https://api.dropboxapi.com/2/files/move_v2", arg)
         client.newCall(req).execute().use { resp -> if (!resp.isSuccessful) throw Exception("HTTP ${resp.code}") }
     }
 

app/src/main/kotlin/com/syncflow/data/providers/google/GoogleDriveProvider.kt

@@ -44,9 +44,11 @@ class GoogleDriveProvider(private val account: CloudAccount) : CloudProvider {
         val name = remotePath.substringAfterLast('/')
         val parentId = if ('/' in remotePath.dropLast(1)) remotePath.substringBeforeLast('/') else "root"
 
-        // Multipart upload
-        val metaPart = """{"name":"$name","parents":["$parentId"]}"""
-            .toRequestBody("application/json".toMediaType())
+        // Multipart upload — use JSON builder to avoid injection via filenames with special chars
+        val metaPart = buildJsonObject {
+            put("name", name)
+            put("parents", buildJsonArray { add(parentId) })
+        }.toString().toRequestBody("application/json".toMediaType())
         val dataPart = bytes.toRequestBody("application/octet-stream".toMediaType())
         val multipart = MultipartBody.Builder()
             .setType(MultipartBody.FORM)
@@ -86,8 +88,11 @@ class GoogleDriveProvider(private val account: CloudAccount) : CloudProvider {
     override suspend fun createDirectory(remotePath: String): Result<Unit> = runCatching {
         val name = remotePath.substringAfterLast('/')
         val parentId = if ('/' in remotePath.dropLast(1)) remotePath.substringBeforeLast('/') else "root"
-        val body = """{"name":"$name","mimeType":"application/vnd.google-apps.folder","parents":["$parentId"]}"""
-            .toRequestBody("application/json".toMediaType())
+        val body = buildJsonObject {
+            put("name", name)
+            put("mimeType", "application/vnd.google-apps.folder")
+            put("parents", buildJsonArray { add(parentId) })
+        }.toString().toRequestBody("application/json".toMediaType())
         val req = auth(Request.Builder().url("https://www.googleapis.com/drive/v3/files").post(body)).build()
         client.newCall(req).execute().use { resp -> if (!resp.isSuccessful) throw Exception("HTTP ${resp.code}") }
     }
@@ -102,7 +107,8 @@ class GoogleDriveProvider(private val account: CloudAccount) : CloudProvider {
 
     override suspend fun moveFile(fromPath: String, toPath: String): Result<Unit> = runCatching {
         val newName = toPath.substringAfterLast('/')
-        val body = """{"name":"$newName"}""".toRequestBody("application/json".toMediaType())
+        val body = buildJsonObject { put("name", newName) }.toString()
+            .toRequestBody("application/json".toMediaType())
         val req = auth(Request.Builder().url("https://www.googleapis.com/drive/v3/files/$fromPath").patch(body)).build()
         client.newCall(req).execute().use { resp -> if (!resp.isSuccessful) throw Exception("HTTP ${resp.code}") }
     }

app/src/main/kotlin/com/syncflow/data/providers/sftp/SftpProvider.kt

@@ -1,6 +1,7 @@
 package com.syncflow.data.providers.sftp
 
 import com.syncflow.data.providers.CloudProvider
+import com.syncflow.data.security.CredentialStore
 import com.syncflow.domain.model.CloudAccount
 import com.syncflow.domain.model.RemoteFile
 import kotlinx.serialization.json.Json
@@ -8,13 +9,12 @@ import kotlinx.serialization.json.jsonObject
 import kotlinx.serialization.json.jsonPrimitive
 import net.schmizz.sshj.SSHClient
 import net.schmizz.sshj.sftp.SFTPClient
-import net.schmizz.sshj.transport.verification.PromiscuousVerifier
 import net.schmizz.sshj.xfer.InMemorySourceFile
 import java.io.InputStream
 import java.io.OutputStream
 import java.time.Instant
 
-class SftpProvider(private val account: CloudAccount) : CloudProvider {
+class SftpProvider(private val account: CloudAccount, private val credentialStore: CredentialStore) : CloudProvider {
 
     private val creds = Json.parseToJsonElement(account.credentialJson).jsonObject
     private val host = account.serverUrl ?: "localhost"
@@ -25,7 +25,7 @@ class SftpProvider(private val account: CloudAccount) : CloudProvider {
 
     private fun <T> withSftp(block: (SFTPClient) -> T): T {
         val ssh = SSHClient()
-        ssh.addHostKeyVerifier(PromiscuousVerifier()) // TODO: replace with proper key pinning
+        ssh.addHostKeyVerifier(TofuHostKeyVerifier(credentialStore))
         ssh.connect(host, port)
         try {
             if (!privateKey.isNullOrBlank()) {

app/src/main/kotlin/com/syncflow/data/providers/sftp/TofuHostKeyVerifier.kt

@@ -0,0 +1,35 @@
+package com.syncflow.data.providers.sftp
+
+import com.syncflow.data.security.CredentialStore
+import net.schmizz.sshj.transport.verification.HostKeyVerifier
+import java.security.MessageDigest
+import java.security.PublicKey
+
+/**
+ * Trust-On-First-Use SSH host key verifier.
+ *
+ * First connection to a host: fingerprint is stored in EncryptedSharedPreferences and accepted.
+ * Subsequent connections: stored fingerprint must match — mismatch aborts (possible MITM).
+ */
+class TofuHostKeyVerifier(private val credentialStore: CredentialStore) : HostKeyVerifier {
+
+    override fun verify(hostname: String, port: Int, key: PublicKey): Boolean {
+        val fingerprint = sha256Fingerprint(key)
+        val stored = credentialStore.getHostFingerprint(hostname, port)
+        return if (stored == null) {
+            credentialStore.saveHostKey(hostname, port, fingerprint)
+            true
+        } else {
+            stored == fingerprint
+        }
+    }
+
+    // Return empty list so sshj uses server preference order for key exchange.
+    // Our verify() will accept or reject whatever algorithm is negotiated.
+    override fun findExistingAlgorithms(hostname: String, port: Int): List<String> = emptyList()
+
+    private fun sha256Fingerprint(key: PublicKey): String {
+        val digest = MessageDigest.getInstance("SHA-256").digest(key.encoded)
+        return digest.joinToString(":") { "%02x".format(it) }
+    }
+}

app/src/main/kotlin/com/syncflow/data/providers/webdav/WebDavProvider.kt

@@ -1,7 +1,7 @@
 package com.syncflow.data.providers.webdav
 
-import android.util.Log
 import com.syncflow.data.providers.CloudProvider
+import timber.log.Timber
 import com.syncflow.domain.model.CloudAccount
 import com.syncflow.domain.model.RemoteFile
 import kotlinx.coroutines.Dispatchers
@@ -10,6 +10,7 @@ import kotlinx.serialization.json.Json
 import kotlinx.serialization.json.jsonObject
 import kotlinx.serialization.json.jsonPrimitive
 import okhttp3.*
+import okhttp3.HttpUrl.Companion.toHttpUrlOrNull
 import okhttp3.MediaType.Companion.toMediaType
 import okhttp3.RequestBody.Companion.toRequestBody
 import org.xmlpull.v1.XmlPullParser
@@ -38,9 +39,14 @@ open class WebDavProvider(protected val account: CloudAccount) : CloudProvider {
                     .header("Authorization", Credentials.basic(user, pass))
                     .build()
                 val resp = chain.proceed(req)
-                // follow redirect manually for WebDAV methods (OkHttp skips non-GET/HEAD redirects)
+                // Follow redirects for WebDAV methods (OkHttp skips non-GET/HEAD redirects).
+                // Only follow same-host redirects to prevent credential leakage to a different server.
                 if (resp.code in 301..308) {
                     val location = resp.header("Location") ?: return@addInterceptor resp
+                    val redirectHost = location.toHttpUrlOrNull()?.host
+                    if (redirectHost == null || redirectHost != req.url.host) {
+                        return@addInterceptor resp
+                    }
                     resp.close()
                     val redirectReq = req.newBuilder().url(location).build()
                     chain.proceed(redirectReq)
@@ -53,14 +59,13 @@ open class WebDavProvider(protected val account: CloudAccount) : CloudProvider {
         withContext(Dispatchers.IO) {
             val req = Request.Builder().url(baseUrl).method("PROPFIND", PROPFIND_BODY).header("Depth", "0").build()
             client.newCall(req).execute().use { resp ->
-                Log.d("SyncFlow/WebDAV", "testConnection ${resp.code} url=$baseUrl")
+                Timber.d("WebDAV testConnection %d url=%s", resp.code, baseUrl)
                 if (!resp.isSuccessful && resp.code != 207) {
-                    val body = resp.body?.string()?.take(300) ?: ""
-                    throw Exception("HTTP ${resp.code} ${resp.message} — $body")
+                    throw Exception("HTTP ${resp.code} ${resp.message}")
                 }
             }
         }
-    }.onFailure { e -> Log.e("SyncFlow/WebDAV", "testConnection failed: ${e::class.simpleName}: ${e.message}", e.cause) }
+    }.onFailure { e -> Timber.e(e, "WebDAV testConnection failed") }
 
     override suspend fun listFiles(remotePath: String): Result<List<RemoteFile>> = runCatching {
         withContext(Dispatchers.IO) {
@@ -132,7 +137,10 @@ open class WebDavProvider(protected val account: CloudAccount) : CloudProvider {
             val req = Request.Builder().url(url(remotePath)).method("PROPFIND", PROPFIND_BODY).header("Depth", "0").build()
             client.newCall(req).execute().use { resp ->
                 if (resp.code != 207) throw Exception("HTTP ${resp.code}")
-                parsePropfind(resp.body?.string() ?: "", remotePath.substringBeforeLast('/'))
+                // Depth:0 returns exactly the requested resource as the single response entry.
+                // parsePropfind normally drops the first entry (the parent dir) for Depth:1
+                // directory listings, so pass dropFirst=false here.
+                parsePropfind(resp.body?.string() ?: "", remotePath.substringBeforeLast('/'), dropFirst = false)
                     .firstOrNull() ?: throw Exception("File not found")
             }
         }
@@ -153,46 +161,50 @@ open class WebDavProvider(protected val account: CloudAccount) : CloudProvider {
 
     protected fun url(path: String) = "$baseUrl/${path.trimStart('/')}"
 
-    private fun parsePropfind(xml: String, parentPath: String): List<RemoteFile> {
+    private fun parsePropfind(xml: String, parentPath: String, dropFirst: Boolean = true): List<RemoteFile> {
         val results = mutableListOf<RemoteFile>()
-        try {
-            val factory = XmlPullParserFactory.newInstance()
-            factory.isNamespaceAware = true
-            val parser = factory.newPullParser()
-            parser.setInput(xml.reader())
+        val factory = XmlPullParserFactory.newInstance()
+        factory.isNamespaceAware = true
+        val parser = factory.newPullParser()
+        parser.setInput(xml.reader())
 
-            var href = ""; var isCollection = false; var contentLength = 0L
-            var lastModified: Instant = Instant.EPOCH; var etag: String? = null; var contentType: String? = null
-            var inResponse = false; var inProp = false
+        var href = ""; var isCollection = false; var contentLength = 0L
+        var lastModified: Instant = Instant.EPOCH; var etag: String? = null; var contentType: String? = null
+        var inResponse = false; var inProp = false
 
-            var eventType = parser.eventType
-            while (eventType != XmlPullParser.END_DOCUMENT) {
-                val tag = parser.name?.substringAfterLast(':')?.lowercase()
-                when (eventType) {
-                    XmlPullParser.START_TAG -> when (tag) {
-                        "response" -> { inResponse = true; href = ""; isCollection = false; contentLength = 0L; lastModified = Instant.EPOCH; etag = null; contentType = null }
-                        "prop" -> inProp = true
-                        "href" -> if (!inProp) href = parser.nextText().trim()
-                        "collection" -> if (inProp) isCollection = true
-                        "getcontentlength" -> if (inProp) contentLength = parser.nextText().trim().toLongOrNull() ?: 0L
-                        "getlastmodified" -> if (inProp) lastModified = parseHttpDate(parser.nextText().trim())
-                        "getetag" -> if (inProp) etag = parser.nextText().trim().trim('"')
-                        "getcontenttype" -> if (inProp) contentType = parser.nextText().trim()
-                    }
-                    XmlPullParser.END_TAG -> when (tag) {
-                        "prop" -> inProp = false
-                        "response" -> if (inResponse && href.isNotBlank()) {
-                            val name = href.trimEnd('/').substringAfterLast('/')
+        var eventType = parser.eventType
+        while (eventType != XmlPullParser.END_DOCUMENT) {
+            val tag = parser.name?.substringAfterLast(':')?.lowercase()
+            when (eventType) {
+                XmlPullParser.START_TAG -> when (tag) {
+                    "response" -> { inResponse = true; href = ""; isCollection = false; contentLength = 0L; lastModified = Instant.EPOCH; etag = null; contentType = null }
+                    "prop" -> inProp = true
+                    "href" -> if (!inProp) href = parser.nextText().trim()
+                    "collection" -> if (inProp) isCollection = true
+                    "getcontentlength" -> if (inProp) contentLength = parser.nextText().trim().toLongOrNull() ?: 0L
+                    "getlastmodified" -> if (inProp) lastModified = parseHttpDate(parser.nextText().trim())
+                    "getetag" -> if (inProp) etag = parser.nextText().trim().trim('"')
+                    "getcontenttype" -> if (inProp) contentType = parser.nextText().trim()
+                }
+                XmlPullParser.END_TAG -> when (tag) {
+                    "prop" -> inProp = false
+                    "response" -> if (inResponse && href.isNotBlank()) {
+                        val rawName = href.trimEnd('/').substringAfterLast('/')
+                        val name = try { java.net.URLDecoder.decode(rawName, "UTF-8") } catch (_: Exception) { rawName }
+                        // Guard against path-traversal sequences delivered by a malicious server
+                        if (name.contains("..") || name.contains('/') || name.contains('\\')) {
+                            inResponse = false
+                        } else {
                             val relPath = "$parentPath/$name".replace("//", "/")
                             results.add(RemoteFile(relPath, name, isCollection, contentLength, lastModified, etag, contentType))
                             inResponse = false
                         }
                     }
                 }
-                eventType = parser.next()
             }
-        } catch (_: Exception) {}
-        return results.drop(1) // drop the parent folder itself
+            eventType = parser.next()
+        }
+        return if (dropFirst) results.drop(1) else results
     }
 
     private fun parseHttpDate(value: String): Instant = try {

app/src/main/kotlin/com/syncflow/data/security/CredentialStore.kt

@@ -3,7 +3,7 @@ package com.syncflow.data.security
 import android.content.Context
 import android.content.SharedPreferences
 import androidx.security.crypto.EncryptedSharedPreferences
-import androidx.security.crypto.MasterKey
+import androidx.security.crypto.MasterKeys
 import dagger.hilt.android.qualifiers.ApplicationContext
 import javax.inject.Inject
 import javax.inject.Singleton
@@ -12,13 +12,12 @@ import javax.inject.Singleton
 class CredentialStore @Inject constructor(@ApplicationContext private val context: Context) {
 
     private val prefs: SharedPreferences by lazy {
-        val masterKey = MasterKey.Builder(context)
-            .setKeyScheme(MasterKey.KeyScheme.AES256_GCM)
-            .build()
+        @Suppress("DEPRECATION")
+        val masterKeyAlias = MasterKeys.getOrCreate(MasterKeys.AES256_GCM_SPEC)
         EncryptedSharedPreferences.create(
-            context,
             "syncflow_credentials",
-            masterKey,
+            masterKeyAlias,
+            context,
             EncryptedSharedPreferences.PrefKeyEncryptionScheme.AES256_SIV,
             EncryptedSharedPreferences.PrefValueEncryptionScheme.AES256_GCM,
         )
@@ -37,7 +36,7 @@ class CredentialStore @Inject constructor(@ApplicationContext private val contex
         prefs.edit().remove(credKey(accountId)).apply()
     }
 
-    // ── PKCE verifiers (OAuth flow) ───────────────────────────────────────────
+    // ── PKCE verifiers and OAuth state (OAuth flow) ───────────────────────────
 
     fun savePkceVerifier(provider: String, verifier: String) {
         prefs.edit().putString(pkceKey(provider), verifier).apply()
@@ -49,8 +48,18 @@ class CredentialStore @Inject constructor(@ApplicationContext private val contex
         prefs.edit().remove(pkceKey(provider)).apply()
     }
 
+    // ── SFTP host key fingerprints (TOFU) ─────────────────────────────────────
+
+    fun saveHostKey(host: String, port: Int, fingerprint: String) {
+        prefs.edit().putString(hostKey(host, port), fingerprint).apply()
+    }
+
+    fun getHostFingerprint(host: String, port: Int): String? =
+        prefs.getString(hostKey(host, port), null)
+
     // ── Key helpers ───────────────────────────────────────────────────────────
 
     private fun credKey(accountId: Long) = "cred_$accountId"
     private fun pkceKey(provider: String) = "pkce_$provider"
+    private fun hostKey(host: String, port: Int) = "sshhost_${host}_$port"
 }

app/src/main/kotlin/com/syncflow/di/AppModule.kt

@@ -21,9 +21,8 @@ object AppModule {
     @Provides @Singleton
     fun provideDatabase(@ApplicationContext ctx: Context): SyncDatabase =
         Room.databaseBuilder(ctx, SyncDatabase::class.java, "syncflow.db")
-            // Only fall back to destructive migration for very old dev builds (v1).
-            // All future version bumps must include a proper Migration object.
             .fallbackToDestructiveMigrationFrom(1)
+            .addMigrations(SyncDatabase.MIGRATION_2_3)
             .build()
 
     @Provides fun provideCloudAccountDao(db: SyncDatabase): CloudAccountDao = db.cloudAccountDao()

app/src/main/kotlin/com/syncflow/domain/sync/LocalAccessor.kt

@@ -0,0 +1,218 @@
+package com.syncflow.domain.sync
+
+import android.content.ContentResolver
+import android.net.Uri
+import android.provider.DocumentsContract
+import com.syncflow.domain.model.SyncPair
+import java.io.File
+import java.io.InputStream
+import java.io.OutputStream
+
+data class LocalFileInfo(val relativePath: String, val sizeBytes: Long, val lastModifiedMs: Long)
+
+sealed class LocalAccessor {
+
+    abstract fun walkFiles(pair: SyncPair): Map<String, LocalFileInfo>
+    abstract fun openInputStream(relativePath: String): InputStream?
+    abstract fun createOutputStream(relativePath: String): OutputStream?
+    abstract fun delete(relativePath: String): Boolean
+    abstract fun lastModifiedMs(relativePath: String): Long
+
+    // ── java.io.File backend (regular /storage/... paths) ────────────────────
+
+    class JavaFile(private val root: File) : LocalAccessor() {
+
+        override fun walkFiles(pair: SyncPair): Map<String, LocalFileInfo> {
+            if (!root.exists()) return emptyMap()
+            val includeExts = pair.includeExtensions.map { it.lowercase().trimStart('.') }.toSet()
+            val excludeExts = pair.excludeExtensions.map { it.lowercase().trimStart('.') }.toSet()
+            val minBytes = pair.minFileSizeKb * 1024L
+            val maxBytes = if (pair.maxFileSizeKb > 0) pair.maxFileSizeKb * 1024L else Long.MAX_VALUE
+
+            return root.walkTopDown()
+                .onEnter { dir -> pair.recursive || dir == root }
+                .filter { it.isFile }
+                .filter { f -> !pair.skipHiddenFiles || !f.name.startsWith('.') }
+                .filter { f -> pair.excludePatterns.none { pat -> f.name.matches(globToRegex(pat)) } }
+                .filter { f ->
+                    val ext = f.extension.lowercase()
+                    (includeExts.isEmpty() || ext in includeExts) && ext !in excludeExts
+                }
+                .filter { f -> f.length() in minBytes..maxBytes }
+                .associate { f ->
+                    val rel = f.relativeTo(root).path
+                    rel to LocalFileInfo(rel, f.length(), f.lastModified())
+                }
+        }
+
+        override fun openInputStream(relativePath: String): InputStream =
+            File(root, relativePath).inputStream()
+
+        override fun createOutputStream(relativePath: String): OutputStream {
+            val dest = File(root, relativePath)
+            dest.parentFile?.mkdirs()
+            return dest.outputStream()
+        }
+
+        override fun delete(relativePath: String): Boolean = File(root, relativePath).delete()
+
+        override fun lastModifiedMs(relativePath: String): Long = File(root, relativePath).lastModified()
+    }
+
+    // ── SAF backend (content:// tree URIs from Storage Access Framework) ─────
+
+    class Saf(private val treeUri: Uri, private val resolver: ContentResolver) : LocalAccessor() {
+
+        // Populated by walkFiles so openInputStream can skip the re-query for files that
+        // already exist locally (uploads). Root-level files are the common failure case
+        // when findDocUri re-queries: the cache sidesteps the issue entirely.
+        private val docIdCache = mutableMapOf<String, String>()
+
+        override fun walkFiles(pair: SyncPair): Map<String, LocalFileInfo> {
+            docIdCache.clear()
+            val rootDocId = DocumentsContract.getTreeDocumentId(treeUri)
+            val childrenUri = DocumentsContract.buildChildDocumentsUriUsingTree(treeUri, rootDocId)
+            return cursorWalk(childrenUri, "", pair)
+        }
+
+        private fun cursorWalk(childrenUri: Uri, base: String, pair: SyncPair): Map<String, LocalFileInfo> {
+            val result = mutableMapOf<String, LocalFileInfo>()
+            val includeExts = pair.includeExtensions.map { it.lowercase().trimStart('.') }.toSet()
+            val excludeExts = pair.excludeExtensions.map { it.lowercase().trimStart('.') }.toSet()
+            val minBytes = pair.minFileSizeKb * 1024L
+            val maxBytes = if (pair.maxFileSizeKb > 0) pair.maxFileSizeKb * 1024L else Long.MAX_VALUE
+
+            val cursor = resolver.query(
+                childrenUri,
+                arrayOf(
+                    DocumentsContract.Document.COLUMN_DOCUMENT_ID,
+                    DocumentsContract.Document.COLUMN_DISPLAY_NAME,
+                    DocumentsContract.Document.COLUMN_MIME_TYPE,
+                    DocumentsContract.Document.COLUMN_SIZE,
+                    DocumentsContract.Document.COLUMN_LAST_MODIFIED,
+                ),
+                null, null, null,
+            ) ?: return result
+
+            cursor.use {
+                while (it.moveToNext()) {
+                    val docId = it.getString(0) ?: continue
+                    val name = it.getString(1) ?: continue
+                    val mime = it.getString(2) ?: continue
+                    val size = it.getLong(3)
+                    val modified = it.getLong(4)
+                    val rel = if (base.isEmpty()) name else "$base/$name"
+
+                    if (mime == DocumentsContract.Document.MIME_TYPE_DIR) {
+                        if (pair.recursive) {
+                            val subUri = DocumentsContract.buildChildDocumentsUriUsingTree(treeUri, docId)
+                            result.putAll(cursorWalk(subUri, rel, pair))
+                        }
+                    } else {
+                        if (pair.skipHiddenFiles && name.startsWith('.')) continue
+                        if (pair.excludePatterns.any { pat -> name.matches(globToRegex(pat)) }) continue
+                        val ext = name.substringAfterLast('.', "").lowercase()
+                        if (includeExts.isNotEmpty() && ext !in includeExts) continue
+                        if (ext in excludeExts) continue
+                        if (size !in minBytes..maxBytes) continue
+                        result[rel] = LocalFileInfo(rel, size, modified)
+                        docIdCache[rel] = docId
+                    }
+                }
+            }
+            return result
+        }
+
+        override fun openInputStream(relativePath: String): InputStream? {
+            val docUri = docIdCache[relativePath]
+                ?.let { DocumentsContract.buildDocumentUriUsingTree(treeUri, it) }
+                ?: findDocUri(relativePath)
+                ?: return null
+            return resolver.openInputStream(docUri)
+        }
+
+        override fun createOutputStream(relativePath: String): OutputStream? {
+            val parts = relativePath.replace('\\', '/').split('/')
+            var currentId = DocumentsContract.getTreeDocumentId(treeUri)
+
+            for (i in 0 until parts.size - 1) {
+                val childrenUri = DocumentsContract.buildChildDocumentsUriUsingTree(treeUri, currentId)
+                currentId = findChildId(childrenUri, parts[i]) ?: run {
+                    val parentUri = DocumentsContract.buildDocumentUriUsingTree(treeUri, currentId)
+                    val newDir = DocumentsContract.createDocument(
+                        resolver, parentUri, DocumentsContract.Document.MIME_TYPE_DIR, parts[i]
+                    ) ?: return null
+                    DocumentsContract.getDocumentId(newDir)
+                }
+            }
+
+            val fileName = parts.last()
+            val childrenUri = DocumentsContract.buildChildDocumentsUriUsingTree(treeUri, currentId)
+            val parentUri = DocumentsContract.buildDocumentUriUsingTree(treeUri, currentId)
+
+            // Delete existing to allow overwrite
+            findChildId(childrenUri, fileName)?.let { existingId ->
+                DocumentsContract.deleteDocument(
+                    resolver,
+                    DocumentsContract.buildDocumentUriUsingTree(treeUri, existingId)
+                )
+            }
+
+            val newUri = DocumentsContract.createDocument(
+                resolver, parentUri, "application/octet-stream", fileName
+            ) ?: return null
+            return resolver.openOutputStream(newUri)
+        }
+
+        override fun delete(relativePath: String): Boolean {
+            val docUri = docIdCache[relativePath]
+                ?.let { DocumentsContract.buildDocumentUriUsingTree(treeUri, it) }
+                ?: findDocUri(relativePath)
+                ?: return false
+            return try {
+                DocumentsContract.deleteDocument(resolver, docUri)
+            } catch (e: Exception) {
+                false
+            }
+        }
+
+        override fun lastModifiedMs(relativePath: String): Long {
+            val docUri = findDocUri(relativePath) ?: return 0L
+            val cursor = resolver.query(
+                docUri,
+                arrayOf(DocumentsContract.Document.COLUMN_LAST_MODIFIED),
+                null, null, null,
+            ) ?: return 0L
+            return cursor.use { if (it.moveToFirst()) it.getLong(0) else 0L }
+        }
+
+        private fun findDocUri(relativePath: String): Uri? {
+            var currentId = DocumentsContract.getTreeDocumentId(treeUri)
+            for (part in relativePath.replace('\\', '/').split('/')) {
+                val childrenUri = DocumentsContract.buildChildDocumentsUriUsingTree(treeUri, currentId)
+                currentId = findChildId(childrenUri, part) ?: return null
+            }
+            return DocumentsContract.buildDocumentUriUsingTree(treeUri, currentId)
+        }
+
+        private fun findChildId(childrenUri: Uri, name: String): String? {
+            val cursor = resolver.query(
+                childrenUri,
+                arrayOf(
+                    DocumentsContract.Document.COLUMN_DOCUMENT_ID,
+                    DocumentsContract.Document.COLUMN_DISPLAY_NAME,
+                ),
+                null, null, null,
+            ) ?: return null
+            return cursor.use {
+                while (it.moveToNext()) {
+                    if (it.getString(1) == name) return@use it.getString(0)
+                }
+                null
+            }
+        }
+    }
+}
+
+internal fun globToRegex(pat: String): Regex =
+    Regex(pat.replace(".", "\\.").replace("*", ".*").replace("?", "."), RegexOption.IGNORE_CASE)

app/src/main/kotlin/com/syncflow/domain/sync/SyncEngine.kt

@@ -1,5 +1,7 @@
 package com.syncflow.domain.sync
 
+import android.content.Context
+import android.net.Uri
 import com.syncflow.data.db.SyncConflictDao
 import com.syncflow.data.db.SyncEventDao
 import com.syncflow.data.db.SyncFileStateDao
@@ -15,12 +17,12 @@ import com.syncflow.domain.model.SyncDirection
 import com.syncflow.domain.model.SyncEventType
 import com.syncflow.domain.model.SyncPair
 import com.syncflow.domain.model.SyncStatus
+import dagger.hilt.android.qualifiers.ApplicationContext
 import kotlinx.coroutines.*
 import kotlinx.coroutines.sync.Semaphore
 import kotlinx.coroutines.sync.withPermit
 import timber.log.Timber
 import java.io.File
-import java.security.MessageDigest
 import java.time.Instant
 import javax.inject.Inject
 
@@ -29,6 +31,7 @@ class SyncEngine @Inject constructor(
     private val fileStateDao: SyncFileStateDao,
     private val conflictDao: SyncConflictDao,
     private val eventDao: SyncEventDao,
+    @ApplicationContext private val context: Context,
 ) {
     suspend fun sync(pair: SyncPair, provider: CloudProvider): SyncResult {
         syncPairDao.updateStatus(pair.id, SyncStatus.SYNCING)
@@ -43,7 +46,7 @@ class SyncEngine @Inject constructor(
                 else -> SyncStatus.SUCCESS
             }
             syncPairDao.updateSyncResult(pair.id, Instant.now(), finalStatus, result.conflicts)
-            logEvent(pair.id, SyncEventType.SYNC_COMPLETED, null, "↑${result.uploaded} ↓${result.downloaded} ✗${result.failedFiles}", result.bytesTransferred)
+            logEvent(pair.id, SyncEventType.SYNC_COMPLETED, null, "↑${result.uploaded} ↓${result.downloaded} ✕${result.deleted} ✗${result.failedFiles}", result.bytesTransferred)
             result
         } catch (e: Exception) {
             Timber.e(e, "Sync failed for pair ${pair.id}")
@@ -53,183 +56,184 @@ class SyncEngine @Inject constructor(
         }
     }
 
-    private suspend fun performSync(pair: SyncPair, provider: CloudProvider): SyncResult {
-        val localRoot = File(pair.localPath)
-        val knownStates = fileStateDao.getForPair(pair.id).associateBy { it.relativePath }
-        val remoteFiles = provider.listFiles(pair.remotePath).getOrThrow().associateBy { it.path.removePrefix(pair.remotePath).trimStart('/') }
-        val localFiles = localRoot.walkFiles(pair)
+    private fun makeAccessor(localPath: String): LocalAccessor =
+        if (localPath.startsWith("content://"))
+            LocalAccessor.Saf(Uri.parse(localPath), context.contentResolver)
+        else
+            LocalAccessor.JavaFile(File(localPath))
 
-        var uploaded = 0; var downloaded = 0; var deleted = 0; var skipped = 0; var failed = 0; var conflicts = 0
-        var bytesTransferred = 0L
-        val newStates = mutableListOf<SyncFileStateEntity>()
+    private suspend fun performSync(
+        pair: SyncPair,
+        provider: CloudProvider,
+        isRetry: Boolean = false,
+    ): SyncResult {
+        val accessor = makeAccessor(pair.localPath)
+        var knownStates = fileStateDao.getForPair(pair.id).associateBy { it.relativePath }
+        val remoteFiles = provider.listFiles(pair.remotePath).getOrThrow()
+            .associateBy { it.path.removePrefix(pair.remotePath).trimStart('/') }
+        val localFiles = accessor.walkFiles(pair)
+
+        // Self-healing: if every known-state path is absent from the current local scan but
+        // the local folder does have files, the localPath was changed without clearing state.
+        // The stale records would cause every old file to look like "DELETE_REMOTE" and every
+        // new file to re-upload indefinitely. Wipe and retry once as a fresh initial sync.
+        if (!isRetry && knownStates.isNotEmpty() && localFiles.isNotEmpty() &&
+            knownStates.keys.none { it in localFiles }) {
+            Timber.w("SyncEngine: stale folder states detected for pair ${pair.id} — resetting")
+            fileStateDao.deleteForPair(pair.id)
+            return performSync(pair, provider, isRetry = true)
+        }
 
         val allPaths = (localFiles.keys + remoteFiles.keys + knownStates.keys).toSet()
-
-        // Fan out with bounded parallelism
+        val hasPriorSyncState = knownStates.isNotEmpty()
         val semaphore = Semaphore(4)
-        coroutineScope {
+
+        // Each async block returns its outcome; no shared mutable state across coroutines.
+        data class FileOutcome(
+            val uploaded: Int = 0, val downloaded: Int = 0, val deleted: Int = 0,
+            val skipped: Int = 0, val failed: Int = 0, val conflicts: Int = 0,
+            val bytesTransferred: Long = 0L,
+            val newState: SyncFileStateEntity? = null,
+        )
+
+        val outcomes: List<FileOutcome> = coroutineScope {
             allPaths.map { rel ->
                 async {
                     semaphore.withPermit {
                         val local = localFiles[rel]
                         val remote = remoteFiles[rel]
                         val known = knownStates[rel]
-                        val decision = decide(pair.syncDirection, pair.conflictStrategy, pair.deleteBehavior, local, remote, known)
+                        val decision = syncDecide(pair.syncDirection, pair.conflictStrategy, pair.deleteBehavior, local, remote, known, hasPriorSyncState)
 
                         when (decision) {
                             SyncDecision.UPLOAD -> {
-                                val file = File(localRoot, rel)
+                                var uploadedRemoteFile: RemoteFile? = null
                                 val bytes = runCatching {
-                                    file.inputStream().use { stream ->
-                                        provider.uploadFile(stream, "${pair.remotePath}/$rel", file.length()) { }
+                                    ensureRemoteDirs(provider, pair.remotePath, rel)
+                                    accessor.openInputStream(rel)?.use { stream ->
+                                        uploadedRemoteFile = provider.uploadFile(stream, "${pair.remotePath}/$rel", local!!.sizeBytes) { }.getOrThrow()
                                     }
-                                    file.length()
+                                    local!!.sizeBytes
                                 }.getOrElse { e ->
                                     Timber.e(e, "Upload failed: $rel")
-                                    failed++
                                     logEvent(pair.id, SyncEventType.FILE_SKIPPED, rel, e.message, 0)
-                                    return@withPermit
+                                    return@withPermit FileOutcome(failed = 1)
                                 }
-                                uploaded++
-                                bytesTransferred += bytes
-                                newStates += buildState(pair.id, rel, file, remote)
                                 logEvent(pair.id, SyncEventType.FILE_UPLOADED, rel, null, bytes)
+                                FileOutcome(uploaded = 1, bytesTransferred = bytes,
+                                    newState = buildState(pair.id, rel, local!!, remoteAfterTransfer = uploadedRemoteFile))
                             }
                             SyncDecision.DOWNLOAD -> {
-                                val dest = File(localRoot, rel).also { it.parentFile?.mkdirs() }
                                 val bytes = runCatching {
-                                    dest.outputStream().use { stream ->
+                                    accessor.createOutputStream(rel)?.use { stream ->
                                         provider.downloadFile("${pair.remotePath}/$rel", stream) { }
                                     }
                                     remote!!.sizeBytes
                                 }.getOrElse { e ->
                                     Timber.e(e, "Download failed: $rel")
-                                    failed++
                                     logEvent(pair.id, SyncEventType.FILE_SKIPPED, rel, e.message, 0)
-                                    return@withPermit
+                                    return@withPermit FileOutcome(failed = 1)
                                 }
-                                downloaded++
-                                bytesTransferred += bytes
-                                newStates += buildState(pair.id, rel, dest, remote)
+                                // Read the actual local mtime written by the OS/SAF after download.
+                                val localMtime = runCatching { accessor.lastModifiedMs(rel) }
+                                    .getOrDefault(System.currentTimeMillis()).takeIf { it > 0L }
+                                    ?: System.currentTimeMillis()
                                 logEvent(pair.id, SyncEventType.FILE_DOWNLOADED, rel, null, bytes)
+                                FileOutcome(downloaded = 1, bytesTransferred = bytes,
+                                    newState = buildState(pair.id, rel,
+                                        LocalFileInfo(rel, remote!!.sizeBytes, localMtime),
+                                        remoteAfterTransfer = remote,
+                                        storeLocalMtime = false))
                             }
                             SyncDecision.DELETE_LOCAL -> {
-                                File(localRoot, rel).delete()
+                                val deleted = accessor.delete(rel)
+                                if (!deleted) Timber.w("SyncEngine: DELETE_LOCAL failed (silent) for $rel")
                                 fileStateDao.delete(pair.id, rel)
-                                deleted++
                                 logEvent(pair.id, SyncEventType.FILE_DELETED, rel, "local", 0)
+                                FileOutcome(deleted = 1)
                             }
                             SyncDecision.DELETE_REMOTE -> {
-                                provider.deleteFile("${pair.remotePath}/$rel")
+                                runCatching { provider.deleteFile("${pair.remotePath}/$rel") }
+                                    .onFailure { e -> Timber.e(e, "SyncEngine: DELETE_REMOTE failed for $rel") }
                                 fileStateDao.delete(pair.id, rel)
-                                deleted++
                                 logEvent(pair.id, SyncEventType.FILE_DELETED, rel, "remote", 0)
+                                FileOutcome(deleted = 1)
                             }
                             SyncDecision.CONFLICT -> {
-                                conflicts++
                                 conflictDao.insert(SyncConflictEntity(
                                     syncPairId = pair.id,
                                     relativePath = rel,
-                                    localModifiedAt = local?.lastModified()?.let { Instant.ofEpochMilli(it) } ?: Instant.EPOCH,
-                                    localSizeBytes = local?.length() ?: 0L,
+                                    localModifiedAt = local?.lastModifiedMs?.let { Instant.ofEpochMilli(it) } ?: Instant.EPOCH,
+                                    localSizeBytes = local?.sizeBytes ?: 0L,
                                     remoteModifiedAt = remote?.modifiedAt ?: Instant.EPOCH,
                                     remoteSizeBytes = remote?.sizeBytes ?: 0L,
                                     resolution = null,
                                     detectedAt = Instant.now(),
                                 ))
                                 logEvent(pair.id, SyncEventType.CONFLICT_DETECTED, rel, null, 0)
+                                FileOutcome(conflicts = 1)
+                            }
+                            SyncDecision.SKIP -> {
+                                // Save state whenever both sides are present and state is absent or
+                                // incomplete (post-upload null metadata). Without a baseline record,
+                                // a subsequent local deletion would look like an unseen remote file
+                                // and be re-downloaded instead of triggering DELETE_REMOTE.
+                                val saveState = local != null && remote != null && (
+                                    known == null ||
+                                    known.remoteModifiedAt == null || known.localModifiedAt == null
+                                )
+                                if (saveState) {
+                                    FileOutcome(skipped = 1, newState = buildState(pair.id, rel, local, remoteAfterTransfer = remote))
+                                } else {
+                                    FileOutcome(skipped = 1)
+                                }
                             }
-                            SyncDecision.SKIP -> skipped++
                         }
                     }
                 }
             }.awaitAll()
         }
 
-        fileStateDao.upsertAll(newStates)
-        return SyncResult(uploaded, downloaded, deleted, skipped, failed, conflicts, bytesTransferred)
+        fileStateDao.upsertAll(outcomes.mapNotNull { it.newState })
+        return SyncResult(
+            uploaded = outcomes.sumOf { it.uploaded },
+            downloaded = outcomes.sumOf { it.downloaded },
+            deleted = outcomes.sumOf { it.deleted },
+            skipped = outcomes.sumOf { it.skipped },
+            failedFiles = outcomes.sumOf { it.failed },
+            conflicts = outcomes.sumOf { it.conflicts },
+            bytesTransferred = outcomes.sumOf { it.bytesTransferred },
+        )
     }
 
-    private fun decide(
-        direction: SyncDirection,
-        conflictStrategy: ConflictStrategy,
-        deleteBehavior: DeleteBehavior,
-        local: File?,
-        remote: RemoteFile?,
-        known: SyncFileStateEntity?,
-    ): SyncDecision {
-        val localExists = local?.exists() == true
-        val remoteExists = remote != null
-
-        val localChanged = known == null || (localExists && local!!.lastModified() != known.localModifiedAt?.toEpochMilli())
-        val remoteChanged = known == null || (remoteExists && remote!!.etag != known.remoteEtag && remote.modifiedAt != known.remoteModifiedAt)
-
-        return when {
-            !localExists && !remoteExists -> SyncDecision.SKIP
-
-            // File only exists locally
-            localExists && !remoteExists -> when {
-                known == null -> when (direction) {
-                    SyncDirection.UPLOAD_ONLY, SyncDirection.TWO_WAY -> SyncDecision.UPLOAD
-                    else -> SyncDecision.SKIP
-                }
-                // Remote was deleted — respect deleteBehavior
-                else -> when {
-                    deleteBehavior == DeleteBehavior.KEEP -> SyncDecision.SKIP
-                    direction == SyncDirection.DOWNLOAD_ONLY || direction == SyncDirection.TWO_WAY -> SyncDecision.DELETE_LOCAL
-                    else -> SyncDecision.SKIP
-                }
+    private suspend fun ensureRemoteDirs(provider: CloudProvider, remotePairPath: String, rel: String) {
+        val parts = rel.replace('\\', '/').split('/')
+        var currentPath = remotePairPath
+        for (part in parts.dropLast(1)) {
+            currentPath = "$currentPath/$part"
+            provider.createDirectory(currentPath).onFailure { e ->
+                Timber.w("MKCOL $currentPath: ${e.message}")
             }
-
-            // File only exists remotely
-            !localExists && remoteExists -> when {
-                known == null -> when (direction) {
-                    SyncDirection.DOWNLOAD_ONLY, SyncDirection.TWO_WAY -> SyncDecision.DOWNLOAD
-                    else -> SyncDecision.SKIP
-                }
-                // Local was deleted — respect deleteBehavior
-                else -> when {
-                    deleteBehavior == DeleteBehavior.KEEP -> SyncDecision.SKIP
-                    direction == SyncDirection.UPLOAD_ONLY || direction == SyncDirection.TWO_WAY -> SyncDecision.DELETE_REMOTE
-                    else -> SyncDecision.SKIP
-                }
-            }
-
-            // Both changed — conflict
-            localChanged && remoteChanged -> when (direction) {
-                SyncDirection.UPLOAD_ONLY -> SyncDecision.UPLOAD
-                SyncDirection.DOWNLOAD_ONLY -> SyncDecision.DOWNLOAD
-                SyncDirection.TWO_WAY -> when (conflictStrategy) {
-                    ConflictStrategy.KEEP_LOCAL -> SyncDecision.UPLOAD
-                    ConflictStrategy.KEEP_REMOTE -> SyncDecision.DOWNLOAD
-                    ConflictStrategy.KEEP_NEWEST -> if ((local?.lastModified() ?: 0L) >= (remote?.modifiedAt?.toEpochMilli() ?: 0L)) SyncDecision.UPLOAD else SyncDecision.DOWNLOAD
-                    ConflictStrategy.KEEP_LARGEST -> if ((local?.length() ?: 0L) >= (remote?.sizeBytes ?: 0L)) SyncDecision.UPLOAD else SyncDecision.DOWNLOAD
-                    ConflictStrategy.KEEP_BOTH -> SyncDecision.CONFLICT  // engine keeps both via rename
-                    ConflictStrategy.ASK -> SyncDecision.CONFLICT
-                }
-            }
-
-            localChanged -> when (direction) {
-                SyncDirection.UPLOAD_ONLY, SyncDirection.TWO_WAY -> SyncDecision.UPLOAD
-                else -> SyncDecision.SKIP
-            }
-            remoteChanged -> when (direction) {
-                SyncDirection.DOWNLOAD_ONLY, SyncDirection.TWO_WAY -> SyncDecision.DOWNLOAD
-                else -> SyncDecision.SKIP
-            }
-            else -> SyncDecision.SKIP
         }
     }
 
-    private fun buildState(pairId: Long, rel: String, local: File, remote: RemoteFile?) = SyncFileStateEntity(
+    private fun buildState(
+        pairId: Long,
+        rel: String,
+        local: LocalFileInfo?,
+        remoteAfterTransfer: RemoteFile?,
+        storeLocalMtime: Boolean = true,
+    ) = SyncFileStateEntity(
         syncPairId = pairId,
         relativePath = rel,
-        localModifiedAt = if (local.exists()) Instant.ofEpochMilli(local.lastModified()) else null,
-        localSizeBytes = local.length(),
+        // When storeLocalMtime=false, leave localModifiedAt null so the SKIP reconciliation
+        // pass on the next sync reads it from the walkFiles cursor (avoids SAF stale-mtime loops).
+        localModifiedAt = if (storeLocalMtime) local?.lastModifiedMs?.let { Instant.ofEpochMilli(it) } else null,
+        localSizeBytes = local?.sizeBytes ?: 0L,
         localHash = null,
-        remoteModifiedAt = remote?.modifiedAt,
-        remoteSizeBytes = remote?.sizeBytes ?: 0L,
-        remoteEtag = remote?.etag,
+        remoteModifiedAt = remoteAfterTransfer?.modifiedAt,
+        remoteSizeBytes = remoteAfterTransfer?.sizeBytes ?: 0L,
+        remoteEtag = remoteAfterTransfer?.etag,
         lastSyncedAt = Instant.now(),
         syncedHash = null,
     )
@@ -237,31 +241,90 @@ class SyncEngine @Inject constructor(
     private suspend fun logEvent(pairId: Long, type: SyncEventType, file: String?, msg: String?, bytes: Long) {
         eventDao.insert(SyncEventEntity(syncPairId = pairId, timestamp = Instant.now(), eventType = type, filePath = file, message = msg, bytesTransferred = bytes))
     }
+}
 
-    private fun File.walkFiles(pair: SyncPair): Map<String, File> {
-        if (!exists()) return emptyMap()
-        val includeExts = pair.includeExtensions.map { it.lowercase().trimStart('.') }.toSet()
-        val excludeExts = pair.excludeExtensions.map { it.lowercase().trimStart('.') }.toSet()
-        val minBytes = pair.minFileSizeKb * 1024
-        val maxBytes = if (pair.maxFileSizeKb > 0) pair.maxFileSizeKb * 1024 else Long.MAX_VALUE
+// Top-level so unit tests can call it directly without instantiating SyncEngine.
+internal fun syncDecide(
+    direction: SyncDirection,
+    conflictStrategy: ConflictStrategy,
+    deleteBehavior: DeleteBehavior,
+    local: LocalFileInfo?,
+    remote: RemoteFile?,
+    known: SyncFileStateEntity?,
+    hasPriorSyncState: Boolean = false,
+): SyncDecision {
+    val localExists = local != null
+    val remoteExists = remote != null
 
-        return walkTopDown()
-            .onEnter { dir ->
-                pair.recursive || dir == this
+    // Treat null known timestamps as "not yet recorded" — don't treat as changed.
+    // The SKIP reconciliation pass will fill them in on the next sync.
+    // Use second-precision for both sides: FAT32 has 2-second mtime resolution, WebDAV
+    // RFC-1123 has 1-second resolution, so millisecond comparison causes phantom "changed"
+    // detections and rewrite loops after a fresh download/upload.
+    val localChanged = known == null ||
+        (localExists && known.localModifiedAt != null &&
+            local!!.lastModifiedMs / 1000 != known.localModifiedAt.epochSecond)
+    val remoteChanged = known == null ||
+        (remoteExists && known.remoteModifiedAt != null &&
+            (remote!!.etag != known.remoteEtag ||
+             remote.modifiedAt.epochSecond != known.remoteModifiedAt.epochSecond))
+
+    return when {
+        !localExists && !remoteExists -> SyncDecision.SKIP
+
+        localExists && !remoteExists -> when {
+            known == null -> when (direction) {
+                SyncDirection.UPLOAD_ONLY, SyncDirection.TWO_WAY -> SyncDecision.UPLOAD
+                else -> SyncDecision.SKIP
             }
-            .filter { it.isFile }
-            .filter { f -> !pair.skipHiddenFiles || !f.name.startsWith('.') }
-            .filter { f -> pair.excludePatterns.none { pat -> f.name.matches(pat.toGlob()) } }
-            .filter { f ->
-                val ext = f.extension.lowercase()
-                (includeExts.isEmpty() || ext in includeExts) && ext !in excludeExts
+            else -> when {
+                deleteBehavior == DeleteBehavior.KEEP -> SyncDecision.SKIP
+                direction == SyncDirection.DOWNLOAD_ONLY || direction == SyncDirection.TWO_WAY -> SyncDecision.DELETE_LOCAL
+                else -> SyncDecision.SKIP
             }
-            .filter { f -> f.length() >= minBytes && f.length() <= maxBytes }
-            .associate { f -> f.relativeTo(this).path to f }
+        }
+
+        !localExists && remoteExists -> when {
+            known == null -> {
+                // No state record: could be a new remote file OR a file whose state was lost.
+                // Downloading is always safer than deleting — if the user deleted the local
+                // copy intentionally, the state record will still exist (known != null) and
+                // the else-branch below correctly deletes the remote copy.
+                when (direction) {
+                    SyncDirection.DOWNLOAD_ONLY, SyncDirection.TWO_WAY -> SyncDecision.DOWNLOAD
+                    else -> SyncDecision.SKIP
+                }
+            }
+            else -> when {
+                deleteBehavior == DeleteBehavior.KEEP -> SyncDecision.SKIP
+                direction == SyncDirection.UPLOAD_ONLY || direction == SyncDirection.TWO_WAY -> SyncDecision.DELETE_REMOTE
+                else -> SyncDecision.SKIP
+            }
+        }
+
+        localChanged && remoteChanged -> when (direction) {
+            SyncDirection.UPLOAD_ONLY -> SyncDecision.UPLOAD
+            SyncDirection.DOWNLOAD_ONLY -> SyncDecision.DOWNLOAD
+            SyncDirection.TWO_WAY -> when (conflictStrategy) {
+                ConflictStrategy.KEEP_LOCAL -> SyncDecision.UPLOAD
+                ConflictStrategy.KEEP_REMOTE -> SyncDecision.DOWNLOAD
+                ConflictStrategy.KEEP_NEWEST -> if ((local?.lastModifiedMs ?: 0L) >= (remote?.modifiedAt?.toEpochMilli() ?: 0L)) SyncDecision.UPLOAD else SyncDecision.DOWNLOAD
+                ConflictStrategy.KEEP_LARGEST -> if ((local?.sizeBytes ?: 0L) >= (remote?.sizeBytes ?: 0L)) SyncDecision.UPLOAD else SyncDecision.DOWNLOAD
+                ConflictStrategy.KEEP_BOTH -> SyncDecision.CONFLICT
+                ConflictStrategy.ASK -> SyncDecision.CONFLICT
+            }
+        }
+
+        localChanged -> when (direction) {
+            SyncDirection.UPLOAD_ONLY, SyncDirection.TWO_WAY -> SyncDecision.UPLOAD
+            else -> SyncDecision.SKIP
+        }
+        remoteChanged -> when (direction) {
+            SyncDirection.DOWNLOAD_ONLY, SyncDirection.TWO_WAY -> SyncDecision.DOWNLOAD
+            else -> SyncDecision.SKIP
+        }
+        else -> SyncDecision.SKIP
     }
-
-    private fun String.toGlob(): Regex =
-        Regex(replace(".", "\\.").replace("*", ".*").replace("?", "."), RegexOption.IGNORE_CASE)
 }
 
 enum class SyncDecision { UPLOAD, DOWNLOAD, DELETE_LOCAL, DELETE_REMOTE, CONFLICT, SKIP }

app/src/main/kotlin/com/syncflow/ui/addpair/AddPairScreen.kt

@@ -1,5 +1,6 @@
 package com.syncflow.ui.addpair
 
+import android.content.Intent
 import android.net.Uri
 import androidx.activity.compose.rememberLauncherForActivityResult
 import androidx.activity.result.contract.ActivityResultContracts
@@ -14,6 +15,7 @@ import androidx.compose.material3.*
 import androidx.compose.runtime.*
 import androidx.compose.ui.Alignment
 import androidx.compose.ui.Modifier
+import androidx.compose.ui.platform.LocalContext
 import androidx.compose.ui.text.font.FontWeight
 import androidx.compose.ui.text.input.ImeAction
 import androidx.compose.ui.text.input.KeyboardType
@@ -29,10 +31,17 @@ fun AddPairScreen(onDone: () -> Unit, vm: AddPairViewModel = hiltViewModel()) {
     val s by vm.state.collectAsState()
     LaunchedEffect(s.done) { if (s.done) onDone() }
 
+    val context = LocalContext.current
     var showRemoteBrowser by remember { mutableStateOf(false) }
 
     val dirPicker = rememberLauncherForActivityResult(ActivityResultContracts.OpenDocumentTree()) { uri: Uri? ->
-        uri?.let { vm.update { copy(localPath = it.toString()) } }
+        uri?.let {
+            context.contentResolver.takePersistableUriPermission(
+                it,
+                Intent.FLAG_GRANT_READ_URI_PERMISSION or Intent.FLAG_GRANT_WRITE_URI_PERMISSION,
+            )
+            vm.update { copy(localPath = it.toString()) }
+        }
     }
 
     if (showRemoteBrowser && s.selectedAccountId != -1L) {

app/src/main/kotlin/com/syncflow/ui/addpair/AddPairViewModel.kt

@@ -1,15 +1,18 @@
 package com.syncflow.ui.addpair
 
+import android.content.Context
 import androidx.lifecycle.SavedStateHandle
 import androidx.lifecycle.ViewModel
 import androidx.lifecycle.viewModelScope
 import com.syncflow.data.db.CloudAccountDao
+import com.syncflow.data.db.SyncFileStateDao
 import com.syncflow.data.db.SyncPairDao
 import com.syncflow.data.db.entities.CloudAccountEntity
 import com.syncflow.data.db.entities.SyncPairEntity
-import com.syncflow.data.db.entities.toDomain
 import com.syncflow.domain.model.*
+import com.syncflow.worker.FileWatchService
 import dagger.hilt.android.lifecycle.HiltViewModel
+import dagger.hilt.android.qualifiers.ApplicationContext
 import kotlinx.coroutines.flow.*
 import kotlinx.coroutines.launch
 import javax.inject.Inject
@@ -31,7 +34,7 @@ data class AddPairUiState(
     val scheduleType: ScheduleType = ScheduleType.INTERVAL,
     val intervalMinutes: Int = 30,
     val dailyTime: String = "02:00",
-    val weekdays: Int = 0b1111111,           // all 7 days by default
+    val weekdays: Int = 0b1111111,
     // ── Constraints ──────────────────────────────────────────────────────────
     val wifiOnly: Boolean = true,
     val wifiSsid: String = "",
@@ -56,7 +59,9 @@ data class AddPairUiState(
 @HiltViewModel
 class AddPairViewModel @Inject constructor(
     private val syncPairDao: SyncPairDao,
+    private val fileStateDao: SyncFileStateDao,
     private val accountDao: CloudAccountDao,
+    @ApplicationContext private val context: Context,
     savedState: SavedStateHandle,
 ) : ViewModel() {
 
@@ -145,9 +150,25 @@ class AddPairViewModel @Inject constructor(
                     notifyOnComplete = s.notifyOnComplete, notifyOnError = s.notifyOnError,
                     isEnabled = true, lastSyncAt = null, lastSyncResult = SyncStatus.IDLE, pendingConflicts = 0,
                 )
-                if (editPairId == null) syncPairDao.insert(entity) else syncPairDao.update(entity)
+                if (editPairId == null) {
+                    syncPairDao.insert(entity)
+                } else {
+                    val existing = syncPairDao.getById(editPairId)
+                    syncPairDao.update(entity)
+                    // If local or remote folder changed, old file-state records no longer
+                    // correspond to any real path — wipe them so the next sync starts fresh
+                    // instead of trying to delete/re-upload stale paths.
+                    if (existing != null &&
+                        (existing.localPath != entity.localPath || existing.remotePath != entity.remotePath)
+                    ) {
+                        fileStateDao.deleteForPair(editPairId)
+                    }
+                }
             }
-                .onSuccess { _state.update { it.copy(done = true) } }
+                .onSuccess {
+                    if (s.scheduleType == ScheduleType.ON_CHANGE) FileWatchService.start(context)
+                    _state.update { it.copy(done = true) }
+                }
                 .onFailure { e -> _state.update { it.copy(isSaving = false, error = e.message) } }
         }
     }

app/src/main/kotlin/com/syncflow/ui/auth/AccountSetupScreen.kt

@@ -2,6 +2,7 @@ package com.syncflow.ui.auth
 
 import android.accounts.AccountManager
 import android.app.Activity
+import android.view.WindowManager
 import androidx.activity.compose.rememberLauncherForActivityResult
 import androidx.activity.result.contract.ActivityResultContracts
 import androidx.compose.foundation.Image
@@ -201,6 +202,15 @@ private fun CredentialContent(
 ) {
     val provider = state.providerType ?: return
 
+    // Prevent screenshots and screen recording while credentials are visible
+    val activity = LocalContext.current as? Activity
+    DisposableEffect(Unit) {
+        activity?.window?.addFlags(WindowManager.LayoutParams.FLAG_SECURE)
+        onDispose {
+            activity?.window?.clearFlags(WindowManager.LayoutParams.FLAG_SECURE)
+        }
+    }
+
     Column(
         modifier = modifier
             .padding(horizontal = 20.dp)

app/src/main/kotlin/com/syncflow/ui/auth/OAuthHelper.kt

@@ -38,7 +38,9 @@ private fun generateChallenge(verifier: String): String {
 
 fun launchDropboxOAuth(context: Context, credentialStore: CredentialStore, appKey: String) {
     val verifier = generateVerifier()
+    val state = generateVerifier()
     credentialStore.savePkceVerifier("dropbox", verifier)
+    credentialStore.savePkceVerifier("dropbox_state", state)
     val challenge = generateChallenge(verifier)
     val url = "https://www.dropbox.com/oauth2/authorize" +
         "?client_id=$appKey" +
@@ -46,13 +48,16 @@ fun launchDropboxOAuth(context: Context, credentialStore: CredentialStore, appKe
         "&redirect_uri=syncflow%3A%2F%2Foauth%2Fdropbox" +
         "&code_challenge=$challenge" +
         "&code_challenge_method=S256" +
-        "&token_access_type=offline"
+        "&token_access_type=offline" +
+        "&state=$state"
     openCustomTab(context, url)
 }
 
 fun launchOneDriveOAuth(context: Context, credentialStore: CredentialStore, clientId: String) {
     val verifier = generateVerifier()
+    val state = generateVerifier()
     credentialStore.savePkceVerifier("onedrive", verifier)
+    credentialStore.savePkceVerifier("onedrive_state", state)
     val challenge = generateChallenge(verifier)
     val scopes = "Files.ReadWrite+User.Read+offline_access"
     val url = "https://login.microsoftonline.com/common/oauth2/v2.0/authorize" +
@@ -61,7 +66,8 @@ fun launchOneDriveOAuth(context: Context, credentialStore: CredentialStore, clie
         "&redirect_uri=syncflow%3A%2F%2Foauth%2Fonedrive" +
         "&scope=$scopes" +
         "&code_challenge=$challenge" +
-        "&code_challenge_method=S256"
+        "&code_challenge_method=S256" +
+        "&state=$state"
     openCustomTab(context, url)
 }
 

app/src/main/kotlin/com/syncflow/ui/auth/OAuthRedirectActivity.kt

@@ -28,11 +28,22 @@ class OAuthRedirectActivity : ComponentActivity() {
     private fun handleIntent(intent: Intent) {
         val uri = intent.data ?: run { finish(); return }
         val code = uri.getQueryParameter("code") ?: run { finish(); return }
+        val returnedState = uri.getQueryParameter("state") ?: run { finish(); return }
+
         val provider = when {
             uri.host == "oauth" && uri.path?.contains("dropbox") == true -> "dropbox"
             uri.host == "oauth" && uri.path?.contains("onedrive") == true -> "onedrive"
             else -> run { finish(); return }
         }
+
+        // Validate state before doing anything with the code (CSRF protection)
+        val storedState = credentialStore.getPkceVerifier("${provider}_state")
+        if (storedState == null || returnedState != storedState) {
+            finish()
+            return
+        }
+        credentialStore.removePkceVerifier("${provider}_state")
+
         val appKey = getString(com.syncflow.R.string.dropbox_app_key)
         val odClientId = getString(com.syncflow.R.string.onedrive_client_id)
         lifecycleScope.launch {

app/src/main/kotlin/com/syncflow/ui/browser/RemoteBrowserDialog.kt

@@ -27,7 +27,7 @@ fun RemoteBrowserDialog(
     onDismiss: () -> Unit,
     vm: RemoteBrowserViewModel = hiltViewModel(),
 ) {
-    LaunchedEffect(accountId) { vm.init(accountId, initialPath) }
+    LaunchedEffect(accountId, initialPath) { vm.init(accountId, initialPath) }
 
     val state by vm.state.collectAsState()
 
@@ -81,6 +81,7 @@ fun RemoteBrowserDialog(
                         Column(horizontalAlignment = Alignment.CenterHorizontally, verticalArrangement = Arrangement.spacedBy(8.dp)) {
                             Icon(Icons.Default.ErrorOutline, null, Modifier.size(48.dp), tint = MaterialTheme.colorScheme.error)
                             Text(state.error!!, color = MaterialTheme.colorScheme.error)
+                            FilledTonalButton(onClick = { vm.retry() }) { Text("Retry") }
                         }
                     }
                     state.entries.isEmpty() -> Box(Modifier.fillMaxSize(), contentAlignment = Alignment.Center) {

app/src/main/kotlin/com/syncflow/ui/browser/RemoteBrowserViewModel.kt

@@ -6,6 +6,7 @@ import com.syncflow.data.providers.ProviderFactory
 import com.syncflow.data.repository.AccountRepository
 import com.syncflow.domain.model.RemoteFile
 import dagger.hilt.android.lifecycle.HiltViewModel
+import kotlinx.coroutines.Job
 import kotlinx.coroutines.flow.MutableStateFlow
 import kotlinx.coroutines.flow.asStateFlow
 import kotlinx.coroutines.flow.update
@@ -30,15 +31,19 @@ class RemoteBrowserViewModel @Inject constructor(
     private val _state = MutableStateFlow(BrowserState())
     val state = _state.asStateFlow()
 
+    private var loadJob: Job? = null
+
     fun init(accountId: Long, startPath: String = "/") {
-        _state.update { it.copy(accountId = accountId, currentPath = startPath, pathStack = listOf(startPath)) }
-        loadPath(accountId, startPath)
+        loadJob?.cancel()
+        _state.value = BrowserState(accountId = accountId, currentPath = startPath, pathStack = listOf(startPath), isLoading = true)
+        loadJob = loadPath(accountId, startPath)
     }
 
     fun navigateTo(path: String) {
         val accountId = _state.value.accountId
-        _state.update { s -> s.copy(currentPath = path, pathStack = s.pathStack + path) }
-        loadPath(accountId, path)
+        loadJob?.cancel()
+        _state.update { s -> s.copy(currentPath = path, pathStack = s.pathStack + path, isLoading = true, entries = emptyList(), error = null) }
+        loadJob = loadPath(accountId, path)
     }
 
     fun navigateUp(): Boolean {
@@ -46,30 +51,36 @@ class RemoteBrowserViewModel @Inject constructor(
         if (stack.size <= 1) return false
         val newStack = stack.dropLast(1)
         val parent = newStack.last()
-        _state.update { it.copy(currentPath = parent, pathStack = newStack) }
-        loadPath(_state.value.accountId, parent)
+        loadJob?.cancel()
+        _state.update { it.copy(currentPath = parent, pathStack = newStack, isLoading = true, entries = emptyList(), error = null) }
+        loadJob = loadPath(_state.value.accountId, parent)
         return true
     }
 
-    private fun loadPath(accountId: Long, path: String) {
-        viewModelScope.launch {
-            _state.update { it.copy(isLoading = true, error = null) }
-            val account = accountRepository.getAccount(accountId)
-            if (account == null) {
-                _state.update { it.copy(isLoading = false, error = "Account not found") }
-                return@launch
-            }
-            val provider = runCatching { providerFactory.create(account) }.getOrElse { e ->
-                _state.update { it.copy(isLoading = false, error = e.message) }
-                return@launch
-            }
-            provider.listFiles(path)
-                .onSuccess { files ->
-                    _state.update { it.copy(isLoading = false, entries = files.sortedWith(compareBy({ !it.isDirectory }, { it.name.lowercase() }))) }
-                }
-                .onFailure { e ->
-                    _state.update { it.copy(isLoading = false, error = e.message ?: "Failed to list files") }
-                }
+    fun retry() {
+        val s = _state.value
+        if (s.accountId == -1L) return
+        loadJob?.cancel()
+        _state.update { it.copy(isLoading = true, error = null) }
+        loadJob = loadPath(s.accountId, s.currentPath)
+    }
+
+    private fun loadPath(accountId: Long, path: String): Job = viewModelScope.launch {
+        val account = accountRepository.getAccount(accountId)
+        if (account == null) {
+            _state.update { it.copy(isLoading = false, error = "Account not found") }
+            return@launch
         }
+        val provider = runCatching { providerFactory.create(account) }.getOrElse { e ->
+            _state.update { it.copy(isLoading = false, error = e.message ?: "Failed to create provider") }
+            return@launch
+        }
+        provider.listFiles(path)
+            .onSuccess { files ->
+                _state.update { it.copy(isLoading = false, entries = files.sortedWith(compareBy({ !it.isDirectory }, { it.name.lowercase() }))) }
+            }
+            .onFailure { e ->
+                _state.update { it.copy(isLoading = false, error = e.message ?: "Failed to list files") }
+            }
     }
 }

app/src/main/kotlin/com/syncflow/ui/files/FilesScreen.kt

@@ -0,0 +1,527 @@
+package com.syncflow.ui.files
+
+import android.content.ClipData
+import android.content.Intent
+import android.net.Uri
+import android.webkit.MimeTypeMap
+import androidx.activity.compose.BackHandler
+import androidx.compose.foundation.ExperimentalFoundationApi
+import androidx.compose.foundation.combinedClickable
+import androidx.compose.foundation.layout.*
+import androidx.compose.foundation.lazy.LazyColumn
+import androidx.compose.foundation.lazy.items
+import androidx.compose.foundation.shape.RoundedCornerShape
+import androidx.compose.material.icons.Icons
+import androidx.compose.material.icons.filled.*
+import androidx.compose.material3.*
+import androidx.compose.runtime.*
+import androidx.compose.ui.Alignment
+import androidx.compose.ui.Modifier
+import androidx.compose.ui.graphics.vector.ImageVector
+import androidx.compose.ui.platform.LocalContext
+import androidx.compose.ui.text.style.TextOverflow
+import androidx.compose.ui.unit.dp
+import androidx.core.content.FileProvider
+import androidx.hilt.navigation.compose.hiltViewModel
+import com.syncflow.data.db.entities.SyncFileStateEntity
+import kotlinx.coroutines.launch
+import java.io.File
+import java.time.ZoneId
+import java.time.format.DateTimeFormatter
+import java.time.format.FormatStyle
+
+@OptIn(ExperimentalMaterial3Api::class, ExperimentalFoundationApi::class)
+@Composable
+fun FilesScreen(
+    modifier: Modifier = Modifier,
+    vm: FilesViewModel = hiltViewModel(),
+) {
+    val pairs by vm.pairs.collectAsState()
+    val selectedPair by vm.selectedPair.collectAsState()
+    val files by vm.files.collectAsState()
+    val isDownloading by vm.isDownloading.collectAsState()
+    val selectedKeys by vm.selectedKeys.collectAsState()
+    val isSelectionMode = selectedKeys.isNotEmpty()
+    val selectedCount = selectedKeys.size
+    val context = LocalContext.current
+    val snackbarHostState = remember { SnackbarHostState() }
+    val scope = rememberCoroutineScope()
+    var showDeleteSelectedDialog by remember { mutableStateOf(false) }
+
+    BackHandler(enabled = isSelectionMode) { vm.clearSelection() }
+
+    LaunchedEffect(Unit) {
+        vm.fileAction.collect { action ->
+            when (action) {
+                is FileAction.Open -> {
+                    try {
+                        val uri = FileProvider.getUriForFile(
+                            context, "${context.packageName}.fileprovider", action.file
+                        )
+                        val mimeType = action.file.name.mimeType()
+                        val intent = Intent(Intent.ACTION_VIEW).apply {
+                            setDataAndType(uri, mimeType)
+                            // ClipData is required so FLAG_GRANT_READ_URI_PERMISSION
+                            // propagates to whichever app the system chooser picks.
+                            clipData = ClipData.newRawUri("", uri)
+                            addFlags(
+                                Intent.FLAG_GRANT_READ_URI_PERMISSION or
+                                Intent.FLAG_ACTIVITY_NEW_TASK
+                            )
+                        }
+                        context.startActivity(intent)
+                    } catch (e: Exception) {
+                        snackbarHostState.showSnackbar("Cannot open file: ${e.message}")
+                    }
+                }
+                is FileAction.Share -> {
+                    try {
+                        val uri = FileProvider.getUriForFile(
+                            context, "${context.packageName}.fileprovider", action.file
+                        )
+                        val intent = Intent(Intent.ACTION_SEND).apply {
+                            type = action.file.name.mimeType()
+                            putExtra(Intent.EXTRA_STREAM, uri)
+                            clipData = ClipData.newRawUri("", uri)
+                            addFlags(Intent.FLAG_GRANT_READ_URI_PERMISSION or Intent.FLAG_ACTIVITY_NEW_TASK)
+                        }
+                        context.startActivity(
+                            Intent.createChooser(intent, "Share via").apply {
+                                addFlags(Intent.FLAG_ACTIVITY_NEW_TASK)
+                            }
+                        )
+                    } catch (e: Exception) {
+                        snackbarHostState.showSnackbar("Cannot share file: ${e.message}")
+                    }
+                }
+                is FileAction.ShareMultiple -> {
+                    try {
+                        val uris = action.files.map { file ->
+                            FileProvider.getUriForFile(context, "${context.packageName}.fileprovider", file)
+                        }
+                        val intent = Intent(Intent.ACTION_SEND_MULTIPLE).apply {
+                            type = "*/*"
+                            putParcelableArrayListExtra(Intent.EXTRA_STREAM, ArrayList(uris))
+                            addFlags(Intent.FLAG_GRANT_READ_URI_PERMISSION or Intent.FLAG_ACTIVITY_NEW_TASK)
+                        }
+                        context.startActivity(
+                            Intent.createChooser(intent, "Share files").apply {
+                                addFlags(Intent.FLAG_ACTIVITY_NEW_TASK)
+                            }
+                        )
+                    } catch (e: Exception) {
+                        snackbarHostState.showSnackbar("Cannot share: ${e.message}")
+                    }
+                }
+                is FileAction.Error -> scope.launch {
+                    snackbarHostState.showSnackbar(action.message)
+                }
+            }
+        }
+    }
+
+    if (showDeleteSelectedDialog) {
+        AlertDialog(
+            onDismissRequest = { showDeleteSelectedDialog = false },
+            icon = { Icon(Icons.Default.Delete, contentDescription = null) },
+            title = { Text("Delete $selectedCount file${if (selectedCount != 1) "s" else ""}?") },
+            text = { Text("Selected files will be removed from this device.") },
+            confirmButton = {
+                TextButton(onClick = {
+                    vm.deleteSelected()
+                    showDeleteSelectedDialog = false
+                }) { Text("Delete", color = MaterialTheme.colorScheme.error) }
+            },
+            dismissButton = {
+                TextButton(onClick = { showDeleteSelectedDialog = false }) { Text("Cancel") }
+            },
+        )
+    }
+
+    Box(modifier = modifier.fillMaxSize()) {
+        Column(modifier = Modifier.fillMaxSize()) {
+            // Selection toolbar
+            if (isSelectionMode) {
+                Surface(
+                    color = MaterialTheme.colorScheme.primaryContainer,
+                    tonalElevation = 3.dp,
+                ) {
+                    Row(
+                        modifier = Modifier
+                            .fillMaxWidth()
+                            .padding(horizontal = 4.dp, vertical = 4.dp),
+                        verticalAlignment = Alignment.CenterVertically,
+                    ) {
+                        IconButton(onClick = { vm.clearSelection() }) {
+                            Icon(Icons.Default.Close, contentDescription = "Clear selection")
+                        }
+                        Text(
+                            "$selectedCount selected",
+                            style = MaterialTheme.typography.titleSmall,
+                            modifier = Modifier.weight(1f),
+                        )
+                        IconButton(onClick = { vm.shareSelected() }) {
+                            Icon(Icons.Default.Share, contentDescription = "Share selected")
+                        }
+                        IconButton(onClick = { showDeleteSelectedDialog = true }) {
+                            Icon(
+                                Icons.Default.Delete, contentDescription = "Delete selected",
+                                tint = MaterialTheme.colorScheme.error,
+                            )
+                        }
+                    }
+                }
+                HorizontalDivider()
+            }
+
+            // Pair tabs
+            if (pairs.size > 1 && !isSelectionMode) {
+                ScrollableTabRow(
+                    selectedTabIndex = pairs.indexOfFirst { it.id == selectedPair?.id }.coerceAtLeast(0),
+                    edgePadding = 16.dp,
+                    containerColor = MaterialTheme.colorScheme.surface,
+                    divider = {},
+                ) {
+                    pairs.forEach { pair ->
+                        Tab(
+                            selected = pair.id == selectedPair?.id,
+                            onClick = { vm.selectPair(pair.id) },
+                            text = { Text(pair.name, maxLines = 1, overflow = TextOverflow.Ellipsis) },
+                        )
+                    }
+                }
+                HorizontalDivider()
+            }
+
+            when {
+                pairs.isEmpty() -> FilesEmptyState(
+                    icon = Icons.Default.FolderOpen,
+                    title = "No sync pairs yet",
+                    subtitle = "Create a sync pair to browse its files",
+                )
+                files.isEmpty() -> FilesEmptyState(
+                    icon = Icons.Default.FolderOpen,
+                    title = "No synced files yet",
+                    subtitle = "Run a sync to populate this view",
+                )
+                else -> {
+                    if (!isSelectionMode) {
+                        Surface(color = MaterialTheme.colorScheme.surfaceVariant.copy(alpha = 0.5f)) {
+                            Row(
+                                modifier = Modifier
+                                    .fillMaxWidth()
+                                    .padding(horizontal = 16.dp, vertical = 8.dp),
+                                horizontalArrangement = Arrangement.SpaceBetween,
+                                verticalAlignment = Alignment.CenterVertically,
+                            ) {
+                                Text(
+                                    "${files.size} file${if (files.size != 1) "s" else ""}",
+                                    style = MaterialTheme.typography.labelMedium,
+                                    color = MaterialTheme.colorScheme.onSurfaceVariant,
+                                )
+                                Text(
+                                    files.sumOf { it.localSizeBytes }.toDisplaySize(),
+                                    style = MaterialTheme.typography.labelMedium,
+                                    color = MaterialTheme.colorScheme.onSurfaceVariant,
+                                )
+                            }
+                        }
+                    }
+
+                    LazyColumn(
+                        contentPadding = PaddingValues(horizontal = 16.dp, vertical = 8.dp),
+                        verticalArrangement = Arrangement.spacedBy(0.dp),
+                    ) {
+                        val grouped = files.groupBy { f ->
+                            val idx = f.relativePath.indexOf('/')
+                            if (idx < 0) "" else f.relativePath.substring(0, idx)
+                        }
+                        grouped.forEach { (dir, dirFiles) ->
+                            if (dir.isNotEmpty() && !isSelectionMode) {
+                                item(key = "dir_$dir") {
+                                    Row(
+                                        modifier = Modifier.padding(top = 12.dp, bottom = 4.dp),
+                                        verticalAlignment = Alignment.CenterVertically,
+                                    ) {
+                                        Icon(
+                                            Icons.Default.Folder, contentDescription = null,
+                                            modifier = Modifier.size(16.dp),
+                                            tint = MaterialTheme.colorScheme.primary,
+                                        )
+                                        Spacer(Modifier.width(6.dp))
+                                        Text(
+                                            dir,
+                                            style = MaterialTheme.typography.labelMedium,
+                                            color = MaterialTheme.colorScheme.primary,
+                                        )
+                                    }
+                                }
+                            }
+                            items(dirFiles, key = { "${it.syncPairId}_${it.relativePath}" }) { file ->
+                                FileRow(
+                                    file = file,
+                                    isInSubDir = dir.isNotEmpty() && !isSelectionMode,
+                                    isSelectionMode = isSelectionMode,
+                                    isSelected = vm.fileKey(file) in selectedKeys,
+                                    vm = vm,
+                                )
+                                HorizontalDivider(
+                                    color = MaterialTheme.colorScheme.outline.copy(alpha = 0.25f),
+                                    modifier = Modifier.padding(start = if (dir.isNotEmpty() && !isSelectionMode) 38.dp else 16.dp),
+                                )
+                            }
+                        }
+                        item { Spacer(Modifier.height(80.dp)) }
+                    }
+                }
+            }
+        }
+
+        // Download progress
+        if (isDownloading) {
+            Box(
+                modifier = Modifier
+                    .fillMaxWidth()
+                    .align(Alignment.BottomCenter),
+            ) {
+                Surface(
+                    color = MaterialTheme.colorScheme.surfaceVariant,
+                    tonalElevation = 4.dp,
+                    modifier = Modifier.fillMaxWidth(),
+                ) {
+                    Row(
+                        modifier = Modifier
+                            .fillMaxWidth()
+                            .padding(horizontal = 16.dp, vertical = 10.dp),
+                        verticalAlignment = Alignment.CenterVertically,
+                        horizontalArrangement = Arrangement.spacedBy(12.dp),
+                    ) {
+                        CircularProgressIndicator(modifier = Modifier.size(18.dp), strokeWidth = 2.dp)
+                        Text("Downloading for preview…", style = MaterialTheme.typography.bodySmall)
+                    }
+                }
+            }
+        }
+
+        SnackbarHost(
+            hostState = snackbarHostState,
+            modifier = Modifier.align(Alignment.BottomCenter),
+        )
+    }
+}
+
+@Composable
+private fun FilesEmptyState(icon: ImageVector, title: String, subtitle: String) {
+    Box(modifier = Modifier.fillMaxSize(), contentAlignment = Alignment.Center) {
+        Column(
+            horizontalAlignment = Alignment.CenterHorizontally,
+            verticalArrangement = Arrangement.spacedBy(8.dp),
+        ) {
+            Icon(
+                icon, contentDescription = null,
+                modifier = Modifier.size(72.dp),
+                tint = MaterialTheme.colorScheme.primary.copy(alpha = 0.35f),
+            )
+            Text(title, style = MaterialTheme.typography.titleMedium)
+            Text(
+                subtitle,
+                style = MaterialTheme.typography.bodySmall,
+                color = MaterialTheme.colorScheme.onSurfaceVariant,
+            )
+        }
+    }
+}
+
+@OptIn(ExperimentalFoundationApi::class)
+@Composable
+private fun FileRow(
+    file: SyncFileStateEntity,
+    isInSubDir: Boolean,
+    isSelectionMode: Boolean,
+    isSelected: Boolean,
+    vm: FilesViewModel,
+) {
+    val name = file.relativePath.substringAfterLast('/')
+    val timeFmt = DateTimeFormatter.ofLocalizedDate(FormatStyle.SHORT)
+    val syncedAt = file.lastSyncedAt.atZone(ZoneId.systemDefault()).let { timeFmt.format(it) }
+
+    var menuExpanded by remember { mutableStateOf(false) }
+    var showRenameDialog by remember { mutableStateOf(false) }
+    var showDeleteDialog by remember { mutableStateOf(false) }
+
+    if (showRenameDialog) {
+        RenameDialog(
+            currentName = name,
+            onConfirm = { newName -> vm.renameFile(file, newName); showRenameDialog = false },
+            onDismiss = { showRenameDialog = false },
+        )
+    }
+
+    if (showDeleteDialog) {
+        AlertDialog(
+            onDismissRequest = { showDeleteDialog = false },
+            icon = { Icon(Icons.Default.Delete, contentDescription = null) },
+            title = { Text("Delete file?") },
+            text = { Text("\"$name\" will be removed from this device.") },
+            confirmButton = {
+                TextButton(onClick = { vm.deleteFile(file); showDeleteDialog = false }) {
+                    Text("Delete", color = MaterialTheme.colorScheme.error)
+                }
+            },
+            dismissButton = {
+                TextButton(onClick = { showDeleteDialog = false }) { Text("Cancel") }
+            },
+        )
+    }
+
+    Surface(
+        color = if (isSelected) MaterialTheme.colorScheme.primaryContainer.copy(alpha = 0.4f)
+                else MaterialTheme.colorScheme.surface,
+        modifier = Modifier
+            .fillMaxWidth()
+            .combinedClickable(
+                onClick = {
+                    if (isSelectionMode) vm.toggleSelection(file) else menuExpanded = true
+                },
+                onLongClick = { vm.toggleSelection(file) },
+            ),
+    ) {
+        Row(
+            modifier = Modifier.padding(
+                start = if (isInSubDir) 22.dp else 0.dp,
+                top = 10.dp,
+                bottom = 10.dp,
+                end = 0.dp,
+            ),
+            verticalAlignment = Alignment.CenterVertically,
+        ) {
+            if (isSelectionMode) {
+                Checkbox(
+                    checked = isSelected,
+                    onCheckedChange = { vm.toggleSelection(file) },
+                    modifier = Modifier.padding(horizontal = 4.dp),
+                )
+            } else {
+                Surface(
+                    shape = RoundedCornerShape(8.dp),
+                    color = MaterialTheme.colorScheme.secondaryContainer,
+                    modifier = Modifier.size(32.dp),
+                ) {
+                    Box(contentAlignment = Alignment.Center) {
+                        Icon(
+                            fileIcon(name), contentDescription = null,
+                            modifier = Modifier.size(16.dp),
+                            tint = MaterialTheme.colorScheme.onSecondaryContainer,
+                        )
+                    }
+                }
+                Spacer(Modifier.width(12.dp))
+            }
+            Column(modifier = Modifier.weight(1f)) {
+                Text(
+                    name,
+                    style = MaterialTheme.typography.bodySmall,
+                    maxLines = 1,
+                    overflow = TextOverflow.Ellipsis,
+                )
+                Text(
+                    "Synced $syncedAt · ${file.localSizeBytes.toDisplaySize()}",
+                    style = MaterialTheme.typography.labelSmall,
+                    color = MaterialTheme.colorScheme.onSurfaceVariant,
+                )
+            }
+            if (!isSelectionMode) {
+                Box {
+                    IconButton(onClick = { menuExpanded = true }, modifier = Modifier.size(36.dp)) {
+                        Icon(
+                            Icons.Default.MoreVert, contentDescription = "File options",
+                            modifier = Modifier.size(18.dp),
+                            tint = MaterialTheme.colorScheme.onSurfaceVariant,
+                        )
+                    }
+                    DropdownMenu(expanded = menuExpanded, onDismissRequest = { menuExpanded = false }) {
+                        DropdownMenuItem(
+                            text = { Text("Open") },
+                            leadingIcon = { Icon(Icons.Default.OpenInNew, null) },
+                            onClick = { menuExpanded = false; vm.openFile(file) },
+                        )
+                        DropdownMenuItem(
+                            text = { Text("Share") },
+                            leadingIcon = { Icon(Icons.Default.Share, null) },
+                            onClick = { menuExpanded = false; vm.shareFile(file) },
+                        )
+                        HorizontalDivider()
+                        DropdownMenuItem(
+                            text = { Text("Rename") },
+                            leadingIcon = { Icon(Icons.Default.Edit, null) },
+                            onClick = { menuExpanded = false; showRenameDialog = true },
+                        )
+                        DropdownMenuItem(
+                            text = { Text("Delete", color = MaterialTheme.colorScheme.error) },
+                            leadingIcon = {
+                                Icon(Icons.Default.Delete, null, tint = MaterialTheme.colorScheme.error)
+                            },
+                            onClick = { menuExpanded = false; showDeleteDialog = true },
+                        )
+                    }
+                }
+            }
+        }
+    }
+}
+
+@Composable
+private fun RenameDialog(currentName: String, onConfirm: (String) -> Unit, onDismiss: () -> Unit) {
+    var newName by remember { mutableStateOf(currentName) }
+    AlertDialog(
+        onDismissRequest = onDismiss,
+        icon = { Icon(Icons.Default.Edit, contentDescription = null) },
+        title = { Text("Rename file") },
+        text = {
+            OutlinedTextField(
+                value = newName,
+                onValueChange = { newName = it },
+                label = { Text("New name") },
+                singleLine = true,
+                modifier = Modifier.fillMaxWidth(),
+            )
+        },
+        confirmButton = {
+            TextButton(
+                onClick = {
+                    val trimmed = newName.trim()
+                    if (trimmed.isNotBlank() && trimmed != currentName) onConfirm(trimmed) else onDismiss()
+                },
+                enabled = newName.isNotBlank(),
+            ) { Text("Rename") }
+        },
+        dismissButton = { TextButton(onClick = onDismiss) { Text("Cancel") } },
+    )
+}
+
+private fun String.mimeType(): String {
+    val ext = substringAfterLast('.', "").lowercase()
+    return MimeTypeMap.getSingleton().getMimeTypeFromExtension(ext) ?: "*/*"
+}
+
+private fun fileIcon(name: String) = when {
+    name.endsWith(".pdf", ignoreCase = true) -> Icons.Default.PictureAsPdf
+    name.endsWith(".jpg", ignoreCase = true) || name.endsWith(".jpeg", ignoreCase = true) ||
+    name.endsWith(".png", ignoreCase = true) || name.endsWith(".gif", ignoreCase = true) ||
+    name.endsWith(".webp", ignoreCase = true) -> Icons.Default.Image
+    name.endsWith(".mp4", ignoreCase = true) || name.endsWith(".mkv", ignoreCase = true) ||
+    name.endsWith(".mov", ignoreCase = true) -> Icons.Default.VideoFile
+    name.endsWith(".mp3", ignoreCase = true) || name.endsWith(".m4a", ignoreCase = true) ||
+    name.endsWith(".ogg", ignoreCase = true) -> Icons.Default.AudioFile
+    name.endsWith(".zip", ignoreCase = true) || name.endsWith(".tar", ignoreCase = true) ||
+    name.endsWith(".gz", ignoreCase = true) -> Icons.Default.FolderZip
+    name.endsWith(".txt", ignoreCase = true) || name.endsWith(".md", ignoreCase = true) -> Icons.Default.TextSnippet
+    else -> Icons.Default.InsertDriveFile
+}
+
+private fun Long.toDisplaySize(): String = when {
+    this < 1_024 -> "$this B"
+    this < 1_048_576 -> "${"%.1f".format(this / 1_024.0)} KB"
+    this < 1_073_741_824 -> "${"%.1f".format(this / 1_048_576.0)} MB"
+    else -> "${"%.1f".format(this / 1_073_741_824.0)} GB"
+}

app/src/main/kotlin/com/syncflow/ui/files/FilesViewModel.kt

@@ -0,0 +1,241 @@
+package com.syncflow.ui.files
+
+import android.content.Context
+import android.media.MediaScannerConnection
+import androidx.lifecycle.ViewModel
+import androidx.lifecycle.viewModelScope
+import com.syncflow.data.db.SyncFileStateDao
+import com.syncflow.data.db.SyncPairDao
+import com.syncflow.data.db.entities.SyncFileStateEntity
+import com.syncflow.data.db.entities.SyncPairEntity
+import com.syncflow.data.providers.ProviderFactory
+import com.syncflow.data.repository.AccountRepository
+import dagger.hilt.android.lifecycle.HiltViewModel
+import dagger.hilt.android.qualifiers.ApplicationContext
+import kotlinx.coroutines.ExperimentalCoroutinesApi
+import kotlinx.coroutines.flow.*
+import kotlinx.coroutines.launch
+import kotlinx.coroutines.flow.update
+import timber.log.Timber
+import java.io.File
+import javax.inject.Inject
+
+sealed class FileAction {
+    data class Open(val file: File) : FileAction()
+    data class Share(val file: File) : FileAction()
+    data class ShareMultiple(val files: List<File>) : FileAction()
+    data class Error(val message: String) : FileAction()
+}
+
+@OptIn(ExperimentalCoroutinesApi::class)
+@HiltViewModel
+class FilesViewModel @Inject constructor(
+    private val syncPairDao: SyncPairDao,
+    private val fileStateDao: SyncFileStateDao,
+    private val accountRepository: AccountRepository,
+    private val providerFactory: ProviderFactory,
+    @ApplicationContext private val context: Context,
+) : ViewModel() {
+
+    val pairs: StateFlow<List<SyncPairEntity>> = syncPairDao.observeAll()
+        .stateIn(viewModelScope, SharingStarted.WhileSubscribed(5_000), emptyList())
+
+    private val _selectedPairId = MutableStateFlow<Long?>(null)
+
+    val selectedPair: StateFlow<SyncPairEntity?> = combine(_selectedPairId, pairs) { id, list ->
+        list.firstOrNull { it.id == id } ?: list.firstOrNull()
+    }.stateIn(viewModelScope, SharingStarted.WhileSubscribed(5_000), null)
+
+    val files: StateFlow<List<SyncFileStateEntity>> = _selectedPairId
+        .flatMapLatest { id ->
+            if (id == null) pairs.map { it.firstOrNull()?.id }.filterNotNull()
+                .flatMapLatest { fileStateDao.observeForPair(it) }
+            else fileStateDao.observeForPair(id)
+        }
+        .stateIn(viewModelScope, SharingStarted.WhileSubscribed(5_000), emptyList())
+
+    private val _fileAction = MutableSharedFlow<FileAction>()
+    val fileAction: SharedFlow<FileAction> = _fileAction
+
+    private val _isDownloading = MutableStateFlow(false)
+    val isDownloading: StateFlow<Boolean> = _isDownloading
+
+    private val _selectedKeys = MutableStateFlow<Set<String>>(emptySet())
+    val selectedKeys: StateFlow<Set<String>> = _selectedKeys
+    val isSelectionMode: StateFlow<Boolean> = _selectedKeys.map { it.isNotEmpty() }
+        .stateIn(viewModelScope, SharingStarted.WhileSubscribed(5_000), false)
+    val selectedCount: StateFlow<Int> = _selectedKeys.map { it.size }
+        .stateIn(viewModelScope, SharingStarted.WhileSubscribed(5_000), 0)
+
+    fun selectPair(id: Long) { _selectedPairId.value = id }
+
+    fun openFile(file: SyncFileStateEntity) {
+        val resolved = resolveFile(file, emitErrorIfMissing = false)
+        if (resolved != null) {
+            // Ensure MediaStore knows about this file so gallery apps can open it
+            MediaScannerConnection.scanFile(context, arrayOf(resolved.absolutePath), null, null)
+            viewModelScope.launch { _fileAction.emit(FileAction.Open(resolved)) }
+        } else {
+            downloadAndOpen(file)
+        }
+    }
+
+    fun shareFile(file: SyncFileStateEntity) {
+        val resolved = resolveFile(file, emitErrorIfMissing = false)
+        if (resolved != null) {
+            viewModelScope.launch { _fileAction.emit(FileAction.Share(resolved)) }
+        } else {
+            downloadAndShare(file)
+        }
+    }
+
+    fun deleteFile(file: SyncFileStateEntity) {
+        viewModelScope.launch {
+            try {
+                val resolved = resolveFile(file, emitErrorIfMissing = false)
+                resolved?.delete()
+                fileStateDao.delete(file.syncPairId, file.relativePath)
+            } catch (e: Exception) {
+                Timber.e(e, "Delete failed: ${file.relativePath}")
+                _fileAction.emit(FileAction.Error("Delete failed: ${e.message}"))
+            }
+        }
+    }
+
+    fun renameFile(file: SyncFileStateEntity, newName: String) {
+        viewModelScope.launch {
+            try {
+                val resolved = resolveFile(file) ?: return@launch
+                val parent = resolved.parentFile ?: return@launch
+                val dest = File(parent, newName)
+                if (!resolved.renameTo(dest)) {
+                    _fileAction.emit(FileAction.Error("Rename failed"))
+                    return@launch
+                }
+                fileStateDao.delete(file.syncPairId, file.relativePath)
+            } catch (e: Exception) {
+                Timber.e(e, "Rename failed: ${file.relativePath}")
+                _fileAction.emit(FileAction.Error("Rename failed: ${e.message}"))
+            }
+        }
+    }
+
+    fun isSelected(file: SyncFileStateEntity): Boolean = fileKey(file) in _selectedKeys.value
+
+    fun toggleSelection(file: SyncFileStateEntity) {
+        val key = fileKey(file)
+        _selectedKeys.update { if (key in it) it - key else it + key }
+    }
+
+    fun clearSelection() { _selectedKeys.value = emptySet() }
+
+    fun deleteSelected() {
+        viewModelScope.launch {
+            val toDelete = files.value.filter { isSelected(it) }
+            toDelete.forEach { file ->
+                try {
+                    resolveFile(file, emitErrorIfMissing = false)?.delete()
+                    fileStateDao.delete(file.syncPairId, file.relativePath)
+                } catch (e: Exception) {
+                    Timber.e(e, "Bulk delete failed: ${file.relativePath}")
+                }
+            }
+            clearSelection()
+        }
+    }
+
+    fun shareSelected() {
+        viewModelScope.launch {
+            val toShare = files.value.filter { isSelected(it) }
+            val resolved = toShare.mapNotNull { resolveFile(it, emitErrorIfMissing = false) }
+            if (resolved.isEmpty()) {
+                _fileAction.emit(FileAction.Error("No local files available to share"))
+                return@launch
+            }
+            _fileAction.emit(FileAction.ShareMultiple(resolved))
+        }
+    }
+
+    fun fileKey(file: SyncFileStateEntity) = "${file.syncPairId}:${file.relativePath}"
+
+    // ── Download-then-open/share ──────────────────────────────────────────────
+
+    private fun downloadAndOpen(file: SyncFileStateEntity) {
+        viewModelScope.launch {
+            downloadToCache(file)?.let { cached ->
+                _fileAction.emit(FileAction.Open(cached))
+            }
+        }
+    }
+
+    private fun downloadAndShare(file: SyncFileStateEntity) {
+        viewModelScope.launch {
+            downloadToCache(file)?.let { cached ->
+                _fileAction.emit(FileAction.Share(cached))
+            }
+        }
+    }
+
+    private suspend fun downloadToCache(file: SyncFileStateEntity): File? {
+        val pair = selectedPair.value ?: run {
+            _fileAction.emit(FileAction.Error("No sync pair selected"))
+            return null
+        }
+        val account = accountRepository.getAccount(pair.accountId) ?: run {
+            _fileAction.emit(FileAction.Error("Cloud account not found"))
+            return null
+        }
+        val provider = providerFactory.create(account)
+        val fileName = file.relativePath.substringAfterLast('/')
+        val cacheFile = File(context.cacheDir, "syncflow_open/$fileName")
+        cacheFile.parentFile?.mkdirs()
+
+        _isDownloading.value = true
+        return try {
+            cacheFile.outputStream().use { out ->
+                provider.downloadFile("${pair.remotePath}/${file.relativePath}", out) { }.getOrThrow()
+            }
+            MediaScannerConnection.scanFile(context, arrayOf(cacheFile.absolutePath), null, null)
+            cacheFile
+        } catch (e: Exception) {
+            Timber.e(e, "Download for preview failed: ${file.relativePath}")
+            cacheFile.delete()
+            _fileAction.emit(FileAction.Error("Download failed: ${e.message}"))
+            null
+        } finally {
+            _isDownloading.value = false
+        }
+    }
+
+    // ── Path resolution ───────────────────────────────────────────────────────
+
+    private fun resolveFile(file: SyncFileStateEntity, emitErrorIfMissing: Boolean = true): File? {
+        // Guard against path traversal from untrusted server responses
+        if (file.relativePath.contains("..")) {
+            viewModelScope.launch { _fileAction.emit(FileAction.Error("Invalid file path")) }
+            return null
+        }
+        val pair = selectedPair.value ?: return null
+        val root = safTreeUriToRealPath(pair.localPath) ?: pair.localPath
+        // localPath is a content:// URI we couldn't resolve — File-based access won't work
+        if (root.startsWith("content://")) return null
+        val f = File(root, file.relativePath)
+        if (!f.exists()) {
+            if (emitErrorIfMissing) {
+                viewModelScope.launch { _fileAction.emit(FileAction.Error("File not found on device")) }
+            }
+            return null
+        }
+        return f
+    }
+
+    private fun safTreeUriToRealPath(uriString: String): String? {
+        if (!uriString.startsWith("content://")) return uriString
+        return try {
+            val treeUri = android.net.Uri.parse(uriString)
+            val docId = android.provider.DocumentsContract.getTreeDocumentId(treeUri)
+            if (docId.startsWith("primary:")) "/storage/emulated/0/${docId.removePrefix("primary:")}"
+            else null
+        } catch (e: Exception) { null }
+    }
+}

app/src/main/kotlin/com/syncflow/ui/home/HomeScreen.kt

@@ -1,9 +1,16 @@
 package com.syncflow.ui.home
 
+import androidx.compose.animation.core.LinearEasing
+import androidx.compose.animation.core.animateFloat
+import androidx.compose.animation.core.infiniteRepeatable
+import androidx.compose.animation.core.rememberInfiniteTransition
+import androidx.compose.animation.core.tween
+import androidx.compose.foundation.BorderStroke
 import androidx.compose.foundation.clickable
 import androidx.compose.foundation.layout.*
 import androidx.compose.foundation.lazy.LazyColumn
 import androidx.compose.foundation.lazy.items
+import androidx.compose.foundation.shape.RoundedCornerShape
 import androidx.compose.material.icons.Icons
 import androidx.compose.material.icons.filled.*
 import androidx.compose.material.icons.outlined.*
@@ -11,11 +18,13 @@ import androidx.compose.material3.*
 import androidx.compose.runtime.*
 import androidx.compose.ui.Alignment
 import androidx.compose.ui.Modifier
-import androidx.compose.ui.text.font.FontWeight
+import androidx.compose.ui.graphics.Color
+import androidx.compose.ui.graphics.graphicsLayer
 import androidx.compose.ui.unit.dp
 import androidx.hilt.navigation.compose.hiltViewModel
 import com.syncflow.data.db.entities.SyncPairEntity
 import com.syncflow.domain.model.SyncStatus
+import java.time.Duration
 import java.time.Instant
 import java.time.ZoneId
 import java.time.format.DateTimeFormatter
@@ -58,49 +67,117 @@ private fun SyncPairCard(
     onSync: () -> Unit,
     onToggle: () -> Unit,
 ) {
-    ElevatedCard(
-        modifier = Modifier.fillMaxWidth().clickable(onClick = onClick),
-        elevation = CardDefaults.elevatedCardElevation(defaultElevation = 2.dp),
+    val accentColor = pair.lastSyncResult.accentColor
+
+    Card(
+        modifier = Modifier
+            .fillMaxWidth()
+            .clickable(onClick = onClick),
+        shape = RoundedCornerShape(16.dp),
+        border = BorderStroke(1.dp, MaterialTheme.colorScheme.outline),
+        colors = CardDefaults.cardColors(containerColor = MaterialTheme.colorScheme.surface),
     ) {
-        Column(modifier = Modifier.padding(16.dp)) {
-            Row(verticalAlignment = Alignment.CenterVertically) {
-                Column(modifier = Modifier.weight(1f)) {
-                    Text(pair.name, style = MaterialTheme.typography.titleMedium, fontWeight = FontWeight.SemiBold)
-                    Spacer(Modifier.height(2.dp))
-                    Text(
-                        pair.localPath.takeLast(40),
-                        style = MaterialTheme.typography.bodySmall,
-                        color = MaterialTheme.colorScheme.onSurfaceVariant,
-                    )
-                }
-                Switch(checked = pair.isEnabled, onCheckedChange = { onToggle() })
-            }
-            Spacer(Modifier.height(10.dp))
-            Row(
-                verticalAlignment = Alignment.CenterVertically,
-                horizontalArrangement = Arrangement.spacedBy(8.dp),
+        Row(modifier = Modifier.fillMaxWidth()) {
+            // Colored left accent bar
+            Box(
+                modifier = Modifier
+                    .width(3.dp)
+                    .height(IntrinsicSize.Min)
+                    .defaultMinSize(minHeight = 80.dp),
             ) {
-                StatusChip(pair.lastSyncResult)
-                if (pair.pendingConflicts > 0) {
-                    AssistChip(
-                        onClick = {},
-                        label = { Text("${pair.pendingConflicts} conflicts") },
-                        leadingIcon = { Icon(Icons.Default.Warning, null, Modifier.size(16.dp)) },
-                        colors = AssistChipDefaults.assistChipColors(
-                            containerColor = MaterialTheme.colorScheme.errorContainer,
-                        ),
+                Box(
+                    modifier = Modifier
+                        .fillMaxHeight()
+                        .width(3.dp),
+                ) {
+                    Surface(
+                        modifier = Modifier.fillMaxSize(),
+                        color = accentColor,
+                    ) {}
+                }
+            }
+
+            Column(modifier = Modifier.padding(start = 12.dp, top = 12.dp, end = 12.dp, bottom = 12.dp)) {
+                Row(verticalAlignment = Alignment.CenterVertically) {
+                    Column(modifier = Modifier.weight(1f)) {
+                        Text(
+                            pair.name,
+                            style = MaterialTheme.typography.titleMedium,
+                        )
+                        Spacer(Modifier.height(2.dp))
+                        val localShortName = pair.localPath.toDisplayPath()
+                        Text(
+                            localShortName,
+                            style = MaterialTheme.typography.bodySmall,
+                            color = MaterialTheme.colorScheme.onSurfaceVariant,
+                        )
+                        Spacer(Modifier.height(2.dp))
+                        Row(verticalAlignment = Alignment.CenterVertically) {
+                            Icon(
+                                Icons.Default.ArrowForward,
+                                contentDescription = null,
+                                modifier = Modifier.size(12.dp),
+                                tint = MaterialTheme.colorScheme.onSurfaceVariant,
+                            )
+                            Spacer(Modifier.width(4.dp))
+                            Text(
+                                pair.remotePath,
+                                style = MaterialTheme.typography.bodySmall,
+                                color = MaterialTheme.colorScheme.onSurfaceVariant,
+                            )
+                        }
+                    }
+                    Switch(
+                        checked = pair.isEnabled,
+                        onCheckedChange = { onToggle() },
                     )
                 }
-                Spacer(Modifier.weight(1f))
-                pair.lastSyncAt?.let { at ->
-                    Text(
-                        at.formatRelative(),
-                        style = MaterialTheme.typography.labelSmall,
-                        color = MaterialTheme.colorScheme.onSurfaceVariant,
+                Spacer(Modifier.height(8.dp))
+                Row(
+                    verticalAlignment = Alignment.CenterVertically,
+                    horizontalArrangement = Arrangement.spacedBy(8.dp),
+                ) {
+                    StatusPill(pair.lastSyncResult)
+                    if (pair.pendingConflicts > 0) {
+                        Surface(
+                            shape = RoundedCornerShape(50),
+                            color = MaterialTheme.colorScheme.errorContainer,
+                        ) {
+                            Row(
+                                modifier = Modifier.padding(horizontal = 8.dp, vertical = 4.dp),
+                                verticalAlignment = Alignment.CenterVertically,
+                                horizontalArrangement = Arrangement.spacedBy(4.dp),
+                            ) {
+                                Icon(Icons.Default.Warning, null, Modifier.size(12.dp), tint = MaterialTheme.colorScheme.error)
+                                Text(
+                                    "${pair.pendingConflicts} conflicts",
+                                    style = MaterialTheme.typography.labelSmall,
+                                    color = MaterialTheme.colorScheme.error,
+                                )
+                            }
+                        }
+                    }
+                    Spacer(Modifier.weight(1f))
+                    pair.lastSyncAt?.let { at ->
+                        Text(
+                            at.toRelativeString(),
+                            style = MaterialTheme.typography.labelSmall,
+                            color = MaterialTheme.colorScheme.onSurfaceVariant,
+                        )
+                    }
+                    val syncRotation by rememberInfiniteTransition(label = "cardSyncSpin").animateFloat(
+                        initialValue = 0f, targetValue = 360f,
+                        animationSpec = infiniteRepeatable(tween(900, easing = LinearEasing)),
+                        label = "cardRotation",
                     )
-                }
-                FilledTonalIconButton(onClick = onSync, modifier = Modifier.size(36.dp)) {
-                    Icon(Icons.Default.Sync, "Sync now", modifier = Modifier.size(18.dp))
+                    FilledTonalIconButton(onClick = onSync, modifier = Modifier.size(36.dp)) {
+                        Icon(
+                            Icons.Default.Sync, "Sync now",
+                            modifier = Modifier.size(18.dp).graphicsLayer {
+                                if (pair.lastSyncResult == SyncStatus.SYNCING) rotationZ = syncRotation
+                            },
+                        )
+                    }
                 }
             }
         }
@@ -108,21 +185,38 @@ private fun SyncPairCard(
 }
 
 @Composable
-private fun StatusChip(status: SyncStatus) {
-    val (icon, label, color) = when (status) {
-        SyncStatus.SUCCESS -> Triple(Icons.Default.CheckCircle, "Synced", MaterialTheme.colorScheme.primaryContainer)
-        SyncStatus.SYNCING -> Triple(Icons.Default.Sync, "Syncing…", MaterialTheme.colorScheme.secondaryContainer)
-        SyncStatus.FAILED -> Triple(Icons.Default.Error, "Failed", MaterialTheme.colorScheme.errorContainer)
-        SyncStatus.CONFLICT -> Triple(Icons.Default.Warning, "Conflict", MaterialTheme.colorScheme.tertiaryContainer)
-        SyncStatus.PARTIAL -> Triple(Icons.Default.WarningAmber, "Partial", MaterialTheme.colorScheme.tertiaryContainer)
-        SyncStatus.IDLE -> Triple(Icons.Outlined.Circle, "Idle", MaterialTheme.colorScheme.surfaceVariant)
+private fun StatusPill(status: SyncStatus) {
+    val (icon, label) = when (status) {
+        SyncStatus.SUCCESS  -> Pair(Icons.Default.CheckCircle, "Synced")
+        SyncStatus.SYNCING  -> Pair(Icons.Default.Sync, "Syncing…")
+        SyncStatus.FAILED   -> Pair(Icons.Default.Error, "Failed")
+        SyncStatus.CONFLICT -> Pair(Icons.Default.Warning, "Conflict")
+        SyncStatus.PARTIAL  -> Pair(Icons.Default.WarningAmber, "Partial")
+        SyncStatus.IDLE     -> Pair(Icons.Outlined.Circle, "Idle")
     }
-    AssistChip(
-        onClick = {},
-        label = { Text(label) },
-        leadingIcon = { Icon(icon, null, Modifier.size(16.dp)) },
-        colors = AssistChipDefaults.assistChipColors(containerColor = color),
+    val containerColor = status.accentColor
+    val rotation by rememberInfiniteTransition(label = "syncSpin").animateFloat(
+        initialValue = 0f, targetValue = 360f,
+        animationSpec = infiniteRepeatable(tween(1000, easing = LinearEasing)),
+        label = "rotation",
     )
+    Surface(
+        shape = RoundedCornerShape(50),
+        color = containerColor.copy(alpha = 0.15f),
+    ) {
+        Row(
+            modifier = Modifier.padding(horizontal = 8.dp, vertical = 4.dp),
+            verticalAlignment = Alignment.CenterVertically,
+            horizontalArrangement = Arrangement.spacedBy(4.dp),
+        ) {
+            Icon(
+                icon, null,
+                Modifier.size(12.dp).graphicsLayer { if (status == SyncStatus.SYNCING) rotationZ = rotation },
+                tint = containerColor,
+            )
+            Text(label, style = MaterialTheme.typography.labelSmall, color = containerColor)
+        }
+    }
 }
 
 @Composable
@@ -132,15 +226,49 @@ private fun EmptyState(modifier: Modifier = Modifier, onAdd: () -> Unit) {
         horizontalAlignment = Alignment.CenterHorizontally,
         verticalArrangement = Arrangement.Center,
     ) {
-        Icon(Icons.Outlined.CloudSync, null, modifier = Modifier.size(80.dp), tint = MaterialTheme.colorScheme.primary)
+        Icon(
+            Icons.Outlined.CloudSync,
+            null,
+            modifier = Modifier.size(100.dp),
+            tint = MaterialTheme.colorScheme.primary.copy(alpha = 0.4f),
+        )
         Spacer(Modifier.height(16.dp))
-        Text("No sync pairs yet", style = MaterialTheme.typography.titleLarge, fontWeight = FontWeight.Medium)
+        Text("No sync pairs yet", style = MaterialTheme.typography.titleLarge)
         Spacer(Modifier.height(8.dp))
-        Text("Tap + to create your first sync", style = MaterialTheme.typography.bodyMedium, color = MaterialTheme.colorScheme.onSurfaceVariant)
+        Text(
+            "Tap + to create your first sync",
+            style = MaterialTheme.typography.bodyMedium,
+            color = MaterialTheme.colorScheme.onSurfaceVariant,
+        )
         Spacer(Modifier.height(24.dp))
-        Button(onClick = onAdd) { Text("Add Sync Pair") }
+        FilledTonalButton(onClick = onAdd) { Text("Add Sync Pair") }
     }
 }
 
-private val fmt = DateTimeFormatter.ofLocalizedDateTime(FormatStyle.SHORT)
-private fun Instant.formatRelative(): String = fmt.format(atZone(ZoneId.systemDefault()))
+private val SyncStatus.accentColor: Color
+    @Composable get() = when (this) {
+        SyncStatus.SUCCESS              -> MaterialTheme.colorScheme.primary
+        SyncStatus.SYNCING              -> MaterialTheme.colorScheme.secondary
+        SyncStatus.FAILED               -> MaterialTheme.colorScheme.error
+        SyncStatus.CONFLICT,
+        SyncStatus.PARTIAL              -> MaterialTheme.colorScheme.tertiary
+        SyncStatus.IDLE                 -> MaterialTheme.colorScheme.outline
+    }
+
+private fun String.toDisplayPath(): String {
+    // For SAF content:// URIs, decode the last path segment (e.g. primary%3ASyncFlowTest → SyncFlowTest)
+    val decoded = java.net.URLDecoder.decode(this, "UTF-8")
+    return decoded.trimEnd('/').substringAfterLast('/').substringAfterLast(':').ifEmpty { decoded }
+}
+
+private fun Instant.toRelativeString(): String {
+    val diff = Duration.between(this, Instant.now()).abs()
+    return when {
+        diff.toMinutes() < 1  -> "Just now"
+        diff.toMinutes() < 60 -> "${diff.toMinutes()} min ago"
+        diff.toHours() < 24   -> "${diff.toHours()} hr ago"
+        diff.toDays() == 1L   -> "Yesterday"
+        else -> DateTimeFormatter.ofLocalizedDate(FormatStyle.SHORT)
+            .format(atZone(ZoneId.systemDefault()))
+    }
+}

app/src/main/kotlin/com/syncflow/ui/home/HomeViewModel.kt

@@ -1,13 +1,17 @@
 package com.syncflow.ui.home
 
+import android.content.Context
 import androidx.lifecycle.ViewModel
 import androidx.lifecycle.viewModelScope
+import androidx.work.ExistingPeriodicWorkPolicy
 import androidx.work.WorkManager
 import com.syncflow.data.db.SyncPairDao
 import com.syncflow.data.db.entities.SyncPairEntity
 import com.syncflow.domain.model.ScheduleType
+import com.syncflow.worker.FileWatchService
 import com.syncflow.worker.SyncWorker
 import dagger.hilt.android.lifecycle.HiltViewModel
+import dagger.hilt.android.qualifiers.ApplicationContext
 import kotlinx.coroutines.flow.SharingStarted
 import kotlinx.coroutines.flow.stateIn
 import kotlinx.coroutines.launch
@@ -17,33 +21,41 @@ import javax.inject.Inject
 class HomeViewModel @Inject constructor(
     private val syncPairDao: SyncPairDao,
     private val workManager: WorkManager,
+    @ApplicationContext private val context: Context,
 ) : ViewModel() {
 
     val syncPairs = syncPairDao.observeAll()
         .stateIn(viewModelScope, SharingStarted.WhileSubscribed(5000), emptyList())
 
     fun triggerSync(pair: SyncPairEntity) {
-        val req = SyncWorker.buildOneTimeRequest(pair.id, pair.wifiOnly, pair.chargingOnly)
+        val req = SyncWorker.buildOneTimeRequest(pair.id, wifiOnly = false, chargingOnly = false)
         workManager.enqueue(req)
     }
 
     fun toggleEnabled(pair: SyncPairEntity) {
         viewModelScope.launch {
-            syncPairDao.update(pair.copy(isEnabled = !pair.isEnabled))
-            if (!pair.isEnabled && pair.scheduleType != ScheduleType.MANUAL) {
-                val req = SyncWorker.buildPeriodicRequest(
-                    pair.id,
-                    pair.scheduleIntervalMinutes.toLong().coerceAtLeast(15),
-                    pair.wifiOnly,
-                    pair.chargingOnly,
-                )
-                workManager.enqueueUniquePeriodicWork(
-                    "periodic_${pair.id}",
-                    androidx.work.ExistingPeriodicWorkPolicy.UPDATE,
-                    req,
-                )
+            val nowEnabled = !pair.isEnabled
+            syncPairDao.update(pair.copy(isEnabled = nowEnabled))
+            if (nowEnabled) {
+                when (pair.scheduleType) {
+                    ScheduleType.ON_CHANGE -> FileWatchService.start(context)
+                    ScheduleType.MANUAL -> { /* nothing */ }
+                    else -> {
+                        val req = SyncWorker.buildPeriodicRequest(
+                            pair.id,
+                            pair.scheduleIntervalMinutes.toLong().coerceAtLeast(15),
+                            pair.wifiOnly,
+                            pair.chargingOnly,
+                        )
+                        workManager.enqueueUniquePeriodicWork("periodic_${pair.id}", ExistingPeriodicWorkPolicy.UPDATE, req)
+                    }
+                }
             } else {
                 workManager.cancelAllWorkByTag("sync_${pair.id}")
+                // Refresh watcher (it will stop itself if no ON_CHANGE pairs remain)
+                if (pair.scheduleType == ScheduleType.ON_CHANGE) {
+                    FileWatchService.start(context)
+                }
             }
         }
     }

app/src/main/kotlin/com/syncflow/ui/log/LogScreen.kt

@@ -0,0 +1,152 @@
+package com.syncflow.ui.log
+
+import androidx.compose.foundation.layout.*
+import androidx.compose.foundation.lazy.LazyColumn
+import androidx.compose.foundation.lazy.items
+import androidx.compose.foundation.shape.RoundedCornerShape
+import androidx.compose.material.icons.Icons
+import androidx.compose.material.icons.filled.*
+import androidx.compose.material3.*
+import androidx.compose.runtime.*
+import androidx.compose.ui.Alignment
+import androidx.compose.ui.Modifier
+import androidx.compose.ui.unit.dp
+import androidx.hilt.navigation.compose.hiltViewModel
+import com.syncflow.domain.model.SyncEventType
+import com.syncflow.ui.shared.iconAndTint
+import com.syncflow.ui.shared.label
+import java.time.Duration
+import java.time.Instant
+import java.time.ZoneId
+import java.time.format.DateTimeFormatter
+import java.time.format.FormatStyle
+
+@Composable
+fun LogScreen(
+    modifier: Modifier = Modifier,
+    vm: LogViewModel = hiltViewModel(),
+) {
+    val entries by vm.entries.collectAsState()
+
+    if (entries.isEmpty()) {
+        Box(
+            modifier = modifier.fillMaxSize(),
+            contentAlignment = Alignment.Center,
+        ) {
+            Column(
+                horizontalAlignment = Alignment.CenterHorizontally,
+                verticalArrangement = Arrangement.spacedBy(8.dp),
+            ) {
+                Icon(
+                    Icons.Default.Notifications,
+                    contentDescription = null,
+                    modifier = Modifier.size(72.dp),
+                    tint = MaterialTheme.colorScheme.primary.copy(alpha = 0.35f),
+                )
+                Text("No activity yet", style = MaterialTheme.typography.titleMedium)
+                Text(
+                    "Sync events will appear here",
+                    style = MaterialTheme.typography.bodySmall,
+                    color = MaterialTheme.colorScheme.onSurfaceVariant,
+                )
+            }
+        }
+    } else {
+        LazyColumn(
+            modifier = modifier.fillMaxSize(),
+            contentPadding = PaddingValues(horizontal = 16.dp, vertical = 8.dp),
+            verticalArrangement = Arrangement.spacedBy(0.dp),
+        ) {
+            // Group entries by calendar date
+            val grouped = entries.groupBy { entry ->
+                entry.event.timestamp.atZone(ZoneId.systemDefault()).toLocalDate()
+            }
+            grouped.forEach { (date, dayEntries) ->
+                item(key = date.toString()) {
+                    Text(
+                        text = date.toRelativeLabel(),
+                        style = MaterialTheme.typography.labelMedium,
+                        color = MaterialTheme.colorScheme.primary,
+                        modifier = Modifier.padding(top = 16.dp, bottom = 4.dp),
+                    )
+                }
+                items(dayEntries, key = { it.event.id }) { entry ->
+                    LogEntryRow(entry)
+                    HorizontalDivider(
+                        color = MaterialTheme.colorScheme.outline.copy(alpha = 0.3f),
+                        modifier = Modifier.padding(start = 52.dp),
+                    )
+                }
+            }
+            item { Spacer(Modifier.height(80.dp)) }
+        }
+    }
+}
+
+@Composable
+private fun LogEntryRow(entry: LogEntry) {
+    val (icon, tint) = entry.event.eventType.iconAndTint()
+    val timeFmt = DateTimeFormatter.ofLocalizedTime(FormatStyle.SHORT)
+    val timeStr = entry.event.timestamp.atZone(ZoneId.systemDefault()).let { timeFmt.format(it) }
+
+    Row(
+        modifier = Modifier
+            .fillMaxWidth()
+            .padding(vertical = 10.dp),
+        verticalAlignment = Alignment.Top,
+    ) {
+        // Icon bubble
+        Surface(
+            shape = RoundedCornerShape(10.dp),
+            color = tint.copy(alpha = 0.12f),
+            modifier = Modifier.size(36.dp),
+        ) {
+            Box(contentAlignment = Alignment.Center) {
+                Icon(icon, contentDescription = null, Modifier.size(18.dp), tint = tint)
+            }
+        }
+        Spacer(Modifier.width(12.dp))
+        Column(modifier = Modifier.weight(1f)) {
+            Row(
+                modifier = Modifier.fillMaxWidth(),
+                horizontalArrangement = Arrangement.SpaceBetween,
+                verticalAlignment = Alignment.CenterVertically,
+            ) {
+                Text(
+                    entry.pairName,
+                    style = MaterialTheme.typography.labelMedium,
+                    color = MaterialTheme.colorScheme.primary,
+                    modifier = Modifier.weight(1f, fill = false),
+                )
+                Text(
+                    timeStr,
+                    style = MaterialTheme.typography.labelSmall,
+                    color = MaterialTheme.colorScheme.onSurfaceVariant,
+                )
+            }
+            Spacer(Modifier.height(2.dp))
+            Text(
+                text = entry.event.eventType.label(),
+                style = MaterialTheme.typography.bodySmall,
+            )
+            val detail = entry.event.filePath ?: entry.event.message
+            if (detail != null) {
+                Text(
+                    text = detail,
+                    style = MaterialTheme.typography.labelSmall,
+                    color = MaterialTheme.colorScheme.onSurfaceVariant,
+                    maxLines = 1,
+                )
+            }
+        }
+    }
+}
+
+private fun java.time.LocalDate.toRelativeLabel(): String {
+    val today = java.time.LocalDate.now()
+    return when {
+        this == today -> "Today"
+        this == today.minusDays(1) -> "Yesterday"
+        else -> DateTimeFormatter.ofLocalizedDate(FormatStyle.MEDIUM).format(this)
+    }
+}

app/src/main/kotlin/com/syncflow/ui/log/LogViewModel.kt

@@ -0,0 +1,29 @@
+package com.syncflow.ui.log
+
+import androidx.lifecycle.ViewModel
+import androidx.lifecycle.viewModelScope
+import com.syncflow.data.db.SyncEventDao
+import com.syncflow.data.db.SyncPairDao
+import com.syncflow.data.db.entities.SyncEventEntity
+import dagger.hilt.android.lifecycle.HiltViewModel
+import kotlinx.coroutines.flow.SharingStarted
+import kotlinx.coroutines.flow.combine
+import kotlinx.coroutines.flow.stateIn
+import javax.inject.Inject
+
+data class LogEntry(val event: SyncEventEntity, val pairName: String)
+
+@HiltViewModel
+class LogViewModel @Inject constructor(
+    syncEventDao: SyncEventDao,
+    syncPairDao: SyncPairDao,
+) : ViewModel() {
+
+    val entries = combine(
+        syncEventDao.observeAll(500),
+        syncPairDao.observeAll(),
+    ) { events, pairs ->
+        val pairNames = pairs.associateBy({ it.id }, { it.name })
+        events.map { LogEntry(it, pairNames[it.syncPairId] ?: "Unknown") }
+    }.stateIn(viewModelScope, SharingStarted.WhileSubscribed(5_000), emptyList())
+}

app/src/main/kotlin/com/syncflow/ui/main/MainShell.kt

@@ -6,22 +6,38 @@ import androidx.compose.animation.fadeOut
 import androidx.compose.animation.scaleIn
 import androidx.compose.animation.scaleOut
 import androidx.compose.foundation.ExperimentalFoundationApi
+import androidx.compose.foundation.layout.Row
+import androidx.compose.foundation.layout.Spacer
 import androidx.compose.foundation.layout.fillMaxSize
 import androidx.compose.foundation.layout.padding
+import androidx.compose.foundation.layout.size
+import androidx.compose.foundation.layout.width
+import androidx.compose.foundation.layout.WindowInsets
+import androidx.compose.foundation.layout.statusBars
+import androidx.compose.foundation.layout.windowInsetsPadding
 import androidx.compose.foundation.pager.HorizontalPager
 import androidx.compose.foundation.pager.rememberPagerState
 import androidx.compose.material.icons.Icons
 import androidx.compose.material.icons.filled.Add
+import androidx.compose.material.icons.filled.Folder
 import androidx.compose.material.icons.filled.ManageAccounts
+import androidx.compose.material.icons.filled.Notifications
 import androidx.compose.material.icons.filled.Sync
+import androidx.compose.material.icons.outlined.FolderOpen
 import androidx.compose.material.icons.outlined.ManageAccounts
+import androidx.compose.material.icons.outlined.NotificationsNone
 import androidx.compose.material.icons.outlined.Sync
 import androidx.compose.material3.*
 import androidx.compose.runtime.Composable
 import androidx.compose.runtime.rememberCoroutineScope
+import androidx.compose.ui.Alignment
 import androidx.compose.ui.Modifier
-import androidx.compose.ui.text.font.FontWeight
+import androidx.compose.ui.res.painterResource
+import androidx.compose.ui.unit.dp
+import com.syncflow.R
+import com.syncflow.ui.files.FilesScreen
 import com.syncflow.ui.home.HomeScreen
+import com.syncflow.ui.log.LogScreen
 import com.syncflow.ui.settings.SettingsScreen
 import kotlinx.coroutines.launch
 
@@ -32,17 +48,32 @@ fun MainShell(
     onPairClick: (Long) -> Unit,
     onAddAccount: () -> Unit,
 ) {
-    val pagerState = rememberPagerState(pageCount = { 2 })
+    val pagerState = rememberPagerState(pageCount = { 4 })
     val scope = rememberCoroutineScope()
     val currentPage = pagerState.currentPage
 
     Scaffold(
         topBar = {
-            TopAppBar(
-                title = { Text("SyncFlow", fontWeight = FontWeight.Bold) },
-                colors = TopAppBarDefaults.topAppBarColors(
+            CenterAlignedTopAppBar(
+                title = {
+                    Row(verticalAlignment = Alignment.CenterVertically) {
+                        Icon(
+                            painter = painterResource(id = R.drawable.ic_sync),
+                            contentDescription = null,
+                            modifier = Modifier.size(20.dp),
+                            tint = MaterialTheme.colorScheme.primary,
+                        )
+                        Spacer(Modifier.width(8.dp))
+                        Text(
+                            "SyncFlow",
+                            style = MaterialTheme.typography.titleLarge,
+                        )
+                    }
+                },
+                colors = TopAppBarDefaults.centerAlignedTopAppBarColors(
                     containerColor = MaterialTheme.colorScheme.surface,
                 ),
+                modifier = Modifier.windowInsetsPadding(WindowInsets.statusBars),
             )
         },
         bottomBar = {
@@ -63,7 +94,29 @@ fun MainShell(
                     onClick = { scope.launch { pagerState.animateScrollToPage(1) } },
                     icon = {
                         Icon(
-                            if (currentPage == 1) Icons.Filled.ManageAccounts else Icons.Outlined.ManageAccounts,
+                            if (currentPage == 1) Icons.Filled.Notifications else Icons.Outlined.NotificationsNone,
+                            contentDescription = null,
+                        )
+                    },
+                    label = { Text("Log") },
+                )
+                NavigationBarItem(
+                    selected = currentPage == 2,
+                    onClick = { scope.launch { pagerState.animateScrollToPage(2) } },
+                    icon = {
+                        Icon(
+                            if (currentPage == 2) Icons.Filled.Folder else Icons.Outlined.FolderOpen,
+                            contentDescription = null,
+                        )
+                    },
+                    label = { Text("Files") },
+                )
+                NavigationBarItem(
+                    selected = currentPage == 3,
+                    onClick = { scope.launch { pagerState.animateScrollToPage(3) } },
+                    icon = {
+                        Icon(
+                            if (currentPage == 3) Icons.Filled.ManageAccounts else Icons.Outlined.ManageAccounts,
                             contentDescription = null,
                         )
                     },
@@ -81,6 +134,8 @@ fun MainShell(
                     text = { Text("Add Sync") },
                     icon = { Icon(Icons.Default.Add, null) },
                     onClick = onAddPair,
+                    containerColor = MaterialTheme.colorScheme.primary,
+                    contentColor = MaterialTheme.colorScheme.onPrimary,
                 )
             }
         },
@@ -93,7 +148,9 @@ fun MainShell(
         ) { page ->
             when (page) {
                 0 -> HomeScreen(onAddPair = onAddPair, onPairClick = onPairClick)
-                1 -> SettingsScreen(onAddAccount = onAddAccount)
+                1 -> LogScreen()
+                2 -> FilesScreen()
+                3 -> SettingsScreen(onAddAccount = onAddAccount)
             }
         }
     }

app/src/main/kotlin/com/syncflow/ui/navigation/NavGraph.kt

@@ -48,6 +48,7 @@ fun SyncFlowNavGraph(navController: NavHostController) {
         ) {
             PairDetailScreen(
                 onBack = { navController.popBackStack() },
+                onEdit = { id -> navController.navigate(Screen.AddPair.route(id)) },
                 onConflicts = { id -> navController.navigate(Screen.Conflicts.route(id)) },
             )
         }

app/src/main/kotlin/com/syncflow/ui/pairdetail/PairDetailScreen.kt

@@ -1,18 +1,30 @@
 package com.syncflow.ui.pairdetail
 
+import androidx.compose.animation.core.LinearEasing
+import androidx.compose.animation.core.animateFloat
+import androidx.compose.animation.core.infiniteRepeatable
+import androidx.compose.animation.core.rememberInfiniteTransition
+import androidx.compose.animation.core.tween
 import androidx.compose.foundation.layout.*
 import androidx.compose.foundation.lazy.LazyColumn
 import androidx.compose.foundation.lazy.items
+import androidx.compose.foundation.shape.RoundedCornerShape
 import androidx.compose.material.icons.Icons
 import androidx.compose.material.icons.filled.*
+import androidx.compose.material.icons.outlined.Circle
 import androidx.compose.material3.*
 import androidx.compose.runtime.*
 import androidx.compose.ui.Alignment
 import androidx.compose.ui.Modifier
+import androidx.compose.ui.draw.clip
+import androidx.compose.ui.graphics.graphicsLayer
 import androidx.compose.ui.unit.dp
 import androidx.hilt.navigation.compose.hiltViewModel
-import com.syncflow.data.db.entities.SyncEventEntity
-import com.syncflow.domain.model.SyncEventType
+import com.syncflow.data.db.entities.SyncPairEntity
+import com.syncflow.domain.model.SyncStatus
+import com.syncflow.ui.shared.SyncEventRow
+import java.time.Duration
+import java.time.Instant
 import java.time.ZoneId
 import java.time.format.DateTimeFormatter
 import java.time.format.FormatStyle
@@ -21,6 +33,7 @@ import java.time.format.FormatStyle
 @Composable
 fun PairDetailScreen(
     onBack: () -> Unit,
+    onEdit: (Long) -> Unit,
     onConflicts: (Long) -> Unit,
     vm: PairDetailViewModel = hiltViewModel(),
 ) {
@@ -35,7 +48,10 @@ fun PairDetailScreen(
             title = { Text("Delete sync pair?") },
             text = { Text("This removes the pair and all sync history. Files are NOT deleted.") },
             confirmButton = {
-                TextButton(onClick = { vm.delete(); onBack() }, colors = ButtonDefaults.textButtonColors(contentColor = MaterialTheme.colorScheme.error)) {
+                TextButton(
+                    onClick = { vm.delete(); onBack() },
+                    colors = ButtonDefaults.textButtonColors(contentColor = MaterialTheme.colorScheme.error),
+                ) {
                     Text("Delete")
                 }
             },
@@ -49,6 +65,7 @@ fun PairDetailScreen(
                 title = { Text(pair?.name ?: "…") },
                 navigationIcon = { IconButton(onClick = onBack) { Icon(Icons.Default.ArrowBack, "Back") } },
                 actions = {
+                    IconButton(onClick = { pair?.let { onEdit(it.id) } }) { Icon(Icons.Default.Edit, "Edit") }
                     IconButton(onClick = { vm.syncNow() }) { Icon(Icons.Default.Sync, "Sync now") }
                     IconButton(onClick = { showDelete = true }) { Icon(Icons.Default.Delete, "Delete") }
                 },
@@ -58,8 +75,12 @@ fun PairDetailScreen(
         LazyColumn(
             modifier = Modifier.padding(padding),
             contentPadding = PaddingValues(16.dp),
-            verticalArrangement = Arrangement.spacedBy(8.dp),
+            verticalArrangement = Arrangement.spacedBy(12.dp),
         ) {
+            item {
+                pair?.let { p -> StatusBanner(p) }
+            }
+
             item {
                 pair?.let { p ->
                     InfoCard(p.localPath, p.remotePath, p.syncDirection.name, p.scheduleType.name)
@@ -83,8 +104,22 @@ fun PairDetailScreen(
             }
 
             item {
-                Text("Activity", style = MaterialTheme.typography.titleSmall, color = MaterialTheme.colorScheme.primary)
-                HorizontalDivider(modifier = Modifier.padding(vertical = 4.dp))
+                Row(
+                    verticalAlignment = Alignment.CenterVertically,
+                    modifier = Modifier.padding(top = 4.dp),
+                ) {
+                    Box(
+                        modifier = Modifier
+                            .width(3.dp)
+                            .height(16.dp)
+                            .clip(RoundedCornerShape(2.dp)),
+                    ) {
+                        Surface(color = MaterialTheme.colorScheme.primary, modifier = Modifier.fillMaxSize()) {}
+                    }
+                    Spacer(Modifier.width(8.dp))
+                    Text("Activity", style = MaterialTheme.typography.titleSmall)
+                }
+                HorizontalDivider(modifier = Modifier.padding(top = 4.dp))
             }
 
             if (events.isEmpty()) {
@@ -95,7 +130,48 @@ fun PairDetailScreen(
                 }
             } else {
                 items(events, key = { it.id }) { event ->
-                    EventRow(event)
+                    SyncEventRow(event, showDivider = event != events.last())
+                }
+            }
+        }
+    }
+}
+
+@Composable
+private fun StatusBanner(pair: SyncPairEntity) {
+    val (icon, label, containerColor) = when (pair.lastSyncResult) {
+        SyncStatus.SUCCESS  -> Triple(Icons.Default.CheckCircle, "Synced",    MaterialTheme.colorScheme.primaryContainer)
+        SyncStatus.SYNCING  -> Triple(Icons.Default.Sync,        "Syncing…",  MaterialTheme.colorScheme.secondaryContainer)
+        SyncStatus.FAILED   -> Triple(Icons.Default.Error,       "Failed",    MaterialTheme.colorScheme.errorContainer)
+        SyncStatus.CONFLICT -> Triple(Icons.Default.Warning,     "Conflict",  MaterialTheme.colorScheme.tertiaryContainer)
+        SyncStatus.PARTIAL  -> Triple(Icons.Default.WarningAmber,"Partial",   MaterialTheme.colorScheme.tertiaryContainer)
+        SyncStatus.IDLE     -> Triple(Icons.Outlined.Circle,     "Idle",      MaterialTheme.colorScheme.surfaceVariant)
+    }
+    val rotation by rememberInfiniteTransition(label = "bannerSpin").animateFloat(
+        initialValue = 0f, targetValue = 360f,
+        animationSpec = infiniteRepeatable(tween(1000, easing = LinearEasing)),
+        label = "bannerRotation",
+    )
+    Surface(
+        color = containerColor,
+        shape = RoundedCornerShape(16.dp),
+        modifier = Modifier.fillMaxWidth(),
+    ) {
+        Row(
+            modifier = Modifier.padding(16.dp),
+            verticalAlignment = Alignment.CenterVertically,
+        ) {
+            Icon(
+                icon, null,
+                modifier = Modifier.size(40.dp).graphicsLayer {
+                    if (pair.lastSyncResult == SyncStatus.SYNCING) rotationZ = rotation
+                },
+            )
+            Spacer(Modifier.width(16.dp))
+            Column {
+                Text(label, style = MaterialTheme.typography.titleMedium)
+                pair.lastSyncAt?.let {
+                    Text(it.toRelativeString(), style = MaterialTheme.typography.bodySmall)
                 }
             }
         }
@@ -104,62 +180,68 @@ fun PairDetailScreen(
 
 @Composable
 private fun InfoCard(localPath: String, remotePath: String, direction: String, schedule: String) {
-    ElevatedCard(modifier = Modifier.fillMaxWidth()) {
-        Column(modifier = Modifier.padding(16.dp), verticalArrangement = Arrangement.spacedBy(6.dp)) {
-            InfoRow(Icons.Default.PhoneAndroid, "Local", localPath)
-            InfoRow(Icons.Default.Cloud, "Remote", remotePath)
-            InfoRow(Icons.Default.SwapHoriz, "Direction", direction)
-            InfoRow(Icons.Default.Schedule, "Schedule", schedule)
-        }
-    }
-}
-
-@Composable
-private fun InfoRow(icon: androidx.compose.ui.graphics.vector.ImageVector, label: String, value: String) {
-    Row(verticalAlignment = Alignment.CenterVertically) {
-        Icon(icon, null, Modifier.size(16.dp), tint = MaterialTheme.colorScheme.primary)
-        Spacer(Modifier.width(8.dp))
-        Text("$label: ", style = MaterialTheme.typography.labelMedium)
-        Text(value, style = MaterialTheme.typography.bodySmall, modifier = Modifier.weight(1f))
-    }
-}
-
-@Composable
-private fun EventRow(event: SyncEventEntity) {
-    val fmt = DateTimeFormatter.ofLocalizedTime(FormatStyle.SHORT)
-    val zone = ZoneId.systemDefault()
-    val (icon, tint) = eventIcon(event.eventType)
-    Row(
-        modifier = Modifier.fillMaxWidth().padding(vertical = 2.dp),
-        verticalAlignment = Alignment.CenterVertically,
+    Card(
+        modifier = Modifier.fillMaxWidth(),
+        shape = RoundedCornerShape(16.dp),
+        border = androidx.compose.foundation.BorderStroke(1.dp, MaterialTheme.colorScheme.outline),
+        colors = CardDefaults.cardColors(containerColor = MaterialTheme.colorScheme.surface),
     ) {
-        Icon(icon, null, Modifier.size(16.dp), tint = tint)
-        Spacer(Modifier.width(8.dp))
-        Column(modifier = Modifier.weight(1f)) {
-            Text(event.filePath ?: event.message ?: event.eventType.name, style = MaterialTheme.typography.bodySmall)
-            event.message?.takeIf { event.filePath != null }?.let {
-                Text(it, style = MaterialTheme.typography.labelSmall, color = MaterialTheme.colorScheme.onSurfaceVariant)
+        Column(modifier = Modifier.padding(16.dp), verticalArrangement = Arrangement.spacedBy(8.dp)) {
+            InfoRow(Icons.Default.PhoneAndroid, "Local", localPath.toDisplayPath())
+            HorizontalDivider(color = MaterialTheme.colorScheme.outline.copy(alpha = 0.5f))
+            InfoRow(Icons.Default.Cloud, "Remote", remotePath)
+            HorizontalDivider(color = MaterialTheme.colorScheme.outline.copy(alpha = 0.5f))
+            Row {
+                InfoRow(Icons.Default.SwapHoriz, "Direction", direction, modifier = Modifier.weight(1f))
+                InfoRow(Icons.Default.Schedule, "Schedule", schedule, modifier = Modifier.weight(1f))
             }
         }
-        Text(fmt.format(event.timestamp.atZone(zone)), style = MaterialTheme.typography.labelSmall, color = MaterialTheme.colorScheme.onSurfaceVariant)
     }
 }
 
 @Composable
-private fun eventIcon(type: SyncEventType): Pair<androidx.compose.ui.graphics.vector.ImageVector, androidx.compose.ui.graphics.Color> {
-    val green = MaterialTheme.colorScheme.primary
-    val red = MaterialTheme.colorScheme.error
-    val orange = MaterialTheme.colorScheme.tertiary
-    val grey = MaterialTheme.colorScheme.onSurfaceVariant
-    return when (type) {
-        SyncEventType.SYNC_STARTED -> Pair(Icons.Default.PlayArrow, green)
-        SyncEventType.SYNC_COMPLETED -> Pair(Icons.Default.CheckCircle, green)
-        SyncEventType.SYNC_FAILED -> Pair(Icons.Default.Error, red)
-        SyncEventType.FILE_UPLOADED -> Pair(Icons.Default.Upload, green)
-        SyncEventType.FILE_DOWNLOADED -> Pair(Icons.Default.Download, green)
-        SyncEventType.FILE_DELETED -> Pair(Icons.Default.Delete, orange)
-        SyncEventType.FILE_SKIPPED -> Pair(Icons.Default.SkipNext, grey)
-        SyncEventType.CONFLICT_DETECTED -> Pair(Icons.Default.Warning, orange)
-        SyncEventType.CONFLICT_RESOLVED -> Pair(Icons.Default.CheckCircle, green)
+private fun InfoRow(
+    icon: androidx.compose.ui.graphics.vector.ImageVector,
+    label: String,
+    value: String,
+    modifier: Modifier = Modifier,
+) {
+    Row(verticalAlignment = Alignment.CenterVertically, modifier = modifier) {
+        Surface(
+            shape = RoundedCornerShape(8.dp),
+            color = MaterialTheme.colorScheme.primaryContainer,
+            modifier = Modifier.size(28.dp),
+        ) {
+            Box(contentAlignment = Alignment.Center) {
+                Icon(
+                    icon,
+                    null,
+                    Modifier.size(16.dp),
+                    tint = MaterialTheme.colorScheme.onPrimaryContainer,
+                )
+            }
+        }
+        Spacer(Modifier.width(8.dp))
+        Column {
+            Text(label, style = MaterialTheme.typography.labelSmall, color = MaterialTheme.colorScheme.onSurfaceVariant)
+            Text(value, style = MaterialTheme.typography.bodySmall)
+        }
+    }
+}
+
+private fun String.toDisplayPath(): String {
+    val decoded = java.net.URLDecoder.decode(this, "UTF-8")
+    return decoded.trimEnd('/').substringAfterLast('/').substringAfterLast(':').ifEmpty { decoded }
+}
+
+private fun Instant.toRelativeString(): String {
+    val diff = Duration.between(this, Instant.now()).abs()
+    return when {
+        diff.toMinutes() < 1  -> "Just now"
+        diff.toMinutes() < 60 -> "${diff.toMinutes()} min ago"
+        diff.toHours() < 24   -> "${diff.toHours()} hr ago"
+        diff.toDays() == 1L   -> "Yesterday"
+        else -> DateTimeFormatter.ofLocalizedDate(FormatStyle.SHORT)
+            .format(atZone(ZoneId.systemDefault()))
     }
 }

app/src/main/kotlin/com/syncflow/ui/pairdetail/PairDetailViewModel.kt

@@ -36,7 +36,7 @@ class PairDetailViewModel @Inject constructor(
 
     fun syncNow() {
         val p = pair.value ?: return
-        workManager.enqueue(SyncWorker.buildOneTimeRequest(p.id, p.wifiOnly, p.chargingOnly))
+        workManager.enqueue(SyncWorker.buildOneTimeRequest(p.id, wifiOnly = false, chargingOnly = false))
     }
 
     fun delete() {

app/src/main/kotlin/com/syncflow/ui/settings/SettingsScreen.kt

@@ -1,14 +1,17 @@
 package com.syncflow.ui.settings
 
+import androidx.compose.foundation.BorderStroke
 import androidx.compose.foundation.layout.*
 import androidx.compose.foundation.lazy.LazyColumn
 import androidx.compose.foundation.lazy.items
+import androidx.compose.foundation.shape.RoundedCornerShape
 import androidx.compose.material.icons.Icons
 import androidx.compose.material.icons.filled.*
 import androidx.compose.material3.*
 import androidx.compose.runtime.*
 import androidx.compose.ui.Alignment
 import androidx.compose.ui.Modifier
+import androidx.compose.ui.draw.clip
 import androidx.compose.ui.unit.dp
 import androidx.hilt.navigation.compose.hiltViewModel
 import com.syncflow.data.db.entities.CloudAccountEntity
@@ -45,15 +48,18 @@ fun SettingsScreen(
         verticalArrangement = Arrangement.spacedBy(8.dp),
     ) {
         item {
-            Row(verticalAlignment = Alignment.CenterVertically) {
-                Text("Cloud Accounts", style = MaterialTheme.typography.titleMedium, modifier = Modifier.weight(1f))
+            SectionHeader(title = "Cloud Accounts")
+            Spacer(Modifier.height(4.dp))
+            Row(
+                modifier = Modifier.fillMaxWidth(),
+                horizontalArrangement = Arrangement.End,
+            ) {
                 FilledTonalButton(onClick = onAddAccount) {
                     Icon(Icons.Default.Add, null, Modifier.size(18.dp))
                     Spacer(Modifier.width(6.dp))
                     Text("Add Account")
                 }
             }
-            HorizontalDivider(modifier = Modifier.padding(vertical = 4.dp))
         }
 
         if (accounts.isEmpty()) {
@@ -63,9 +69,22 @@ fun SettingsScreen(
                     horizontalAlignment = Alignment.CenterHorizontally,
                     verticalArrangement = Arrangement.spacedBy(8.dp),
                 ) {
-                    Icon(Icons.Default.CloudOff, null, Modifier.size(48.dp), tint = MaterialTheme.colorScheme.onSurfaceVariant)
-                    Text("No accounts yet", style = MaterialTheme.typography.bodyMedium, color = MaterialTheme.colorScheme.onSurfaceVariant)
-                    Text("Add a cloud account to start syncing", style = MaterialTheme.typography.bodySmall, color = MaterialTheme.colorScheme.onSurfaceVariant)
+                    Icon(
+                        Icons.Default.CloudOff,
+                        null,
+                        Modifier.size(48.dp),
+                        tint = MaterialTheme.colorScheme.onSurfaceVariant.copy(alpha = 0.5f),
+                    )
+                    Text(
+                        "No accounts yet",
+                        style = MaterialTheme.typography.bodyMedium,
+                        color = MaterialTheme.colorScheme.onSurfaceVariant,
+                    )
+                    Text(
+                        "Add a cloud account to start syncing",
+                        style = MaterialTheme.typography.bodySmall,
+                        color = MaterialTheme.colorScheme.onSurfaceVariant,
+                    )
                     OutlinedButton(onClick = onAddAccount) {
                         Icon(Icons.Default.Add, null, Modifier.size(16.dp))
                         Spacer(Modifier.width(6.dp))
@@ -80,40 +99,108 @@ fun SettingsScreen(
         }
 
         item {
-            Spacer(Modifier.height(16.dp))
-            Text("Security", style = MaterialTheme.typography.titleMedium)
-            HorizontalDivider(modifier = Modifier.padding(vertical = 4.dp))
-            Row(
-                modifier = Modifier.fillMaxWidth().padding(vertical = 4.dp),
-                verticalAlignment = Alignment.CenterVertically,
+            Spacer(Modifier.height(8.dp))
+            SectionHeader(title = "Security")
+            Spacer(Modifier.height(4.dp))
+            Card(
+                modifier = Modifier.fillMaxWidth(),
+                shape = RoundedCornerShape(16.dp),
+                border = BorderStroke(1.dp, MaterialTheme.colorScheme.outline),
+                colors = CardDefaults.cardColors(containerColor = MaterialTheme.colorScheme.surface),
             ) {
-                Column(modifier = Modifier.weight(1f)) {
-                    Text("Biometric Lock", style = MaterialTheme.typography.bodyMedium)
-                    Text(
-                        "Require biometrics when returning to app",
-                        style = MaterialTheme.typography.bodySmall,
-                        color = MaterialTheme.colorScheme.onSurfaceVariant,
-                    )
+                Row(
+                    modifier = Modifier.fillMaxWidth().padding(16.dp),
+                    verticalAlignment = Alignment.CenterVertically,
+                ) {
+                    Column(modifier = Modifier.weight(1f)) {
+                        Text("Biometric Lock", style = MaterialTheme.typography.bodyMedium)
+                        Text(
+                            "Require biometrics when returning to app",
+                            style = MaterialTheme.typography.bodySmall,
+                            color = MaterialTheme.colorScheme.onSurfaceVariant,
+                        )
+                    }
+                    Switch(checked = biometricEnabled, onCheckedChange = { vm.setBiometricLock(it) })
                 }
-                Switch(checked = biometricEnabled, onCheckedChange = { vm.setBiometricLock(it) })
             }
         }
 
         item {
-            Spacer(Modifier.height(16.dp))
-            Text("About", style = MaterialTheme.typography.titleMedium)
-            HorizontalDivider(modifier = Modifier.padding(vertical = 4.dp))
-            Text("SyncFlow v${com.syncflow.BuildConfig.VERSION_NAME} — Free, no subscription.", style = MaterialTheme.typography.bodySmall)
-            Text("Open source. No ads. No tracking.", style = MaterialTheme.typography.bodySmall, color = MaterialTheme.colorScheme.onSurfaceVariant)
+            Spacer(Modifier.height(8.dp))
+            SectionHeader(title = "About")
+            Spacer(Modifier.height(4.dp))
+            Card(
+                modifier = Modifier.fillMaxWidth(),
+                shape = RoundedCornerShape(16.dp),
+                border = BorderStroke(1.dp, MaterialTheme.colorScheme.outline),
+                colors = CardDefaults.cardColors(containerColor = MaterialTheme.colorScheme.surface),
+            ) {
+                Column(modifier = Modifier.padding(16.dp), verticalArrangement = Arrangement.spacedBy(4.dp)) {
+                    Text(
+                        "SyncFlow",
+                        style = MaterialTheme.typography.titleSmall,
+                    )
+                    Text(
+                        "Version ${com.syncflow.BuildConfig.VERSION_NAME} (build ${com.syncflow.BuildConfig.VERSION_CODE})",
+                        style = MaterialTheme.typography.bodySmall,
+                        color = MaterialTheme.colorScheme.onSurfaceVariant,
+                    )
+                    Spacer(Modifier.height(2.dp))
+                    Text(
+                        "Free, no subscription. No ads. No tracking.",
+                        style = MaterialTheme.typography.bodySmall,
+                        color = MaterialTheme.colorScheme.onSurfaceVariant,
+                    )
+                }
+            }
         }
     }
 }
 
+@Composable
+private fun SectionHeader(title: String) {
+    Row(verticalAlignment = Alignment.CenterVertically) {
+        Box(
+            modifier = Modifier
+                .width(3.dp)
+                .height(16.dp)
+                .clip(RoundedCornerShape(2.dp)),
+        ) {
+            Surface(color = MaterialTheme.colorScheme.primary, modifier = Modifier.fillMaxSize()) {}
+        }
+        Spacer(Modifier.width(8.dp))
+        Text(
+            title,
+            style = MaterialTheme.typography.titleMedium,
+            color = MaterialTheme.colorScheme.onBackground,
+        )
+    }
+}
+
 @Composable
 private fun AccountCard(acct: CloudAccountEntity, onDelete: () -> Unit) {
-    ElevatedCard(modifier = Modifier.fillMaxWidth()) {
+    Card(
+        modifier = Modifier.fillMaxWidth(),
+        shape = RoundedCornerShape(16.dp),
+        border = BorderStroke(1.dp, MaterialTheme.colorScheme.outline),
+        colors = CardDefaults.cardColors(containerColor = MaterialTheme.colorScheme.surface),
+    ) {
         Row(modifier = Modifier.padding(12.dp), verticalAlignment = Alignment.CenterVertically) {
-            Icon(providerIcon(acct.providerType), null, Modifier.size(32.dp), tint = MaterialTheme.colorScheme.primary)
+            // Icon with primaryContainer background
+            Surface(
+                shape = RoundedCornerShape(12.dp),
+                color = MaterialTheme.colorScheme.primaryContainer,
+                modifier = Modifier.size(40.dp),
+            ) {
+                Box(contentAlignment = Alignment.Center) {
+                    Icon(
+                        providerIcon(acct.providerType),
+                        null,
+                        Modifier.size(22.dp),
+                        tint = MaterialTheme.colorScheme.onPrimaryContainer,
+                    )
+                }
+            }
             Spacer(Modifier.width(12.dp))
             Column(modifier = Modifier.weight(1f)) {
                 Text(acct.displayName, style = MaterialTheme.typography.bodyMedium)
@@ -138,22 +225,22 @@ private fun AccountCard(acct: CloudAccountEntity, onDelete: () -> Unit) {
 
 private fun providerIcon(type: ProviderType) = when (type) {
     ProviderType.GOOGLE_DRIVE -> Icons.Default.Cloud
-    ProviderType.DROPBOX -> Icons.Default.CloudQueue
-    ProviderType.ONEDRIVE -> Icons.Default.CloudDone
-    ProviderType.WEBDAV -> Icons.Default.Storage
-    ProviderType.SFTP -> Icons.Default.Terminal
-    ProviderType.NEXTCLOUD -> Icons.Default.CloudCircle
-    ProviderType.OWNCLOUD -> Icons.Default.CloudCircle
-    ProviderType.SFTPGO -> Icons.Default.Storage
+    ProviderType.DROPBOX      -> Icons.Default.CloudQueue
+    ProviderType.ONEDRIVE     -> Icons.Default.CloudDone
+    ProviderType.WEBDAV       -> Icons.Default.Storage
+    ProviderType.SFTP         -> Icons.Default.Terminal
+    ProviderType.NEXTCLOUD    -> Icons.Default.CloudCircle
+    ProviderType.OWNCLOUD     -> Icons.Default.CloudCircle
+    ProviderType.SFTPGO       -> Icons.Default.Storage
 }
 
 private fun friendlyProviderName(type: ProviderType) = when (type) {
     ProviderType.GOOGLE_DRIVE -> "Google Drive"
-    ProviderType.DROPBOX -> "Dropbox"
-    ProviderType.ONEDRIVE -> "OneDrive"
-    ProviderType.WEBDAV -> "WebDAV"
-    ProviderType.SFTP -> "SFTP"
-    ProviderType.NEXTCLOUD -> "Nextcloud"
-    ProviderType.OWNCLOUD -> "ownCloud"
-    ProviderType.SFTPGO -> "SFTPGo"
+    ProviderType.DROPBOX      -> "Dropbox"
+    ProviderType.ONEDRIVE     -> "OneDrive"
+    ProviderType.WEBDAV       -> "WebDAV"
+    ProviderType.SFTP         -> "SFTP"
+    ProviderType.NEXTCLOUD    -> "Nextcloud"
+    ProviderType.OWNCLOUD     -> "ownCloud"
+    ProviderType.SFTPGO       -> "SFTPGo"
 }

app/src/main/kotlin/com/syncflow/ui/shared/SyncEventRow.kt

@@ -0,0 +1,102 @@
+package com.syncflow.ui.shared
+
+import androidx.compose.foundation.layout.*
+import androidx.compose.foundation.shape.RoundedCornerShape
+import androidx.compose.material.icons.Icons
+import androidx.compose.material.icons.filled.*
+import androidx.compose.material.icons.outlined.Circle
+import androidx.compose.material3.*
+import androidx.compose.runtime.Composable
+import androidx.compose.ui.Alignment
+import androidx.compose.ui.Modifier
+import androidx.compose.ui.graphics.Color
+import androidx.compose.ui.graphics.vector.ImageVector
+import androidx.compose.ui.unit.dp
+import com.syncflow.data.db.entities.SyncEventEntity
+import com.syncflow.domain.model.SyncEventType
+import java.time.ZoneId
+import java.time.format.DateTimeFormatter
+import java.time.format.FormatStyle
+
+@Composable
+fun SyncEventRow(event: SyncEventEntity, showDivider: Boolean = true) {
+    val (icon, tint) = event.eventType.iconAndTint()
+    val timeFmt = DateTimeFormatter.ofLocalizedTime(FormatStyle.SHORT)
+    val timeStr = timeFmt.format(event.timestamp.atZone(ZoneId.systemDefault()))
+
+    Row(
+        modifier = Modifier
+            .fillMaxWidth()
+            .padding(vertical = 10.dp),
+        verticalAlignment = Alignment.Top,
+    ) {
+        Surface(
+            shape = RoundedCornerShape(10.dp),
+            color = tint.copy(alpha = 0.12f),
+            modifier = Modifier.size(36.dp),
+        ) {
+            Box(contentAlignment = Alignment.Center) {
+                Icon(icon, contentDescription = null, Modifier.size(18.dp), tint = tint)
+            }
+        }
+        Spacer(Modifier.width(12.dp))
+        Column(modifier = Modifier.weight(1f)) {
+            Row(
+                modifier = Modifier.fillMaxWidth(),
+                horizontalArrangement = Arrangement.SpaceBetween,
+                verticalAlignment = Alignment.CenterVertically,
+            ) {
+                Text(
+                    event.eventType.label(),
+                    style = MaterialTheme.typography.labelMedium,
+                )
+                Text(
+                    timeStr,
+                    style = MaterialTheme.typography.labelSmall,
+                    color = MaterialTheme.colorScheme.onSurfaceVariant,
+                )
+            }
+            val detail = event.filePath ?: event.message
+            if (detail != null) {
+                Spacer(Modifier.height(2.dp))
+                Text(
+                    text = detail,
+                    style = MaterialTheme.typography.bodySmall,
+                    color = MaterialTheme.colorScheme.onSurfaceVariant,
+                    maxLines = 1,
+                )
+            }
+        }
+    }
+    if (showDivider) {
+        HorizontalDivider(
+            color = MaterialTheme.colorScheme.outline.copy(alpha = 0.3f),
+            modifier = Modifier.padding(start = 48.dp),
+        )
+    }
+}
+
+@Composable
+fun SyncEventType.iconAndTint(): Pair<ImageVector, Color> = when (this) {
+    SyncEventType.SYNC_STARTED     -> Icons.Default.Sync to MaterialTheme.colorScheme.secondary
+    SyncEventType.SYNC_COMPLETED   -> Icons.Default.CheckCircle to MaterialTheme.colorScheme.primary
+    SyncEventType.SYNC_FAILED      -> Icons.Default.Error to MaterialTheme.colorScheme.error
+    SyncEventType.FILE_UPLOADED    -> Icons.Default.CloudUpload to MaterialTheme.colorScheme.secondary
+    SyncEventType.FILE_DOWNLOADED  -> Icons.Default.CloudDownload to MaterialTheme.colorScheme.secondary
+    SyncEventType.FILE_DELETED     -> Icons.Default.DeleteForever to MaterialTheme.colorScheme.tertiary
+    SyncEventType.FILE_SKIPPED     -> Icons.Outlined.Circle to MaterialTheme.colorScheme.onSurfaceVariant
+    SyncEventType.CONFLICT_DETECTED -> Icons.Default.Warning to MaterialTheme.colorScheme.tertiary
+    SyncEventType.CONFLICT_RESOLVED -> Icons.Default.CheckCircle to MaterialTheme.colorScheme.primary
+}
+
+fun SyncEventType.label(): String = when (this) {
+    SyncEventType.SYNC_STARTED      -> "Sync started"
+    SyncEventType.SYNC_COMPLETED    -> "Sync completed"
+    SyncEventType.SYNC_FAILED       -> "Sync failed"
+    SyncEventType.FILE_UPLOADED     -> "File uploaded"
+    SyncEventType.FILE_DOWNLOADED   -> "File downloaded"
+    SyncEventType.FILE_DELETED      -> "File deleted"
+    SyncEventType.FILE_SKIPPED      -> "File skipped"
+    SyncEventType.CONFLICT_DETECTED -> "Conflict detected"
+    SyncEventType.CONFLICT_RESOLVED -> "Conflict resolved"
+}

app/src/main/kotlin/com/syncflow/ui/theme/Color.kt

@@ -2,8 +2,28 @@ package com.syncflow.ui.theme
 
 import androidx.compose.ui.graphics.Color
 
-val SyncBlue = Color(0xFF2196F3)
-val SyncGreen = Color(0xFF4CAF50)
-val SyncOrange = Color(0xFFFF9800)
-val SyncRed = Color(0xFFF44336)
-val SyncPurple = Color(0xFF9C27B0)
+// Primary — deep red (Passbolt-inspired)
+val Red900  = Color(0xFF7F0000)
+val Red700  = Color(0xFFB71C1C)
+val Red500  = Color(0xFFEF5350)
+val Red100  = Color(0xFFFFCDD2)
+val Red50   = Color(0xFFFFEBEE)
+
+// Secondary — deep orange
+val Orange700 = Color(0xFFE64A19)
+val Orange100 = Color(0xFFFBE9E7)
+
+// Tertiary — amber
+val Amber500  = Color(0xFFFFB300)
+val Amber100  = Color(0xFFFFF8E1)
+
+// Neutrals
+val Gray50   = Color(0xFFF8F9FA)
+val Gray100  = Color(0xFFF3F4F6)
+val Gray200  = Color(0xFFE5E7EB)
+val Gray600  = Color(0xFF6B7280)
+val Gray900  = Color(0xFF111827)
+
+// Semantic
+val GreenSuccess = Color(0xFF2E7D32)
+val RedError     = Color(0xFFEF5350)

app/src/main/kotlin/com/syncflow/ui/theme/Theme.kt

@@ -1,50 +1,79 @@
 package com.syncflow.ui.theme
 
 import android.app.Activity
-import android.os.Build
 import androidx.compose.foundation.isSystemInDarkTheme
 import androidx.compose.material3.*
 import androidx.compose.runtime.Composable
 import androidx.compose.runtime.SideEffect
-import androidx.compose.ui.graphics.toArgb
-import androidx.compose.ui.platform.LocalContext
+import androidx.compose.ui.graphics.Color
 import androidx.compose.ui.platform.LocalView
+import androidx.compose.ui.text.TextStyle
+import androidx.compose.ui.text.font.FontWeight
+import androidx.compose.ui.unit.sp
 import androidx.core.view.WindowCompat
 
 private val LightColors = lightColorScheme(
-    primary = SyncBlue,
-    onPrimary = androidx.compose.ui.graphics.Color.White,
-    secondary = SyncGreen,
-    tertiary = SyncPurple,
+    primary            = Red700,
+    onPrimary          = Color.White,
+    primaryContainer   = Red50,
+    onPrimaryContainer = Red900,
+    secondary          = Orange700,
+    onSecondary        = Color.White,
+    secondaryContainer = Orange100,
+    tertiary           = Amber500,
+    tertiaryContainer  = Amber100,
+    background         = Gray50,
+    surface            = Color.White,
+    surfaceVariant     = Gray100,
+    onSurface          = Gray900,
+    onSurfaceVariant   = Gray600,
+    error              = RedError,
+    errorContainer     = Red50,
+    outline            = Gray200,
 )
 
 private val DarkColors = darkColorScheme(
-    primary = SyncBlue,
-    secondary = SyncGreen,
-    tertiary = SyncPurple,
+    primary            = Red500,
+    onPrimary          = Color.White,
+    primaryContainer   = Red900,
+    onPrimaryContainer = Red100,
+    secondary          = Color(0xFFFF7043),
+    onSecondary        = Color.White,
+    secondaryContainer = Color(0xFF4E1500),
+    tertiary           = Amber500,
+    tertiaryContainer  = Color(0xFF3E2700),
+    background         = Color(0xFF0F0F0F),
+    surface            = Color(0xFF1C1C1C),
+    surfaceVariant     = Color(0xFF2A2A2A),
+    onSurface          = Color(0xFFEAEAEA),
+    onSurfaceVariant   = Color(0xFF9E9E9E),
+    error              = Color(0xFFFF5252),
+    errorContainer     = Color(0xFF5C0000),
+    outline            = Color(0xFF3D3D3D),
+)
+
+private val AppTypography = Typography(
+    titleLarge  = TextStyle(fontWeight = FontWeight.Bold,     fontSize = 22.sp, letterSpacing = (-0.5).sp),
+    titleMedium = TextStyle(fontWeight = FontWeight.SemiBold, fontSize = 16.sp, letterSpacing = (-0.25).sp),
+    titleSmall  = TextStyle(fontWeight = FontWeight.SemiBold, fontSize = 14.sp, letterSpacing = 0.sp),
+    labelMedium = TextStyle(fontWeight = FontWeight.Medium,   fontSize = 12.sp, letterSpacing = 0.1.sp),
+    labelSmall  = TextStyle(fontWeight = FontWeight.Medium,   fontSize = 11.sp, letterSpacing = 0.1.sp),
 )
 
 @Composable
 fun SyncFlowTheme(
     darkTheme: Boolean = isSystemInDarkTheme(),
-    dynamicColor: Boolean = true,
     content: @Composable () -> Unit,
 ) {
-    val colorScheme = when {
-        dynamicColor && Build.VERSION.SDK_INT >= Build.VERSION_CODES.S -> {
-            val ctx = LocalContext.current
-            if (darkTheme) dynamicDarkColorScheme(ctx) else dynamicLightColorScheme(ctx)
-        }
-        darkTheme -> DarkColors
-        else -> LightColors
-    }
+    val colorScheme = if (darkTheme) DarkColors else LightColors
     val view = LocalView.current
     if (!view.isInEditMode) {
         SideEffect {
             val window = (view.context as Activity).window
-            window.statusBarColor = colorScheme.primary.toArgb()
+            WindowCompat.setDecorFitsSystemWindows(window, false)
+            window.statusBarColor = android.graphics.Color.TRANSPARENT
             WindowCompat.getInsetsController(window, view).isAppearanceLightStatusBars = !darkTheme
         }
     }
-    MaterialTheme(colorScheme = colorScheme, typography = Typography(), content = content)
+    MaterialTheme(colorScheme = colorScheme, typography = AppTypography, content = content)
 }

app/src/main/kotlin/com/syncflow/worker/BootReceiver.kt

@@ -3,6 +3,7 @@ package com.syncflow.worker
 import android.content.BroadcastReceiver
 import android.content.Context
 import android.content.Intent
+import androidx.work.ExistingPeriodicWorkPolicy
 import androidx.work.WorkManager
 import dagger.hilt.android.AndroidEntryPoint
 import kotlinx.coroutines.CoroutineScope
@@ -17,22 +18,30 @@ class BootReceiver : BroadcastReceiver() {
     @Inject lateinit var syncPairDao: SyncPairDao
 
     override fun onReceive(context: Context, intent: Intent) {
-        if (intent.action != Intent.ACTION_BOOT_COMPLETED) return
+        val validActions = setOf(Intent.ACTION_BOOT_COMPLETED, Intent.ACTION_MY_PACKAGE_REPLACED)
+        if (intent.action !in validActions) return
         val wm = WorkManager.getInstance(context)
         val pending = goAsync()
         CoroutineScope(Dispatchers.IO).launch {
             try {
-                syncPairDao.getEnabled()
-                    .filter { it.scheduleType != ScheduleType.MANUAL && it.scheduleType != ScheduleType.ON_CHANGE }
-                    .forEach { pair ->
-                        val req = SyncWorker.buildPeriodicRequest(
-                            pair.id,
-                            pair.scheduleIntervalMinutes.toLong().coerceAtLeast(15),
-                            pair.wifiOnly,
-                            pair.chargingOnly,
-                        )
-                        wm.enqueueUniquePeriodicWork("periodic_${pair.id}", androidx.work.ExistingPeriodicWorkPolicy.UPDATE, req)
+                val pairs = syncPairDao.getEnabled()
+                var hasOnChange = false
+                pairs.forEach { pair ->
+                    when (pair.scheduleType) {
+                        ScheduleType.ON_CHANGE -> hasOnChange = true
+                        ScheduleType.MANUAL -> { /* nothing */ }
+                        else -> {
+                            val req = SyncWorker.buildPeriodicRequest(
+                                pair.id,
+                                pair.scheduleIntervalMinutes.toLong().coerceAtLeast(15),
+                                pair.wifiOnly,
+                                pair.chargingOnly,
+                            )
+                            wm.enqueueUniquePeriodicWork("periodic_${pair.id}", ExistingPeriodicWorkPolicy.UPDATE, req)
+                        }
                     }
+                }
+                if (hasOnChange) FileWatchService.start(context)
             } finally {
                 pending.finish()
             }

app/src/main/kotlin/com/syncflow/worker/FileWatchService.kt

@@ -0,0 +1,381 @@
+package com.syncflow.worker
+
+import android.app.*
+import android.content.Context
+import android.content.Intent
+import android.database.ContentObserver
+import android.net.Uri
+import android.os.Build
+import android.os.FileObserver
+import android.os.Handler
+import android.os.IBinder
+import android.os.Looper
+import android.provider.DocumentsContract
+import androidx.core.app.NotificationCompat
+import androidx.work.ExistingWorkPolicy
+import androidx.work.WorkInfo
+import androidx.work.WorkManager
+import kotlinx.coroutines.flow.first
+import com.syncflow.MainActivity
+import com.syncflow.R
+import com.syncflow.data.db.SyncFileStateDao
+import com.syncflow.data.db.SyncPairDao
+import com.syncflow.data.db.entities.toDomain
+import com.syncflow.domain.model.ScheduleType
+import com.syncflow.domain.sync.LocalAccessor
+import dagger.hilt.android.AndroidEntryPoint
+import kotlinx.coroutines.*
+import kotlinx.coroutines.sync.Mutex
+import kotlinx.coroutines.sync.withLock
+import timber.log.Timber
+import java.io.File
+import javax.inject.Inject
+
+@AndroidEntryPoint
+class FileWatchService : Service() {
+
+    @Inject lateinit var syncPairDao: SyncPairDao
+    @Inject lateinit var fileStateDao: SyncFileStateDao
+
+    private val scope = CoroutineScope(Dispatchers.IO + SupervisorJob())
+    private val mainHandler = Handler(Looper.getMainLooper())
+    // Prevents concurrent refresh() calls from doubling watchers + catchup scans
+    private val refreshMutex = Mutex()
+
+    // Multiple FileObserver instances per pair: one per directory (recursive)
+    private val fileObservers = mutableMapOf<Long, MutableList<FileObserver>>()
+    private val contentObservers = mutableMapOf<Long, ContentObserver>()
+    private val debounceJobs = mutableMapOf<Long, Job>()
+    // Persistent monitors that watch WorkManager for ANY sync (manual, catchup, onchange)
+    // so the cooldown is set regardless of who triggered the sync.
+    private val syncMonitorJobs = mutableMapOf<Long, Job>()
+    // After a sync completes, suppress FileObserver events for this long.
+    private val syncCooldownUntil = mutableMapOf<Long, Long>()
+
+    companion object {
+        const val CHANNEL_WATCH = "sync_watching"
+        private const val NOTIFICATION_ID = 1002
+
+        fun start(context: Context) {
+            val intent = Intent(context, FileWatchService::class.java)
+            if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.O) {
+                context.startForegroundService(intent)
+            } else {
+                context.startService(intent)
+            }
+        }
+
+        fun stop(context: Context) {
+            context.stopService(Intent(context, FileWatchService::class.java))
+        }
+    }
+
+    override fun onCreate() {
+        super.onCreate()
+        ensureChannel()
+        startForeground(NOTIFICATION_ID, buildNotification(0))
+    }
+
+    override fun onStartCommand(intent: Intent?, flags: Int, startId: Int): Int {
+        scope.launch { refresh() }
+        return START_STICKY
+    }
+
+    override fun onDestroy() {
+        clearWatchers()
+        scope.cancel()
+        super.onDestroy()
+    }
+
+    override fun onBind(intent: Intent?): IBinder? = null
+
+    private suspend fun refresh() = refreshMutex.withLock {
+        clearWatchers()
+        val pairs = syncPairDao.getEnabled().filter { it.scheduleType == ScheduleType.ON_CHANGE }
+
+        pairs.forEach { pair ->
+            val pairId = pair.id
+            val localPath = pair.localPath
+
+            if (localPath.startsWith("content://")) {
+                // Try to resolve the SAF tree URI to a real filesystem path so we can use
+                // FileObserver. ContentObserver on a DocumentsProvider tree URI only fires
+                // when changes come through the SAF API, not for raw filesystem writes.
+                val realPath = safTreeUriToRealPath(localPath)
+                if (realPath != null) {
+                    watchPath(realPath, pairId, pair.wifiOnly, pair.chargingOnly)
+                } else {
+                    // Fallback: register a ContentObserver for SAF paths that can't be resolved
+                    val treeUri = Uri.parse(localPath)
+                    val observer = object : ContentObserver(mainHandler) {
+                        override fun onChange(selfChange: Boolean) = onChangeDetected(pairId, pair.wifiOnly, pair.chargingOnly)
+                        override fun onChange(selfChange: Boolean, uri: Uri?) = onChangeDetected(pairId, pair.wifiOnly, pair.chargingOnly)
+                    }
+                    contentResolver.registerContentObserver(treeUri, true, observer)
+                    contentObservers[pairId] = observer
+                    Timber.d("FileWatchService: watching SAF URI (ContentObserver fallback) for pair $pairId")
+                }
+            } else {
+                watchPath(localPath, pairId, pair.wifiOnly, pair.chargingOnly)
+            }
+        }
+
+        val count = fileObservers.keys.size + contentObservers.size
+        updateNotification(count)
+
+        if (count == 0) {
+            Timber.d("FileWatchService: no ON_CHANGE pairs, stopping")
+            stopSelf()
+        }
+    }
+
+    private fun safTreeUriToRealPath(uriString: String): String? {
+        return try {
+            val treeUri = Uri.parse(uriString)
+            val docId = DocumentsContract.getTreeDocumentId(treeUri)
+            // docId format is "primary:RelativePath" for primary internal storage
+            if (docId.startsWith("primary:")) {
+                val relative = docId.removePrefix("primary:")
+                "/storage/emulated/0/$relative"
+            } else {
+                null
+            }
+        } catch (e: Exception) {
+            Timber.w("FileWatchService: could not resolve SAF URI to real path: $e")
+            null
+        }
+    }
+
+    private fun watchPath(path: String, pairId: Long, wifiOnly: Boolean, chargingOnly: Boolean) {
+        val dir = File(path)
+        if (!dir.exists()) {
+            Timber.w("FileWatchService: path does not exist for pair $pairId: $path")
+            return
+        }
+        fileObservers[pairId] = mutableListOf()
+        // Set startup cooldown BEFORE registering watchers so inotify events that fire
+        // immediately on registration don't trigger the debounce before catchupScan runs.
+        syncCooldownUntil[pairId] = System.currentTimeMillis() + 15_000
+        watchDirRecursive(dir, pairId, wifiOnly, chargingOnly)
+        Timber.d("FileWatchService: watching pair $pairId at $path (${fileObservers[pairId]?.size} dirs)")
+        startSyncMonitor(pairId)
+        scope.launch { catchupScan(pairId, dir, wifiOnly, chargingOnly) }
+    }
+
+    // Watches WorkManager for ANY sync tagged sync_$pairId (manual, catchup, onchange).
+    // Sets cooldown while running and for 60s after, so FileObserver events from our
+    // own file writes never trigger a re-sync regardless of what started the sync.
+    private fun startSyncMonitor(pairId: Long) {
+        syncMonitorJobs[pairId]?.cancel()
+        syncMonitorJobs[pairId] = scope.launch {
+            var wasSyncing = false
+            WorkManager.getInstance(applicationContext)
+                .getWorkInfosByTagFlow("sync_$pairId")
+                .collect { infos ->
+                    val isSyncing = infos.any {
+                        it.state == WorkInfo.State.RUNNING || it.state == WorkInfo.State.ENQUEUED
+                    }
+                    if (isSyncing) {
+                        Timber.d("FileWatchService: sync active for pair $pairId — cooldown extended")
+                        syncCooldownUntil[pairId] = System.currentTimeMillis() + 120_000
+                        wasSyncing = true
+                    } else if (wasSyncing) {
+                        Timber.d("FileWatchService: sync finished for pair $pairId — 60s settle cooldown")
+                        syncCooldownUntil[pairId] = System.currentTimeMillis() + 60_000
+                        wasSyncing = false
+                    }
+                }
+        }
+    }
+
+    private fun watchDirRecursive(dir: File, pairId: Long, wifiOnly: Boolean, chargingOnly: Boolean) {
+        if (!dir.isDirectory) return
+        val mask = FileObserver.CREATE or FileObserver.DELETE or FileObserver.MODIFY or
+                   FileObserver.MOVED_FROM or FileObserver.MOVED_TO
+        val observer = if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.Q) {
+            object : FileObserver(dir, mask) {
+                override fun onEvent(event: Int, path: String?) {
+                    if (event and FileObserver.CREATE != 0 && path != null) {
+                        val created = File(dir, path)
+                        if (created.isDirectory) watchDirRecursive(created, pairId, wifiOnly, chargingOnly)
+                    }
+                    onChangeDetected(pairId, wifiOnly, chargingOnly)
+                }
+            }
+        } else {
+            @Suppress("DEPRECATION")
+            object : FileObserver(dir.absolutePath, mask) {
+                override fun onEvent(event: Int, path: String?) {
+                    if (event and FileObserver.CREATE != 0 && path != null) {
+                        val created = File(dir, path)
+                        if (created.isDirectory) watchDirRecursive(created, pairId, wifiOnly, chargingOnly)
+                    }
+                    onChangeDetected(pairId, wifiOnly, chargingOnly)
+                }
+            }
+        }
+        observer.startWatching()
+        fileObservers.getOrPut(pairId) { mutableListOf() }.add(observer)
+        // Recursively watch existing subdirectories
+        dir.listFiles()?.filter { it.isDirectory }?.forEach { sub ->
+            watchDirRecursive(sub, pairId, wifiOnly, chargingOnly)
+        }
+    }
+
+    private suspend fun catchupScan(pairId: Long, dir: File, wifiOnly: Boolean, chargingOnly: Boolean) {
+        val known = fileStateDao.getForPair(pairId).associateBy { it.relativePath }
+        if (known.isEmpty()) return // Never synced — first sync will be triggered manually
+
+        val pairEntity = syncPairDao.getById(pairId) ?: return
+        val pair = pairEntity.toDomain()
+        // Use the same accessor + filters as SyncEngine so hidden/excluded/size-filtered files
+        // don't appear as "new" in the catchup scan and trigger a perpetual sync loop.
+        val accessor = if (pair.localPath.startsWith("content://"))
+            LocalAccessor.Saf(Uri.parse(pair.localPath), contentResolver)
+        else
+            LocalAccessor.JavaFile(dir)
+        val current = accessor.walkFiles(pair)
+
+        val hasNew      = current.any { (rel, _) -> rel !in known }
+        val hasModified = current.any { (rel, info) ->
+            val s = known[rel]; s != null && s.localModifiedAt != null &&
+            s.localModifiedAt.epochSecond != info.lastModifiedMs / 1000
+        }
+        val hasDeleted  = known.keys.any { rel -> rel !in current }
+
+        if (hasNew || hasModified || hasDeleted) {
+            Timber.d("FileWatchService: catchup detected changes for pair $pairId, scheduling sync")
+            // Cancel any debounce that started before our startup cooldown was set
+            debounceJobs[pairId]?.cancel()
+            debounceJobs.remove(pairId)
+            // Hold cooldown for duration of sync + 60s settle
+            syncCooldownUntil[pairId] = System.currentTimeMillis() + 120_000
+            val req = SyncWorker.buildOneTimeRequest(pairId, wifiOnly, chargingOnly)
+            WorkManager.getInstance(applicationContext)
+                .enqueueUniqueWork("catchup_$pairId", ExistingWorkPolicy.KEEP, req)
+            scope.launch {
+                try {
+                    WorkManager.getInstance(applicationContext)
+                        .getWorkInfoByIdFlow(req.id)
+                        .first { it?.state?.isFinished == true }
+                    syncCooldownUntil[pairId] = System.currentTimeMillis() + 60_000
+                } catch (e: CancellationException) {
+                    throw e
+                } catch (_: Exception) {
+                    syncCooldownUntil[pairId] = System.currentTimeMillis() + 60_000
+                }
+            }
+        }
+    }
+
+    private fun onChangeDetected(pairId: Long, wifiOnly: Boolean, chargingOnly: Boolean) {
+        // Ignore events fired by our own sync writing files — prevents the feedback loop
+        // where downloaded/uploaded files trigger another sync indefinitely.
+        if (System.currentTimeMillis() < (syncCooldownUntil[pairId] ?: 0L)) {
+            Timber.d("FileWatchService: suppressing change event for pair $pairId (sync cooldown)")
+            return
+        }
+
+        debounceJobs[pairId]?.cancel()
+        debounceJobs[pairId] = scope.launch {
+            delay(5_000)
+            // Re-check: catchupScan or another path may have already set a cooldown
+            // and handled this sync while we were waiting.
+            if (System.currentTimeMillis() < (syncCooldownUntil[pairId] ?: 0L)) {
+                Timber.d("FileWatchService: debounce fired but cooldown active for pair $pairId, skipping")
+                return@launch
+            }
+            val pair = syncPairDao.getById(pairId)
+            if (pair == null || !pair.isEnabled) return@launch
+            Timber.d("FileWatchService: triggering sync for pair $pairId after debounce")
+
+            // Block new triggers from this point until 60s after sync completes
+            syncCooldownUntil[pairId] = System.currentTimeMillis() + 120_000
+
+            val req = SyncWorker.buildOneTimeRequest(pairId, wifiOnly, chargingOnly, silent = true)
+            WorkManager.getInstance(applicationContext)
+                .enqueueUniqueWork("onchange_$pairId", ExistingWorkPolicy.KEEP, req)
+
+            updateNotificationDynamic("Syncing: ${pair.name}…")
+
+            scope.launch {
+                try {
+                    val info = WorkManager.getInstance(applicationContext)
+                        .getWorkInfoByIdFlow(req.id)
+                        .first { it?.state?.isFinished == true }
+                    // Extend cooldown: 60s after sync finishes to let filesystem settle
+                    syncCooldownUntil[pairId] = System.currentTimeMillis() + 60_000
+                    val summary = info?.outputData?.getString(SyncWorker.KEY_RESULT_SUMMARY)
+                    val watchCount = fileObservers.keys.size + contentObservers.size
+                    val watching = "Watching $watchCount folder${if (watchCount != 1) "s" else ""}"
+                    if (info?.state == WorkInfo.State.SUCCEEDED && summary != null) {
+                        updateNotificationDynamic("${pair.name}: $summary — $watching")
+                    } else {
+                        updateNotificationDynamic("$watching")
+                    }
+                    delay(12_000)
+                    updateNotificationDynamic(null)
+                } catch (e: CancellationException) {
+                    throw e
+                } catch (_: Exception) {
+                    syncCooldownUntil[pairId] = System.currentTimeMillis() + 60_000
+                    updateNotificationDynamic(null)
+                }
+            }
+        }
+    }
+
+    private fun clearWatchers() {
+        fileObservers.values.flatten().forEach { it.stopWatching() }
+        fileObservers.clear()
+        contentObservers.values.forEach { contentResolver.unregisterContentObserver(it) }
+        contentObservers.clear()
+        debounceJobs.values.forEach { it.cancel() }
+        debounceJobs.clear()
+        syncMonitorJobs.values.forEach { it.cancel() }
+        syncMonitorJobs.clear()
+        syncCooldownUntil.clear()
+    }
+
+    private fun ensureChannel() {
+        val nm = getSystemService(Context.NOTIFICATION_SERVICE) as NotificationManager
+        if (nm.getNotificationChannel(CHANNEL_WATCH) == null) {
+            nm.createNotificationChannel(
+                NotificationChannel(CHANNEL_WATCH, "File watching", NotificationManager.IMPORTANCE_LOW).apply {
+                    description = "Background service watching folders for changes"
+                    setShowBadge(false)
+                }
+            )
+        }
+    }
+
+    private fun buildNotification(count: Int, overrideText: String? = null): Notification {
+        val tapIntent = PendingIntent.getActivity(
+            this, 0,
+            Intent(this, MainActivity::class.java).apply { flags = Intent.FLAG_ACTIVITY_SINGLE_TOP },
+            PendingIntent.FLAG_UPDATE_CURRENT or PendingIntent.FLAG_IMMUTABLE,
+        )
+        return NotificationCompat.Builder(this, CHANNEL_WATCH)
+            .setContentTitle("SyncFlow")
+            .setContentText(
+                overrideText ?: if (count > 0) "Watching $count folder${if (count != 1) "s" else ""} for changes"
+                else "Starting file watcher…"
+            )
+            .setSmallIcon(R.drawable.ic_sync)
+            .setContentIntent(tapIntent)
+            .setOngoing(true)
+            .setPriority(NotificationCompat.PRIORITY_MIN)
+            .build()
+    }
+
+    private fun updateNotification(count: Int) {
+        val nm = getSystemService(Context.NOTIFICATION_SERVICE) as NotificationManager
+        nm.notify(NOTIFICATION_ID, buildNotification(count))
+    }
+
+    private fun updateNotificationDynamic(overrideText: String?) {
+        val count = fileObservers.keys.size + contentObservers.size
+        val nm = getSystemService(Context.NOTIFICATION_SERVICE) as NotificationManager
+        nm.notify(NOTIFICATION_ID, buildNotification(count, overrideText))
+    }
+}

app/src/main/kotlin/com/syncflow/worker/SyncWorker.kt

@@ -2,10 +2,15 @@ package com.syncflow.worker
 
 import android.app.NotificationChannel
 import android.app.NotificationManager
+import android.app.PendingIntent
 import android.content.Context
+import android.content.Intent
+import android.content.pm.ServiceInfo
+import android.os.Build
 import androidx.core.app.NotificationCompat
 import androidx.hilt.work.HiltWorker
 import androidx.work.*
+import com.syncflow.MainActivity
 import com.syncflow.R
 import com.syncflow.data.db.SyncPairDao
 import com.syncflow.data.db.entities.toDomain
@@ -31,48 +36,141 @@ class SyncWorker @AssistedInject constructor(
         val pairId = inputData.getLong(KEY_PAIR_ID, -1L)
         if (pairId == -1L) return Result.failure()
 
-        setForeground(buildForegroundInfo("Syncing…"))
-
         val pair = syncPairDao.getById(pairId) ?: return Result.failure()
         val account = accountRepository.getAccount(pair.accountId) ?: return Result.failure()
 
+        val silent = inputData.getBoolean(KEY_SILENT, false)
+
+        ensureChannels()
+        setForeground(buildForegroundInfo(pair.name, "Syncing…"))
+
         return try {
             val domainPair = pair.toDomain()
             val provider = providerFactory.create(account)
-            syncEngine.sync(domainPair, provider)
-            Result.success()
+            val result = syncEngine.sync(domainPair, provider)
+
+            val lines = buildList {
+                if (result.uploaded > 0)   add("↑${result.uploaded}")
+                if (result.downloaded > 0) add("↓${result.downloaded}")
+                if (result.deleted > 0)    add("🗑${result.deleted}")
+                if (result.conflicts > 0)  add("⚠${result.conflicts}")
+            }
+            val resultSummary = if (lines.isEmpty()) "Up to date" else lines.joinToString(" ")
+
+            if (!silent && result.error != null && pair.notifyOnError) {
+                notify(
+                    id = pairId.toInt() + RESULT_ID_OFFSET,
+                    channelId = CHANNEL_ALERTS,
+                    title = "${pair.name} — Sync failed",
+                    text = result.error.message ?: "Unknown error",
+                    priority = NotificationCompat.PRIORITY_DEFAULT,
+                )
+            } else if (!silent && pair.notifyOnComplete && result.error == null) {
+                val fullLines = buildList {
+                    if (result.uploaded > 0)   add("↑ Uploaded: ${result.uploaded} file${if (result.uploaded != 1) "s" else ""}")
+                    if (result.downloaded > 0) add("↓ Downloaded: ${result.downloaded} file${if (result.downloaded != 1) "s" else ""}")
+                    if (result.deleted > 0)    add("🗑 Deleted: ${result.deleted} file${if (result.deleted != 1) "s" else ""}")
+                    if (result.conflicts > 0)  add("⚠ ${result.conflicts} conflict${if (result.conflicts != 1) "s" else ""}")
+                }
+                val summary = if (fullLines.isEmpty()) "Up to date — nothing to sync" else fullLines.joinToString("\n")
+                notify(
+                    id = pairId.toInt() + RESULT_ID_OFFSET,
+                    channelId = CHANNEL_COMPLETE,
+                    title = "${pair.name} — Synced",
+                    text = if (fullLines.isEmpty()) summary else fullLines.first(),
+                    bigText = summary,
+                    priority = NotificationCompat.PRIORITY_LOW,
+                )
+            }
+
+            Result.success(workDataOf(KEY_RESULT_SUMMARY to resultSummary))
         } catch (e: Exception) {
             Timber.e(e, "SyncWorker failed for pair $pairId")
+            if (!silent && pair.notifyOnError) {
+                notify(
+                    id = pairId.toInt() + RESULT_ID_OFFSET,
+                    channelId = CHANNEL_ALERTS,
+                    title = "${pair.name} — Sync failed",
+                    text = e.message ?: "Unknown error",
+                    priority = NotificationCompat.PRIORITY_DEFAULT,
+                )
+            }
             if (runAttemptCount < 3) Result.retry() else Result.failure()
         }
     }
 
-    private fun buildForegroundInfo(progress: String): ForegroundInfo {
-        val channelId = "sync_channel"
+    private fun ensureChannels() {
         val nm = applicationContext.getSystemService(Context.NOTIFICATION_SERVICE) as NotificationManager
-        if (nm.getNotificationChannel(channelId) == null) {
-            nm.createNotificationChannel(NotificationChannel(channelId, "Sync", NotificationManager.IMPORTANCE_LOW))
-        }
-        val notification = NotificationCompat.Builder(applicationContext, channelId)
-            .setContentTitle("SyncFlow")
-            .setContentText(progress)
+        if (nm.getNotificationChannel(CHANNEL_PROGRESS) == null)
+            nm.createNotificationChannel(NotificationChannel(CHANNEL_PROGRESS, "Sync progress", NotificationManager.IMPORTANCE_LOW).apply {
+                description = "Shown while a sync is running"
+            })
+        if (nm.getNotificationChannel(CHANNEL_COMPLETE) == null)
+            nm.createNotificationChannel(NotificationChannel(CHANNEL_COMPLETE, "Sync complete", NotificationManager.IMPORTANCE_LOW).apply {
+                description = "Summary after each successful sync"
+            })
+        if (nm.getNotificationChannel(CHANNEL_ALERTS) == null)
+            nm.createNotificationChannel(NotificationChannel(CHANNEL_ALERTS, "Sync errors", NotificationManager.IMPORTANCE_DEFAULT).apply {
+                description = "Alerts for sync failures and conflicts"
+            })
+    }
+
+    private fun buildForegroundInfo(pairName: String, status: String): ForegroundInfo {
+        val tapIntent = PendingIntent.getActivity(
+            applicationContext, 0,
+            Intent(applicationContext, MainActivity::class.java).apply { flags = Intent.FLAG_ACTIVITY_SINGLE_TOP },
+            PendingIntent.FLAG_UPDATE_CURRENT or PendingIntent.FLAG_IMMUTABLE,
+        )
+        val notification = NotificationCompat.Builder(applicationContext, CHANNEL_PROGRESS)
+            .setContentTitle(pairName)
+            .setContentText(status)
             .setSmallIcon(R.drawable.ic_sync)
+            .setContentIntent(tapIntent)
             .setOngoing(true)
             .build()
-        return ForegroundInfo(NOTIFICATION_ID, notification)
+        return if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.Q)
+            ForegroundInfo(NOTIFICATION_ID, notification, ServiceInfo.FOREGROUND_SERVICE_TYPE_DATA_SYNC)
+        else
+            ForegroundInfo(NOTIFICATION_ID, notification)
+    }
+
+    private fun notify(id: Int, channelId: String, title: String, text: String, priority: Int, bigText: String? = null) {
+        val tapIntent = PendingIntent.getActivity(
+            applicationContext, id,
+            Intent(applicationContext, MainActivity::class.java).apply { flags = Intent.FLAG_ACTIVITY_SINGLE_TOP },
+            PendingIntent.FLAG_UPDATE_CURRENT or PendingIntent.FLAG_IMMUTABLE,
+        )
+        val nm = applicationContext.getSystemService(Context.NOTIFICATION_SERVICE) as NotificationManager
+        val builder = NotificationCompat.Builder(applicationContext, channelId)
+            .setContentTitle(title)
+            .setContentText(text)
+            .setSmallIcon(R.drawable.ic_sync)
+            .setPriority(priority)
+            .setContentIntent(tapIntent)
+            .setAutoCancel(true)
+        if (bigText != null) {
+            builder.setStyle(NotificationCompat.BigTextStyle().bigText(bigText))
+        }
+        nm.notify(id, builder.build())
     }
 
     companion object {
         const val KEY_PAIR_ID = "pair_id"
+        const val KEY_SILENT = "silent"
+        const val KEY_RESULT_SUMMARY = "result_summary"
         private const val NOTIFICATION_ID = 1001
+        private const val RESULT_ID_OFFSET = 2000
+        private const val CHANNEL_PROGRESS = "sync_progress"
+        private const val CHANNEL_COMPLETE = "sync_complete"
+        private const val CHANNEL_ALERTS   = "sync_alerts"
 
-        fun buildOneTimeRequest(pairId: Long, wifiOnly: Boolean, chargingOnly: Boolean): OneTimeWorkRequest {
+        fun buildOneTimeRequest(pairId: Long, wifiOnly: Boolean, chargingOnly: Boolean, silent: Boolean = false): OneTimeWorkRequest {
             val constraints = Constraints.Builder()
                 .setRequiredNetworkType(if (wifiOnly) NetworkType.UNMETERED else NetworkType.CONNECTED)
                 .setRequiresCharging(chargingOnly)
                 .build()
             return OneTimeWorkRequestBuilder<SyncWorker>()
-                .setInputData(workDataOf(KEY_PAIR_ID to pairId))
+                .setInputData(workDataOf(KEY_PAIR_ID to pairId, KEY_SILENT to silent))
                 .setConstraints(constraints)
                 .setBackoffCriteria(BackoffPolicy.EXPONENTIAL, 30, TimeUnit.SECONDS)
                 .addTag("sync_$pairId")

app/src/main/res/drawable/ic_launcher_background.xml

@@ -0,0 +1,12 @@
+<?xml version="1.0" encoding="utf-8"?>
+<vector xmlns:android="http://schemas.android.com/apk/res/android"
+    android:width="108dp"
+    android:height="108dp"
+    android:viewportWidth="108"
+    android:viewportHeight="108">
+
+    <!-- Pure black background -->
+    <path android:pathData="M0,0 H108 V108 H0 Z"
+        android:fillColor="#000000"/>
+
+</vector>

app/src/main/res/drawable/ic_launcher_foreground.xml

@@ -0,0 +1,84 @@
+<?xml version="1.0" encoding="utf-8"?>
+<vector xmlns:android="http://schemas.android.com/apk/res/android"
+    android:width="108dp"
+    android:height="108dp"
+    android:viewportWidth="108"
+    android:viewportHeight="108">
+
+    <!--
+      Four thick arcs arranged as an interlocked pinwheel.
+      Each arc sweeps ~210 degrees, rounded caps, radius 18 from center (54,54).
+      Draw order creates natural over/under at the four crossing points:
+        blue under green, green under red, red under orange, orange under blue (re-draw blue tip).
+
+      Arc endpoints computed at radius 18, sweep 210 deg clockwise:
+        start angle  end angle    start point    end point
+        270 (top)    120          (54, 36)        (45, 70)
+          0 (right)  210          (72, 54)        (39, 45)
+         90 (bot)    300          (54, 72)        (63, 38)
+        180 (left)   390=30       (36, 54)        (69, 63)
+    -->
+
+    <!-- Blue — starts at top, sweeps clockwise to lower-left -->
+    <path
+        android:strokeColor="#2979FF"
+        android:strokeWidth="8.5"
+        android:fillColor="#00000000"
+        android:strokeLineCap="round"
+        android:pathData="M 54,36 A 18,18 0 1,1 45,70"/>
+
+    <!-- Green — starts at bottom, sweeps clockwise to upper-right -->
+    <path
+        android:strokeColor="#00C853"
+        android:strokeWidth="8.5"
+        android:fillColor="#00000000"
+        android:strokeLineCap="round"
+        android:pathData="M 54,72 A 18,18 0 1,1 63,38"/>
+
+    <!-- Red — starts at right, sweeps clockwise to lower-left -->
+    <path
+        android:strokeColor="#E53935"
+        android:strokeWidth="8.5"
+        android:fillColor="#00000000"
+        android:strokeLineCap="round"
+        android:pathData="M 72,54 A 18,18 0 1,1 39,45"/>
+
+    <!-- Orange — starts at left, sweeps clockwise to upper-right -->
+    <path
+        android:strokeColor="#FF6D00"
+        android:strokeWidth="8.5"
+        android:fillColor="#00000000"
+        android:strokeLineCap="round"
+        android:pathData="M 36,54 A 18,18 0 1,1 69,63"/>
+
+    <!-- Re-draw blue start cap on top so it goes OVER orange end -->
+    <path
+        android:strokeColor="#2979FF"
+        android:strokeWidth="8.5"
+        android:fillColor="#00000000"
+        android:strokeLineCap="round"
+        android:pathData="M 54,36 A 18,18 0 0,1 62,37.5"/>
+
+    <!-- White sync circle at center -->
+    <path
+        android:fillColor="#000000"
+        android:pathData="M 45,54 A 9,9 0 1,0 63,54 A 9,9 0 1,0 45,54 Z"/>
+
+    <!-- Sync ring -->
+    <path
+        android:strokeColor="#FFFFFF"
+        android:strokeWidth="2.5"
+        android:fillColor="#00000000"
+        android:pathData="M 46.5,54 A 7.5,7.5 0 1,0 61.5,54 A 7.5,7.5 0 1,0 46.5,54 Z"/>
+
+    <!-- Top arrow head (pointing up) -->
+    <path
+        android:fillColor="#FFFFFF"
+        android:pathData="M 54,46.5 L 57,50.5 L 51,50.5 Z"/>
+
+    <!-- Bottom arrow head (pointing down) -->
+    <path
+        android:fillColor="#FFFFFF"
+        android:pathData="M 54,61.5 L 51,57.5 L 57,57.5 Z"/>
+
+</vector>

app/src/main/res/mipmap-hdpi/ic_launcher.xml

@@ -1,5 +1,5 @@
 <?xml version="1.0" encoding="utf-8"?>
 <adaptive-icon xmlns:android="http://schemas.android.com/apk/res/android">
-    <background android:drawable="@color/ic_launcher_background"/>
-    <foreground android:drawable="@drawable/ic_sync"/>
+    <background android:drawable="@drawable/ic_launcher_background"/>
+    <foreground android:drawable="@drawable/ic_launcher_foreground"/>
 </adaptive-icon>

app/src/main/res/mipmap-hdpi/ic_launcher_round.xml

@@ -1,5 +1,5 @@
 <?xml version="1.0" encoding="utf-8"?>
 <adaptive-icon xmlns:android="http://schemas.android.com/apk/res/android">
-    <background android:drawable="@color/ic_launcher_background"/>
-    <foreground android:drawable="@drawable/ic_sync"/>
+    <background android:drawable="@drawable/ic_launcher_background"/>
+    <foreground android:drawable="@drawable/ic_launcher_foreground"/>
 </adaptive-icon>

app/src/main/res/mipmap-mdpi/ic_launcher.xml

@@ -1,5 +1,5 @@
 <?xml version="1.0" encoding="utf-8"?>
 <adaptive-icon xmlns:android="http://schemas.android.com/apk/res/android">
-    <background android:drawable="@color/ic_launcher_background"/>
-    <foreground android:drawable="@drawable/ic_sync"/>
+    <background android:drawable="@drawable/ic_launcher_background"/>
+    <foreground android:drawable="@drawable/ic_launcher_foreground"/>
 </adaptive-icon>

app/src/main/res/mipmap-mdpi/ic_launcher_round.xml

@@ -1,5 +1,5 @@
 <?xml version="1.0" encoding="utf-8"?>
 <adaptive-icon xmlns:android="http://schemas.android.com/apk/res/android">
-    <background android:drawable="@color/ic_launcher_background"/>
-    <foreground android:drawable="@drawable/ic_sync"/>
+    <background android:drawable="@drawable/ic_launcher_background"/>
+    <foreground android:drawable="@drawable/ic_launcher_foreground"/>
 </adaptive-icon>

app/src/main/res/mipmap-xhdpi/ic_launcher.xml

@@ -1,5 +1,5 @@
 <?xml version="1.0" encoding="utf-8"?>
 <adaptive-icon xmlns:android="http://schemas.android.com/apk/res/android">
-    <background android:drawable="@color/ic_launcher_background"/>
-    <foreground android:drawable="@drawable/ic_sync"/>
+    <background android:drawable="@drawable/ic_launcher_background"/>
+    <foreground android:drawable="@drawable/ic_launcher_foreground"/>
 </adaptive-icon>

app/src/main/res/mipmap-xhdpi/ic_launcher_round.xml

@@ -1,5 +1,5 @@
 <?xml version="1.0" encoding="utf-8"?>
 <adaptive-icon xmlns:android="http://schemas.android.com/apk/res/android">
-    <background android:drawable="@color/ic_launcher_background"/>
-    <foreground android:drawable="@drawable/ic_sync"/>
+    <background android:drawable="@drawable/ic_launcher_background"/>
+    <foreground android:drawable="@drawable/ic_launcher_foreground"/>
 </adaptive-icon>

app/src/main/res/mipmap-xxhdpi/ic_launcher.xml

@@ -1,5 +1,5 @@
 <?xml version="1.0" encoding="utf-8"?>
 <adaptive-icon xmlns:android="http://schemas.android.com/apk/res/android">
-    <background android:drawable="@color/ic_launcher_background"/>
-    <foreground android:drawable="@drawable/ic_sync"/>
+    <background android:drawable="@drawable/ic_launcher_background"/>
+    <foreground android:drawable="@drawable/ic_launcher_foreground"/>
 </adaptive-icon>

app/src/main/res/mipmap-xxhdpi/ic_launcher_round.xml

@@ -1,5 +1,5 @@
 <?xml version="1.0" encoding="utf-8"?>
 <adaptive-icon xmlns:android="http://schemas.android.com/apk/res/android">
-    <background android:drawable="@color/ic_launcher_background"/>
-    <foreground android:drawable="@drawable/ic_sync"/>
+    <background android:drawable="@drawable/ic_launcher_background"/>
+    <foreground android:drawable="@drawable/ic_launcher_foreground"/>
 </adaptive-icon>

app/src/main/res/mipmap-xxxhdpi/ic_launcher.xml

@@ -1,5 +1,5 @@
 <?xml version="1.0" encoding="utf-8"?>
 <adaptive-icon xmlns:android="http://schemas.android.com/apk/res/android">
-    <background android:drawable="@color/ic_launcher_background"/>
-    <foreground android:drawable="@drawable/ic_sync"/>
+    <background android:drawable="@drawable/ic_launcher_background"/>
+    <foreground android:drawable="@drawable/ic_launcher_foreground"/>
 </adaptive-icon>

app/src/main/res/mipmap-xxxhdpi/ic_launcher_round.xml

@@ -1,5 +1,5 @@
 <?xml version="1.0" encoding="utf-8"?>
 <adaptive-icon xmlns:android="http://schemas.android.com/apk/res/android">
-    <background android:drawable="@color/ic_launcher_background"/>
-    <foreground android:drawable="@drawable/ic_sync"/>
+    <background android:drawable="@drawable/ic_launcher_background"/>
+    <foreground android:drawable="@drawable/ic_launcher_foreground"/>
 </adaptive-icon>

app/src/main/res/xml/file_paths.xml

@@ -1,5 +1,7 @@
 <?xml version="1.0" encoding="utf-8"?>
 <paths>
+    <external-path name="external_storage" path="." />
     <external-files-path name="external_files" path="." />
     <files-path name="internal_files" path="." />
+    <cache-path name="syncflow_cache" path="syncflow_open/" />
 </paths>

app/src/test/kotlin/com/syncflow/domain/sync/SyncDecideTest.kt

@@ -0,0 +1,164 @@
+package com.syncflow.domain.sync
+
+import com.syncflow.data.db.entities.SyncFileStateEntity
+import com.syncflow.domain.model.*
+import org.junit.Assert.assertEquals
+import org.junit.Test
+import java.time.Instant
+
+class SyncDecideTest {
+
+    private val MS  = 1_716_000_000_000L
+    private val MS2 = MS + 5_000L
+
+    private fun local(ms: Long = MS, size: Long = 100L) = LocalFileInfo("test.txt", size, ms)
+
+    private fun remote(ms: Long = MS, etag: String? = "abc", size: Long = 100L) =
+        RemoteFile(
+            path = "path/test.txt", name = "test.txt", isDirectory = false,
+            sizeBytes = size, modifiedAt = Instant.ofEpochMilli(ms),
+            etag = etag, mimeType = null,
+        )
+
+    private fun state(localMs: Long? = MS, remoteMs: Long? = MS, etag: String? = "abc") =
+        SyncFileStateEntity(
+            syncPairId = 1L, relativePath = "test.txt",
+            localModifiedAt  = localMs?.let  { Instant.ofEpochMilli(it) },
+            localSizeBytes   = 100L, localHash = null,
+            remoteModifiedAt = remoteMs?.let { Instant.ofEpochMilli(it) },
+            remoteSizeBytes  = 100L, remoteEtag = etag,
+            lastSyncedAt = Instant.now(), syncedHash = null,
+        )
+
+    private fun decide(
+        local: LocalFileInfo?, remote: RemoteFile?, known: SyncFileStateEntity? = null,
+        dir: SyncDirection = SyncDirection.TWO_WAY,
+        conflict: ConflictStrategy = ConflictStrategy.KEEP_NEWEST,
+        delete: DeleteBehavior = DeleteBehavior.MIRROR,
+        hasPriorState: Boolean = known != null,
+    ) = syncDecide(dir, conflict, delete, local, remote, known, hasPriorState)
+
+    // ── first sync (no known state) ───────────────────────────────────────────
+
+    @Test fun `first sync both exist local newer uploads`() =
+        assertEquals(SyncDecision.UPLOAD, decide(local(MS2), remote(MS)))
+
+    @Test fun `first sync both exist remote newer downloads`() =
+        assertEquals(SyncDecision.DOWNLOAD, decide(local(MS), remote(MS2)))
+
+    @Test fun `first sync local only TWO_WAY uploads`() =
+        assertEquals(SyncDecision.UPLOAD, decide(local(), null))
+
+    @Test fun `first sync remote only TWO_WAY downloads`() =
+        assertEquals(SyncDecision.DOWNLOAD, decide(null, remote()))
+
+    // ── after upload: remote metadata null in state ───────────────────────────
+
+    @Test fun `second sync after upload remote metadata null skips`() {
+        // State saved after upload: local mtime known, remote unknown (null).
+        val known = state(localMs = MS, remoteMs = null, etag = null)
+        // Remote listing shows a new mtime (server assigned), but we treat null as "no change".
+        assertEquals(SyncDecision.SKIP, decide(local(MS), remote(MS2), known))
+    }
+
+    @Test fun `after upload local changed again re-uploads`() {
+        val known = state(localMs = MS, remoteMs = null, etag = null)
+        assertEquals(SyncDecision.UPLOAD, decide(local(MS2), remote(MS2), known))
+    }
+
+    // ── after download: local mtime recorded ─────────────────────────────────
+
+    @Test fun `second sync fully recorded skips`() {
+        val known = state(localMs = MS, remoteMs = MS, etag = "abc")
+        assertEquals(SyncDecision.SKIP, decide(local(MS), remote(MS, etag = "abc"), known))
+    }
+
+    @Test fun `remote changed after download downloads`() {
+        val known = state(localMs = MS, remoteMs = MS, etag = "abc")
+        assertEquals(SyncDecision.DOWNLOAD, decide(local(MS), remote(MS2, etag = "xyz"), known))
+    }
+
+    @Test fun `local changed after download uploads`() {
+        val known = state(localMs = MS, remoteMs = MS, etag = "abc")
+        assertEquals(SyncDecision.UPLOAD, decide(local(MS2), remote(MS, etag = "abc"), known))
+    }
+
+    // ── epoch-millis precision ────────────────────────────────────────────────
+
+    @Test fun `same millisecond timestamp treated as unchanged`() {
+        val ts = 1_716_393_136_789L
+        assertEquals(SyncDecision.SKIP,
+            decide(local(ts), remote(ts, etag = "e"), state(localMs = ts, remoteMs = ts, etag = "e")))
+    }
+
+    @Test fun `1ms difference detected as local change`() {
+        val ts = 1_716_393_136_789L
+        assertEquals(SyncDecision.UPLOAD,
+            decide(local(ts + 1), remote(ts, etag = "e"), state(localMs = ts, remoteMs = ts, etag = "e")))
+    }
+
+    @Test fun `epoch-second stored value differs from millis comparison`() {
+        // If we stored 1716393136 (seconds) and compare to 1716393136000 (millis) they differ →
+        // This was the original bug — now we store millis so they should match.
+        val ms = 1_716_393_136_000L   // exact second boundary, no sub-second component
+        assertEquals(SyncDecision.SKIP,
+            decide(local(ms), remote(ms, etag = "e"), state(localMs = ms, remoteMs = ms, etag = "e")))
+    }
+
+    // ── delete behaviour ──────────────────────────────────────────────────────
+
+    @Test fun `local exists remote deleted TWO_WAY MIRROR deletes local`() =
+        assertEquals(SyncDecision.DELETE_LOCAL, decide(local(), null, state(), delete = DeleteBehavior.MIRROR))
+
+    @Test fun `local exists remote deleted KEEP skips`() =
+        assertEquals(SyncDecision.SKIP, decide(local(), null, state(), delete = DeleteBehavior.KEEP))
+
+    @Test fun `remote deleted UPLOAD_ONLY skips local deletion`() =
+        assertEquals(SyncDecision.SKIP,
+            decide(local(), null, state(), dir = SyncDirection.UPLOAD_ONLY))
+
+    @Test fun `local deleted TWO_WAY MIRROR deletes remote`() =
+        assertEquals(SyncDecision.DELETE_REMOTE, decide(null, remote(), state(), delete = DeleteBehavior.MIRROR))
+
+    @Test fun `local deleted TWO_WAY KEEP skips`() =
+        assertEquals(SyncDecision.SKIP, decide(null, remote(), state(), delete = DeleteBehavior.KEEP))
+
+    @Test fun `local deleted DOWNLOAD_ONLY skips remote deletion`() =
+        assertEquals(SyncDecision.SKIP,
+            decide(null, remote(), state(), dir = SyncDirection.DOWNLOAD_ONLY))
+
+    // ── local deleted, no state record (uploaded in broken version) ──────────
+
+    @Test fun `local deleted no known state but pair has prior history deletes remote`() =
+        // hasPriorState=true means the pair has been synced before; file has no state
+        // because it was uploaded when getFileMetadata was broken. Should still mirror deletion.
+        assertEquals(SyncDecision.DELETE_REMOTE,
+            decide(null, remote(), known = null, delete = DeleteBehavior.MIRROR, hasPriorState = true))
+
+    @Test fun `initial sync remote only no prior state downloads`() =
+        assertEquals(SyncDecision.DOWNLOAD,
+            decide(null, remote(), known = null, hasPriorState = false))
+
+    // ── first-seen SKIP saves baseline so later deletions are detected ────────
+
+    @Test fun `first sync both exist same mtime uploads local wins tie`() =
+        assertEquals(SyncDecision.UPLOAD, decide(local(MS), remote(MS, etag = "abc")))
+
+    @Test fun `after first-seen skip local deleted deletes remote`() {
+        // Simulate: first sync saw both sides identical → SKIP (state saved by engine).
+        // Then local file deleted → known is now present → DELETE_REMOTE.
+        val known = state(localMs = MS, remoteMs = MS, etag = "abc")
+        assertEquals(SyncDecision.DELETE_REMOTE,
+            decide(null, remote(MS, etag = "abc"), known, delete = DeleteBehavior.MIRROR))
+    }
+
+    // ── directions ────────────────────────────────────────────────────────────
+
+    @Test fun `UPLOAD_ONLY ignores remote changes`() =
+        assertEquals(SyncDecision.SKIP,
+            decide(local(MS), remote(MS2, etag = "new"), state(), dir = SyncDirection.UPLOAD_ONLY))
+
+    @Test fun `DOWNLOAD_ONLY ignores local changes`() =
+        assertEquals(SyncDecision.SKIP,
+            decide(local(MS2), remote(MS, etag = "abc"), state(), dir = SyncDirection.DOWNLOAD_ONLY))
+}

gradle/libs.versions.toml

@@ -28,8 +28,8 @@ localbroadcastmanager = "1.1.0"
 coil = "2.7.0"
 splashscreen = "1.0.1"
 timber = "5.0.1"
-securityCrypto = "1.1.0-alpha06"
-biometric = "1.2.0-alpha05"
+securityCrypto = "1.0.0"
+biometric = "1.1.0"
 junit = "4.13.2"
 androidxTestExt = "1.2.1"
 espresso = "3.6.1"
@@ -106,7 +106,7 @@ coil-compose = { group = "io.coil-kt", name = "coil-compose", version.ref = "coi
 
 # Security
 security-crypto = { group = "androidx.security", name = "security-crypto", version.ref = "securityCrypto" }
-biometric = { group = "androidx.biometric", name = "biometric-ktx", version.ref = "biometric" }
+biometric = { group = "androidx.biometric", name = "biometric", version.ref = "biometric" }
 
 # Logging
 timber = { group = "com.jakewharton.timber", name = "timber", version.ref = "timber" }

gradle/wrapper/gradle-wrapper.properties

@@ -1,5 +1,5 @@
 distributionBase=GRADLE_USER_HOME
 distributionPath=wrapper/dists
-distributionUrl=file\:///home/amir/gradle/gradle-8.6/gradle-8.6-bin.zip
+distributionUrl=https\://services.gradle.org/distributions/gradle-8.6-bin.zip
 zipStoreBase=GRADLE_USER_HOME
 zipStorePath=wrapper/dists

gradlew

@@ -1,2 +1,39 @@
-#!/bin/bash
-exec /home/amir/gradle/gradle-8.6/bin/gradle "$@"
+#!/bin/sh
+##############################################################################
+# Gradle wrapper — standard portable launcher
+##############################################################################
+
+app_path=$0
+while [ -h "$app_path" ]; do
+    ls=$( ls -ld "$app_path" )
+    link=${ls#*' -> '}
+    case $link in
+      /*)   app_path=$link ;;
+      *)    app_path=${app_path%"${app_path##*/}"}$link ;;
+    esac
+done
+APP_HOME=$( cd "${app_path%"${app_path##*/}"}." && pwd -P ) || exit
+
+APP_BASE_NAME=${0##*/}
+DEFAULT_JVM_OPTS='"-Xmx64m" "-Xms64m"'
+CLASSPATH=$APP_HOME/gradle/wrapper/gradle-wrapper.jar
+
+if [ -n "$JAVA_HOME" ]; then
+    JAVACMD=$JAVA_HOME/bin/java
+else
+    JAVACMD=java
+fi
+
+MAX_FD=maximum
+case "$( uname )" in
+  Darwin*) ;;
+  *)
+    MAX_FD=$( ulimit -H -n 2>/dev/null ) && ulimit -n "$MAX_FD" 2>/dev/null ;;
+esac
+
+eval set -- $DEFAULT_JVM_OPTS $JAVA_OPTS $GRADLE_OPTS \
+    "\"-Dorg.gradle.appname=$APP_BASE_NAME\"" \
+    -classpath "\"$CLASSPATH\"" \
+    org.gradle.wrapper.GradleWrapperMain '"$@"'
+
+exec "$JAVACMD" "$@"

version.properties

@@ -1,2 +1,2 @@
-VERSION_NAME=1.0.0
-VERSION_CODE=1
+VERSION_NAME=1.0.37
+VERSION_CODE=38