Cloud synchronization

Synchronize reading progress, bookmarks, and annotations across installations while preserving offline-first local reading and keeping credentials out of SQLite, logs, diagnostics, and payloads. Open books and their positions are per device in the first release (RFD 12); carrying them across devices is a possible follow-up here, decided by how much complexity it adds (recorded 2026-10-14).

Introduce portable book and record identities before transport and define deterministic revisions, conflicts, deletions, and tombstone retention with test vectors. Shōsai is unreleased, so the development SQLite schema may be replaced instead of preserving path-keyed compatibility. Synchronization remains outside the open/read critical path and applies remote changes transactionally.

A narrow transport interface provides conditional reads and writes, capability validation, bounded payloads, cancellation, and typed failures. WebDAV is the first candidate, not a permanent choice absent evidence. Credentials use the OS credential store; book files and cover blobs are initially out of scope.

Identity, protocol, conflict, transport, and privacy decisions must converge before implementation commits to a wire format or provider.

Annotations join the first sync model only after their RFD 16 anchors and lifecycle are stable. Their opaque IDs, color, body, selectors, provenance, modification time, and tombstones participate in the same versioned record, outbox, conflict, replay, and retention design as bookmarks. Selected quotes and notes are sensitive payload data: synchronization must minimize them and the privacy ADR must decide whether they require end-to-end encryption before any remote transport is enabled.

Flutter presents sync state and supplies platform credential, connectivity, and background-scheduling adapters under RFD 12. The core may emit privacy-safe typed notification intents for actionable sync failures. Push delivery is not a sync transport, must not be required for convergence, and is deferred until a server-originated event justifies APNs, FCM, or web-push infrastructure.

The decision gates, migrations, transport milestones, and acceptance tests are tracked in RFD 11 implementation checklist.