Plans

rebuildListFromPersistedOps replays the view from index 0 inside the 1-second join poll (up to ~120×). Add a materialized-view checkpoint to resume from; acceptance is bounded replay work during joins.

SYNC_LIST resends the whole list on poll ticks. Make per-item events the default and snapshots the exception; acceptance is no repeated full-list push during steady-state polling.

Shared _writableCheckTimer across two pollers and a module-global _writeChain never reset across base teardown can send in-flight writes to the wrong base. Add per-base write contexts, reset write queues on teardown, and use distinct timers.

lista.lock (wx, cleanup only on teardown) leaves a stale lock after a crash and cannot coordinate desktop + headless on one machine. Add a lease with owner pid/instance id, heartbeat, stale-lock recovery, and separate storage roots where appropriate.

Store-and-forward of others' messages has no quotas/rate limits. Defer third-party relay/storage past milestone 1, then add per-topic quotas, queue caps, TTLs, rate limits, and visible storage usage.

Zero tests exist and package-lock.json is gitignored. Stand up milestone-zero CI with a reproducible lockfile, test runner, lint, dependency hygiene, redaction scan, and backend reducer/join/security smoke tests.

Security hardening, test bootstrap, reproducible installs, and docs/wiki alignment should land before Redux/package extraction.

Stand up the separate app repositories (listam-mobile, listam-desktop, listam-headless) and the shared listam-shared package repo from milestone 1, and decouple @listam/backend from BareKit globals so the published backend package runs under mobile worklet, Pear Desktop, and headless Bare/Node.

The safe current tiers are trusted full participant and blind ciphertext helper. Richer read-only or sync-only roles require membership authority, key epochs, and a new credential model.

RPC numbers, protocol events, package exports, storage migrations, owner-control commands, and cross-app sync should all have boundary tests before desktop/headless are accepted.

Each instance starts with its own base dir (mobile = Expo document dir; desktop/headless take --storage <dir>). Never share lista-local between instances.

Run a local hyperdht bootstrap node and pass it via BOOTSTRAP / --bootstrap so test peers discover each other without the public DHT.

Headless exposes scriptable primitives: create-base, print-invite, join <invite>, status, dump-list, add-item, edit-item, mark-done, delete-item, export, import, shutdown.

Every shared harness run generates content, edits it, marks it done/undone, deletes it, and asserts the resulting snapshot syncs across peers. Assertions compare canonical item ids and deletion state, not display names, so duplicate-name content cannot collapse by text.

Every test closes stores, destroys swarms, releases the lock, and removes temp dirs; seeded keypairs make assertions reproducible.

Redux Toolkit is planned because Listam is expected to grow into multiple list types: to-dos, simple tasks, calendar-derived lists, kanban boards, configurable rules, and state transitions.

Normalized entities, predictable actions, selectors, and audit-friendly event trails give mobile and desktop one shared app-state model while Autobase/Corestore stays the durable replicated source of truth.

Redux should be the UI projection and command dispatcher, not the database. Backend snapshots and protocol events reconcile Redux after persistence and replication.

Grocery category and item translations stay in @listam/grocery. Screen titles, actions, empty states, errors, confirmations, diagnostics labels, settings copy, and loyalty-card UI belong in a shared @listam/i18n layer so mobile and desktop do not grow separate hardcoded strings.

Locale choice lives in local preferences: follow the system language by default, allow an explicit override, persist it locally, and fall back predictably. The same selected locale should drive UI messages and the grocery-label resolver.

Add pseudo-locale and long-string checks for the main list, invite/join confirmation, settings, diagnostics, and loyalty-card surfaces. Mobile and desktop screens must be reviewed against any project-local design-guide/ examples in English and pseudo-localized modes before acceptance.

Shared packages should separate pure domain code from platform code. Domain reducers, selectors, protocol types, migrations, and grocery intelligence should stay usable in any JavaScript runtime. Bare, Pear, React Native, P2P owner-control, and setup/recovery transport details belong behind backend/client adapters so each app can swap transport without changing list logic.

Redux should not become the durable database. Replicated list data remains authoritative in Autobase/Corestore. Redux holds a local projection optimized for rendering, optimistic interaction, and debugging. Backend snapshots and operation events reconcile the Redux projection after persistence and peer replication.

Public command names, event names, operation versions, and RPC numeric values should be treated as shared contracts. New behavior should append new commands or versioned fields instead of changing old meanings, so mobile, desktop, and headless can update on different schedules.

Before implementing UI for any app or project, check for a project-local design-guide/ directory. When it exists, its design system docs, tokens, component rules, and example screens are the UI source of truth and must guide implementation and review before generic visual preferences.

Use trace for very detailed development-only command/event flow, debug for development diagnostics, info for normal lifecycle milestones, warn for recoverable problems, error for failed operations, fatal for startup or persistence failures, and audit for security-relevant owner actions.

Start with smaller mobile/desktop retention, such as 10 MB files with 10 rotations, and larger headless retention, such as 50 MB files with 20 rotations. Development can keep more debug or trace data; production should default to info and above.

Redact before writing and before export. Owner-control tokens, pairing codes, invite codes, base keys, writer keys, encryption keys, raw topic keys, auth headers, and local API tokens should become short fingerprints or omitted values. Full user content should also be omitted when a diagnostic event is useful without it.

Diagnostics views should filter by app or instance name, level, component, topic/list fingerprint, request or operation correlation id, time window, and warnings/errors only.

Log startup/shutdown, backend readiness, Redux commands, adapter requests, invite and pairing phases, peer count changes, replication progress, Autobase apply/snapshot, headless role changes, queue depth, storage usage, exports/imports, and unhandled errors.

Peer log requests should be disabled by default for normal production users. The user's own paired headless instance may expose logs through explicit diagnostics actions over owner-control, but logs should never be fetched from public endpoints.

Use iOS Keychain and Android Keystore-backed storage, such as Expo SecureStore or a lower-level native adapter if the Bare bridge needs tighter control.

Use the OS keychain where possible. If unavailable, use an encrypted key file unlocked by a device-local key or user passphrase, with strict file permissions.

Use the OS keyring, TPM-backed secret storage, systemd credentials, encrypted local key file, or user-provided passphrase depending on the device. Plain files should be explicit development mode only.

On startup, detect legacy plaintext key files, validate them, write sensitive values to the secure store, replace normal metadata with fingerprints, delete plaintext files after success, and log only migration status. Provide a recovery path if secure storage is unavailable or the user is moving to a new device.

Avoid storing raw application encryption keys on generic relay hardware unless the device is explicitly acting as trusted storage for the owner.

Mobile secret storage should align with Expo SecureStore, Apple Keychain Services, and Android Keystore-backed storage.

Owner-control tokens, pairing codes, invite codes, base keys, encryption keys, and writer keys must be redacted from production logs and should not remain in plaintext app files. Public internet exposure should require an explicit future decision, not a default headless behavior.

Adapters should report typed failures for backend unavailable, not writable, pairing timeout, invite expired, incompatible protocol version, storage locked, and auth rejected. Redux should surface these in sync or ownedDevices instead of hiding them in console logs.

Run milestone-zero hardening first, refactor mobile onto the shared Redux/protocol/client packages second, then extract the backend package, then build desktop and headless. That keeps the current app working while each shared boundary is proven by the existing product.

Use stable item ids when available, preserve compatibility with legacy text-only entries, normalize entities in Redux, keep operation contracts append-only and versioned, and avoid embedding UI-only concepts into replicated backend operations.

The first milestone should keep current simple Listam behavior, but the domain model should be ready for to-dos, simple tasks, calendar-ingested lists, kanban-style boards, configurable rules, and additional personal-life-management features.

Future USB dongles should work with every app using the Holepunch stack, not only Listam. Keep relay envelopes generic and encrypted so dongles can provide bootstrap, async messages, blind relay, reliable redundant storage, store-and-forward storage, push notification relay, reconnection help, media streaming/distribution improvements, and Bluetooth configuration for relay topics without understanding Listam payloads.

The dongle prototype path currently considers Seeed Studio XIAO ESP32S3, ESP32-S3 DevKitC-1 N16R8, SPI microSD card reader modules, and 32 GB microSDHC cards. The plan keeps those devices as relay/storage appliances around generic Holepunch topics rather than Listam-only hardware.

Prove current Listam parity across mobile, desktop, and headless first. Do not add new list domains in the first milestone; add the architecture that makes them possible. All three app surfaces should consume the shared package versions and existing simple list operations should remain compatible.

Each phase is a pause gate rather than necessarily one commit. Small phases land as a single commit; larger phases (package extraction, desktop, headless) may span several commits. Implementation must pause at the phase boundary - after the work is committed, verified, and recorded - before the next phase begins, and the record must capture the full commit range.

After Phase 1 the work splits into a membership-crypto track (Phases 2-4: secret-storage foundation, owner membership authority, key epochs / member-removal re-key) and a data-model / extraction track (Phases 5-8: stable item IDs, in-place Redux migration, shared-package extraction). The extraction track depends only on Phases 0-1, not on the membership-crypto track, so it does not wait behind the re-key flow. Both reconverge before Phase 11 onward; Phase 9 adds shared UI internationalization and Phase 10 finishes loyalty-card secret migration and logging redaction before durability and app-surface work.

After each phase, add or update a collapsible subsection in this plan and the dedicated wiki phase log. Each record must list all files modified with reasons, all functions created/updated/deleted with reasons, a summary of implementation decisions and actions, and the commit range, dependencies satisfied, and acceptance signal met.

Phase 0 test/CI/repo-hygiene bootstrap; Phase 1 invite safety and deep-link confirmation; Phase 2 secret-storage foundation; Phase 3 membership authority and honest revocation language; Phase 4 key epochs and member-removal re-key; Phase 5 stable item IDs and backend reduction migration; Phase 6 in-place Redux Toolkit migration; Phase 7 pure shared-package extraction; Phase 8 backend/client extraction with platform adapter; Phase 9 UI internationalization foundation; Phase 10 loyalty-card secrets and redaction routing; Phase 11 recovery, snapshots, and storage durability; Phase 12 desktop parity; Phase 13 headless service and CLI parity; Phase 14 owner-control protocol; Phase 15 cross-app acceptance and release readiness.

Surfaces — the tonal ladder --surface-0 (canvas) → --surface-3 (pressed / selected-mute), plus --card (row and kv-row fill). Inks — --ink, --ink-mute, --ink-faint (metadata, AA-large only). Signals — --signal / --on-signal (acid) and --danger plus containers. No third hue: pending and offline states are carried by shape, not by adding amber.

#C3F400 on white is ~1.4:1. As a fill, acid always pairs with --on-signal; as text it appears only on --ink-block.

Any block carrying acid text (active nav, active locale) uses --ink-block: #1B1C1C in light, #000000 in dark. The first mockup flipped the active-nav block to --ink in dark mode, which resolves to near-white and put acid text on a light fill (~1.4:1) — exactly the failure this rule prevents.

It is the brand constant. The adoption PR includes an AA audit table of every ink × surface pair actually used, and --ink-faint is restricted to ≥14px mono or non-text.

Themes resolve through html[data-theme="light" | "dark"]; the default follows prefers-color-scheme with a pre-JS fallback so the first paint is already correct. The choice persists in preferences next to isGridView, cycles system → light → dark from the Settings dialog or the T shortcut, and backend-boot applies the persisted theme to the Pear window background at startup — replacing the hardcoded #fbf9f9.

Semantic tokens, the dark palette, and the contrast / scrollbar / label floors land with no markup changes — the biggest visible win for the least risk. Tabler outline icons inherit ink, so they theme automatically; prefers-reduced-motion and forced-colors (Windows high-contrast) both pass nearly for free because state is encoded as shape, not colour. Shipped 2026-06-11 as phases 1–2 of Kinetic Minimalist v2 (user-approved).

leaf-host is the desktop/server binary (disk or in-memory storage); leaf-esp32 is firmware for the ESP32-S3-N16R8; leaf-core is the shared, platform-agnostic mirror logic. The firmware is provisioned from cfg.toml (up to three 2.4GHz WiFi networks + hub address + control key; the real file with credentials is gitignored).

The bridge is transport-pluggable (callers inject a net-compatible module). Headless = Node, shipped and enabled with LISTAM_LEAF_BRIDGE_PORT. Desktop = Pear/Bare, shipped with full UI in the Peers & Devices pane (enable toggle, port field, provisioning-key display/copy, live "N boards connected"), off by default. Mobile = planned only — a BareKit worklet dies when the app backgrounds, so the recommended path is an always-on headless hub, not phone-as-hub.

After cp cfg.toml.example cfg.toml and . ~/export-esp.sh, run cargo build --release then espflash flash --monitor --flash-size 16mb --partition-table partitions.csv …/leaf-esp32 (espflash ignores the IDF table, so pass --partition-table explicitly).

Mounted at /data via esp_vfs_fat_spiflash_mount_rw_wl; mirrored cores persist there through a blocking std::fs storage backend (Storage::new_file_storage) in the vendored hypercore. On boot the leaf reopens the control core from flash and re-registers every announced core, so after a power cycle it reloads the whole project and only syncs deltas. RAM (64 KiB PSRAM pages) is the fallback if the FAT mount fails.

Entry::decode read tree_upgrade and bitfield under the wrong flag bit (flags & 2 instead of bits 4 and 8), so any entry with nodes + bitfield but no upgrade (a replicated data block) overran the buffer — invisible in-memory, fatal on disk reopen. Fixed with regression tests in oplog/entry.rs.

FATFS leaves seek-past-EOF gaps undefined (stale flash) but hypercore assumes sparse-zero semantics → tree-store checksum corruption on multi-block downloads; fixed by zero-filling gaps before any past-EOF write. FATFS also has no fd-ftruncate (EPERM), emulated by a grow-by-zero-write / shrink-by-reopen set_len_compat. flush_infos now sync_all()s each store (FATFS only persists size on fsync/close); fresh-format FAT had no /data/cores dir → the mount now creates it.

listam cores are v11 manifest cores (key = manifestHash); the upstream hypercore / hypercore-protocol-rs / hypercore_schema crates can't do this yet. The vendor/ forks add manifest codecs + hash + verify, raw-key keyless cores (HypercoreBuilder::raw_key + set_manifest), Data.manifest flag 16, RequestSeek.padding, the protomux batch encode fix (Opens/Closes must be channel-0 control messages with type tags — JS silently drops mistagged opens), and the file-storage / FATFS quirk handling above. All are candidates for upstreaming.

Golden vectors generated from JS hypercore 11.33 (bridge-js/gen-vectors.mjs) pin the crypto (manifest codec, manifestHash, v1 signables, multisig encoding, signature verification). The E2E harness (bridge-js/e2e.mjs) proves the contract against the real headless app, and the board is a first-class --esp32 row in the cross-device test matrix.

Added to the S3-N16R8 via a solderless screw-terminal shield. The pin map was adversarially verified clean (it avoids the octal-PSRAM, flash, native-USB, UART0, and strapping pins). Both modules run on 3V3 only (never 5V), shared GND; the two buses are independent peripherals that need no coordination.

leaf-esp32/src/bin/mic_test.rs (an isolated bin that touches no leaf code) is an I2S0 level-meter printing peak / RMS / dBFS per ~100ms window. Flashed and booted clean, it tracked a full-scale transient (−0.0 dBFS) decaying smoothly to a ~−40 dBFS room floor with symmetric min/max around 0 = healthy AC PCM. Mic + wiring confirmed recording correctly.

Autobase optimistic writers (every invited member's first blocks) fail "Manifest signature verification failed" — the verifier doesn't reconstruct the patched tree hash yet. Owner / system / bootstrap cores verify fine (so single-member hubs and the ESP matrix row pass); porting verifier.js's _verifyMulti patch path is needed only once a multi-member project's member writer cores must mirror.

For projects larger than the ~13 MB internal FAT, point MirrorStorage::StdFs at /sdcard/cores via esp_vfs_fat_sdspi_mount (fallback SD → internal FAT → RAM). leaf-core is unchanged — StdFs is path-agnostic and reuses the existing zero-fill / no-ftruncate handling.

The mobile bridge plan is written but unimplemented: the real blocker is background lifecycle (iOS has no supported background TCP listener; Android needs a foreground service), not wiring. For the offline-LAN niche the preferred direction is to add an ESP firmware listen-mode and have the phone dial the board, rather than run a background server.

A board-level mode, on by default, that the board owner can disable. While on, creating a ticket requires at minimum a short description, a task checklist (≥1 item), estimated hours (>0), and estimated complexity (1–100%).

Accumulate the time a ticket spends in the In Progress state.

On reaching Done, freeze a verdict from delta = (actualInProgressHours − estimatedHours) / estimatedHours: delta > +10% → overtime (not in time); delta < −10% → undertime (overestimated); otherwise on time.

Calibration accuracy: a user is more congruent the closer their average estimated complexity is to the share of their tickets that missed the estimate (ran overtime or undertime).

normalizeListItem spreads ...item before stamping the three required fields (text, isDone, timeOfCompletion), so arbitrary extra fields survive the reduction untouched. A ticket is a list item with listType:'kanban' plus optional fields — no new op types and no LIST_OPERATION_VERSION bump (stays 1; ops with version>1 are dropped, so keeping it 1 stays forward-compatible with old peers).

but addItem(text, listId, listType) discards everything but text. So addItem and the RPC_ADD handler must be extended to carry ticket fields — the one unavoidable backend change for ticket creation.

isStaleUpdate drops any update with a lower updatedAt. Every ticket mutation (drag, block edit, checklist toggle, property edit) MUST set updatedAt: Date.now() — forgetting this is the #1 silent-no-op bug.

membership.mjs provides the template: an owner authority keypair, an owner check, records persisted to the view as {op, record}, rebuilt via a reducer plus view-checkpoint.mjs, and normalizeViewEntry ignoring control records so they never pollute the item reduction. Board config mirrors this exactly.

The surface was renamed from "Kanban" to Board. To avoid forking apply() across a partially-updated mesh, the migration is dual-read: isBoardType() accepts both the canonical 'board' value and the legacy 'kanban' value, while tickets are still written with the legacy wire type 'kanban' until the whole mesh (including the pre-bundled mobile backend) ships dual-read — only then does the write-side flip to 'board'. The pure block / ticket / congruency logic now lives in the shared @listam/domain/board.mjs (BOARD_LIST_TYPE = 'board', LEGACY_BOARD_LIST_TYPE = 'kanban'), generic enough to back both desktop and mobile.

New module backend/lib/board-config.mjs (models membership.mjs). A single owner-signed record holds the whole board config — also what the Properties/States/Automations/Rules config edits:

reduceBoardConfigOperation verifies against body.ownerAuthorityKey and accepts only if it equals the board creator's authority key; it rejects wrong-base, replay (sequence ≤ highest), and bad signatures. This is how non-creators are prevented — purely cryptographic, no client trust. Absence of any record = defaults (rigor ON, the 4 default states).

apply() handles isBoardConfigRecord(value) after the membership branch (reduce, set state, persist {op:'board-config'}, broadcast); view-checkpoint.mjs collects the records and keeps them out of the item reduction; state.mjs holds boardConfigState, rebuilt on restart. Owner-only mutation RPC; non-owner attempts notify {type:'config-denied', reason:'not-owner'}.

→ {ok, missing[]}. When config.rigorOn, requires description, checklist≥1, estimatedHours>0, estimatedComplexity∈[1,100]. Enforced on add only, never on update — so status changes of legacy / grandfathered tickets are never rejected.

On entering in_progress, set inProgressSince=now; on leaving, accumulate inProgressMs (clamp negative skew, cap a single slice). On entering done, flush the open slice, freeze actualInProgressHours, compute delta, freeze timeliness, set isDone/timeOfCompletion/completedBy. Reopen re-arms; re-completion recomputes. Timeliness/time are frozen at the source writer that owns the wall clock; every peer receives the verdict verbatim and agrees.

Per-user, grouped by completedBy ?? createdBy: offEstimateRatePct = 100·(#overtime + #undertime)/N; gap = |avgComplexityPct − offEstimateRatePct|; raw = 100 − gap; volume-shrunk toward neutral 50 via score = round(50 + (raw − 50)·N/(N+5)). Also emits on-time/over/under counts and an optional tendency.

→ {blocked[], warnings[]} for WIP limit, required-owner-in-active, done-gate ("no open checklist items"), and blocked-needs-reason.

Selectors/helpers that keep ui.mjs presentational and re-export the shared math: isTicket, isKanbanList, groupByStatus, ticketBadges, selectBoardConfig, selectWriterStats (delegates to computeCongruency), validateRigorDraft.

renderBoardPane builds columns from groupByStatus; renderTicketCard shows priority pill, assignee avatar, due, checklist count, an in-progress timer, and the on-time / overtime / undertime badge when done.

Three shared pure builders (renderTicketSummary, renderTicketBody, renderPropertyRail) feed both a right-hand split panel and a full-screen .ticket-doc grid (no duplication). The 8-block body editor dispatches per type with a hover gutter, / slash menu, and one commitBlocks → RPC_UPDATE with updatedAt. Live markdown is a minimal subset (bold/italic/code/links).

The add-ticket-rigor dialog validates required fields with a .shake + .rigor-notice; the Settings rigor row and the Properties/States/Automations/Rules config dialog are owner-gated and write RPC_SET_BOARD_CONFIG (read-only chip for non-creators).

Native HTML5 DnD (survives full re-render; feedback via classList; one RPC_UPDATE on drop; Ctrl+←/→ keyboard fallback). renderCongruencyPane shows one card per user: completed count, on-time/over/under bar, score numeral + reason. Board/rigor/stats all derive from state.items — no duplicated ticket state.

All new keys land in all 6 catalogs (en/es/de/fr/it/pt) or the assertCompleteCatalog parity test fails.

Persist {op:'activity'} entries (ticket completed + timeliness, config changed); done→in_progress re-arms timing and re-completion recomputes timeliness.

Control records and the grocery list never render kanban tickets and vice-versa (filter by listType); mock-backend.mjs seeds kanban tickets (mixed statuses, each timeliness) + a board-config so ?mock=1 exercises board/rigor/congruency without a backend.

Keyboard drag, focus management, prefers-reduced-motion; no op-version bump, optional fields, default config when no record, old peers ignore unknown fields and re-emit them intact. Mobile/headless reuse the same shared logic (UI is a follow-up — see the Mobile Kanban plan below).

domain/kanban.test.mjs (validate, transition accumulation/freeze/reopen, congruency gap + shrinkage), board-config.test.mjs (default rigor ON, creator flips it, non-creator/replay/wrong-base rejected, log rebuild), backend apply integration (rigor add-gate, checkpoint keeps config out of item reduction), desktop ticket.test.mjs/store.test.mjs, and the i18n parity test.

npm test in listam-packages + listam-desktop; ?mock=1 board walk (rigor validation, drag, in-progress timer, frozen badge, congruency); a two-peer cross-device run proves a non-creator rigor toggle is rejected cluster-wide and a ticket completed on peer A shows the same timeliness on peer B.

List + group metadata are ordinary synced items in a reserved meta list (listType:'registry'), each carrying { kind:'list'|'group', name, type?, groupId?, order }. They flow through the existing RPC_ADD/UPDATE/DELETE → sync → reduce pipeline (LWW, encrypted, attributed) with zero backend changes; frontends reduce them into a registry and filter listType:'registry' out of user-facing views. The fallback is a dedicated owner-signed list-registry record mirroring board-config.mjs.

"Opens here on launch" is inherently local — preferencesSlice + AsyncStorage, not synced.

Capture-phase PanResponder + Animated translateX (no react-native-gesture-handler / pager-view; check-deps.mjs gates new imports). Content swaps by dispatching selectedListChanged.

Flip grocery swipe-to-delete to swipe-left and switch kanban columns by tapping — horizontal swipe is reserved for list navigation.

reduceRegistry(metaItems) → { groups:[{id,name,order}], lists:[{id,name,type,groupId,order}] } with LWW by updatedAt, tombstone deletes, stable sort by order then name, and unfiled lists folded into an implicit "Ungrouped" group last. REGISTRY_LIST_TYPE='registry'; no backend changes (rides item ops). Used by mobile now and desktop later.

{ config, canAdminister }; boardConfigReceived/boardConfigReset; selectBoardConfig falls back to normalizeBoardConfig(null) (never null).

Reduces synced registry meta-items (via @listam/domain/list-registry) plus the local default; thunks send RPC_ADD/UPDATE/DELETE for the meta-items; selectors selectGroupedLists, selectListsInGroup, selectListIndexInGroup.

preferencesSlice.defaultListId (+ AsyncStorage hydration); _useWorklet.ts decoder gains board-config → boardConfigReceived and config-denied → snackbar, re-exports the two board-config RPCs. Registry meta-items arrive through the existing sync/from-backend cases — no new transport.

step(lib,curId,dir,{jumpGroup,wrap}), nextList/prevList, crossesGroupBoundary (→ toast group name), resolveLaunchList (default → first-of-first-group → null; stale default falls through). No wrap by default.

Capture-phase PanResponder claims horizontal only when clearly horizontal (dead-zone ~14px + axis-lock) AND no category drag active AND not in a no-pager zone; animates one translateX, dispatches on settle; long-press a blank area (~250ms) arms jumpGroup + haptic; reduced-motion → instant swap.

PositionIndicator.tsx (green active dot, hidden when ≤1); ListsMenu.tsx (grouped list of every list, opened from the top-left menu; current highlighted, default starred); ListItem.tsx swipe-to-delete flipped to left; Header.tsx top-right default star; index.tsx wraps the list view in the pager and resolves the launch list.

From desktop src/ticket.mjs with the DOM/innerHTML markdown bits dropped — pure reuse of @listam/domain/kanban (groupByStatus, ticketBadges, buildStatusChange, validateRigorDraft, formatDuration, block helpers).

Board switches columns by tapping a segmented control (one column at a time); cards via ticketBadges with a live in-progress timer; a full-screen ticket detail sends one RPC_UPDATE via buildStatusChange (backend freezes time/timeliness); the rigor create form runs validateRigorDraft before RPC_ADD; the congruency view renders selectWriterStats as monochrome bars; a new-list bottom sheet (grocery vs kanban) calls createListThunk.

Kanban/ticket/board keys already exist in all 6 @listam/i18n catalogs. Add only new nav keys (nav.toast.enteredGroup, nav.hint.jumpArmed, board.configDenied, group/menu/default-star labels) to all 6 + the MessageKey union; the parity test gates it.

Consume useTheme() tokens only; green (colors.accent, the native #2f9e44 — not the desktop acid green) is reserved for active/positive: default star, FAB, active column/tab, live timer, done/on-time, primary actions, slider.

Co-locate .mjs tests under listam-mobile/backend/lib/ and extract pure logic the .ts imports: list-registry.test.mjs (LWW, deletes, ordering, Ungrouped), list-nav.test.mjs (next/prev, cross-boundary toast, jumpGroup, no-wrap, stale default), kanban-ticket.test.mjs (ported helpers; domain math is already covered in packages/domain/kanban.test.mjs).

npm test (mobile + packages); Expo simulator: create a grocery and a kanban list, file them into groups, star a default and relaunch, swipe between lists (confirm the group-boundary toast), long-press + swipe to jump a group, confirm grocery delete swipes left, tap kanban columns vs swipe to change list, rigor create validation, an on-time badge, congruency; a two-device run proves registry sync and shared timeliness with per-device defaults.

Centralize an isRegistryItem guard; if overloading items feels wrong, switch to the owner-signed list-registry record fallback (more backend work).

Vertical FlatList scroll must never be captured (axis-lock is the invariant); category long-press-drag (~280ms on rows) and jump-arm (~250ms on blank space) are disjoint by surface — verify on device.

Any-writer registry edits race under LWW (two peers rename a group → last write wins, acceptable). Desktop multi-list/group UI is out of scope; the shared reducer lets desktop adopt it later for parity.