push registration no longer depends on notification permission, reporting effective opt-in and os permission

analysis_options.yaml

@@ -18,6 +18,9 @@ analyzer:
     - "**/*.freezed.dart"
     - "lib/firebase_options.dart"
     - "build/**"
+    - android/**
+    - ios/**
+    - web/**
 
 linter:
   rules:

android/.gitignore

@@ -11,3 +11,4 @@ GeneratedPluginRegistrant.java
 key.properties
 **/*.keystore
 **/*.jks
+.kotlin/

android/app/build.gradle

@@ -33,10 +33,6 @@ android {
         coreLibraryDesugaringEnabled true
     }
 
-    kotlinOptions {
-        jvmTarget = '17'
-    }
-
     sourceSets {
         main.java.srcDirs += 'src/main/kotlin'
     }
@@ -47,7 +43,6 @@ android {
         targetSdkVersion flutter.targetSdkVersion
         versionCode flutterVersionCode.toInteger()
         versionName flutterVersionName
-        multiDexEnabled true
     }
 
     buildTypes {
@@ -59,11 +54,20 @@ android {
     }
 }
 
+kotlin {
+    compilerOptions {
+        jvmTarget = org.jetbrains.kotlin.gradle.dsl.JvmTarget.JVM_17
+    }
+}
+
 flutter {
     source '../..'
 }
 
 dependencies {
-    implementation 'com.android.support:multidex:2.0.1'
+    // Same version as workmanager_android pins — needed to enqueue its
+    // BackgroundWorker from native widget code (the plugin uses
+    // `implementation`, so androidx.work is not exposed transitively).
+    implementation 'androidx.work:work-runtime:2.11.2'
     coreLibraryDesugaring 'com.android.tools:desugar_jdk_libs:2.1.4'
 }

android/app/src/main/AndroidManifest.xml

@@ -9,7 +9,7 @@
         <activity
             android:name=".MainActivity"
             android:exported="true"
-            android:launchMode="singleTop"
+            android:launchMode="singleTask"
             android:theme="@style/LaunchTheme"
             android:configChanges="orientation|keyboardHidden|keyboard|screenSize|smallestScreenSize|locale|layoutDirection|fontScale|screenLayout|density|uiMode"
             android:hardwareAccelerated="true"

android/app/src/main/java/io/flutter/app/FlutterMultiDexApplication.java

@@ -1,25 +0,0 @@
-// Generated file.
-//
-// If you wish to remove Flutter's multidex support, delete this entire file.
-//
-// Modifications to this file should be done in a copy under a different name
-// as this file may be regenerated.
-
-package io.flutter.app;
-
-import android.app.Application;
-import android.content.Context;
-import androidx.annotation.CallSuper;
-import androidx.multidex.MultiDex;
-
-/**
- * Extension of {@link android.app.Application}, adding multidex support.
- */
-public class FlutterMultiDexApplication extends Application {
-  @Override
-  @CallSuper
-  protected void attachBaseContext(Context base) {
-    super.attachBaseContext(base);
-    MultiDex.install(this);
-  }
-}

android/app/src/main/kotlin/eu/mhsl/marianum/mobile/client/MainActivity.kt

@@ -1,15 +1,38 @@
 package eu.mhsl.marianum.mobile.client
 
 import android.content.Intent
+import android.os.Bundle
 import io.flutter.embedding.android.FlutterActivity
 import io.flutter.embedding.engine.FlutterEngine
 import io.flutter.plugin.common.MethodChannel
 
 class MainActivity : FlutterActivity() {
     private val widgetChannel = "eu.mhsl.marianum.widget"
+    private val shareChannel = "eu.mhsl.marianum.share"
     /// Last seen widget tap target. Cleared by Dart via `consumePendingNavigation`
     /// so the same intent isn't replayed on every resume.
     private var pendingTimetableTap: Boolean = false
+    private val shareActions = setOf(Intent.ACTION_SEND, Intent.ACTION_SEND_MULTIPLE)
+
+    /// receive_sharing_intent only emits warm shares to a live Dart listener and
+    /// does not buffer them. After a relaunch into an existing task the share
+    /// arrives via onNewIntent before Dart subscribed, so it is held here until
+    /// Dart reports `listenerReady`.
+    private var shareListenerReady = false
+    private var bufferedShare: Intent? = null
+
+    override fun onCreate(savedInstanceState: Bundle?) {
+        // Android replays the original launch intent when the activity is
+        // recreated from recents or after process death. A share or widget tap
+        // that was already handled would otherwise run again — for shares with
+        // temp files that are long gone.
+        val replayed = savedInstanceState != null ||
+            (intent.flags and Intent.FLAG_ACTIVITY_LAUNCHED_FROM_HISTORY) != 0
+        if (replayed && (intent.action in shareActions || isWidgetTap(intent))) {
+            intent = Intent(Intent.ACTION_MAIN).addCategory(Intent.CATEGORY_LAUNCHER)
+        }
+        super.onCreate(savedInstanceState)
+    }
 
     override fun configureFlutterEngine(flutterEngine: FlutterEngine) {
         super.configureFlutterEngine(flutterEngine)
@@ -26,17 +49,35 @@ class MainActivity : FlutterActivity() {
                 else -> result.notImplemented()
             }
         }
+        MethodChannel(
+            flutterEngine.dartExecutor.binaryMessenger,
+            shareChannel
+        ).setMethodCallHandler { call, result ->
+            when (call.method) {
+                "listenerReady" -> {
+                    shareListenerReady = true
+                    bufferedShare?.let { flutterEngine.activityControlSurface.onNewIntent(it) }
+                    bufferedShare = null
+                    result.success(null)
+                }
+                else -> result.notImplemented()
+            }
+        }
         consumeIntentData(intent)
     }
 
     override fun onNewIntent(intent: Intent) {
         super.onNewIntent(intent)
+        if (!shareListenerReady && intent.action in shareActions) {
+            bufferedShare = intent
+        }
         consumeIntentData(intent)
     }
 
+    private fun isWidgetTap(intent: Intent?): Boolean =
+        intent?.getBooleanExtra("widget_open_timetable", false) == true
+
     private fun consumeIntentData(intent: Intent?) {
-        if (intent?.getBooleanExtra("widget_open_timetable", false) == true) {
-            pendingTimetableTap = true
-        }
+        if (isWidgetTap(intent)) pendingTimetableTap = true
     }
 }

android/app/src/main/kotlin/eu/mhsl/marianum/mobile/client/TimetableDayWidget.kt

@@ -4,6 +4,7 @@ import android.appwidget.AppWidgetManager
 import android.appwidget.AppWidgetProvider
 import android.content.Context
 import android.os.Bundle
+import eu.mhsl.marianum.mobile.client.widgets.WidgetRefreshRequester
 import eu.mhsl.marianum.mobile.client.widgets.WidgetRenderer
 
 /**
@@ -11,6 +12,11 @@ import eu.mhsl.marianum.mobile.client.widgets.WidgetRenderer
  * Flutter plugin resolves the receiver class as `<app-package>.<androidName>`.
  */
 class TimetableDayWidget : AppWidgetProvider() {
+    override fun onEnabled(context: Context) {
+        // First widget of this kind placed → fetch fresh data right away.
+        WidgetRefreshRequester.enqueueOneOffRefresh(context)
+    }
+
     override fun onUpdate(
         context: Context,
         appWidgetManager: AppWidgetManager,

android/app/src/main/kotlin/eu/mhsl/marianum/mobile/client/TimetableWeekWidget.kt

@@ -4,9 +4,15 @@ import android.appwidget.AppWidgetManager
 import android.appwidget.AppWidgetProvider
 import android.content.Context
 import android.os.Bundle
+import eu.mhsl.marianum.mobile.client.widgets.WidgetRefreshRequester
 import eu.mhsl.marianum.mobile.client.widgets.WidgetRenderer
 
 class TimetableWeekWidget : AppWidgetProvider() {
+    override fun onEnabled(context: Context) {
+        // First widget of this kind placed → fetch fresh data right away.
+        WidgetRefreshRequester.enqueueOneOffRefresh(context)
+    }
+
     override fun onUpdate(
         context: Context,
         appWidgetManager: AppWidgetManager,

android/app/src/main/kotlin/eu/mhsl/marianum/mobile/client/widgets/WidgetData.kt

@@ -33,6 +33,8 @@ data class WidgetLesson(
     val subjectShort: String,
     val subjectLong: String?,
     val room: String?,
+    // On teacher accounts this carries the class label ("7a") instead of the
+    // teacher short name (originalTeacher is null then) — mapped in Dart.
     val teacher: String?,
     val originalTeacher: String?,
     val status: WidgetLessonStatus,

android/app/src/main/kotlin/eu/mhsl/marianum/mobile/client/widgets/WidgetRefreshRequester.kt

@@ -0,0 +1,40 @@
+package eu.mhsl.marianum.mobile.client.widgets
+
+import android.content.Context
+import androidx.work.Constraints
+import androidx.work.Data
+import androidx.work.NetworkType
+import androidx.work.OneTimeWorkRequest
+import androidx.work.WorkManager
+import dev.fluttercommunity.workmanager.BackgroundWorker
+
+/**
+ * Enqueues the app's Dart one-off widget refresh from native code, so a
+ * freshly placed widget populates within seconds instead of waiting for the
+ * next periodic slot.
+ *
+ * DART_TASK_KEY is public plugin API but no semver guarantee — re-verify on
+ * workmanager upgrades. The Dart callback handle comes from SharedPreferences
+ * persisted by Workmanager().initialize(); if the app never ran, the worker
+ * fails gracefully and the widget keeps rendering its cached/empty state.
+ */
+object WidgetRefreshRequester {
+    // Mirrors WidgetBackgroundTask.oneOffTaskName on the Dart side.
+    private const val DART_ONE_OFF_TASK = "eu.mhsl.marianum.widget.refresh.once"
+
+    fun enqueueOneOffRefresh(context: Context) {
+        val request = OneTimeWorkRequest.Builder(BackgroundWorker::class.java)
+            .setInputData(
+                Data.Builder()
+                    .putString(BackgroundWorker.DART_TASK_KEY, DART_ONE_OFF_TASK)
+                    .build(),
+            )
+            .setConstraints(
+                Constraints.Builder()
+                    .setRequiredNetworkType(NetworkType.CONNECTED)
+                    .build(),
+            )
+            .build()
+        WorkManager.getInstance(context).enqueue(request)
+    }
+}

android/app/src/main/kotlin/eu/mhsl/marianum/mobile/client/widgets/WidgetRenderer.kt

@@ -736,8 +736,11 @@ object WidgetRenderer {
         )
     }
 
+    // Mirrors lib/widget_data/widget_sync.dart (the canonical key list) — a
+    // schema bump must land in Dart, Swift (WidgetData.swift) and here
+    // together, or the out-of-sync platform silently renders empty.
     const val KEY_DAY_DATA = "widget_data_day_v1"
-    const val KEY_WEEK_DATA = "widget_data_week_v1"
+    const val KEY_WEEK_DATA = "widget_data_week_v2"
     const val KEY_LOGGED_IN = "widget_data_logged_in_v1"
     const val KEY_THEME_MODE = "widget_setting_theme_mode_v1"
 }

android/build.gradle

@@ -5,10 +5,25 @@ allprojects {
     }
 }
 
-rootProject.buildDir = '../build'
+rootProject.layout.buildDirectory = file('../build')
 subprojects {
-    project.buildDir = "${rootProject.buildDir}/${project.name}"
+    project.layout.buildDirectory = rootProject.layout.buildDirectory.dir(project.name)
 }
+// AGP 9 enables built-in Kotlin, but Flutter's migrator pins
+// android.builtInKotlin=false while the plugin ecosystem catches up. Most
+// plugins honour that flag and fall back to KGP themselves; file_picker and
+// background_downloader only check the AGP major version and silently skip
+// applying KGP, which leaves their Kotlin sources uncompiled (missing
+// FilePickerPlugin/BackgroundDownloaderPlugin at link time). Apply KGP for
+// them as soon as AGP is on the project, i.e. before their android {} block
+// runs. Drop this once both plugins ship a builtInKotlin-aware build script.
+gradle.beforeProject { sub ->
+    if (!(sub.name in ['file_picker', 'background_downloader'])) return
+    sub.plugins.withId('com.android.library') {
+        sub.pluginManager.apply('org.jetbrains.kotlin.android')
+    }
+}
+
 // Pin every Android subproject to JVM 17 so plugins that ship Kotlin sources
 // compiled with a higher target (e.g. receive_sharing_intent at 21) or stale
 // Java compatibility (e.g. home_widget at 1.8) don't break the build under
@@ -42,5 +57,5 @@ subprojects {
 }
 
 tasks.register("clean", Delete) {
-    delete rootProject.buildDir
+    delete rootProject.layout.buildDirectory
 }

android/gradle.properties

@@ -1,10 +1,6 @@
 org.gradle.jvmargs=-Xmx4G
 android.useAndroidX=true
-android.enableJetifier=true
-android.defaults.buildfeatures.buildconfig=true
-android.nonTransitiveRClass=false
-android.nonFinalResIds=false
-# This builtInKotlin flag was added automatically by Flutter migrator
-android.builtInKotlin=false
 # This newDsl flag was added automatically by Flutter migrator
 android.newDsl=false
+# This builtInKotlin flag was added automatically by Flutter migrator
+android.builtInKotlin=false

android/gradle/wrapper/gradle-wrapper.properties

@@ -1,6 +1,6 @@
 distributionBase=GRADLE_USER_HOME
 distributionPath=wrapper/dists
-distributionUrl=https\://services.gradle.org/distributions/gradle-8.14-all.zip
+distributionUrl=https\://services.gradle.org/distributions/gradle-9.3.1-all.zip
 networkTimeout=10000
 validateDistributionUrl=true
 zipStoreBase=GRADLE_USER_HOME

android/settings.gradle

@@ -19,9 +19,9 @@ pluginManagement {
 
 plugins {
     id "dev.flutter.flutter-plugin-loader" version "1.0.0"
-    id "com.android.application" version '8.13.2' apply false
-    id "com.android.library" version '8.13.2' apply false
-    id "org.jetbrains.kotlin.android" version "2.2.20" apply false
+    id "com.android.application" version '9.1.0' apply false
+    id "com.android.library" version '9.1.0' apply false
+    id "org.jetbrains.kotlin.android" version "2.4.0" apply false
     id 'org.gradle.toolchains.foojay-resolver-convention' version '0.10.0'
 }
 

docs/marMobile.example.override

@@ -0,0 +1,40 @@
+---
+#
+# Hinweis: Die Steuerzeichen ("---") dürfen NICHT entfernt werden!
+# Nach dem zweiten Steuerzeichen wird als Markdown interpretiert und es sind keine Kommentare mehr möglich!
+# Kommentare sind nur innerhalb des Steuerblocks zugelassen, sowie die Variablen.
+#
+# Notfall-Nachricht der MarianumMobile-App
+#
+# Diese Datei wird bei jedem App-Start geladen.
+# Solange 'active' nicht true ist, wird NICHTS angezeigt (Normalzustand).
+#
+# Steuerfelder:
+#   active:      true schaltet die Anzeige ein   (Default: false)
+#   dismissible: true = wegklickbar & gecachte Inhalte der App weiterhin normal sichtbar, false = Vollbild & nicht schließbar (Default: true)
+#   title:       optionale Überschrift
+#
+# Im Notfall: 'active: false' auf 'active: true' setzen, unten Inhalt anpassen.
+# Der Textinhalt wird in Markdown ausgewertet. Siehe https://markdownlivepreview.com/
+# VORSICHT: Hashtags (#) sind in Markdown kein Kommentar sondern "Titel"!
+# Beispielkonfiguration:
+#
+#   ---
+#   # Ein Kommentar
+#   active: true
+#   dismissible: false
+#   title: Wichtiger Hinweis
+#   ---
+#   Hinweistext in Markdown
+#
+# ============================================================================
+
+active: false
+dismissible: true
+title: Hinweis
+---
+# Serverstörung
+Der Zugriff auf einige Funktionen ist derzeit großflächig **eingeschränkt**. Wir arbeiten an einer Lösung.
+Bitte prüfe unter folgendem Link auf aktuelle Informationen der Schulleitung.
+
+- Aktuelle Informationen: [www.marianum-fulda.de](https://www.marianum-fulda.de)

ios/Flutter/NotificationServiceExtension-Debug.xcconfig

@@ -0,0 +1 @@
+#include "Generated.xcconfig"

ios/Flutter/NotificationServiceExtension-Profile.xcconfig

@@ -0,0 +1 @@
+#include "Generated.xcconfig"

ios/Flutter/NotificationServiceExtension-Release.xcconfig

@@ -0,0 +1 @@
+#include "Generated.xcconfig"

ios/NotificationServiceExtension/NotificationService.swift

@@ -31,7 +31,7 @@ class NotificationService: UNNotificationServiceExtension {
     /// Must exactly match `kPushKeychainGroup` in lib/push/push_secure_storage.dart
     /// and the `keychain-access-groups` entitlement of BOTH the Runner and this
     /// extension. Wrong value here => keychain reads return nil => placeholder.
-    private static let keychainAccessGroup = "group.eu.mhsl.marianum.mobile.client.widget"
+    private static let keychainAccessGroup = "MY55VF3KPG.eu.mhsl.marianum.mobile.client.push"
 
     private static let devicePrivateKeyAccount = "push_device_private_key_pem"
     private static let serverPublicKeyAccount = "push_server_public_key_pem"
@@ -233,7 +233,7 @@ class NotificationService: UNNotificationServiceExtension {
     ///   kSecClass       = kSecClassGenericPassword
     ///   kSecAttrAccount = the Dart key, verbatim
     ///   kSecAttrService = (unset — the Dart IOSOptions set no accountName)
-    ///   kSecAttrAccessGroup = the App Group id
+    ///   kSecAttrAccessGroup = the team-prefixed shared keychain group
     ///   value           = raw UTF-8 bytes of the string
     private func keychainString(_ account: String) -> String? {
         let query: [CFString: Any] = [

ios/NotificationServiceExtension/NotificationServiceExtension.entitlements

@@ -8,7 +8,7 @@
 	</array>
 	<key>keychain-access-groups</key>
 	<array>
-		<string>group.eu.mhsl.marianum.mobile.client.widget</string>
+		<string>$(AppIdentifierPrefix)eu.mhsl.marianum.mobile.client.push</string>
 	</array>
 </dict>
 </plist>

ios/PUSH_NSE_SETUP.md

@@ -55,8 +55,9 @@ iOS zeigt die fertige Notification
 | `ios/Runner/AppDelegate.swift` | **geändert** | TALK_MESSAGE-Category + native Action-Behandlung |
 | `lib/push/push_registration_store.dart` | **geändert** | schreibt `nextcloud_username` + `nextcloud_base_url` group-scoped |
 | `lib/push/push_registration.dart` | **geändert** | `_persistNativeAuthContext()` bei `register()` |
-| **Xcode-Target „NotificationServiceExtension"** | **FEHLT** | muss in Xcode angelegt werden (Abschnitt 3) |
-| `ios/Runner.xcodeproj/project.pbxproj` | **unverändert** | bewusst NICHT von Hand editiert — Xcode legt das Target an |
+| **Xcode-Target „NotificationServiceExtension"** | **existiert** | programmatisch via `xcodeproj`-Gem angelegt (2026-07-07), gespiegelt an der Share-Extension |
+| `ios/Runner.xcodeproj/project.pbxproj` | **geändert** | NSE-Target, Dependency + „Embed Foundation Extensions" ergänzt |
+| `ios/Flutter/NotificationServiceExtension-{Debug,Release,Profile}.xcconfig` | **neu** | Base-Configs, inkludieren `Generated.xcconfig` (Flutter-Versionsvariablen) |
 
 > **Wichtig:** Die vier Dateien unter `ios/NotificationServiceExtension/` liegen
 > schon auf der Platte. Beim Anlegen des Targets erzeugt Xcode eigene
@@ -67,6 +68,15 @@ iOS zeigt die fertige Notification
 
 ## 3. Xcode-Checkliste (auf dem Mac)
 
+> **Stand 2026-07-07:** Abschnitte 3.1–3.2 (Target anlegen, Dateien zuordnen) sind
+> bereits **programmatisch** erledigt (via `xcodeproj`-Gem). Der unsignierte Build
+> aller Targets läuft durch (`flutter build ios --no-codesign`), die
+> `NotificationServiceExtension.appex` wird korrekt in `Runner.app/PlugIns/`
+> eingebettet. **Offen bleiben nur noch Signing/Capabilities (3.3–3.4, 3.6)** —
+> die brauchen den Apple-Developer-Account und einen signierten Build/Archive.
+> Die 3.1/3.2-Anleitung unten bleibt als Referenz stehen (falls das Target mal neu
+> aufgesetzt werden muss).
+
 ### 3.1 Target anlegen
 1. `ios/Runner.xcworkspace` in Xcode öffnen (nicht `.xcodeproj`).
 2. **File → New → Target… → iOS → Notification Service Extension**.
@@ -132,7 +142,18 @@ iOS zeigt die fertige Notification
 ## 4. Ermittelte Keychain-Details (verbindlich)
 
 Die Dart-Seite schreibt mit
-`IOSOptions(groupId: 'group.eu.mhsl.marianum.mobile.client.widget', accessibility: first_unlock)`.
+`IOSOptions(groupId: 'MY55VF3KPG.eu.mhsl.marianum.mobile.client.push', accessibility: first_unlock)`.
+
+> **Wichtig (Stand 2026-07-07):** Als Keychain-Access-Group wird **nicht** mehr die
+> App-Group (`group.*`) genutzt, sondern eine **team-prefixed** Group
+> (`$(AppIdentifierPrefix)eu.mhsl.marianum.mobile.client.push`). Grund: Die
+> Xcode-verwalteten Provisioning-Profile gewähren als `keychain-access-groups`
+> nur `<TeamID>.*` — eine `group.*`-App-Group fällt da **nicht** drunter, was
+> Automatic Signing mit „doesn't match the entitlements file's value for the
+> keychain-access-groups entitlement" abbricht. Runner und NSE teilen die Group,
+> weil sie mit demselben Team (`MY55VF3KPG`) signieren. Der `MY55VF3KPG.`-Prefix
+> ist der stabile AppIdentifierPrefix und in Dart/Swift hart hinterlegt.
+
 Aus dem Quellcode von **`flutter_secure_storage_darwin` 0.3.2** (gepinnt in
 `pubspec.lock`) ergibt sich die exakte Ablage im Keychain:
 
@@ -141,7 +162,7 @@ Aus dem Quellcode von **`flutter_secure_storage_darwin` 0.3.2** (gepinnt in
 | `kSecClass` | `kSecClassGenericPassword` |
 | `kSecAttrAccount` | der Dart-**Key**, **wortwörtlich** (kein Hash, kein Prefix) |
 | `kSecAttrService` | **nicht gesetzt** (die `IOSOptions` setzen kein `accountName`) |
-| `kSecAttrAccessGroup` | `group.eu.mhsl.marianum.mobile.client.widget` |
+| `kSecAttrAccessGroup` | `MY55VF3KPG.eu.mhsl.marianum.mobile.client.push` (team-prefixed) |
 | `kSecAttrAccessible` | `kSecAttrAccessibleAfterFirstUnlock` (aus `first_unlock`) |
 | Wert (`kSecValueData`) | **rohe UTF-8-Bytes** des Strings (PEM/Passwort im Klartext) |
 
@@ -278,9 +299,14 @@ ist der fragilste Teil und **muss auf dem Gerät verifiziert werden**:
    innerhalb des NSE-Budgets). Nicht implementiert.
 3. **`aps-environment = production`** ist noch nicht hart gesetzt (Abschnitt 3.6) —
    vor dem Release erledigen und im Archive gegenchecken (5.2).
-4. **Keychain-Access-Group-Schreibweise.** Die Entitlements listen die App-Group
-   ohne `$(AppIdentifierPrefix)` als `keychain-access-groups`. Das ist das von
-   `flutter_secure_storage` erwartete Verhalten (Access-Group == App-Group-ID).
-   Sollte der Keychain-Zugriff wider Erwarten scheitern (Status `-34018` /
-   `errSecMissingEntitlement`), in **beiden** Targets die Keychain-Sharing-
-   Capability über die Xcode-UI neu setzen und Provisioning-Profile erneuern.
+4. **Keychain-Access-Group-Schreibweise (gelöst 2026-07-07).** Die Entitlements
+   listen `$(AppIdentifierPrefix)eu.mhsl.marianum.mobile.client.push` als
+   `keychain-access-groups` (team-prefixed, **keine** App-Group). Damit greift das
+   `<TeamID>.*` der Xcode-Profile und Automatic Signing läuft ohne Portal-Änderung
+   durch (verifiziert: `flutter build ios --release` signiert Runner **und** NSE
+   mit `MY55VF3KPG.eu.mhsl.marianum.mobile.client.push`). Der frühere App-Group-
+   Ansatz (`group.*`) scheiterte an genau diesem Profil-Matching. Falls der
+   Keychain-Zugriff zur Laufzeit doch scheitert (Status `-34018` /
+   `errSecMissingEntitlement`), prüfen, dass Dart (`push_secure_storage.dart`) und
+   Swift (`AppDelegate.swift`, `NotificationService.swift`) **exakt denselben**
+   vollqualifizierten Group-String verwenden.

ios/Podfile.lock

@@ -4,8 +4,6 @@ PODS:
   - Flutter (1.0.0)
   - flutter_app_badge (2.0.0):
     - Flutter
-  - home_widget (0.0.1):
-    - Flutter
   - open_filex (0.0.2):
     - Flutter
   - PhoneNumberKit (3.7.11):
@@ -14,8 +12,6 @@ PODS:
   - PhoneNumberKit/PhoneNumberKitCore (3.7.11)
   - PhoneNumberKit/UIKit (3.7.11):
     - PhoneNumberKit/PhoneNumberKitCore
-  - receive_sharing_intent (1.8.1):
-    - Flutter
   - workmanager_apple (0.0.1):
     - Flutter
 
@@ -23,10 +19,8 @@ DEPENDENCIES:
   - eraser (from `.symlinks/plugins/eraser/ios`)
   - Flutter (from `Flutter`)
   - flutter_app_badge (from `.symlinks/plugins/flutter_app_badge/ios`)
-  - home_widget (from `.symlinks/plugins/home_widget/ios`)
   - open_filex (from `.symlinks/plugins/open_filex/ios`)
   - PhoneNumberKit (~> 3.7.6)
-  - receive_sharing_intent (from `.symlinks/plugins/receive_sharing_intent/ios`)
   - workmanager_apple (from `.symlinks/plugins/workmanager_apple/ios`)
 
 SPEC REPOS:
@@ -40,12 +34,8 @@ EXTERNAL SOURCES:
     :path: Flutter
   flutter_app_badge:
     :path: ".symlinks/plugins/flutter_app_badge/ios"
-  home_widget:
-    :path: ".symlinks/plugins/home_widget/ios"
   open_filex:
     :path: ".symlinks/plugins/open_filex/ios"
-  receive_sharing_intent:
-    :path: ".symlinks/plugins/receive_sharing_intent/ios"
   workmanager_apple:
     :path: ".symlinks/plugins/workmanager_apple/ios"
 
@@ -53,10 +43,8 @@ SPEC CHECKSUMS:
   eraser: 83a4b06985f3702aa3d8dec816f9693266012937
   Flutter: cabc95a1d2626b1b06e7179b784ebcf0c0cde467
   flutter_app_badge: ca742dd659a157c1090ef7cd881cb78f48f3bcdf
-  home_widget: f169fc41fd807b4d46ab6615dc44d62adbf9f64f
   open_filex: 432f3cd11432da3e39f47fcc0df2b1603854eff1
   PhoneNumberKit: 9ff0c5ae9fe4770193b68a3d3e6c938fe976788c
-  receive_sharing_intent: 222384f00ffe7e952bbfabaa9e3967cb87e5fe00
   workmanager_apple: 904529ae31e97fc5be632cf628507652294a0778
 
 PODFILE CHECKSUM: 087d168982f24fb137e2d46f893b771b4b9955c6

ios/Runner.xcodeproj/project.pbxproj

@@ -12,14 +12,18 @@
 		3321F80F2FB1C00C0011C712 /* Share Extension.appex in Embed Foundation Extensions */ = {isa = PBXBuildFile; fileRef = 3321F8052FB1C00C0011C712 /* Share Extension.appex */; settings = {ATTRIBUTES = (RemoveHeadersOnCopy, ); }; };
 		33FDB0982EE9ABDC000B2391 /* GoogleService-Info.plist in Resources */ = {isa = PBXBuildFile; fileRef = 33FDB0972EE9ABDC000B2391 /* GoogleService-Info.plist */; };
 		3B3967161E833CAA004F5970 /* AppFrameworkInfo.plist in Resources */ = {isa = PBXBuildFile; fileRef = 3B3967151E833CAA004F5970 /* AppFrameworkInfo.plist */; };
+		725388B5C3A724B19BD6FD06 /* NotificationService.swift in Sources */ = {isa = PBXBuildFile; fileRef = 2960F029246C39E2A03F6D87 /* NotificationService.swift */; };
 		74858FAF1ED2DC5600515810 /* AppDelegate.swift in Sources */ = {isa = PBXBuildFile; fileRef = 74858FAE1ED2DC5600515810 /* AppDelegate.swift */; };
+		7832A860F2264966809A9402 /* NotificationServiceExtension.appex in Embed Foundation Extensions */ = {isa = PBXBuildFile; fileRef = C3B91710361EFED8934F0FDC /* NotificationServiceExtension.appex */; settings = {ATTRIBUTES = (RemoveHeadersOnCopy, ); }; };
+		78A318202AECB46A00862997 /* FlutterGeneratedPluginSwiftPackage in Frameworks */ = {isa = PBXBuildFile; productRef = 78A3181F2AECB46A00862997 /* FlutterGeneratedPluginSwiftPackage */; };
 		97C146FC1CF9000F007C117D /* Main.storyboard in Resources */ = {isa = PBXBuildFile; fileRef = 97C146FA1CF9000F007C117D /* Main.storyboard */; };
 		97C146FE1CF9000F007C117D /* Assets.xcassets in Resources */ = {isa = PBXBuildFile; fileRef = 97C146FD1CF9000F007C117D /* Assets.xcassets */; };
 		97C147011CF9000F007C117D /* LaunchScreen.storyboard in Resources */ = {isa = PBXBuildFile; fileRef = 97C146FF1CF9000F007C117D /* LaunchScreen.storyboard */; };
+		97D9AFE39CF2369A97F04721 /* PEM.swift in Sources */ = {isa = PBXBuildFile; fileRef = 509DCCD474353408FE5806C5 /* PEM.swift */; };
 		AA0101070000000011111111 /* TimetableWidgetExtension.appex in Embed Foundation Extensions */ = {isa = PBXBuildFile; fileRef = AA0101020000000011111111 /* TimetableWidgetExtension.appex */; settings = {ATTRIBUTES = (RemoveHeadersOnCopy, ); }; };
 		AA0102010000000022222222 /* SceneDelegate.swift in Sources */ = {isa = PBXBuildFile; fileRef = AA0102020000000022222222 /* SceneDelegate.swift */; };
 		B8263932DB64B022CCEE7A53 /* Pods_Runner.framework in Frameworks */ = {isa = PBXBuildFile; fileRef = 90960A132A5F91779B3FBE28 /* Pods_Runner.framework */; };
-		78A318202AECB46A00862997 /* FlutterGeneratedPluginSwiftPackage in Frameworks */ = {isa = PBXBuildFile; productRef = 78A3181F2AECB46A00862997 /* FlutterGeneratedPluginSwiftPackage */; };
+		C40CF71846788CD98CB99E2B /* Foundation.framework in Frameworks */ = {isa = PBXBuildFile; fileRef = F5B421EAF56B77B775E58E92 /* Foundation.framework */; };
 /* End PBXBuildFile section */
 
 /* Begin PBXContainerItemProxy section */
@@ -37,6 +41,13 @@
 			remoteGlobalIDString = AA0101010000000011111111;
 			remoteInfo = TimetableWidgetExtension;
 		};
+		AABEF26FF24F76E01DA5ADEA /* PBXContainerItemProxy */ = {
+			isa = PBXContainerItemProxy;
+			containerPortal = 97C146E61CF9000F007C117D /* Project object */;
+			proxyType = 1;
+			remoteGlobalIDString = AEDC710FEBFF2CC736D88AB2;
+			remoteInfo = NotificationServiceExtension;
+		};
 /* End PBXContainerItemProxy section */
 
 /* Begin PBXCopyFilesBuildPhase section */
@@ -48,6 +59,7 @@
 			files = (
 				3321F80F2FB1C00C0011C712 /* Share Extension.appex in Embed Foundation Extensions */,
 				AA0101070000000011111111 /* TimetableWidgetExtension.appex in Embed Foundation Extensions */,
+				7832A860F2264966809A9402 /* NotificationServiceExtension.appex in Embed Foundation Extensions */,
 			);
 			name = "Embed Foundation Extensions";
 			runOnlyForDeploymentPostprocessing = 0;
@@ -65,17 +77,24 @@
 /* End PBXCopyFilesBuildPhase section */
 
 /* Begin PBXFileReference section */
+		12B96C78930441C73F123636 /* Info.plist */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = text.plist.xml; name = Info.plist; path = Info.plist; sourceTree = "<group>"; };
 		1498D2321E8E86230040F4C2 /* GeneratedPluginRegistrant.h */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.h; path = GeneratedPluginRegistrant.h; sourceTree = "<group>"; };
 		1498D2331E8E89220040F4C2 /* GeneratedPluginRegistrant.m */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.objc; path = GeneratedPluginRegistrant.m; sourceTree = "<group>"; };
+		17E2EE012C4361AC05DCA4C9 /* NotificationServiceExtension-Release.xcconfig */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = text.xcconfig; name = "NotificationServiceExtension-Release.xcconfig"; path = "Flutter/NotificationServiceExtension-Release.xcconfig"; sourceTree = "<group>"; };
+		2960F029246C39E2A03F6D87 /* NotificationService.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = NotificationService.swift; path = NotificationService.swift; sourceTree = "<group>"; };
 		3321F8052FB1C00C0011C712 /* Share Extension.appex */ = {isa = PBXFileReference; explicitFileType = "wrapper.app-extension"; includeInIndex = 0; path = "Share Extension.appex"; sourceTree = BUILT_PRODUCTS_DIR; };
 		33FDB0972EE9ABDC000B2391 /* GoogleService-Info.plist */ = {isa = PBXFileReference; lastKnownFileType = text.plist.xml; path = "GoogleService-Info.plist"; sourceTree = "<group>"; };
+		36C6C71327C68B43F522F5B2 /* NotificationServiceExtension-Debug.xcconfig */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = text.xcconfig; name = "NotificationServiceExtension-Debug.xcconfig"; path = "Flutter/NotificationServiceExtension-Debug.xcconfig"; sourceTree = "<group>"; };
 		3B3967151E833CAA004F5970 /* AppFrameworkInfo.plist */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.plist.xml; name = AppFrameworkInfo.plist; path = Flutter/AppFrameworkInfo.plist; sourceTree = "<group>"; };
 		4509EC31CB08BA9BF367AF6C /* Pods-Runner.profile.xcconfig */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = text.xcconfig; name = "Pods-Runner.profile.xcconfig"; path = "Target Support Files/Pods-Runner/Pods-Runner.profile.xcconfig"; sourceTree = "<group>"; };
 		4F2428AC5384E0EF8DAB462A /* Pods_Share_Extension.framework */ = {isa = PBXFileReference; explicitFileType = wrapper.framework; includeInIndex = 0; path = Pods_Share_Extension.framework; sourceTree = BUILT_PRODUCTS_DIR; };
+		509DCCD474353408FE5806C5 /* PEM.swift */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = sourcecode.swift; name = PEM.swift; path = PEM.swift; sourceTree = "<group>"; };
+		5C2F4C79DD573778092882AB /* NotificationServiceExtension.entitlements */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = text.plist.entitlements; name = NotificationServiceExtension.entitlements; path = NotificationServiceExtension.entitlements; sourceTree = "<group>"; };
 		60E1803A3FB28FCC6F435E99 /* Pods-Share Extension.release.xcconfig */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = text.xcconfig; name = "Pods-Share Extension.release.xcconfig"; path = "Target Support Files/Pods-Share Extension/Pods-Share Extension.release.xcconfig"; sourceTree = "<group>"; };
 		64801C012A9112D500E8B558 /* Runner.entitlements */ = {isa = PBXFileReference; lastKnownFileType = text.plist.entitlements; path = Runner.entitlements; sourceTree = "<group>"; };
 		74858FAD1ED2DC5600515810 /* Runner-Bridging-Header.h */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.h; path = "Runner-Bridging-Header.h"; sourceTree = "<group>"; };
 		74858FAE1ED2DC5600515810 /* AppDelegate.swift */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.swift; path = AppDelegate.swift; sourceTree = "<group>"; };
+		78E0A7A72DC9AD7400C4905E /* FlutterGeneratedPluginSwiftPackage */ = {isa = PBXFileReference; lastKnownFileType = wrapper; name = FlutterGeneratedPluginSwiftPackage; path = Flutter/ephemeral/Packages/FlutterGeneratedPluginSwiftPackage; sourceTree = "<group>"; };
 		7AFA3C8E1D35360C0083082E /* Release.xcconfig */ = {isa = PBXFileReference; lastKnownFileType = text.xcconfig; name = Release.xcconfig; path = Flutter/Release.xcconfig; sourceTree = "<group>"; };
 		90960A132A5F91779B3FBE28 /* Pods_Runner.framework */ = {isa = PBXFileReference; explicitFileType = wrapper.framework; includeInIndex = 0; path = Pods_Runner.framework; sourceTree = BUILT_PRODUCTS_DIR; };
 		9740EEB21CF90195004384FC /* Debug.xcconfig */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.xcconfig; name = Debug.xcconfig; path = Flutter/Debug.xcconfig; sourceTree = "<group>"; };
@@ -94,10 +113,12 @@
 		BB0001040000000011111111 /* TimetableWidget-Debug.xcconfig */ = {isa = PBXFileReference; lastKnownFileType = text.xcconfig; name = "TimetableWidget-Debug.xcconfig"; path = "Flutter/TimetableWidget-Debug.xcconfig"; sourceTree = "<group>"; };
 		BB0001050000000011111111 /* TimetableWidget-Release.xcconfig */ = {isa = PBXFileReference; lastKnownFileType = text.xcconfig; name = "TimetableWidget-Release.xcconfig"; path = "Flutter/TimetableWidget-Release.xcconfig"; sourceTree = "<group>"; };
 		BB0001060000000011111111 /* TimetableWidget-Profile.xcconfig */ = {isa = PBXFileReference; lastKnownFileType = text.xcconfig; name = "TimetableWidget-Profile.xcconfig"; path = "Flutter/TimetableWidget-Profile.xcconfig"; sourceTree = "<group>"; };
+		C3B91710361EFED8934F0FDC /* NotificationServiceExtension.appex */ = {isa = PBXFileReference; explicitFileType = "wrapper.app-extension"; includeInIndex = 0; path = NotificationServiceExtension.appex; sourceTree = BUILT_PRODUCTS_DIR; };
 		C7E1879BE78835C7E3256316 /* Pods-Runner.debug.xcconfig */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = text.xcconfig; name = "Pods-Runner.debug.xcconfig"; path = "Target Support Files/Pods-Runner/Pods-Runner.debug.xcconfig"; sourceTree = "<group>"; };
 		DD904D7C0FC0AD11449CEB80 /* Pods-Share Extension.debug.xcconfig */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = text.xcconfig; name = "Pods-Share Extension.debug.xcconfig"; path = "Target Support Files/Pods-Share Extension/Pods-Share Extension.debug.xcconfig"; sourceTree = "<group>"; };
 		EF5279D9BF8FCBB117AF998E /* Pods-Share Extension.profile.xcconfig */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = text.xcconfig; name = "Pods-Share Extension.profile.xcconfig"; path = "Target Support Files/Pods-Share Extension/Pods-Share Extension.profile.xcconfig"; sourceTree = "<group>"; };
-		78E0A7A72DC9AD7400C4905E /* FlutterGeneratedPluginSwiftPackage */ = {isa = PBXFileReference; lastKnownFileType = wrapper; name = FlutterGeneratedPluginSwiftPackage; path = Flutter/ephemeral/Packages/FlutterGeneratedPluginSwiftPackage; sourceTree = "<group>"; };
+		F5B421EAF56B77B775E58E92 /* Foundation.framework */ = {isa = PBXFileReference; lastKnownFileType = wrapper.framework; name = Foundation.framework; path = Platforms/iPhoneOS.platform/Developer/SDKs/iPhoneOS18.0.sdk/System/Library/Frameworks/Foundation.framework; sourceTree = DEVELOPER_DIR; };
+		F758339399E7B5FD1A88FC92 /* NotificationServiceExtension-Profile.xcconfig */ = {isa = PBXFileReference; includeInIndex = 1; lastKnownFileType = text.xcconfig; name = "NotificationServiceExtension-Profile.xcconfig"; path = "Flutter/NotificationServiceExtension-Profile.xcconfig"; sourceTree = "<group>"; };
 /* End PBXFileReference section */
 
 /* Begin PBXFileSystemSynchronizedBuildFileExceptionSet section */
@@ -169,6 +190,14 @@
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
+		D2447D92E9CCD96B3292B17B /* Frameworks */ = {
+			isa = PBXFrameworksBuildPhase;
+			buildActionMask = 2147483647;
+			files = (
+				C40CF71846788CD98CB99E2B /* Foundation.framework in Frameworks */,
+			);
+			runOnlyForDeploymentPostprocessing = 0;
+		};
 /* End PBXFrameworksBuildPhase section */
 
 /* Begin PBXGroup section */
@@ -185,15 +214,36 @@
 			path = Pods;
 			sourceTree = "<group>";
 		};
+		553E8F3190182FD2E527FEB5 /* NotificationServiceExtension */ = {
+			isa = PBXGroup;
+			children = (
+				2960F029246C39E2A03F6D87 /* NotificationService.swift */,
+				509DCCD474353408FE5806C5 /* PEM.swift */,
+				12B96C78930441C73F123636 /* Info.plist */,
+				5C2F4C79DD573778092882AB /* NotificationServiceExtension.entitlements */,
+			);
+			name = NotificationServiceExtension;
+			path = NotificationServiceExtension;
+			sourceTree = SOURCE_ROOT;
+		};
 		731388A08E3B330B216381D0 /* Frameworks */ = {
 			isa = PBXGroup;
 			children = (
 				90960A132A5F91779B3FBE28 /* Pods_Runner.framework */,
 				4F2428AC5384E0EF8DAB462A /* Pods_Share_Extension.framework */,
+				80D9B9919D3D7CCA2A80C8C5 /* iOS */,
 			);
 			name = Frameworks;
 			sourceTree = "<group>";
 		};
+		80D9B9919D3D7CCA2A80C8C5 /* iOS */ = {
+			isa = PBXGroup;
+			children = (
+				F5B421EAF56B77B775E58E92 /* Foundation.framework */,
+			);
+			name = iOS;
+			sourceTree = "<group>";
+		};
 		9740EEB11CF90186004384FC /* Flutter */ = {
 			isa = PBXGroup;
 			children = (
@@ -208,6 +258,9 @@
 				BB0001040000000011111111 /* TimetableWidget-Debug.xcconfig */,
 				BB0001050000000011111111 /* TimetableWidget-Release.xcconfig */,
 				BB0001060000000011111111 /* TimetableWidget-Profile.xcconfig */,
+				36C6C71327C68B43F522F5B2 /* NotificationServiceExtension-Debug.xcconfig */,
+				17E2EE012C4361AC05DCA4C9 /* NotificationServiceExtension-Release.xcconfig */,
+				F758339399E7B5FD1A88FC92 /* NotificationServiceExtension-Profile.xcconfig */,
 			);
 			name = Flutter;
 			sourceTree = "<group>";
@@ -222,6 +275,7 @@
 				97C146EF1CF9000F007C117D /* Products */,
 				345F4BD4143471FDA71626DE /* Pods */,
 				731388A08E3B330B216381D0 /* Frameworks */,
+				553E8F3190182FD2E527FEB5 /* NotificationServiceExtension */,
 			);
 			sourceTree = "<group>";
 		};
@@ -231,6 +285,7 @@
 				97C146EE1CF9000F007C117D /* Runner.app */,
 				3321F8052FB1C00C0011C712 /* Share Extension.appex */,
 				AA0101020000000011111111 /* TimetableWidgetExtension.appex */,
+				C3B91710361EFED8934F0FDC /* NotificationServiceExtension.appex */,
 			);
 			name = Products;
 			sourceTree = "<group>";
@@ -278,9 +333,6 @@
 			productType = "com.apple.product-type.app-extension";
 		};
 		97C146ED1CF9000F007C117D /* Runner */ = {
-			packageProductDependencies = (
-				78A3181F2AECB46A00862997 /* FlutterGeneratedPluginSwiftPackage */,
-			);
 			isa = PBXNativeTarget;
 			buildConfigurationList = 97C147051CF9000F007C117D /* Build configuration list for PBXNativeTarget "Runner" */;
 			buildPhases = (
@@ -299,8 +351,12 @@
 			dependencies = (
 				3321F80E2FB1C00C0011C712 /* PBXTargetDependency */,
 				AA0101090000000011111111 /* PBXTargetDependency */,
+				43763BD5552A36CA28890DFA /* PBXTargetDependency */,
 			);
 			name = Runner;
+			packageProductDependencies = (
+				78A3181F2AECB46A00862997 /* FlutterGeneratedPluginSwiftPackage */,
+			);
 			productName = Runner;
 			productReference = 97C146EE1CF9000F007C117D /* Runner.app */;
 			productType = "com.apple.product-type.application";
@@ -325,13 +381,27 @@
 			productReference = AA0101020000000011111111 /* TimetableWidgetExtension.appex */;
 			productType = "com.apple.product-type.app-extension";
 		};
+		AEDC710FEBFF2CC736D88AB2 /* NotificationServiceExtension */ = {
+			isa = PBXNativeTarget;
+			buildConfigurationList = C3A6F3FA3E3FD220B736D6E5 /* Build configuration list for PBXNativeTarget "NotificationServiceExtension" */;
+			buildPhases = (
+				DF8C1170E7DF96711030EAC0 /* Sources */,
+				D2447D92E9CCD96B3292B17B /* Frameworks */,
+				239068341DC6E6B36193EC96 /* Resources */,
+			);
+			buildRules = (
+			);
+			dependencies = (
+			);
+			name = NotificationServiceExtension;
+			productName = NotificationServiceExtension;
+			productReference = C3B91710361EFED8934F0FDC /* NotificationServiceExtension.appex */;
+			productType = "com.apple.product-type.app-extension";
+		};
 /* End PBXNativeTarget section */
 
 /* Begin PBXProject section */
 		97C146E61CF9000F007C117D /* Project object */ = {
-			packageReferences = (
-				781AD8BC2B33823900A9FFBB /* XCLocalSwiftPackageReference "Flutter/ephemeral/Packages/FlutterGeneratedPluginSwiftPackage" */,
-			);
 			isa = PBXProject;
 			attributes = {
 				BuildIndependentTargetsInParallel = YES;
@@ -360,6 +430,9 @@
 				Base,
 			);
 			mainGroup = 97C146E51CF9000F007C117D;
+			packageReferences = (
+				781AD8BC2B33823900A9FFBB /* XCLocalSwiftPackageReference "FlutterGeneratedPluginSwiftPackage" */,
+			);
 			productRefGroup = 97C146EF1CF9000F007C117D /* Products */;
 			projectDirPath = "";
 			projectRoot = "";
@@ -367,11 +440,19 @@
 				97C146ED1CF9000F007C117D /* Runner */,
 				3321F8042FB1C00C0011C712 /* Share Extension */,
 				AA0101010000000011111111 /* TimetableWidgetExtension */,
+				AEDC710FEBFF2CC736D88AB2 /* NotificationServiceExtension */,
 			);
 		};
 /* End PBXProject section */
 
 /* Begin PBXResourcesBuildPhase section */
+		239068341DC6E6B36193EC96 /* Resources */ = {
+			isa = PBXResourcesBuildPhase;
+			buildActionMask = 2147483647;
+			files = (
+			);
+			runOnlyForDeploymentPostprocessing = 0;
+		};
 		3321F8032FB1C00C0011C712 /* Resources */ = {
 			isa = PBXResourcesBuildPhase;
 			buildActionMask = 2147483647;
@@ -520,6 +601,15 @@
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
+		DF8C1170E7DF96711030EAC0 /* Sources */ = {
+			isa = PBXSourcesBuildPhase;
+			buildActionMask = 2147483647;
+			files = (
+				725388B5C3A724B19BD6FD06 /* NotificationService.swift in Sources */,
+				97D9AFE39CF2369A97F04721 /* PEM.swift in Sources */,
+			);
+			runOnlyForDeploymentPostprocessing = 0;
+		};
 /* End PBXSourcesBuildPhase section */
 
 /* Begin PBXTargetDependency section */
@@ -528,6 +618,12 @@
 			target = 3321F8042FB1C00C0011C712 /* Share Extension */;
 			targetProxy = 3321F80D2FB1C00C0011C712 /* PBXContainerItemProxy */;
 		};
+		43763BD5552A36CA28890DFA /* PBXTargetDependency */ = {
+			isa = PBXTargetDependency;
+			name = NotificationServiceExtension;
+			target = AEDC710FEBFF2CC736D88AB2 /* NotificationServiceExtension */;
+			targetProxy = AABEF26FF24F76E01DA5ADEA /* PBXContainerItemProxy */;
+		};
 		AA0101090000000011111111 /* PBXTargetDependency */ = {
 			isa = PBXTargetDependency;
 			target = AA0101010000000011111111 /* TimetableWidgetExtension */;
@@ -929,6 +1025,29 @@
 			};
 			name = Release;
 		};
+		A2B046F78AD55232F08583F3 /* Debug */ = {
+			isa = XCBuildConfiguration;
+			baseConfigurationReference = 36C6C71327C68B43F522F5B2 /* NotificationServiceExtension-Debug.xcconfig */;
+			buildSettings = {
+				CLANG_ENABLE_MODULES = YES;
+				CLANG_ENABLE_OBJC_WEAK = NO;
+				CODE_SIGN_ENTITLEMENTS = NotificationServiceExtension/NotificationServiceExtension.entitlements;
+				CODE_SIGN_STYLE = Automatic;
+				CURRENT_PROJECT_VERSION = "$(FLUTTER_BUILD_NUMBER)";
+				DEVELOPMENT_TEAM = MY55VF3KPG;
+				INFOPLIST_FILE = NotificationServiceExtension/Info.plist;
+				IPHONEOS_DEPLOYMENT_TARGET = 15.0;
+				MARKETING_VERSION = "$(FLUTTER_BUILD_NAME)";
+				PRODUCT_BUNDLE_IDENTIFIER = eu.mhsl.marianum.mobile.client.NotificationServiceExtension;
+				PRODUCT_NAME = "$(TARGET_NAME)";
+				SDKROOT = iphoneos;
+				SKIP_INSTALL = YES;
+				SWIFT_OPTIMIZATION_LEVEL = "-Onone";
+				SWIFT_VERSION = 5.0;
+				TARGETED_DEVICE_FAMILY = "1,2";
+			};
+			name = Debug;
+		};
 		AA01010A0000000011111111 /* Debug */ = {
 			isa = XCBuildConfiguration;
 			baseConfigurationReference = BB0001040000000011111111 /* TimetableWidget-Debug.xcconfig */;
@@ -1051,6 +1170,54 @@
 			};
 			name = Profile;
 		};
+		E5EE58583E83B7694F6C3C5E /* Release */ = {
+			isa = XCBuildConfiguration;
+			baseConfigurationReference = 17E2EE012C4361AC05DCA4C9 /* NotificationServiceExtension-Release.xcconfig */;
+			buildSettings = {
+				CLANG_ENABLE_MODULES = YES;
+				CLANG_ENABLE_OBJC_WEAK = NO;
+				CODE_SIGN_ENTITLEMENTS = NotificationServiceExtension/NotificationServiceExtension.entitlements;
+				CODE_SIGN_STYLE = Automatic;
+				CURRENT_PROJECT_VERSION = "$(FLUTTER_BUILD_NUMBER)";
+				DEVELOPMENT_TEAM = MY55VF3KPG;
+				INFOPLIST_FILE = NotificationServiceExtension/Info.plist;
+				IPHONEOS_DEPLOYMENT_TARGET = 15.0;
+				MARKETING_VERSION = "$(FLUTTER_BUILD_NAME)";
+				PRODUCT_BUNDLE_IDENTIFIER = eu.mhsl.marianum.mobile.client.NotificationServiceExtension;
+				PRODUCT_NAME = "$(TARGET_NAME)";
+				SDKROOT = iphoneos;
+				SKIP_INSTALL = YES;
+				SWIFT_OPTIMIZATION_LEVEL = "-O";
+				SWIFT_VERSION = 5.0;
+				TARGETED_DEVICE_FAMILY = "1,2";
+				VALIDATE_PRODUCT = YES;
+			};
+			name = Release;
+		};
+		F418DF43742DC2E30B161652 /* Profile */ = {
+			isa = XCBuildConfiguration;
+			baseConfigurationReference = F758339399E7B5FD1A88FC92 /* NotificationServiceExtension-Profile.xcconfig */;
+			buildSettings = {
+				CLANG_ENABLE_MODULES = YES;
+				CLANG_ENABLE_OBJC_WEAK = NO;
+				CODE_SIGN_ENTITLEMENTS = NotificationServiceExtension/NotificationServiceExtension.entitlements;
+				CODE_SIGN_STYLE = Automatic;
+				CURRENT_PROJECT_VERSION = "$(FLUTTER_BUILD_NUMBER)";
+				DEVELOPMENT_TEAM = MY55VF3KPG;
+				INFOPLIST_FILE = NotificationServiceExtension/Info.plist;
+				IPHONEOS_DEPLOYMENT_TARGET = 15.0;
+				MARKETING_VERSION = "$(FLUTTER_BUILD_NAME)";
+				PRODUCT_BUNDLE_IDENTIFIER = eu.mhsl.marianum.mobile.client.NotificationServiceExtension;
+				PRODUCT_NAME = "$(TARGET_NAME)";
+				SDKROOT = iphoneos;
+				SKIP_INSTALL = YES;
+				SWIFT_OPTIMIZATION_LEVEL = "-O";
+				SWIFT_VERSION = 5.0;
+				TARGETED_DEVICE_FAMILY = "1,2";
+				VALIDATE_PRODUCT = YES;
+			};
+			name = Profile;
+		};
 /* End XCBuildConfiguration section */
 
 /* Begin XCConfigurationList section */
@@ -1094,13 +1261,25 @@
 			defaultConfigurationIsVisible = 0;
 			defaultConfigurationName = Release;
 		};
+		C3A6F3FA3E3FD220B736D6E5 /* Build configuration list for PBXNativeTarget "NotificationServiceExtension" */ = {
+			isa = XCConfigurationList;
+			buildConfigurations = (
+				E5EE58583E83B7694F6C3C5E /* Release */,
+				A2B046F78AD55232F08583F3 /* Debug */,
+				F418DF43742DC2E30B161652 /* Profile */,
+			);
+			defaultConfigurationIsVisible = 0;
+			defaultConfigurationName = Release;
+		};
 /* End XCConfigurationList section */
+
 /* Begin XCLocalSwiftPackageReference section */
-		781AD8BC2B33823900A9FFBB /* XCLocalSwiftPackageReference "Flutter/ephemeral/Packages/FlutterGeneratedPluginSwiftPackage" */ = {
+		781AD8BC2B33823900A9FFBB /* XCLocalSwiftPackageReference "FlutterGeneratedPluginSwiftPackage" */ = {
 			isa = XCLocalSwiftPackageReference;
 			relativePath = Flutter/ephemeral/Packages/FlutterGeneratedPluginSwiftPackage;
 		};
 /* End XCLocalSwiftPackageReference section */
+
 /* Begin XCSwiftPackageProductDependency section */
 		78A3181F2AECB46A00862997 /* FlutterGeneratedPluginSwiftPackage */ = {
 			isa = XCSwiftPackageProductDependency;

ios/Runner.xcodeproj/project.xcworkspace/xcshareddata/swiftpm/Package.resolved

@@ -14,8 +14,8 @@
       "kind" : "remoteSourceControl",
       "location" : "https://github.com/google/app-check.git",
       "state" : {
-        "revision" : "61b85103a1aeed8218f17c794687781505fbbef5",
-        "version" : "11.2.0"
+        "revision" : "3e33dd27dd4c69bd81c7c81fe61d8ccf58846902",
+        "version" : "11.3.1"
       }
     },
     {
@@ -50,8 +50,8 @@
       "kind" : "remoteSourceControl",
       "location" : "https://github.com/firebase/firebase-ios-sdk",
       "state" : {
-        "revision" : "d10045cace0b4c335c4efa8f7df7e9a9fc5a7c60",
-        "version" : "12.13.0"
+        "revision" : "42e81d245e30e49ea6a5830cf2842d44a1591270",
+        "version" : "12.15.0"
       }
     },
     {
@@ -59,8 +59,8 @@
       "kind" : "remoteSourceControl",
       "location" : "https://github.com/googleads/google-ads-on-device-conversion-ios-sdk",
       "state" : {
-        "revision" : "19dffda9a9caf8d86570ff846535902d8509d7bf",
-        "version" : "3.5.0"
+        "revision" : "dc39082d8881109d35b94b1c122164c0e8d08a55",
+        "version" : "3.6.1"
       }
     },
     {
@@ -68,8 +68,8 @@
       "kind" : "remoteSourceControl",
       "location" : "https://github.com/google/GoogleAppMeasurement.git",
       "state" : {
-        "revision" : "c2c76bebcfbb90d90ea10599f934f9af160e1604",
-        "version" : "12.13.0"
+        "revision" : "144855f40d8668927f256a3045f7fdc4c3f4338b",
+        "version" : "12.15.0"
       }
     },
     {
@@ -86,8 +86,8 @@
       "kind" : "remoteSourceControl",
       "location" : "https://github.com/google/GoogleUtilities.git",
       "state" : {
-        "revision" : "60da361632d0de02786f709bdc0c4df340f7613e",
-        "version" : "8.1.0"
+        "revision" : "9f183ae842be978784f2963a343682e0c46d8fb3",
+        "version" : "8.1.2"
       }
     },
     {
@@ -122,8 +122,8 @@
       "kind" : "remoteSourceControl",
       "location" : "https://github.com/firebase/leveldb.git",
       "state" : {
-        "revision" : "0706abcc6b0bd9cedfbb015ba840e4a780b5159b",
-        "version" : "1.22.2"
+        "revision" : "a0bc79961d7be727d258d33d5a6b2f1023270ba1",
+        "version" : "1.22.5"
       }
     },
     {
@@ -131,8 +131,8 @@
       "kind" : "remoteSourceControl",
       "location" : "https://github.com/firebase/nanopb.git",
       "state" : {
-        "revision" : "b7e1104502eca3a213b46303391ca4d3bc8ddec1",
-        "version" : "2.30910.0"
+        "revision" : "3851d94a41890dea16dc3db34caf60e585cb4163",
+        "version" : "2.30910.1"
       }
     },
     {
@@ -140,8 +140,8 @@
       "kind" : "remoteSourceControl",
       "location" : "https://github.com/google/promises.git",
       "state" : {
-        "revision" : "540318ecedd63d883069ae7f1ed811a2df00b6ac",
-        "version" : "2.4.0"
+        "revision" : "f4a19a3c313dc2616c70bb49d29a799fb16be837",
+        "version" : "2.4.1"
       }
     },
     {

ios/Runner/AppDelegate.swift

@@ -1,6 +1,7 @@
 import Flutter
 import UIKit
 import UserNotifications
+import workmanager_apple
 
 @main
 @objc class AppDelegate: FlutterAppDelegate, FlutterImplicitEngineDelegate {
@@ -12,7 +13,7 @@ import UserNotifications
   private let markReadActionId = "TALK_MARK_READ"
 
   // Shared (App Group) keychain — same group as the NSE and the Dart side.
-  private let keychainAccessGroup = "group.eu.mhsl.marianum.mobile.client.widget"
+  private let keychainAccessGroup = "MY55VF3KPG.eu.mhsl.marianum.mobile.client.push"
   private let usernameAccount = "nextcloud_username"
   private let appPasswordAccount = "nextcloud_app_password"
   private let baseUrlAccount = "nextcloud_base_url"
@@ -23,6 +24,19 @@ import UserNotifications
   ) -> Bool {
     let result = super.application(application, didFinishLaunchingWithOptions: launchOptions)
     registerTalkCategory()
+    // BGAppRefresh for the home-screen widget. Must all happen before
+    // didFinishLaunching returns: with the UIScene lifecycle Flutter registers
+    // plugins only during scene connection, which is past BGTaskScheduler's
+    // registration deadline — registerLaunchHandlers() bridges that gap.
+    // The task identifier mirrors WidgetBackgroundTask.periodicTaskName; the
+    // plugin re-submits the refresh request itself after every run.
+    WorkmanagerPlugin.setPluginRegistrantCallback { registry in
+      GeneratedPluginRegistrant.register(with: registry)
+    }
+    WorkmanagerPlugin.registerPeriodicTask(
+      withIdentifier: "eu.mhsl.marianum.widget.refresh",
+      earliestBeginInSeconds: 1800)
+    WorkmanagerPlugin.registerLaunchHandlers()
     // FlutterAppDelegate conforms to UNUserNotificationCenterDelegate and
     // forwards these callbacks to the plugins (firebase_messaging,
     // flutter_local_notifications). We route Talk actions natively here — the

ios/Runner/Info.plist

@@ -66,6 +66,10 @@
 		</dict>
 		<key>UIApplicationSupportsIndirectInputEvents</key>
 		<true/>
+		<key>BGTaskSchedulerPermittedIdentifiers</key>
+		<array>
+			<string>eu.mhsl.marianum.widget.refresh</string>
+		</array>
 		<key>UIBackgroundModes</key>
 		<array>
 			<string>fetch</string>

ios/Runner/Runner.entitlements

@@ -11,7 +11,7 @@
 	</array>
 	<key>keychain-access-groups</key>
 	<array>
-		<string>group.eu.mhsl.marianum.mobile.client.widget</string>
+		<string>$(AppIdentifierPrefix)eu.mhsl.marianum.mobile.client.push</string>
 	</array>
 </dict>
 </plist>

ios/Runner/SceneDelegate.swift

@@ -13,21 +13,44 @@ class SceneDelegate: FlutterSceneDelegate {
     options connectionOptions: UIScene.ConnectionOptions
   ) {
     super.scene(scene, willConnectTo: session, options: connectionOptions)
-    for context in connectionOptions.urlContexts {
-      _ = SwiftReceiveSharingIntentPlugin.instance.application(
+    var handledShare = false
+    for context in connectionOptions.urlContexts where isShareUrl(context.url) {
+      _ = ReceiveSharingIntentPlugin.instance.application(
         UIApplication.shared,
         didFinishLaunchingWithOptions: [UIApplication.LaunchOptionsKey.url: context.url]
       )
+      handledShare = true
     }
+    if handledShare { clearSharedPayload() }
   }
 
   override func scene(_ scene: UIScene, openURLContexts URLContexts: Set<UIOpenURLContext>) {
-    for context in URLContexts {
-      _ = SwiftReceiveSharingIntentPlugin.instance.application(
+    let shares = URLContexts.filter { isShareUrl($0.url) }
+    for context in shares {
+      _ = ReceiveSharingIntentPlugin.instance.application(
         UIApplication.shared,
         open: context.url,
         options: [:]
       )
     }
+    if !shares.isEmpty { clearSharedPayload() }
+    let others = URLContexts.subtracting(shares)
+    if !others.isEmpty { super.scene(scene, openURLContexts: others) }
+  }
+
+  private func isShareUrl(_ url: URL) -> Bool {
+    ReceiveSharingIntentPlugin.instance.hasMatchingSchemePrefix(url: url)
+  }
+
+  // The plugin keeps the payload in memory once read but never removes it
+  // from the App Group defaults. The Share Extension opens the app twice per
+  // share and a scene reconnect replays the URL, so every later delivery
+  // would publish the finished share again.
+  private func clearSharedPayload() {
+    let groupId = Bundle.main.object(forInfoDictionaryKey: "AppGroupId") as? String
+    let defaults = UserDefaults(
+      suiteName: groupId ?? "group.\(Bundle.main.bundleIdentifier ?? "")")
+    defaults?.removeObject(forKey: "ShareKey")
+    defaults?.removeObject(forKey: "ShareMessageKey")
   }
 }

ios/Share Extension/ShareViewController.swift

@@ -3,7 +3,7 @@ import UniformTypeIdentifiers
 import AVFoundation
 
 // Datenmodell muss byte-für-byte zu dem passen, was
-// SwiftReceiveSharingIntentPlugin auf der Host-App-Seite decodiert.
+// ReceiveSharingIntentPlugin auf der Host-App-Seite decodiert.
 private enum SharedMediaType: String, Codable {
   case image, video, text, file, url
 }
@@ -152,17 +152,54 @@ final class ShareViewController: UIViewController {
     }
   }
 
-  private func copyIntoAppGroup(src: URL) -> URL? {
+  // loadItem-Callbacks laufen parallel; Ordneranlage und Namenswahl seriell.
+  private let fileQueue = DispatchQueue(label: "share.files")
+
+  // Ein Ordner pro Share: Gleichnamige Dateien (z. B. bearbeitete Fotos, alle
+  // "FullSizeRender.jpg") überschrieben sich sonst gegenseitig, auch über
+  // zwei Shares hinweg. Die App löscht den Ordner, sobald der Share erledigt ist.
+  private lazy var shareDir: URL? = {
     guard let container = FileManager.default
       .containerURL(forSecurityApplicationGroupIdentifier: appGroupId) else {
       return nil
     }
-    let name = src.lastPathComponent.isEmpty ? UUID().uuidString : src.lastPathComponent
-    let dst = container.appendingPathComponent(name)
+    let root = container.appendingPathComponent("share_intent", isDirectory: true)
+    sweepStaleShares(in: root)
+    let dir = root.appendingPathComponent(UUID().uuidString, isDirectory: true)
+    do {
+      try FileManager.default.createDirectory(at: dir, withIntermediateDirectories: true)
+      return dir
+    } catch {
+      return nil
+    }
+  }()
+
+  // Shares, deren App-Flow nie abgeschlossen wurde (Prozess beendet o. ä.),
+  // räumt sonst niemand weg — der App-Group-Container wird nie geleert.
+  private func sweepStaleShares(in root: URL) {
+    let fm = FileManager.default
+    guard let entries = try? fm.contentsOfDirectory(
+      at: root, includingPropertiesForKeys: [.creationDateKey]) else { return }
+    let cutoff = Date().addingTimeInterval(-24 * 60 * 60)
+    for entry in entries {
+      let created = (try? entry.resourceValues(forKeys: [.creationDateKey]))?.creationDate
+      if let created, created < cutoff { try? fm.removeItem(at: entry) }
+    }
+  }
+
+  private func copyIntoAppGroup(src: URL) -> URL? {
+    fileQueue.sync { copyIntoShareDir(src: src) }
+  }
+
+  private func copyIntoShareDir(src: URL) -> URL? {
+    guard let dir = shareDir else { return nil }
+    let name = src.lastPathComponent.isEmpty ? UUID().uuidString : src.lastPathComponent
+    var dst = dir.appendingPathComponent(name)
+    // Mehrfachauswahl mit gleichem Namen innerhalb eines Shares.
+    if FileManager.default.fileExists(atPath: dst.path) {
+      dst = dir.appendingPathComponent("\(UUID().uuidString.prefix(8))-\(name)")
+    }
     do {
-      if FileManager.default.fileExists(atPath: dst.path) {
-        try FileManager.default.removeItem(at: dst)
-      }
       try FileManager.default.copyItem(at: src, to: dst)
       return dst
     } catch {
@@ -171,10 +208,9 @@ final class ShareViewController: UIViewController {
   }
 
   private func writePng(image: UIImage) -> URL? {
-    guard let container = FileManager.default
-            .containerURL(forSecurityApplicationGroupIdentifier: appGroupId),
-          let data = image.pngData() else { return nil }
-    let dst = container.appendingPathComponent("\(UUID().uuidString).png")
+    guard let data = image.pngData(),
+          let dir = fileQueue.sync(execute: { shareDir }) else { return nil }
+    let dst = dir.appendingPathComponent("\(UUID().uuidString).png")
     return (try? data.write(to: dst)) != nil ? dst : nil
   }
 

ios/TimetableWidgetExtension/TimetableAnchor.swift

@@ -0,0 +1,109 @@
+import Foundation
+
+/// Pure anchor/slicing logic mirroring `lib/widget_data/widget_data_mapper.dart`
+/// (resolveDayAnchor / resolveWeekAnchor). Keep both sides in sync — the Dart
+/// unit tests in test/widget_data/widget_data_mapper_test.dart double as the
+/// review checklist here:
+///   resolveDayAnchor(Wed 2026-05-06 10:00) == 2026-05-06   (before cutoff)
+///   resolveDayAnchor(Wed 2026-05-06 19:00) == 2026-05-07   (after cutoff)
+///   resolveDayAnchor(Fri 2026-05-08 18:00) == 2026-05-11   (Fri → Mon)
+///   resolveDayAnchor(Sat 2026-05-09 10:00) == 2026-05-11
+///   resolveDayAnchor(Sun 2026-05-10 22:00) == 2026-05-11
+///   resolveWeekAnchor(Tue 2026-05-05 10:00) == 2026-05-04
+///   resolveWeekAnchor(Sun 2026-05-10 10:00) == 2026-05-11
+enum TimetableAnchor {
+    /// After 17:00 the user's question shifts from "what's left today" to
+    /// "what's tomorrow", so the day widget rolls forward.
+    static let dayCutoffHour = 17
+
+    static func resolveDayAnchor(_ now: Date, calendar: Calendar = .current) -> Date {
+        var candidate = calendar.startOfDay(for: now)
+        let shiftToTomorrow =
+            calendar.component(.hour, from: now) >= dayCutoffHour || isWeekend(candidate, calendar: calendar)
+        if shiftToTomorrow {
+            candidate = nextDay(candidate, calendar: calendar)
+        }
+        while isWeekend(candidate, calendar: calendar) {
+            candidate = nextDay(candidate, calendar: calendar)
+        }
+        return candidate
+    }
+
+    static func resolveWeekAnchor(_ now: Date, calendar: Calendar = .current) -> Date {
+        let anchor = resolveDayAnchor(now, calendar: calendar)
+        // Swift weekday: 1 = Sunday … 7 = Saturday → distance back to Monday.
+        let daysFromMonday = (calendar.component(.weekday, from: anchor) + 5) % 7
+        let monday = calendar.date(byAdding: .day, value: -daysFromMonday, to: anchor) ?? anchor
+        return calendar.startOfDay(for: monday)
+    }
+
+    /// Future instants at which the rendered anchor can change: each day's
+    /// midnight (rollover) and 17:00 (cutoff), within the horizon. Sorted,
+    /// strictly after `now`.
+    static func boundaryDates(
+        from now: Date,
+        horizonDays: Int = 3,
+        calendar: Calendar = .current
+    ) -> [Date] {
+        var result: [Date] = []
+        let today = calendar.startOfDay(for: now)
+        for offset in 0...horizonDays {
+            guard let day = calendar.date(byAdding: .day, value: offset, to: today) else { continue }
+            let midnight = calendar.startOfDay(for: day)
+            if midnight > now { result.append(midnight) }
+            if let cutoff = calendar.date(
+                bySettingHour: dayCutoffHour, minute: 0, second: 0, of: day
+            ), cutoff > now {
+                result.append(cutoff)
+            }
+        }
+        return result.sorted()
+    }
+
+    /// Derives a day payload from the 14-day week payload — same shape the
+    /// Dart buildDayData produces, since the week payload runs through the
+    /// identical per-day merge/collision pipeline.
+    static func slice(
+        week: WidgetTimetableData,
+        forDay anchor: Date,
+        calendar: Calendar = .current
+    ) -> WidgetTimetableData {
+        let lessons = week.lessons.filter { calendar.isDate($0.start, inSameDayAs: anchor) }
+        // Every v2 week payload carries `days` — the key bump guarantees it.
+        let dayInfo = week.days?.first { calendar.isDate($0.date, inSameDayAs: anchor) }
+        return WidgetTimetableData(
+            fetchedAt: week.fetchedAt,
+            anchorDate: anchor,
+            lessons: lessons,
+            periods: week.periods,
+            isHoliday: dayInfo?.isHoliday ?? false,
+            holidayName: dayInfo?.holidayName,
+            days: nil
+        )
+    }
+
+    /// Week payload re-anchored to the week containing/following `anchorDate`.
+    /// The week view filters its five columns off `anchorDate`, so this alone
+    /// performs the Friday-evening/weekend jump to next week.
+    static func retarget(week: WidgetTimetableData, anchorDate: Date) -> WidgetTimetableData {
+        WidgetTimetableData(
+            fetchedAt: week.fetchedAt,
+            anchorDate: anchorDate,
+            lessons: week.lessons,
+            periods: week.periods,
+            isHoliday: week.isHoliday,
+            holidayName: week.holidayName,
+            days: week.days
+        )
+    }
+
+    private static func isWeekend(_ date: Date, calendar: Calendar) -> Bool {
+        let weekday = calendar.component(.weekday, from: date)
+        return weekday == 1 || weekday == 7
+    }
+
+    private static func nextDay(_ date: Date, calendar: Calendar) -> Date {
+        let next = calendar.date(byAdding: .day, value: 1, to: date) ?? date
+        return calendar.startOfDay(for: next)
+    }
+}

ios/TimetableWidgetExtension/TimetableDayView.swift

@@ -100,13 +100,13 @@ struct TimetableDayView: View {
 
     private func header(data: WidgetTimetableData) -> some View {
         HStack(spacing: 4) {
-            Text(dayLabel(for: data.anchorDate))
+            Text(dayLabel(for: data.anchorDate, relativeTo: entry.date))
                 .font(.system(size: 13, weight: .semibold))
                 .foregroundStyle(palette.textPrimary)
                 .lineLimit(1)
                 .minimumScaleFactor(0.7)
             Spacer(minLength: 4)
-            Text("Stand: \(freshnessLabel(for: data.fetchedAt))")
+            Text("Stand: \(freshnessLabel(for: data.fetchedAt, relativeTo: entry.date))")
                 .font(.system(size: 9))
                 .foregroundStyle(palette.textSecondary)
                 .lineLimit(1)
@@ -383,6 +383,7 @@ struct TimeGridView: View {
         case .irregular: return Color(red: 143/255.0, green: 25/255.0, blue: 179/255.0)
         case .teacherChanged: return Color(red: 41/255.0, green: 99/255.0, blue: 155/255.0)
         case .event: return Color(red: 239/255.0, green: 108/255.0, blue: 0/255.0)
+        case .duty: return Color(red: 0/255.0, green: 121/255.0, blue: 107/255.0)
         }
     }
 }
@@ -400,9 +401,31 @@ func periodBoundaries(_ periods: [WidgetPeriod]) -> [Int] {
     return result.sorted()
 }
 
-func dayLabel(for date: Date) -> String {
+/// Fixed-locale formatters cached once — DateFormatter setup is the
+/// expensive part and the multi-entry timelines render up to ~8 entries per
+/// reload. Only touched from WidgetKit's archival rendering, so the shared
+/// instances are safe.
+enum WidgetDateFormatters {
+    static let shortDate = make("dd.MM.")
+    static let weekdayShort = make("EE")
+    static let weekdayDate = make("EEEE · dd.MM.")
+    static let time = make("HH:mm")
+    static let dateTime = make("dd.MM. HH:mm")
+
+    private static func make(_ format: String) -> DateFormatter {
+        let f = DateFormatter()
+        f.locale = Locale(identifier: "de_DE")
+        f.dateFormat = format
+        return f
+    }
+}
+
+/// `now` is the timeline entry's date, not `Date()`: WidgetKit archives
+/// entries ahead of time, so wall-clock reads would be wrong for every
+/// entry after the first.
+func dayLabel(for date: Date, relativeTo now: Date) -> String {
     let cal = Calendar.current
-    let today = cal.startOfDay(for: Date())
+    let today = cal.startOfDay(for: now)
     let anchor = cal.startOfDay(for: date)
     if anchor == today {
         return "Heute · \(shortDate(date))"
@@ -410,35 +433,23 @@ func dayLabel(for date: Date) -> String {
     if let tomorrow = cal.date(byAdding: .day, value: 1, to: today), anchor == tomorrow {
         return "Morgen · \(shortDate(date))"
     }
-    let formatter = DateFormatter()
-    formatter.locale = Locale(identifier: "de_DE")
-    formatter.dateFormat = "EEEE · dd.MM."
-    return formatter.string(from: date)
+    return WidgetDateFormatters.weekdayDate.string(from: date)
 }
 
 func shortDate(_ date: Date) -> String {
-    let f = DateFormatter()
-    f.locale = Locale(identifier: "de_DE")
-    f.dateFormat = "dd.MM."
-    return f.string(from: date)
+    WidgetDateFormatters.shortDate.string(from: date)
 }
 
-func freshnessLabel(for fetchedAt: Date) -> String {
+func freshnessLabel(for fetchedAt: Date, relativeTo now: Date) -> String {
     let cal = Calendar.current
-    let today = cal.startOfDay(for: Date())
+    let today = cal.startOfDay(for: now)
     let fetchedDay = cal.startOfDay(for: fetchedAt)
-    let timeFmt = DateFormatter()
-    timeFmt.locale = Locale(identifier: "de_DE")
-    timeFmt.dateFormat = "HH:mm"
     if fetchedDay == today {
-        return timeFmt.string(from: fetchedAt)
+        return WidgetDateFormatters.time.string(from: fetchedAt)
     }
     if let yesterday = cal.date(byAdding: .day, value: -1, to: today),
        fetchedDay == yesterday {
-        return "gestern \(timeFmt.string(from: fetchedAt))"
+        return "gestern \(WidgetDateFormatters.time.string(from: fetchedAt))"
     }
-    let dateTimeFmt = DateFormatter()
-    dateTimeFmt.locale = Locale(identifier: "de_DE")
-    dateTimeFmt.dateFormat = "dd.MM. HH:mm"
-    return dateTimeFmt.string(from: fetchedAt)
+    return WidgetDateFormatters.dateTime.string(from: fetchedAt)
 }

ios/TimetableWidgetExtension/TimetableWeekView.swift

@@ -70,7 +70,7 @@ struct TimetableWeekView: View {
                 .lineLimit(1)
                 .minimumScaleFactor(0.8)
             Spacer()
-            Text("Stand: \(freshnessLabel(for: data.fetchedAt))")
+            Text("Stand: \(freshnessLabel(for: data.fetchedAt, relativeTo: entry.date))")
                 .font(.system(size: 9))
                 .foregroundStyle(palette.textSecondary)
                 .lineLimit(1)
@@ -168,10 +168,7 @@ struct TimetableWeekView: View {
     }
 
     private func weekday(for date: Date) -> String {
-        let f = DateFormatter()
-        f.locale = Locale(identifier: "de_DE")
-        f.dateFormat = "EE"
-        return f.string(from: date)
+        WidgetDateFormatters.weekdayShort.string(from: date)
     }
 
     private func placeholder(_ message: String) -> some View {

ios/TimetableWidgetExtension/TimetableWidgetExtension.swift

@@ -41,11 +41,13 @@ struct TimetableDayProvider: TimelineProvider {
         in context: Context,
         completion: @escaping (Timeline<TimetableEntry>) -> Void
     ) {
-        let entry = TimetableEntry.current(variant: .day)
+        let now = Date()
         // 30 min mirrors the Dart workmanager cadence. iOS treats this as
-        // advisory; the "Stand:" label tells the user when data is stale.
-        let next = Calendar.current.date(byAdding: .minute, value: 30, to: Date()) ?? Date()
-        completion(Timeline(entries: [entry], policy: .after(next)))
+        // advisory; the boundary entries below keep the rendered day correct
+        // even when no reload is granted, and the "Stand:" label tells the
+        // user when the underlying data is stale.
+        let next = Calendar.current.date(byAdding: .minute, value: 30, to: now) ?? now
+        completion(Timeline(entries: TimetableEntry.dayEntries(now: now), policy: .after(next)))
     }
 }
 
@@ -80,9 +82,9 @@ struct TimetableWeekProvider: TimelineProvider {
         in context: Context,
         completion: @escaping (Timeline<TimetableEntry>) -> Void
     ) {
-        let entry = TimetableEntry.current(variant: .week)
-        let next = Calendar.current.date(byAdding: .minute, value: 30, to: Date()) ?? Date()
-        completion(Timeline(entries: [entry], policy: .after(next)))
+        let now = Date()
+        let next = Calendar.current.date(byAdding: .minute, value: 30, to: now) ?? now
+        completion(Timeline(entries: TimetableEntry.weekEntries(now: now), policy: .after(next)))
     }
 }
 
@@ -120,6 +122,58 @@ struct TimetableEntry: TimelineEntry {
             themeMode: WidgetDataLoader.themeMode()
         )
     }
+
+    /// Day timeline derived from the 14-day week payload, so the widget shows
+    /// the right day even when iOS grants no reload for days.
+    static func dayEntries(now: Date) -> [TimetableEntry] {
+        entries(now: now, variant: .day) { week, date in
+            TimetableAnchor.slice(week: week, forDay: TimetableAnchor.resolveDayAnchor(date))
+        }
+    }
+
+    /// Week timeline: re-anchoring performs the Friday-evening/weekend jump
+    /// into next week from cached data, and the midnight entries keep the
+    /// "Stand:" freshness label honest.
+    static func weekEntries(now: Date) -> [TimetableEntry] {
+        entries(now: now, variant: .week) { week, date in
+            TimetableAnchor.retarget(week: week, anchorDate: TimetableAnchor.resolveWeekAnchor(date))
+        }
+    }
+
+    /// Shared timeline skeleton: one entry now plus one per anchor boundary
+    /// (midnight rollover, 17:00 cutoff). Boundaries that cannot change the
+    /// render — same anchor and same calendar day for the header labels —
+    /// are dropped.
+    private static func entries(
+        now: Date,
+        variant: TimetableVariant,
+        transform: (WidgetTimetableData, Date) -> WidgetTimetableData
+    ) -> [TimetableEntry] {
+        guard WidgetDataLoader.isLoggedIn(), let week = WidgetDataLoader.loadWeek() else {
+            // Logged out, or no v2 week snapshot yet (fresh app update):
+            // fall back to the legacy single-entry payload.
+            return [TimetableEntry.current(variant: variant)]
+        }
+        let theme = WidgetDataLoader.themeMode()
+        let cal = Calendar.current
+        var result: [TimetableEntry] = []
+        for date in [now] + TimetableAnchor.boundaryDates(from: now) {
+            let data = transform(week, date)
+            if let previous = result.last, let previousData = previous.data,
+               cal.isDate(previousData.anchorDate, inSameDayAs: data.anchorDate),
+               cal.isDate(previous.date, inSameDayAs: date) {
+                continue
+            }
+            result.append(TimetableEntry(
+                date: date,
+                variant: variant,
+                data: data,
+                isLoggedIn: true,
+                themeMode: theme
+            ))
+        }
+        return result
+    }
 }
 
 extension View {

ios/TimetableWidgetExtension/WidgetData.swift

@@ -10,6 +10,15 @@ enum WidgetLessonStatus: String, Codable {
     case irregular
     case teacherChanged
     case event
+    case duty
+
+    /// Unknown future statuses degrade to `.regular` instead of failing the
+    /// whole payload decode (mirrors WidgetData.kt's fromWire fallback) — a
+    /// single new enum value must never blank the widget to the placeholder.
+    init(from decoder: Decoder) throws {
+        let raw = try decoder.singleValueContainer().decode(String.self)
+        self = WidgetLessonStatus(rawValue: raw) ?? .regular
+    }
 }
 
 struct WidgetLesson: Codable {
@@ -18,6 +27,8 @@ struct WidgetLesson: Codable {
     let subjectShort: String
     let subjectLong: String?
     let room: String?
+    // On teacher accounts this carries the class label ("7a") instead of the
+    // teacher short name (originalTeacher is nil then) — mapped in Dart.
     let teacher: String?
     let originalTeacher: String?
     let status: WidgetLessonStatus
@@ -33,6 +44,12 @@ struct WidgetPeriod: Codable {
     let virtualEndMinutes: Int
 }
 
+struct WidgetDayInfo: Codable {
+    let date: Date
+    let isHoliday: Bool
+    let holidayName: String?
+}
+
 struct WidgetTimetableData: Codable {
     let fetchedAt: Date
     let anchorDate: Date
@@ -40,12 +57,17 @@ struct WidgetTimetableData: Codable {
     let periods: [WidgetPeriod]
     let isHoliday: Bool
     let holidayName: String?
+    /// Week payload (v2) only; optional so day payloads keep decoding.
+    let days: [WidgetDayInfo]?
 }
 
+/// Mirrors lib/widget_data/widget_sync.dart (the canonical key list) — a
+/// schema bump must land in Dart, Kotlin (WidgetRenderer.kt) and here
+/// together, or the out-of-sync platform silently blanks to the placeholder.
 enum WidgetDataKey {
     static let appGroupId = "group.eu.mhsl.marianum.mobile.client.widget"
     static let dayData = "widget_data_day_v1"
-    static let weekData = "widget_data_week_v1"
+    static let weekData = "widget_data_week_v2"
     static let loggedIn = "widget_data_logged_in_v1"
     static let themeMode = "widget_setting_theme_mode_v1"
 }

lib/api/api_request.dart

@@ -1 +0,0 @@
-class ApiRequest {}

lib/api/cache_store.dart

@@ -0,0 +1,176 @@
+import 'dart:async';
+import 'dart:convert';
+import 'dart:io';
+
+import 'package:flutter/foundation.dart';
+import 'package:path_provider/path_provider.dart';
+
+import '../utils/directory_size.dart';
+
+/// One cached response: the raw JSON payload and when it was stored.
+class CacheEntry {
+  final String json;
+  final int lastUpdate;
+
+  const CacheEntry({required this.json, required this.lastUpdate});
+}
+
+/// File-per-key store behind [RequestCache] and friends.
+///
+/// Replaces `localstore` for response caching: localstore reads and decodes
+/// the entire collection synchronously on first access, keeps every document
+/// in memory for the whole session and JSON-encodes payloads a second time.
+/// Here every access is async and touches exactly one file, and the payload is
+/// stored verbatim behind a one-line header (`<lastUpdate>\n<json>`).
+class CacheStore {
+  CacheStore._();
+
+  static final CacheStore instance = CacheStore._();
+
+  /// Payloads above this size are decoded on a background isolate.
+  static const int isolateDecodeThreshold = 64 * 1024;
+
+  Future<Directory>? _dir;
+  final Map<String, Future<void>> _writes = {};
+
+  Future<Directory> _directory() => _dir ??= () async {
+    final base = await getApplicationCacheDirectory();
+    final dir = Directory('${base.path}/request_cache');
+    await dir.create(recursive: true);
+    return dir;
+  }();
+
+  Future<File> _file(String key) async =>
+      File('${(await _directory()).path}/${_safeName(key)}');
+
+  /// Keys are internal ids (`nc-chat-<token>`, `wd-folder-<md5>`); only path
+  /// separators would be a problem in a file name.
+  static String _safeName(String key) => key.replaceAll(RegExp(r'[/\\]'), '_');
+
+  Future<CacheEntry?> read(String key) async {
+    try {
+      await _writes[key];
+      return parse(await (await _file(key)).readAsString());
+    } on Object {
+      // Missing (PathNotFoundException) or unreadable: a cache miss.
+      return null;
+    }
+  }
+
+  /// All entries whose key starts with [prefix], read concurrently.
+  Future<Map<String, CacheEntry>> readAll({String prefix = ''}) async {
+    final keys = await this.keys(prefix: prefix);
+    final entries = await Future.wait(keys.map(read));
+    return {for (var i = 0; i < keys.length; i++) keys[i]: ?entries[i]};
+  }
+
+  Future<void> write(String key, String json) {
+    final previous = _writes[key] ?? Future<void>.value();
+    late final Future<void> current;
+    current = previous.then((_) => _write(key, json)).whenComplete(() {
+      if (identical(_writes[key], current)) _writes.remove(key);
+    });
+    return _writes[key] = current;
+  }
+
+  Future<void> _write(String key, String json) async {
+    try {
+      final file = await _file(key);
+      // Write-then-rename so a reader (or the widget background isolate)
+      // never sees a half-written file.
+      final tmp = File('${file.path}.tmp');
+      await tmp.writeAsString(
+        '${DateTime.now().millisecondsSinceEpoch}\n$json',
+        flush: true,
+      );
+      await tmp.rename(file.path);
+    } on Object catch (e) {
+      debugPrint('CacheStore.write($key) failed: $e');
+    }
+  }
+
+  Future<void> delete(String key) async {
+    try {
+      await _writes[key];
+      await (await _file(key)).delete();
+    } on Object {
+      // A missing or locked file is as good as deleted for a cache.
+    }
+  }
+
+  Future<void> clear() async {
+    try {
+      final dir = await _directory();
+      if (dir.existsSync()) await dir.delete(recursive: true);
+    } on Object catch (e) {
+      debugPrint('CacheStore.clear failed: $e');
+    }
+    _dir = null;
+  }
+
+  /// All stored keys, optionally filtered by [prefix].
+  Future<List<String>> keys({String prefix = ''}) async {
+    try {
+      final dir = await _directory();
+      return [
+        await for (final entity in dir.list())
+          if (entity is File && !entity.path.endsWith('.tmp'))
+            if (entity.uri.pathSegments.last case final name
+                when name.startsWith(prefix))
+              name,
+      ];
+    } on Object {
+      return const [];
+    }
+  }
+
+  /// Removes entries not written for [maxAge], judged by file mtime so nothing
+  /// has to be read or decoded.
+  Future<void> deleteOlderThan(Duration maxAge) async {
+    try {
+      final dir = await _directory();
+      final cutoff = DateTime.now().subtract(maxAge);
+      await for (final entity in dir.list()) {
+        if (entity is! File) continue;
+        // ignore: avoid_slow_async_io
+        final modified = (await entity.stat()).modified;
+        if (modified.isBefore(cutoff)) await entity.delete();
+      }
+    } on Object catch (e) {
+      debugPrint('CacheStore.deleteOlderThan failed: $e');
+    }
+  }
+
+  /// Total size of all entries in bytes.
+  Future<int> totalSize() async => directorySize(await _directory());
+
+  /// Parses the stored file format; public for tests.
+  static CacheEntry? parse(String raw) {
+    final newline = raw.indexOf('\n');
+    if (newline < 0) return null;
+    final lastUpdate = int.tryParse(raw.substring(0, newline));
+    if (lastUpdate == null) return null;
+    return CacheEntry(json: raw.substring(newline + 1), lastUpdate: lastUpdate);
+  }
+
+  /// Decodes a cached payload, off the UI isolate when it is large.
+  static Future<Map<String, dynamic>> decode(String json) =>
+      json.length > isolateDecodeThreshold
+      ? compute(_decodeMap, json)
+      : Future.value(_decodeMap(json));
+
+  static Map<String, dynamic> _decodeMap(String json) =>
+      jsonDecode(json) as Map<String, dynamic>;
+
+  /// Deletes the directory the old localstore-based cache lived in. It is
+  /// never read again and would otherwise linger with up to 200 days of data.
+  static Future<void> deleteLegacyLocalstoreCache() async {
+    try {
+      final docs = await getApplicationDocumentsDirectory();
+      final legacy = Directory('${docs.path}/MarianumMobile');
+      if (legacy.existsSync()) await legacy.delete(recursive: true);
+    } on Object catch (e) {
+      debugPrint('Legacy cache cleanup failed: $e');
+    }
+  }
+}

lib/api/demo/data/demo_absence.dart

@@ -0,0 +1,17 @@
+import '../../marianumconnect/queries/absence/absence_prefill_response.dart';
+
+/// Demo fixtures for the absence-report form: the class dropdown and the
+/// identity/phone prefill. Typed (compile-checked) so a field rename can't
+/// silently drift the demo shape away from what the queries parse.
+class DemoAbsence {
+  const DemoAbsence._();
+
+  static List<String> classes() => const ['5a', '6b', '7c', '9d', '10a', 'Q1'];
+
+  static AbsencePrefillResponse prefill() => AbsencePrefillResponse(
+    firstName: 'Max',
+    lastName: 'Mustermann',
+    className: '10a',
+    phone: '0123 456789',
+  );
+}

lib/api/demo/data/demo_capabilities.dart

@@ -2,13 +2,19 @@ import '../../../state/app/modules/capabilities/bloc/capabilities_state.dart';
 import '../../../state/app/modules/nextcloud_capabilities/bloc/nextcloud_capabilities_state.dart';
 
 /// Demo fixtures for the mobile capability flags — everything granted so the
-/// demo persona sees every feature (incl. push) as available.
+/// demo persona sees every feature (incl. push) as available and the timetable
+/// scroll range stays unlimited (null day counts).
 class DemoCapabilities {
   const DemoCapabilities._();
 
   static CapabilitiesState state() => const CapabilitiesState(
     viewForeignTimetables: true,
     pushNotifications: true,
+    timetablePastDays: null,
+    timetableFutureDays: null,
+    // Die Demo-Persona ist explizit Schüler — null hieße "Backend kennt das
+    // Feld nicht" (siehe CapabilitiesResponse.userType).
+    userType: 'STUDENT',
     loaded: true,
   );
 }

lib/api/demo/data/demo_talk.dart

@@ -324,6 +324,22 @@ class DemoTalk {
         message: 'Gute Idee, ich sammle schon mal Vorschläge.',
         reactions: {'👍': 3},
       ),
+      _msg(
+        id: base + 4,
+        token: token,
+        actor: 'ben',
+        display: 'Ben',
+        ago: const Duration(hours: 2),
+        message:
+            '## Ablauf Sommerfest\n'
+            'Ein paar **Punkte** für Mittwoch:\n\n'
+            '- Stände aufbauen ab *14 Uhr*\n'
+            '- [x] Getränke bestellt\n'
+            '- [ ] Musik organisieren\n\n'
+            '> Bitte bringt Ideen mit!\n\n'
+            'Mehr Infos auf der [SV-Seite](https://marianum-fulda.de).',
+        markdown: true,
+      ),
     ];
   }
 
@@ -346,6 +362,7 @@ class DemoTalk {
     required Duration ago,
     required String message,
     Map<String, int>? reactions,
+    bool markdown = false,
   }) => _msg(
     id: id,
     token: token,
@@ -354,6 +371,7 @@ class DemoTalk {
     ago: ago,
     message: message,
     reactions: reactions,
+    markdown: markdown,
   );
 
   static GetChatResponseObject _msg({
@@ -364,6 +382,7 @@ class DemoTalk {
     required Duration ago,
     required String message,
     Map<String, int>? reactions,
+    bool markdown = false,
   }) => GetChatResponseObject(
     id,
     token,
@@ -380,6 +399,7 @@ class DemoTalk {
     reactions,
     null,
     null,
+    markdown,
   );
 
   static GetRoomResponseObject _room({

lib/api/demo/demo_marianumconnect.dart

@@ -1,3 +1,4 @@
+import 'data/demo_absence.dart';
 import 'data/demo_breaker.dart';
 import 'data/demo_holidays.dart';
 import 'data/demo_timetable.dart';
@@ -39,6 +40,10 @@ class DemoMarianumConnect {
             .toList();
       case 'breaker':
         return DemoBreaker.none().toJson();
+      case 'absence/classes':
+        return DemoAbsence.classes();
+      case 'absence/prefill':
+        return DemoAbsence.prefill().toJson();
       case 'timetable/elements/teachers':
       case 'timetable/elements/students':
       case 'timetable/elements/classes':

lib/api/emergency/emergency_notice.dart

@@ -0,0 +1,90 @@
+/// A backend-independent emergency notice loaded from a foreign server URL —
+/// frontmatter (control fields) plus a free Markdown body, so it stays
+/// hand-writable in an outage. See [parse] for the format.
+class EmergencyNotice {
+  /// `false` renders full-screen and blocks back/barrier taps.
+  final bool dismissible;
+  final String? title;
+  final String body;
+
+  const EmergencyNotice({
+    required this.dismissible,
+    required this.title,
+    required this.body,
+  });
+
+  /// Parses the raw file, or returns `null` when there is nothing to show.
+  /// Never throws — malformed input yields `null` so a broken file can't break
+  /// the app.
+  ///
+  /// ```
+  /// ---
+  /// active: true          # required truthy, else null; # lines are comments
+  /// dismissible: true     # default true
+  /// title: Störung        # optional
+  /// ---
+  /// Free **markdown** body (everything after the closing ---).
+  /// ```
+  static EmergencyNotice? parse(String raw) {
+    final lines = raw
+        .replaceAll('\r\n', '\n')
+        .replaceAll('\r', '\n')
+        .split('\n');
+
+    var i = 0;
+    while (i < lines.length && lines[i].trim().isEmpty) {
+      i++;
+    }
+    if (i >= lines.length || lines[i].trim() != '---') return null;
+    final openIndex = i;
+
+    var closeIndex = -1;
+    for (var j = openIndex + 1; j < lines.length; j++) {
+      if (lines[j].trim() == '---') {
+        closeIndex = j;
+        break;
+      }
+    }
+    if (closeIndex == -1) return null;
+
+    final meta = <String, String>{};
+    for (var j = openIndex + 1; j < closeIndex; j++) {
+      final line = lines[j].trim();
+      if (line.isEmpty || line.startsWith('#')) continue;
+      final sep = line.indexOf(':');
+      if (sep <= 0) continue;
+      final key = line.substring(0, sep).trim().toLowerCase();
+      final value = line.substring(sep + 1).trim();
+      meta[key] = value;
+    }
+
+    if (_parseBool(meta['active']) != true) return null;
+
+    final body = lines.sublist(closeIndex + 1).join('\n').trim();
+    if (body.isEmpty) return null;
+
+    final title = meta['title'];
+    return EmergencyNotice(
+      dismissible: _parseBool(meta['dismissible']) ?? true,
+      title: (title == null || title.isEmpty) ? null : title,
+      body: body,
+    );
+  }
+
+  static bool? _parseBool(String? value) {
+    switch (value?.trim().toLowerCase()) {
+      case 'true':
+      case 'yes':
+      case '1':
+      case 'on':
+        return true;
+      case 'false':
+      case 'no':
+      case '0':
+      case 'off':
+        return false;
+      default:
+        return null;
+    }
+  }
+}

lib/api/emergency/emergency_notice_client.dart

@@ -0,0 +1,51 @@
+import 'package:dio/dio.dart';
+
+import 'emergency_notice.dart';
+
+/// Loads the emergency notice from a foreign URL over a standalone [Dio] — no
+/// MarianumConnect interceptors/base URL/auth, so it survives a backend outage.
+/// Never throws: any failure yields `null` (nothing shown).
+///
+/// A [cacheTtl] in-memory throttle keeps rapid resumes from hammering the host;
+/// it lives only for the process, so a cold start always fetches fresh.
+class EmergencyNoticeClient {
+  EmergencyNoticeClient();
+
+  static const Duration cacheTtl = Duration(minutes: 1);
+
+  EmergencyNotice? _cached;
+  String? _cachedUrl;
+  DateTime? _cachedAt;
+
+  Future<EmergencyNotice?> fetch(String url) async {
+    final cachedAt = _cachedAt;
+    if (cachedAt != null &&
+        _cachedUrl == url &&
+        DateTime.now().difference(cachedAt) < cacheTtl) {
+      return _cached;
+    }
+
+    EmergencyNotice? result;
+    try {
+      final dio = Dio(
+        BaseOptions(
+          connectTimeout: const Duration(seconds: 5),
+          receiveTimeout: const Duration(seconds: 5),
+          sendTimeout: const Duration(seconds: 5),
+          responseType: ResponseType.plain,
+        ),
+      );
+      final response = await dio.get<String>(url);
+      final raw = response.data;
+      result = (raw == null || raw.isEmpty) ? null : EmergencyNotice.parse(raw);
+    } catch (_) {
+      result = null;
+    }
+
+    // Cache failures too, so a down server isn't retried on every resume.
+    _cached = result;
+    _cachedUrl = url;
+    _cachedAt = DateTime.now();
+    return result;
+  }
+}

lib/api/errors/error_mapper.dart

@@ -6,6 +6,7 @@ import 'package:http/http.dart' as http;
 import 'package:nextcloud/nextcloud.dart';
 
 import '../api_error.dart';
+import '../http_errors.dart';
 import '../marianumcloud/talk/talk_error.dart';
 import 'app_exception.dart';
 import 'auth_exception.dart';
@@ -59,9 +60,8 @@ AppException? _dioToAppException(DioException error) {
 /// status plus a trimmed body preview (same format as the Talk API errors).
 AppException _dynamiteToAppException(DynamiteApiException error) {
   final status = error.statusCode;
-  final body = error.body.replaceAll(RegExp(r'\s+'), ' ').trim();
-  final preview = body.length > 500 ? '${body.substring(0, 500)}…' : body;
-  final detail = body.isEmpty ? 'HTTP $status' : 'HTTP $status body=$preview';
+  final preview = previewBody(error.body);
+  final detail = preview.isEmpty ? 'HTTP $status' : 'HTTP $status body=$preview';
   switch (status) {
     case 401:
       return AuthException.unauthorized(technicalDetails: detail);

lib/api/errors/permission_exception.dart

@@ -0,0 +1,41 @@
+import 'package:flutter/services.dart';
+
+import 'app_exception.dart';
+
+/// The user denied a system permission the action needs (camera, photos).
+/// Retrying won't help until the permission is granted in the system settings.
+class PermissionException extends AppException {
+  const PermissionException({
+    required super.userMessage,
+    super.technicalDetails,
+  }) : super(allowRetry: false);
+
+  factory PermissionException.camera({String? technicalDetails}) =>
+      PermissionException(
+        userMessage:
+            'Kein Zugriff auf die Kamera. Bitte erlaube der App den '
+            'Kamerazugriff in den Einstellungen deines Geräts.',
+        technicalDetails: technicalDetails,
+      );
+
+  factory PermissionException.photos({String? technicalDetails}) =>
+      PermissionException(
+        userMessage:
+            'Kein Zugriff auf deine Fotos. Bitte erlaube der App den '
+            'Fotozugriff in den Einstellungen deines Geräts.',
+        technicalDetails: technicalDetails,
+      );
+
+  /// Maps the `*_access_denied` codes thrown by `image_picker`; `null` for any
+  /// other platform error.
+  static PermissionException? fromPlatform(PlatformException error) =>
+      switch (error.code) {
+        'camera_access_denied' => PermissionException.camera(
+          technicalDetails: error.message,
+        ),
+        'photo_access_denied' => PermissionException.photos(
+          technicalDetails: error.message,
+        ),
+        _ => null,
+      };
+}

lib/api/errors/stale_session_exception.dart

@@ -0,0 +1,11 @@
+import 'app_exception.dart';
+
+/// A request finished after the account it was started for signed out. Its
+/// result must not reach the state or cache of whoever is signed in now.
+class StaleSessionException extends AppException {
+  const StaleSessionException()
+    : super(
+        userMessage: 'Die Anmeldung hat sich geändert. Bitte lade neu.',
+        technicalDetails: 'result of a previous session discarded',
+      );
+}

lib/api/errors/talk_exception.dart

@@ -4,16 +4,22 @@ import 'app_exception.dart';
 class TalkException extends AppException {
   final TalkError source;
 
-  TalkException(this.source)
+  TalkException(this.source, {String? technicalDetails})
     : super(
         userMessage: _mapMessage(source),
         technicalDetails:
+            technicalDetails ??
             'Talk ${source.status} (${source.code}): ${source.message}',
         allowRetry: source.code >= 500,
       );
 
   static String _mapMessage(TalkError e) {
     switch (e.code) {
+      case 400:
+        return 'Talk hat diese Anfrage abgelehnt. Bitte lade den Chat neu und '
+            'versuche es erneut.';
+      case 413:
+        return 'Diese Nachricht ist zu lang.';
       case 401:
         return 'Bitte melde dich erneut an, um auf Talk zuzugreifen.';
       case 403:

lib/api/http_errors.dart

@@ -0,0 +1,53 @@
+import 'dart:async';
+import 'dart:io';
+
+import 'package:http/http.dart' as http;
+
+import 'errors/auth_exception.dart';
+import 'errors/network_exception.dart';
+import 'errors/not_found_exception.dart';
+import 'errors/server_exception.dart';
+
+/// Runs [send] and converts transport-level failures (socket/timeout/client
+/// errors) into a [NetworkException] tagged with [label] (e.g. `Talk <uri>`).
+/// Passes through whatever [send] produces, including `null` for the base-class
+/// request hooks that may skip the call.
+Future<http.Response?> sendGuarded(
+  String label,
+  Future<http.Response>? Function() send,
+) async {
+  try {
+    return await send();
+  } on SocketException catch (e) {
+    throw NetworkException(technicalDetails: '$label: ${e.message}');
+  } on TimeoutException catch (e) {
+    throw NetworkException.timeout(technicalDetails: '$label: $e');
+  } on http.ClientException catch (e) {
+    throw NetworkException(technicalDetails: '$label: ${e.message}');
+  }
+}
+
+/// Collapses whitespace and caps an HTTP error body at 500 chars so it can be
+/// embedded in an [AppException]'s technical details without dumping headers.
+String previewBody(String body) {
+  final collapsed = body.replaceAll(RegExp(r'\s+'), ' ').trim();
+  return collapsed.length > 500 ? '${collapsed.substring(0, 500)}…' : collapsed;
+}
+
+/// Builds a `<label> -> HTTP <status>[ body=<preview>]` technical detail line.
+String httpErrorDetail(String label, String body, int status) {
+  final preview = previewBody(body);
+  return preview.isEmpty
+      ? '$label -> HTTP $status'
+      : '$label -> HTTP $status body=$preview';
+}
+
+/// Throws the [AppException] matching a non-2xx HTTP [status], carrying
+/// [detail] as technical details: 401/403 map to auth errors, 404 to
+/// not-found, everything else to a generic server error.
+Never throwForStatus(int status, String detail) {
+  if (status == 401) throw AuthException.unauthorized(technicalDetails: detail);
+  if (status == 403) throw AuthException.forbidden(technicalDetails: detail);
+  if (status == 404) throw NotFoundException(technicalDetails: detail);
+  throw ServerException(statusCode: status, technicalDetails: detail);
+}

lib/api/marianumcloud/app_password/get_app_password.dart

@@ -3,6 +3,7 @@ import 'dart:convert';
 import 'package:http/http.dart' as http;
 
 import '../../../model/account_data.dart';
+import '../../http_errors.dart';
 import '../nextcloud_ocs.dart';
 
 /// Exchanges the user's real Nextcloud password for a scoped app password via
@@ -18,21 +19,29 @@ class GetAppPassword {
   GetAppPassword({http.Client? client}) : _client = client ?? http.Client();
 
   /// Returns the freshly minted app password. Throws on any transport or
-  /// protocol error — callers treat push registration as best-effort and swallow
-  /// failures.
+  /// protocol error — a 401 becomes an [AuthException], which the login flow
+  /// reads as "Nextcloud rejects the password" (two-factor authentication or
+  /// password mismatch) and answers with the interactive Login Flow v2.
   Future<String> run() async {
-    final response = await _client.get(
-      NextcloudOcs.uri('core/getapppassword'),
-      headers: {
-        ...NextcloudOcs.headers(),
-        // Deliberately NOT the shared Authorization value: that one prefers
-        // the app password, but an app password cannot mint another one —
-        // this endpoint requires the real password.
-        'Authorization': AccountData().getRealPasswordBasicAuthHeader(),
-      },
-    );
+    const label = 'Nextcloud getapppassword';
+    final response = (await sendGuarded(
+      label,
+      () => _client.get(
+        NextcloudOcs.uri('core/getapppassword'),
+        headers: {
+          ...NextcloudOcs.headers(),
+          // Deliberately NOT the shared Authorization value: that one prefers
+          // the app password, but an app password cannot mint another one —
+          // this endpoint requires the real password.
+          'Authorization': AccountData().getRealPasswordBasicAuthHeader(),
+        },
+      ),
+    ))!;
     if (response.statusCode < 200 || response.statusCode >= 300) {
-      throw Exception('getapppassword HTTP ${response.statusCode}');
+      throwForStatus(
+        response.statusCode,
+        httpErrorDetail(label, response.body, response.statusCode),
+      );
     }
     final json = jsonDecode(utf8.decode(response.bodyBytes));
     final data = (json as Map)['ocs']?['data'];

lib/api/marianumcloud/autocomplete/autocomplete_api.dart

@@ -1,10 +1,10 @@
-import 'dart:convert';
 import 'dart:io';
 
 import 'package:http/http.dart' as http;
 
 import '../../../model/endpoint_data.dart';
 import '../../errors/server_exception.dart';
+import '../../http_errors.dart';
 import '../nextcloud_ocs.dart';
 import 'autocomplete_response.dart';
 
@@ -31,16 +31,18 @@ class AutocompleteApi {
         'limit': '10',
       },
     );
-    final response = await http.get(uri, headers: NextcloudOcs.headers());
+    final response = (await sendGuarded(
+      'Autocomplete $uri',
+      () => http
+          .get(uri, headers: NextcloudOcs.headers())
+          .timeout(const Duration(seconds: 20)),
+    ))!;
     if (response.statusCode != HttpStatus.ok) {
       throw ServerException(
         statusCode: response.statusCode,
         technicalDetails: 'core/autocomplete/get: ${response.body}',
       );
     }
-    final decoded = jsonDecode(response.body) as Map<String, dynamic>;
-    return AutocompleteResponse.fromJson(
-      decoded['ocs'] as Map<String, dynamic>,
-    );
+    return AutocompleteResponse.fromJson(NextcloudOcs.decode(response.body));
   }
 }

lib/api/marianumcloud/cloud_users/cloud_users_actions.dart

@@ -1,18 +1,13 @@
-import 'dart:async';
 import 'dart:convert';
 import 'dart:developer';
-import 'dart:io';
 import 'dart:typed_data';
 
 import 'package:http/http.dart' as http;
 
 import '../../../model/account_data.dart';
 import '../../../model/endpoint_data.dart';
-import '../../errors/auth_exception.dart';
-import '../../errors/network_exception.dart';
-import '../../errors/not_found_exception.dart';
 import '../../errors/parse_exception.dart';
-import '../../errors/server_exception.dart';
+import '../../http_errors.dart';
 import '../nextcloud_ocs.dart';
 
 /// Mix of two Nextcloud surfaces:
@@ -42,30 +37,17 @@ Future<http.Response> _send(
 ) async {
   final headers = NextcloudOcs.headers();
 
-  final http.Response response;
-  try {
-    response = await perform(uri, headers);
-  } on SocketException catch (e) {
-    throw NetworkException(technicalDetails: 'Cloud $uri: ${e.message}');
-  } on TimeoutException catch (e) {
-    throw NetworkException.timeout(technicalDetails: 'Cloud $uri: $e');
-  } on http.ClientException catch (e) {
-    throw NetworkException(technicalDetails: 'Cloud $uri: ${e.message}');
-  }
+  final response = (await sendGuarded(
+    'Cloud $uri',
+    () => perform(uri, headers),
+  ))!;
 
   final status = response.statusCode;
   if (status >= 200 && status < 300) return response;
 
-  final body = response.body.replaceAll(RegExp(r'\s+'), ' ').trim();
-  final preview = body.length > 500 ? '${body.substring(0, 500)}…' : body;
-  final detail = body.isEmpty
-      ? 'Cloud $uri -> HTTP $status'
-      : 'Cloud $uri -> HTTP $status body=$preview';
+  final detail = httpErrorDetail('Cloud $uri', response.body, status);
   log(detail);
-  if (status == 401) throw AuthException.unauthorized(technicalDetails: detail);
-  if (status == 403) throw AuthException.forbidden(technicalDetails: detail);
-  if (status == 404) throw NotFoundException(technicalDetails: detail);
-  throw ServerException(statusCode: status, technicalDetails: detail);
+  throwForStatus(status, detail);
 }
 
 class SetUserAvatar {

lib/api/marianumcloud/login_flow/login_flow_api.dart

@@ -0,0 +1,140 @@
+import 'dart:convert';
+
+import 'package:http/http.dart' as http;
+
+import '../../../model/endpoint_data.dart';
+import '../../http_errors.dart';
+import '../../marianumconnect/auth/device_token_name.dart';
+
+/// Nextcloud Login Flow v2 (`/index.php/login/v2`): interactive browser login
+/// that yields an app password. It is the only way to obtain working Nextcloud
+/// credentials when the account is protected by two-factor authentication —
+/// Basic auth with the real password is rejected server-side in that case.
+class LoginFlowApi {
+  final http.Client _client;
+
+  LoginFlowApi({http.Client? client}) : _client = client ?? http.Client();
+
+  /// Starts a new flow. Nextcloud displays the request's User-Agent as the
+  /// token name in the user's security settings, so the device token label is
+  /// sent (`"Marianum Fulda App (Pixel 10)"`).
+  Future<LoginFlowInit> start() async {
+    final userAgent = await DeviceTokenName.resolve();
+    final uri = _initUri();
+    const label = 'Nextcloud login flow init';
+    final response = (await sendGuarded(
+      label,
+      () => _client.post(
+        uri,
+        headers: {'Accept': 'application/json', 'User-Agent': userAgent},
+      ),
+    ))!;
+    if (response.statusCode < 200 || response.statusCode >= 300) {
+      throwForStatus(
+        response.statusCode,
+        httpErrorDetail(label, response.body, response.statusCode),
+      );
+    }
+    return LoginFlowInit.fromJson(
+      jsonDecode(utf8.decode(response.bodyBytes)) as Map<String, dynamic>,
+    );
+  }
+
+  /// Polls for the flow result: `null` while the browser login has not been
+  /// completed yet (HTTP 404), the final credentials once it has.
+  Future<LoginFlowCredentials?> poll(LoginFlowInit flow) async {
+    const label = 'Nextcloud login flow poll';
+    final response = (await sendGuarded(
+      label,
+      () => _client.post(
+        Uri.parse(flow.pollEndpoint),
+        headers: {'Accept': 'application/json'},
+        body: {'token': flow.pollToken},
+      ),
+    ))!;
+    if (response.statusCode == 404) return null;
+    if (response.statusCode < 200 || response.statusCode >= 300) {
+      throwForStatus(
+        response.statusCode,
+        httpErrorDetail(label, response.body, response.statusCode),
+      );
+    }
+    return LoginFlowCredentials.fromJson(
+      jsonDecode(utf8.decode(response.bodyBytes)) as Map<String, dynamic>,
+    );
+  }
+
+  static Uri _initUri() {
+    final endpoint = EndpointData().nextcloud();
+    return Uri.https(endpoint.domain, '${endpoint.path}/index.php/login/v2');
+  }
+
+  /// Whether the login name reported by the completed flow belongs to the
+  /// account this app session expects — the browser login could have been
+  /// completed with a different Nextcloud account.
+  static bool loginNameMatches({
+    required String expected,
+    required String actual,
+  }) => actual.trim().toLowerCase() == expected.trim().toLowerCase();
+}
+
+/// Response of the flow init call: the URL the user opens in the browser plus
+/// the token/endpoint pair the app polls until the login is confirmed.
+class LoginFlowInit {
+  final String loginUrl;
+  final String pollToken;
+  final String pollEndpoint;
+
+  const LoginFlowInit({
+    required this.loginUrl,
+    required this.pollToken,
+    required this.pollEndpoint,
+  });
+
+  factory LoginFlowInit.fromJson(Map<String, dynamic> json) {
+    final poll = json['poll'];
+    final loginUrl = json['login'] as String?;
+    final token = poll is Map ? poll['token'] as String? : null;
+    final endpoint = poll is Map ? poll['endpoint'] as String? : null;
+    if (loginUrl == null || loginUrl.isEmpty) {
+      throw const FormatException('login flow init: missing login url');
+    }
+    if (token == null || token.isEmpty || endpoint == null || endpoint.isEmpty) {
+      throw const FormatException('login flow init: missing poll token/endpoint');
+    }
+    return LoginFlowInit(
+      loginUrl: loginUrl,
+      pollToken: token,
+      pollEndpoint: endpoint,
+    );
+  }
+}
+
+/// Credentials returned once the user confirmed the login in the browser.
+class LoginFlowCredentials {
+  final String server;
+  final String loginName;
+  final String appPassword;
+
+  const LoginFlowCredentials({
+    required this.server,
+    required this.loginName,
+    required this.appPassword,
+  });
+
+  factory LoginFlowCredentials.fromJson(Map<String, dynamic> json) {
+    final loginName = json['loginName'] as String?;
+    final appPassword = json['appPassword'] as String?;
+    if (loginName == null || loginName.isEmpty) {
+      throw const FormatException('login flow poll: missing loginName');
+    }
+    if (appPassword == null || appPassword.isEmpty) {
+      throw const FormatException('login flow poll: missing appPassword');
+    }
+    return LoginFlowCredentials(
+      server: json['server'] as String? ?? '',
+      loginName: loginName,
+      appPassword: appPassword,
+    );
+  }
+}

lib/api/marianumcloud/nextcloud_ocs.dart

@@ -1,3 +1,5 @@
+import 'dart:convert';
+
 import '../../model/account_data.dart';
 import '../../model/endpoint_data.dart';
 
@@ -6,6 +8,11 @@ import '../../model/endpoint_data.dart';
 class NextcloudOcs {
   NextcloudOcs._();
 
+  /// Decodes an OCS v2 JSON envelope and returns its `ocs` object (the wrapper
+  /// every response nests its `meta`/`data` under).
+  static Map<String, dynamic> decode(String raw) =>
+      (jsonDecode(raw) as Map<String, dynamic>)['ocs'] as Map<String, dynamic>;
+
   static Map<String, String> headers() => {
     'Accept': 'application/json',
     'OCS-APIRequest': 'true',

lib/api/marianumcloud/search/search_files.dart

@@ -1,4 +1,3 @@
-import 'dart:convert';
 import 'dart:io';
 
 import 'package:http/http.dart' as http;
@@ -28,9 +27,7 @@ class SearchFiles {
         'Files search failed with ${response.statusCode}: ${response.body}',
       );
     }
-    final decoded = jsonDecode(response.body) as Map<String, dynamic>;
-    final ocs = decoded['ocs'] as Map<String, dynamic>;
-    final data = ocs['data'] as Map<String, dynamic>;
+    final data = NextcloudOcs.decode(response.body)['data'] as Map<String, dynamic>;
     return SearchFilesResponse.fromJson(data);
   }
 }

lib/api/marianumcloud/talk/actions/talk_actions.dart

@@ -4,6 +4,7 @@ import 'package:http/http.dart' as http;
 
 import '../../../api_params.dart';
 import '../../../api_response.dart';
+import '../room/get_room_response.dart';
 import '../talk_api.dart';
 
 /// Small POST/DELETE-only Talk endpoints that have no response payload.
@@ -105,3 +106,21 @@ class DeleteRoomAvatar extends TalkApi {
     Map<String, String>? headers,
   ) => http.delete(uri, headers: headers);
 }
+
+class SetNotificationLevel extends TalkApi {
+  final String chatToken;
+  final GetRoomResponseObjectParticipantNotificationLevel level;
+
+  SetNotificationLevel(this.chatToken, this.level)
+    : super('v4/room/$chatToken/notify', null);
+
+  @override
+  ApiResponse? assemble(String raw) => null;
+
+  @override
+  Future<http.Response> request(
+    Uri uri,
+    ApiParams? body,
+    Map<String, String>? headers,
+  ) => http.post(uri, headers: headers, body: {'level': '${level.apiValue}'});
+}

lib/api/marianumcloud/talk/chat/get_chat.dart

@@ -1,8 +1,7 @@
-import 'dart:convert';
-
 import 'package:http/http.dart' as http;
 import 'package:http/http.dart';
 
+import '../../nextcloud_ocs.dart';
 import '../talk_api.dart';
 import 'get_chat_params.dart';
 import 'get_chat_response.dart';
@@ -15,10 +14,8 @@ class GetChat extends TalkApi<GetChatResponse> {
     : super('v1/chat/$chatToken', null, getParameters: params.toJson());
 
   @override
-  GetChatResponse assemble(String raw) {
-    final decoded = jsonDecode(raw) as Map<String, dynamic>;
-    return GetChatResponse.fromJson(decoded['ocs'] as Map<String, dynamic>);
-  }
+  GetChatResponse assemble(String raw) =>
+      GetChatResponse.fromJson(NextcloudOcs.decode(raw));
 
   @override
   Future<Response> request(

lib/api/marianumcloud/talk/chat/get_chat_cache.dart

@@ -16,7 +16,10 @@ class GetChatCache extends SimpleCache<GetChatResponse> {
            GetChatParams(
              lookIntoFuture: GetChatParamsSwitch.off,
              setReadMarker: GetChatParamsSwitch.on,
-             limit: 200,
+             // Small initial page; also the per-chat offline snapshot written to
+             // the request cache. Older messages are paged in on scroll-up via
+             // GetChatHistory. Keep in sync with ChatBloc's _kInitialPageSize.
+             limit: 50,
            ),
          ).run(),
          fromJson: GetChatResponse.fromJson,

lib/api/marianumcloud/talk/chat/get_chat_history.dart

@@ -0,0 +1,62 @@
+import 'package:flutter/foundation.dart';
+import 'package:http/http.dart' as http;
+
+import '../../../errors/server_exception.dart';
+import '../../../http_errors.dart';
+import '../../nextcloud_ocs.dart';
+import 'get_chat_params.dart';
+import 'get_chat_response.dart';
+
+/// Backwards-paging variant of GetChat (`lookIntoFuture=0` + `lastKnownMessageId`)
+/// that fetches the page of messages *older* than a given id. Bypasses [TalkApi]
+/// because that layer treats non-2xx as errors, and the server answers HTTP 304
+/// when there are no older messages left — a normal "start of chat" outcome here.
+/// `setReadMarker=off` so paging into history never moves the read cursor.
+class GetChatHistory {
+  final String chatToken;
+  final int lastKnownMessageId;
+  final int limit;
+
+  GetChatHistory({
+    required this.chatToken,
+    required this.lastKnownMessageId,
+    required this.limit,
+  });
+
+  /// Returns the older page, or `null` on HTTP 304 (no older messages).
+  Future<GetChatResponse?> run() async {
+    final params = GetChatParams(
+      lookIntoFuture: GetChatParamsSwitch.off,
+      lastKnownMessageId: lastKnownMessageId,
+      includeLastKnown: GetChatParamsSwitch.off,
+      setReadMarker: GetChatParamsSwitch.off,
+      limit: limit,
+    );
+    final uri = NextcloudOcs.uri(
+      'apps/spreed/api/v1/chat/$chatToken',
+      queryParameters: params.toJson(),
+    );
+    final headers = NextcloudOcs.headers();
+
+    final response = (await sendGuarded(
+      'GetChatHistory $uri',
+      () => http.get(uri, headers: headers),
+    ))!;
+
+    final status = response.statusCode;
+    if (status == 304) return null;
+    if (status >= 200 && status < 300) {
+      // A page holds up to 200 messages and lands while the user is scrolling;
+      // decoding it on the UI isolate stalls the fling.
+      final parsed = await compute(_parseChatResponse, response.body);
+      return parsed..headers = response.headers;
+    }
+    throw ServerException(
+      statusCode: status,
+      technicalDetails: 'GetChatHistory $uri: HTTP $status',
+    );
+  }
+}
+
+GetChatResponse _parseChatResponse(String body) =>
+    GetChatResponse.fromJson(NextcloudOcs.decode(body));

lib/api/marianumcloud/talk/chat/get_chat_response.dart

@@ -42,6 +42,11 @@ class GetChatResponseObject {
   Map<String, RichObjectString>? messageParameters;
   GetChatResponseObject? parent;
 
+  /// Whether the server flagged this message to be rendered as Markdown
+  /// (capability `markdown-messages`). Absent on older servers/messages, in
+  /// which case it stays `false` and the body renders as plain text.
+  bool markdown;
+
   GetChatResponseObject(
     this.id,
     this.token,
@@ -57,8 +62,9 @@ class GetChatResponseObject {
     this.messageParameters,
     this.reactions,
     this.reactionsSelf,
-    this.parent,
-  );
+    this.parent, [
+    this.markdown = false,
+  ]);
 
   factory GetChatResponseObject.fromJson(Map<String, dynamic> json) =>
       _$GetChatResponseObjectFromJson(json);

lib/api/marianumcloud/talk/chat/get_chat_response.g.dart

@@ -49,6 +49,7 @@ GetChatResponseObject _$GetChatResponseObjectFromJson(
   json['parent'] == null
       ? null
       : GetChatResponseObject.fromJson(json['parent'] as Map<String, dynamic>),
+  json['markdown'] as bool? ?? false,
 );
 
 Map<String, dynamic> _$GetChatResponseObjectToJson(
@@ -73,6 +74,7 @@ Map<String, dynamic> _$GetChatResponseObjectToJson(
     (k, e) => MapEntry(k, e.toJson()),
   ),
   'parent': instance.parent?.toJson(),
+  'markdown': instance.markdown,
 };
 
 const _$GetRoomResponseObjectMessageActorTypeEnumMap = {

lib/api/marianumcloud/talk/chat/long_poll_chat.dart

@@ -1,11 +1,7 @@
-import 'dart:async';
-import 'dart:convert';
-import 'dart:io';
-
 import 'package:http/http.dart' as http;
 
-import '../../../errors/network_exception.dart';
 import '../../../errors/server_exception.dart';
+import '../../../http_errors.dart';
 import '../../nextcloud_ocs.dart';
 import 'get_chat_params.dart';
 import 'get_chat_response.dart';
@@ -41,24 +37,17 @@ class LongPollChat {
     );
     final headers = NextcloudOcs.headers();
 
-    final http.Response response;
-    try {
-      response = await http
+    final response = (await sendGuarded(
+      'LongPollChat $uri',
+      () => http
           .get(uri, headers: headers)
-          .timeout(Duration(seconds: timeoutSeconds + 15));
-    } on TimeoutException catch (e) {
-      throw NetworkException.timeout(technicalDetails: 'LongPollChat $uri: $e');
-    } on SocketException catch (e) {
-      throw NetworkException(technicalDetails: 'LongPollChat $uri: ${e.message}');
-    } on http.ClientException catch (e) {
-      throw NetworkException(technicalDetails: 'LongPollChat $uri: ${e.message}');
-    }
+          .timeout(Duration(seconds: timeoutSeconds + 15)),
+    ))!;
 
     final status = response.statusCode;
     if (status == 304) return null;
     if (status >= 200 && status < 300) {
-      final decoded = jsonDecode(response.body) as Map<String, dynamic>;
-      return GetChatResponse.fromJson(decoded['ocs'] as Map<String, dynamic>)
+      return GetChatResponse.fromJson(NextcloudOcs.decode(response.body))
         ..headers = response.headers;
     }
     throw ServerException(

lib/api/marianumcloud/talk/close_poll/close_poll.dart

@@ -1,8 +1,7 @@
-import 'dart:convert';
-
 import 'package:http/http.dart' as http;
 
 import '../../../api_params.dart';
+import '../../nextcloud_ocs.dart';
 import '../get_poll/get_poll_state_response.dart';
 import '../talk_api.dart';
 
@@ -12,12 +11,8 @@ class ClosePoll extends TalkApi<GetPollStateResponse> {
     : super('v1/poll/$token/$pollId', null);
 
   @override
-  GetPollStateResponse assemble(String raw) {
-    final decoded = jsonDecode(raw) as Map<String, dynamic>;
-    return GetPollStateResponse.fromJson(
-      decoded['ocs'] as Map<String, dynamic>,
-    );
-  }
+  GetPollStateResponse assemble(String raw) =>
+      GetPollStateResponse.fromJson(NextcloudOcs.decode(raw));
 
   @override
   Future<http.Response> request(

lib/api/marianumcloud/talk/create_room/create_room.dart

@@ -1,8 +1,7 @@
-import 'dart:convert';
-
 import 'package:http/http.dart' as http;
 import 'package:http/http.dart';
 
+import '../../nextcloud_ocs.dart';
 import '../talk_api.dart';
 import 'create_room_params.dart';
 import 'create_room_response.dart';
@@ -13,10 +12,8 @@ class CreateRoom extends TalkApi<CreateRoomResponse> {
   CreateRoom(this.params) : super('v4/room', params);
 
   @override
-  CreateRoomResponse assemble(String raw) {
-    final decoded = jsonDecode(raw) as Map<String, dynamic>;
-    return CreateRoomResponse.fromJson(decoded['ocs'] as Map<String, dynamic>);
-  }
+  CreateRoomResponse assemble(String raw) =>
+      CreateRoomResponse.fromJson(NextcloudOcs.decode(raw));
 
   @override
   Future<Response>? request(

lib/api/marianumcloud/talk/get_participants/get_participants.dart

@@ -1,7 +1,6 @@
-import 'dart:convert';
-
 import 'package:http/http.dart' as http;
 
+import '../../nextcloud_ocs.dart';
 import '../talk_api.dart';
 import 'get_participants_response.dart';
 
@@ -10,12 +9,8 @@ class GetParticipants extends TalkApi<GetParticipantsResponse> {
   GetParticipants(this.token) : super('v4/room/$token/participants', null);
 
   @override
-  GetParticipantsResponse assemble(String raw) {
-    final decoded = jsonDecode(raw) as Map<String, dynamic>;
-    return GetParticipantsResponse.fromJson(
-      decoded['ocs'] as Map<String, dynamic>,
-    );
-  }
+  GetParticipantsResponse assemble(String raw) =>
+      GetParticipantsResponse.fromJson(NextcloudOcs.decode(raw));
 
   @override
   Future<http.Response> request(

lib/api/marianumcloud/talk/get_poll/get_poll_state.dart

@@ -1,7 +1,6 @@
-import 'dart:convert';
-
 import 'package:http/http.dart' as http;
 
+import '../../nextcloud_ocs.dart';
 import '../talk_api.dart';
 import 'get_poll_state_response.dart';
 
@@ -12,12 +11,8 @@ class GetPollState extends TalkApi<GetPollStateResponse> {
     : super('v1/poll/$token/$pollId', null);
 
   @override
-  GetPollStateResponse assemble(String raw) {
-    final decoded = jsonDecode(raw) as Map<String, dynamic>;
-    return GetPollStateResponse.fromJson(
-      decoded['ocs'] as Map<String, dynamic>,
-    );
-  }
+  GetPollStateResponse assemble(String raw) =>
+      GetPollStateResponse.fromJson(NextcloudOcs.decode(raw));
 
   @override
   Future<http.Response> request(

lib/api/marianumcloud/talk/get_reactions/get_reactions.dart

@@ -1,9 +1,8 @@
-import 'dart:convert';
-
 import 'package:http/http.dart' as http;
 import 'package:http/http.dart';
 
 import '../../../api_params.dart';
+import '../../nextcloud_ocs.dart';
 import '../talk_api.dart';
 import 'get_reactions_response.dart';
 
@@ -14,12 +13,8 @@ class GetReactions extends TalkApi<GetReactionsResponse> {
     : super('v1/reaction/$chatToken/$messageId', null);
 
   @override
-  GetReactionsResponse assemble(String raw) {
-    final decoded = jsonDecode(raw) as Map<String, dynamic>;
-    return GetReactionsResponse.fromJson(
-      decoded['ocs'] as Map<String, dynamic>,
-    );
-  }
+  GetReactionsResponse assemble(String raw) =>
+      GetReactionsResponse.fromJson(NextcloudOcs.decode(raw));
 
   @override
   Future<Response>? request(

lib/api/marianumcloud/talk/get_shared_items/get_shared_items.dart

@@ -0,0 +1,40 @@
+import 'package:http/http.dart' as http;
+
+import '../../nextcloud_ocs.dart';
+import '../talk_api.dart';
+import 'get_shared_items_response.dart';
+
+/// Fetches the messages that shared an item of a given [objectType] in a chat
+/// (Talk's `GET /chat/{token}/share`). Paginated via [lastKnownMessageId] using
+/// the `X-Chat-Last-Given` response header (see
+/// [GetSharedItemsResponse.lastGivenMessageId]).
+///
+/// Known [objectType]s: `media`, `file`, `audio`, `voice`, `location`,
+/// `deckcard`, `recording`, `other`.
+class GetSharedItems extends TalkApi<GetSharedItemsResponse> {
+  GetSharedItems(
+    String token, {
+    required String objectType,
+    int limit = 20,
+    int? lastKnownMessageId,
+  }) : super(
+         'v1/chat/$token/share',
+         null,
+         getParameters: {
+           'objectType': objectType,
+           'limit': limit,
+           'lastKnownMessageId': ?lastKnownMessageId,
+         },
+       );
+
+  @override
+  GetSharedItemsResponse assemble(String raw) =>
+      GetSharedItemsResponse.fromOcs(NextcloudOcs.decode(raw));
+
+  @override
+  Future<http.Response> request(
+    Uri uri,
+    Object? body,
+    Map<String, String>? headers,
+  ) => http.get(uri, headers: headers);
+}

lib/api/marianumcloud/talk/get_shared_items/get_shared_items_overview.dart

@@ -0,0 +1,28 @@
+import 'package:http/http.dart' as http;
+
+import '../../nextcloud_ocs.dart';
+import '../talk_api.dart';
+import 'get_shared_items_overview_response.dart';
+
+/// Fetches the latest shared items of every type at once (Talk's
+/// `GET /chat/{token}/share/overview`). Used to decide which category tabs to
+/// show and to seed their first page. [limit] caps the items returned per type.
+class GetSharedItemsOverview extends TalkApi<GetSharedItemsOverviewResponse> {
+  GetSharedItemsOverview(String token, {int limit = 20})
+    : super(
+        'v1/chat/$token/share/overview',
+        null,
+        getParameters: {'limit': limit},
+      );
+
+  @override
+  GetSharedItemsOverviewResponse assemble(String raw) =>
+      GetSharedItemsOverviewResponse.fromOcs(NextcloudOcs.decode(raw));
+
+  @override
+  Future<http.Response> request(
+    Uri uri,
+    Object? body,
+    Map<String, String>? headers,
+  ) => http.get(uri, headers: headers);
+}

lib/api/marianumcloud/talk/get_shared_items/get_shared_items_overview_response.dart

@@ -0,0 +1,32 @@
+import '../../../api_response.dart';
+import '../chat/get_chat_response.dart';
+
+/// Response of Talk's `GET /chat/{token}/share/overview`: the latest shared
+/// items grouped by object type (`media`, `file`, `voice`, `audio`, `location`,
+/// `recording`, `deckcard`, `other`). Reuses [GetChatResponseObject] for the
+/// message structure.
+class GetSharedItemsOverviewResponse extends ApiResponse {
+  final Map<String, List<GetChatResponseObject>> itemsByType;
+
+  GetSharedItemsOverviewResponse(this.itemsByType);
+
+  factory GetSharedItemsOverviewResponse.fromOcs(Map<String, dynamic> ocs) {
+    final data = ocs['data'];
+    final result = <String, List<GetChatResponseObject>>{};
+    if (data is Map<String, dynamic>) {
+      for (final entry in data.entries) {
+        final value = entry.value;
+        final raw = switch (value) {
+          List<dynamic> list => list,
+          Map<dynamic, dynamic> map => map.values,
+          _ => const <dynamic>[],
+        };
+        result[entry.key] = raw
+            .whereType<Map<String, dynamic>>()
+            .map(GetChatResponseObject.fromJson)
+            .toList();
+      }
+    }
+    return GetSharedItemsOverviewResponse(result);
+  }
+}

lib/api/marianumcloud/talk/get_shared_items/get_shared_items_response.dart

@@ -0,0 +1,35 @@
+import '../../../api_response.dart';
+import '../chat/get_chat_response.dart';
+
+/// Response of Talk's shared-items endpoints. The message objects carry the
+/// same structure as regular chat messages, so we reuse [GetChatResponseObject]
+/// (the shared file lives in `messageParameters['file']`).
+///
+/// The server returns `data` either as a list or as a message-id-keyed map
+/// depending on version; [fromOcs] normalises both to a list.
+class GetSharedItemsResponse extends ApiResponse {
+  final List<GetChatResponseObject> items;
+
+  GetSharedItemsResponse(this.items);
+
+  factory GetSharedItemsResponse.fromOcs(Map<String, dynamic> ocs) {
+    final data = ocs['data'];
+    final raw = switch (data) {
+      List<dynamic> list => list,
+      Map<dynamic, dynamic> map => map.values,
+      _ => const <dynamic>[],
+    };
+    final items = raw
+        .whereType<Map<String, dynamic>>()
+        .map(GetChatResponseObject.fromJson)
+        .toList();
+    return GetSharedItemsResponse(items);
+  }
+
+  /// Offset for the next page, taken from the `X-Chat-Last-Given` header.
+  /// Null when the header is absent (older server) — treat that as "stop".
+  int? get lastGivenMessageId {
+    final value = headers?['x-chat-last-given'];
+    return value == null ? null : int.tryParse(value);
+  }
+}

lib/api/marianumcloud/talk/room/get_room.dart

@@ -1,7 +1,7 @@
-import 'dart:convert';
-
+import 'package:flutter/foundation.dart';
 import 'package:http/http.dart' as http;
 
+import '../../nextcloud_ocs.dart';
 import '../talk_api.dart';
 import 'get_room_params.dart';
 import 'get_room_response.dart';
@@ -11,10 +11,12 @@ class GetRoom extends TalkApi<GetRoomResponse> {
   GetRoom(this.params) : super('v4/room', null, getParameters: params.toJson());
 
   @override
-  GetRoomResponse assemble(String raw) {
-    final decoded = jsonDecode(raw) as Map<String, dynamic>;
-    return GetRoomResponse.fromJson(decoded['ocs'] as Map<String, dynamic>);
-  }
+  GetRoomResponse assemble(String raw) => _parseRooms(raw);
+
+  // The room list with status is 100–250 KB and polled every 15–60 s.
+  @override
+  Future<GetRoomResponse> assembleAsync(String raw) =>
+      compute(_parseRooms, raw);
 
   @override
   Future<http.Response> request(
@@ -23,3 +25,6 @@ class GetRoom extends TalkApi<GetRoomResponse> {
     Map<String, String>? headers,
   ) => http.get(uri, headers: headers);
 }
+
+GetRoomResponse _parseRooms(String raw) =>
+    GetRoomResponse.fromJson(NextcloudOcs.decode(raw));

lib/api/marianumcloud/talk/room/get_room_response.dart

@@ -130,6 +130,12 @@ enum GetRoomResponseObjectParticipantNotificationLevel {
   neverNotify,
 }
 
+extension NotificationLevelApiValue
+    on GetRoomResponseObjectParticipantNotificationLevel {
+  int get apiValue =>
+      _$GetRoomResponseObjectParticipantNotificationLevelEnumMap[this]!;
+}
+
 enum GetRoomResponseObjectMessageActorType {
   @JsonValue('deleted_users')
   deletedUsers,

lib/api/marianumcloud/talk/room/notification_level.dart

@@ -0,0 +1,27 @@
+import 'get_room_response.dart';
+
+typedef NotificationLevel = GetRoomResponseObjectParticipantNotificationLevel;
+
+/// The levels a user can pick in the UI; [NotificationLevel.defaultLevel]
+/// is only ever reported by the server, never chosen.
+const selectableNotificationLevels = [
+  NotificationLevel.alwaysNotify,
+  NotificationLevel.notifyOnMention,
+  NotificationLevel.neverNotify,
+];
+
+extension RoomNotificationLevel on GetRoomResponseObject {
+  /// Resolves "default" the way Spreed does: 1:1 chats notify on every
+  /// message, group chats only on mentions (`default_group_notification`).
+  NotificationLevel get effectiveNotificationLevel {
+    if (notificationLevel != NotificationLevel.defaultLevel) {
+      return notificationLevel;
+    }
+    return type == GetRoomResponseObjectConversationType.oneToOne
+        ? NotificationLevel.alwaysNotify
+        : NotificationLevel.notifyOnMention;
+  }
+
+  bool get isMuted =>
+      effectiveNotificationLevel == NotificationLevel.neverNotify;
+}

lib/api/marianumcloud/talk/share_files_to_chat.dart

@@ -1,10 +1,39 @@
+import 'package:nextcloud/nextcloud.dart';
+
 import '../files_sharing/file_sharing_api.dart';
 import '../files_sharing/file_sharing_api_params.dart';
+import '../webdav/webdav_api.dart';
 
 /// WebDAV folder under which Talk-shared files are uploaded before being
 /// linked into a chat.
 const String talkShareFolder = 'MarianumMobile';
 
+Future<void>? _shareFolderReady;
+
+/// Creates [talkShareFolder] if it is missing, at most once per session — the
+/// folder is permanent, so every later upload would just pay a round trip to
+/// be told it already exists (WebDAV answers MKCOL on an existing collection
+/// with 405, which is the normal case here and must not surface as an error).
+Future<void> ensureTalkShareFolder() =>
+    _shareFolderReady ??= _createTalkShareFolder();
+
+/// The folder is per user; after a sign-out the next account has to check
+/// again.
+void resetTalkShareFolderCache() => _shareFolderReady = null;
+
+Future<void> _createTalkShareFolder() async {
+  try {
+    final webdav = await WebdavApi.webdav;
+    await webdav.mkcol(PathUri.parse('/$talkShareFolder'));
+  } on DynamiteApiException catch (e) {
+    // Anything but "already exists" leaves the folder unconfirmed, so the next
+    // upload has to try again.
+    if (e.statusCode != 405) _shareFolderReady = null;
+  } catch (_) {
+    _shareFolderReady = null;
+  }
+}
+
 /// Posts each already-uploaded WebDAV path as a Talk share (ShareType 10) to
 /// the given conversation token. Calls run concurrently — the server accepts
 /// parallel posts and the picker UI is blocked anyway, so we shouldn't pay

lib/api/marianumcloud/talk/talk_api.dart

@@ -1,29 +1,26 @@
-import 'dart:async';
 import 'dart:developer';
-import 'dart:io';
 
 import 'package:http/http.dart' as http;
 
 import '../../api_params.dart';
-import '../../api_request.dart';
 import '../../api_response.dart';
-import '../../errors/auth_exception.dart';
 import '../../errors/network_exception.dart';
-import '../../errors/not_found_exception.dart';
 import '../../errors/parse_exception.dart';
-import '../../errors/server_exception.dart';
+import '../../errors/talk_exception.dart';
+import '../../http_errors.dart';
 import '../nextcloud_ocs.dart';
+import 'talk_error.dart';
 
-enum TalkApiMethod { get, post, put, delete }
+abstract class TalkApi<T extends ApiResponse?> {
+  // package:http has no timeout of its own; a request stuck on a dead
+  // connection (e.g. one started right before a suspend) would spin forever.
+  static const Duration _timeout = Duration(seconds: 30);
 
-abstract class TalkApi<T extends ApiResponse?> extends ApiRequest {
   String path;
   ApiParams? body;
   Map<String, String>? headers;
   Map<String, dynamic>? getParameters;
 
-  http.Response? response;
-
   TalkApi(this.path, this.body, {this.headers, this.getParameters});
 
   Future<http.Response>? request(
@@ -33,6 +30,10 @@ abstract class TalkApi<T extends ApiResponse?> extends ApiRequest {
   );
   T assemble(String raw);
 
+  /// Override to parse large payloads off the UI isolate (e.g. via `compute`
+  /// with a top-level parser); defaults to the synchronous [assemble].
+  Future<T> assembleAsync(String raw) async => assemble(raw);
+
   Future<T> run() async {
     final endpoint = NextcloudOcs.uri(
       'apps/spreed/api/$path',
@@ -40,22 +41,15 @@ abstract class TalkApi<T extends ApiResponse?> extends ApiRequest {
     );
     final mergedHeaders = {...NextcloudOcs.headers(), ...?headers};
 
-    final http.Response data;
-    try {
-      final raw = await request(endpoint, body, mergedHeaders);
-      if (raw == null) {
-        throw const NetworkException(
-          userMessage: 'Keine Antwort vom Talk-Server erhalten.',
-          technicalDetails: 'Talk request returned null',
-        );
-      }
-      data = raw;
-    } on SocketException catch (e) {
-      throw NetworkException(technicalDetails: 'Talk $endpoint: ${e.message}');
-    } on TimeoutException catch (e) {
-      throw NetworkException.timeout(technicalDetails: 'Talk $endpoint: $e');
-    } on http.ClientException catch (e) {
-      throw NetworkException(technicalDetails: 'Talk $endpoint: ${e.message}');
+    final data = await sendGuarded(
+      'Talk $endpoint',
+      () => request(endpoint, body, mergedHeaders)?.timeout(_timeout),
+    );
+    if (data == null) {
+      throw const NetworkException(
+        userMessage: 'Keine Antwort vom Talk-Server erhalten.',
+        technicalDetails: 'Talk request returned null',
+      );
     }
 
     final status = data.statusCode;
@@ -63,24 +57,23 @@ abstract class TalkApi<T extends ApiResponse?> extends ApiRequest {
       // Talk's OCS errors carry the real reason in the body (expired session,
       // removed participant, ...); include a trimmed preview so the dialog and
       // logs surface the cause instead of just the bare status code.
-      final body = data.body.replaceAll(RegExp(r'\s+'), ' ').trim();
-      final preview = body.length > 500 ? '${body.substring(0, 500)}…' : body;
-      final detail = body.isEmpty
-          ? 'Talk $endpoint -> HTTP $status'
-          : 'Talk $endpoint -> HTTP $status body=$preview';
+      final detail = httpErrorDetail('Talk $endpoint', data.body, status);
       log(detail);
-      if (status == 401) {
-        throw AuthException.unauthorized(technicalDetails: detail);
+      // Talk's own codes need their own wording: a 400/412/413 here is a
+      // rejected request, not a struggling server, and "try again later"
+      // would send the user in circles. 401/403/404 keep the shared mapping
+      // so the auth handling stays in one place.
+      if (status == 400 || status == 412 || status == 413 || status == 429) {
+        throw TalkException(
+          TalkError('failure', status, ''),
+          technicalDetails: detail,
+        );
       }
-      if (status == 403) {
-        throw AuthException.forbidden(technicalDetails: detail);
-      }
-      if (status == 404) throw NotFoundException(technicalDetails: detail);
-      throw ServerException(statusCode: status, technicalDetails: detail);
+      throwForStatus(status, detail);
     }
 
     try {
-      final assembled = assemble(data.body);
+      final assembled = await assembleAsync(data.body);
       assembled?.headers = data.headers;
       return assembled;
     } catch (e) {

lib/api/marianumcloud/talk/vote_poll/vote_poll.dart

@@ -3,6 +3,7 @@ import 'dart:convert';
 import 'package:http/http.dart' as http;
 
 import '../../../api_params.dart';
+import '../../nextcloud_ocs.dart';
 import '../get_poll/get_poll_state_response.dart';
 import '../talk_api.dart';
 import 'vote_poll_params.dart';
@@ -22,12 +23,8 @@ class VotePoll extends TalkApi<GetPollStateResponse> {
        );
 
   @override
-  GetPollStateResponse assemble(String raw) {
-    final decoded = jsonDecode(raw) as Map<String, dynamic>;
-    return GetPollStateResponse.fromJson(
-      decoded['ocs'] as Map<String, dynamic>,
-    );
-  }
+  GetPollStateResponse assemble(String raw) =>
+      GetPollStateResponse.fromJson(NextcloudOcs.decode(raw));
 
   @override
   Future<http.Response>? request(

lib/api/marianumcloud/webdav/queries/list_files/cacheable_file.dart

@@ -29,6 +29,19 @@ class CacheableFile {
   /// file/folder in the list. Nullable so older cached entries decode fine.
   bool? isSharedWithMe;
 
+  /// Lower-cased [name] for sorting/filtering, cached because comparators
+  /// call it for every comparison (name is mutable, hence the identity check).
+  String get lowerName {
+    if (!identical(_lowerNameFor, name)) {
+      _lowerNameFor = name;
+      _lowerName = name.toLowerCase();
+    }
+    return _lowerName;
+  }
+
+  String? _lowerNameFor;
+  String _lowerName = '';
+
   CacheableFile({
     required this.path,
     required this.isDirectory,

lib/api/marianumcloud/webdav/queries/list_files/list_files_cache.dart

@@ -1,9 +1,9 @@
 import 'dart:convert';
 
 import 'package:crypto/crypto.dart';
-import 'package:localstore/localstore.dart';
 
 import '../../../../../utils/cache_invalidation_bus.dart';
+import '../../../../cache_store.dart';
 import '../../../../request_cache.dart';
 import 'list_files.dart';
 import 'list_files_params.dart';
@@ -43,14 +43,11 @@ class ListFilesCache extends SimpleCache<ListFilesResponse> {
   /// (slow) root listing is already populated by the time the user
   /// navigates to the Files module.
   ///
-  /// No-ops when a cached root payload is already present in localstore —
+  /// No-ops when a cached root payload is already present in the cache —
   /// the regular TTL handling in [RequestCache] takes over from there.
   static Future<void> prefetchRootListing() async {
     const rootPath = '';
-    final cached = await Localstore.instance
-        .collection(RequestCache.collection)
-        .doc(_documentId(rootPath))
-        .get();
+    final cached = await CacheStore.instance.read(_documentId(rootPath));
     if (cached != null) return;
     // Drive the same code path as a regular fetch so the result lands in
     // the cache; we don't care about the in-memory callback here.
@@ -69,10 +66,7 @@ class ListFilesCache extends SimpleCache<ListFilesResponse> {
   /// `_FilesView` for that path via [CacheInvalidationBus] so it refetches
   /// even while it is sitting in the background of the navigation stack.
   static Future<void> invalidate(String path) async {
-    await Localstore.instance
-        .collection(RequestCache.collection)
-        .doc(_documentId(path))
-        .delete();
+    await CacheStore.instance.delete(_documentId(path));
     CacheInvalidationBus.notifyListFiles(path);
   }
 }

lib/api/marianumcloud/webdav/webdav_api.dart

@@ -2,24 +2,39 @@ import 'package:nextcloud/nextcloud.dart';
 
 import '../../../model/account_data.dart';
 import '../../../model/endpoint_data.dart';
-import '../../api_request.dart';
 import '../../api_response.dart';
 
-abstract class WebdavApi<T> extends ApiRequest {
+abstract class WebdavApi<T> {
   T genericParams;
 
-  WebdavApi(this.genericParams) {
-    establishWebdavConnection();
-  }
+  WebdavApi(this.genericParams);
 
   Future<ApiResponse> run();
 
-  static Future<WebDavClient> webdav = establishWebdavConnection();
+  static Future<WebDavClient>? _webdav;
+  static String? _webdavSecret;
+
+  /// Shared WebDAV client. Rebuilt whenever the effective Nextcloud secret
+  /// changes (app password minted/renewed, account switch) so it never keeps
+  /// authenticating with stale credentials.
+  static Future<WebDavClient> get webdav {
+    // Keyed by user too: two accounts may share a password (no app password
+    // minted), and the client would keep the previous login name.
+    final secret =
+        '${AccountData().getUsername()}:${AccountData().getNextcloudSecret()}';
+    if (_webdav == null || _webdavSecret != secret) {
+      _webdavSecret = secret;
+      _webdav = establishWebdavConnection();
+    }
+    return _webdav!;
+  }
 
   static Future<WebDavClient> establishWebdavConnection() async =>
       NextcloudClient(
         Uri.parse('https://${EndpointData().nextcloud().full()}'),
-        password: AccountData().getPassword(),
+        // App password preferred — with 2FA the real password is not accepted
+        // by Nextcloud at all (see AccountData.usesLoginFlow).
+        password: AccountData().getNextcloudSecret(),
         loginName: AccountData().getUsername(),
       ).webdav;
 

lib/api/marianumconnect/auth/auth_interceptor.dart

@@ -88,17 +88,29 @@ class MarianumConnectAuthInterceptor extends Interceptor {
 
   Future<bool> _performReLogin() async {
     if (!AccountData().isPopulated()) return false;
+    final username = AccountData().getUsername();
+    // A background engine (widget task) keeps the account it loaded. When
+    // the app signed that account out, its revoked token answers 401 — a
+    // re-login would mint a fresh token for it into the shared keystore.
+    if (await AccountData().readStoredUsername() != username) return false;
     try {
       await _loginClient.run(
-        username: AccountData().getUsername(),
+        username: username,
         password: AccountData().getPassword(),
         tokenName: await DeviceTokenName.resolve(),
       );
-      return true;
     } catch (_) {
-      await _tokenStorage.clear();
+      if (await AccountData().readStoredUsername() == username) {
+        await _tokenStorage.clear();
+      }
       return false;
     }
+    final stored = await AccountData().readStoredUsername();
+    if (stored == username) return true;
+    // Signed out during the login: drop the orphaned token, unless another
+    // account already stored its own.
+    if (stored == null) await _tokenStorage.clear();
+    return false;
   }
 
   Future<Response<dynamic>> _retryWithFreshToken(

lib/api/marianumconnect/auth/session_validator.dart

@@ -19,10 +19,14 @@ class SessionValidator {
     if (AccountData().isDemo) return;
     final username = AccountData().getUsername();
     final password = AccountData().getPassword();
+    final epoch = AccountData().sessionEpoch;
     try {
       await AuthVerify().run(username: username, password: password);
     } on AuthException catch (e) {
       if (e.statusCode != 401) return;
+      // The probed account already signed out; the 401 must not sign out
+      // whoever logged in meanwhile.
+      if (!AccountData().isCurrentSession(epoch)) return;
       log('MC: stored credentials rejected — forcing re-login');
       await AuthLogout().run();
       await const MarianumConnectTokenStorage().clear();

lib/api/marianumconnect/marianumconnect_api.dart

@@ -10,11 +10,35 @@ import 'auth/auth_interceptor.dart';
 class MarianumConnectApi {
   static const Duration _connectTimeout = Duration(seconds: 10);
   static const Duration _receiveTimeout = Duration(seconds: 20);
+  static const Duration _plainReceiveTimeout = Duration(seconds: 15);
 
   static final Dio _instance = _build();
 
   static Dio dio() => _instance;
 
+  /// Drops the pooled keep-alive sockets. After a suspend the OS or a NAT
+  /// has usually killed them already, but dart:io only notices once a request
+  /// is written into one — which then hangs until [_receiveTimeout].
+  /// In-flight requests finish on the old adapter.
+  static void resetConnections() {
+    final stale = _instance.httpClientAdapter;
+    _instance.httpClientAdapter = HttpClientAdapter();
+    stale.close();
+  }
+
+  /// A fresh dio with the standard JSON options but no interceptors — used by
+  /// the auth queries (login/verify) that must bypass the bearer/demo
+  /// interceptors to avoid a re-auth loop.
+  static Dio plainDio() => Dio(
+    BaseOptions(
+      connectTimeout: _connectTimeout,
+      sendTimeout: _connectTimeout,
+      receiveTimeout: _plainReceiveTimeout,
+      responseType: ResponseType.json,
+      contentType: 'application/json',
+    ),
+  );
+
   static Dio _build() {
     final dio = Dio(
       BaseOptions(

lib/api/marianumconnect/marianumconnect_query.dart

@@ -26,4 +26,36 @@ abstract class MarianumConnectQuery {
       throw mapMarianumConnectError(e);
     }
   }
+
+  /// GETs [path] and parses the JSON object body with [fromJson].
+  Future<T> getObject<T>(
+    String path,
+    T Function(Map<String, dynamic> json) fromJson, {
+    Map<String, dynamic>? queryParameters,
+  }) => guard(() async {
+    final response = await dio.get<Map<String, dynamic>>(
+      endpoint(path),
+      queryParameters: queryParameters,
+    );
+    return fromJson(response.data!);
+  });
+
+  /// GETs [path] and maps each element of the JSON array body with [fromJson].
+  Future<List<T>> getList<T>(
+    String path,
+    T Function(Map<String, dynamic> json) fromJson, {
+    Map<String, dynamic>? queryParameters,
+  }) => guard(() async {
+    final response = await dio.get<List<dynamic>>(
+      endpoint(path),
+      queryParameters: queryParameters,
+    );
+    return response.data!
+        .map((e) => fromJson(e as Map<String, dynamic>))
+        .toList();
+  });
+
+  /// Formats [d] as an ISO `yyyy-MM-dd` day for MarianumConnect query params.
+  String isoDate(DateTime d) =>
+      '${d.year.toString().padLeft(4, '0')}-${d.month.toString().padLeft(2, '0')}-${d.day.toString().padLeft(2, '0')}';
 }

lib/api/marianumconnect/queries/absence/absence_classes.dart

@@ -0,0 +1,13 @@
+import '../../marianumconnect_query.dart';
+
+/// GETs the selectable classes for the absence form (`absence/classes`). The
+/// body is a bare JSON string array, so [getList] (which maps objects) does not
+/// fit — read the raw list and cast.
+class AbsenceClasses extends MarianumConnectQuery {
+  AbsenceClasses({super.dio});
+
+  Future<List<String>> run() => guard(() async {
+    final response = await dio.get<List<dynamic>>(endpoint('absence/classes'));
+    return response.data!.cast<String>();
+  });
+}

lib/api/marianumconnect/queries/absence/absence_prefill.dart

@@ -0,0 +1,10 @@
+import '../../marianumconnect_query.dart';
+import 'absence_prefill_response.dart';
+
+/// GETs the absence-report form prefill (`absence/prefill`, bearer-auth).
+class AbsencePrefill extends MarianumConnectQuery {
+  AbsencePrefill({super.dio});
+
+  Future<AbsencePrefillResponse> run() =>
+      getObject('absence/prefill', AbsencePrefillResponse.fromJson);
+}

lib/api/marianumconnect/queries/absence/absence_prefill_response.dart

@@ -0,0 +1,28 @@
+import 'package:json_annotation/json_annotation.dart';
+
+part 'absence_prefill_response.g.dart';
+
+/// Prefill for the absence-report form: identity from LDAP plus the phone
+/// number from the user's last report (empty strings when unknown).
+@JsonSerializable()
+class AbsencePrefillResponse {
+  @JsonKey(defaultValue: '')
+  final String firstName;
+  @JsonKey(defaultValue: '')
+  final String lastName;
+  @JsonKey(defaultValue: '')
+  final String className;
+  @JsonKey(defaultValue: '')
+  final String phone;
+
+  AbsencePrefillResponse({
+    required this.firstName,
+    required this.lastName,
+    required this.className,
+    required this.phone,
+  });
+
+  factory AbsencePrefillResponse.fromJson(Map<String, dynamic> json) =>
+      _$AbsencePrefillResponseFromJson(json);
+  Map<String, dynamic> toJson() => _$AbsencePrefillResponseToJson(this);
+}

lib/api/marianumconnect/queries/absence/absence_prefill_response.g.dart

@@ -0,0 +1,25 @@
+// GENERATED CODE - DO NOT MODIFY BY HAND
+
+part of 'absence_prefill_response.dart';
+
+// **************************************************************************
+// JsonSerializableGenerator
+// **************************************************************************
+
+AbsencePrefillResponse _$AbsencePrefillResponseFromJson(
+  Map<String, dynamic> json,
+) => AbsencePrefillResponse(
+  firstName: json['firstName'] as String? ?? '',
+  lastName: json['lastName'] as String? ?? '',
+  className: json['className'] as String? ?? '',
+  phone: json['phone'] as String? ?? '',
+);
+
+Map<String, dynamic> _$AbsencePrefillResponseToJson(
+  AbsencePrefillResponse instance,
+) => <String, dynamic>{
+  'firstName': instance.firstName,
+  'lastName': instance.lastName,
+  'className': instance.className,
+  'phone': instance.phone,
+};

lib/api/marianumconnect/queries/absence/absence_submit.dart

@@ -0,0 +1,32 @@
+import '../../marianumconnect_query.dart';
+
+/// Submits an absence report (`POST absence`, bearer-auth, `source=mobile`).
+/// Empty identity fields are backfilled from LDAP server-side; validation
+/// (all fields required, class must exist, no past start date, end >= start)
+/// also runs server-side and mirrors the client checks.
+class AbsenceSubmit extends MarianumConnectQuery {
+  AbsenceSubmit({super.dio});
+
+  Future<void> run({
+    required String firstName,
+    required String lastName,
+    required String className,
+    required DateTime absentFrom,
+    required DateTime absentUntil,
+    required String phone,
+    required String note,
+  }) => guard(() async {
+    await dio.post<void>(
+      endpoint('absence'),
+      data: {
+        'firstName': firstName,
+        'lastName': lastName,
+        'className': className,
+        'absentFrom': isoDate(absentFrom),
+        'absentUntil': isoDate(absentUntil),
+        'phone': phone,
+        'note': note,
+      },
+    );
+  });
+}

lib/api/marianumconnect/queries/auth_login/auth_login.dart

@@ -1,6 +1,7 @@
 import 'package:dio/dio.dart';
 
 import '../../auth/token_storage.dart';
+import '../../marianumconnect_api.dart';
 import '../../marianumconnect_query.dart';
 import 'auth_login_response.dart';
 
@@ -9,9 +10,6 @@ import 'auth_login_response.dart';
 /// run through the shared dio instance — that one has the interceptor, which
 /// would attempt to re-auth us into a loop if our credentials are wrong.
 class AuthLogin extends MarianumConnectQuery {
-  static const Duration _connectTimeout = Duration(seconds: 10);
-  static const Duration _receiveTimeout = Duration(seconds: 15);
-
   final MarianumConnectTokenStorage _tokenStorage;
 
   AuthLogin({
@@ -19,17 +17,7 @@ class AuthLogin extends MarianumConnectQuery {
         const MarianumConnectTokenStorage(),
     Dio? dio,
   }) : _tokenStorage = tokenStorage,
-       super(dio: dio ?? _buildDio());
-
-  static Dio _buildDio() => Dio(
-    BaseOptions(
-      connectTimeout: _connectTimeout,
-      receiveTimeout: _receiveTimeout,
-      sendTimeout: _connectTimeout,
-      responseType: ResponseType.json,
-      contentType: 'application/json',
-    ),
-  );
+       super(dio: dio ?? MarianumConnectApi.plainDio());
 
   Future<AuthLoginResponse> run({
     required String username,

lib/api/marianumconnect/queries/auth_verify/auth_verify.dart

@@ -2,6 +2,7 @@ import 'package:dio/dio.dart';
 
 import '../../../errors/auth_exception.dart';
 import '../../auth/token_storage.dart';
+import '../../marianumconnect_api.dart';
 import '../../marianumconnect_query.dart';
 
 /// Probes that the stored bearer token still maps to the given credentials.
@@ -12,9 +13,6 @@ import '../../marianumconnect_query.dart';
 /// Bypasses the shared dio singleton so the auth interceptor doesn't kick in
 /// and obscure a real 401 with a silent re-login.
 class AuthVerify extends MarianumConnectQuery {
-  static const Duration _connectTimeout = Duration(seconds: 10);
-  static const Duration _receiveTimeout = Duration(seconds: 15);
-
   final MarianumConnectTokenStorage _tokenStorage;
 
   AuthVerify({
@@ -22,17 +20,7 @@ class AuthVerify extends MarianumConnectQuery {
         const MarianumConnectTokenStorage(),
     Dio? dio,
   }) : _tokenStorage = tokenStorage,
-       super(dio: dio ?? _buildDio());
-
-  static Dio _buildDio() => Dio(
-    BaseOptions(
-      connectTimeout: _connectTimeout,
-      sendTimeout: _connectTimeout,
-      receiveTimeout: _receiveTimeout,
-      responseType: ResponseType.json,
-      contentType: 'application/json',
-    ),
-  );
+       super(dio: dio ?? MarianumConnectApi.plainDio());
 
   /// Throws [AuthException] on 401 (credentials no longer match the token's
   /// user, token missing, or token rejected), other [AppException]s on

lib/api/marianumconnect/queries/get_breakers/get_breakers.dart

@@ -7,8 +7,6 @@ import 'get_breakers_response.dart';
 class GetBreakers extends MarianumConnectQuery {
   GetBreakers({super.dio});
 
-  Future<GetBreakersResponse> run() => guard(() async {
-    final response = await dio.get<Map<String, dynamic>>(endpoint('breaker'));
-    return GetBreakersResponse.fromJson(response.data!);
-  });
+  Future<GetBreakersResponse> run() =>
+      getObject('breaker', GetBreakersResponse.fromJson);
 }

lib/api/marianumconnect/queries/get_capabilities/get_capabilities.dart

@@ -7,10 +7,6 @@ import 'get_capabilities_response.dart';
 class GetCapabilities extends MarianumConnectQuery {
   GetCapabilities({super.dio});
 
-  Future<CapabilitiesResponse> run() => guard(() async {
-    final response = await dio.get<Map<String, dynamic>>(
-      endpoint('me/capabilities'),
-    );
-    return CapabilitiesResponse.fromJson(response.data!);
-  });
+  Future<CapabilitiesResponse> run() =>
+      getObject('me/capabilities', CapabilitiesResponse.fromJson);
 }

lib/api/marianumconnect/queries/get_capabilities/get_capabilities_response.dart

@@ -16,9 +16,23 @@ class CapabilitiesResponse {
   @JsonKey(defaultValue: false)
   final bool pushNotifications;
 
+  /// How many days into the past/future the user may view the timetable.
+  /// `null` (absent) means unlimited — the school year alone governs. The
+  /// backend widens both to at least cover the current Mon–Sun week.
+  final int? timetablePastDays;
+
+  final int? timetableFutureDays;
+
+  /// LDAP user type ('TEACHER' | 'STUDENT' | 'STAFF'). Null when the backend
+  /// predates the field or has no LDAP record for the user.
+  final String? userType;
+
   CapabilitiesResponse({
     required this.viewForeignTimetables,
     required this.pushNotifications,
+    this.timetablePastDays,
+    this.timetableFutureDays,
+    this.userType,
   });
 
   factory CapabilitiesResponse.fromJson(Map<String, dynamic> json) =>

lib/api/marianumconnect/queries/get_capabilities/get_capabilities_response.g.dart

@@ -11,6 +11,9 @@ CapabilitiesResponse _$CapabilitiesResponseFromJson(
 ) => CapabilitiesResponse(
   viewForeignTimetables: json['viewForeignTimetables'] as bool? ?? false,
   pushNotifications: json['pushNotifications'] as bool? ?? false,
+  timetablePastDays: (json['timetablePastDays'] as num?)?.toInt(),
+  timetableFutureDays: (json['timetableFutureDays'] as num?)?.toInt(),
+  userType: json['userType'] as String?,
 );
 
 Map<String, dynamic> _$CapabilitiesResponseToJson(
@@ -18,4 +21,7 @@ Map<String, dynamic> _$CapabilitiesResponseToJson(
 ) => <String, dynamic>{
   'viewForeignTimetables': instance.viewForeignTimetables,
   'pushNotifications': instance.pushNotifications,
+  'timetablePastDays': instance.timetablePastDays,
+  'timetableFutureDays': instance.timetableFutureDays,
+  'userType': instance.userType,
 };

lib/api/marianumconnect/queries/get_holidays/get_holidays.dart

@@ -4,10 +4,5 @@ import '../../models/mc_holiday.dart';
 class GetHolidays extends MarianumConnectQuery {
   GetHolidays({super.dio});
 
-  Future<List<McHoliday>> run() => guard(() async {
-    final response = await dio.get<List<dynamic>>(endpoint('holidays'));
-    return response.data!
-        .map((e) => McHoliday.fromJson(e as Map<String, dynamic>))
-        .toList();
-  });
+  Future<List<McHoliday>> run() => getList('holidays', McHoliday.fromJson);
 }

lib/api/marianumconnect/queries/get_ticker/get_ticker.dart

@@ -6,8 +6,6 @@ import 'get_ticker_response.dart';
 class GetTicker extends MarianumConnectQuery {
   GetTicker({super.dio});
 
-  Future<TickerResponse> run() => guard(() async {
-    final response = await dio.get<Map<String, dynamic>>(endpoint('ticker'));
-    return TickerResponse.fromJson(response.data!);
-  });
+  Future<TickerResponse> run() =>
+      getObject('ticker', TickerResponse.fromJson);
 }

lib/api/marianumconnect/queries/get_ticker_nav/get_ticker_nav.dart

@@ -6,10 +6,6 @@ import 'get_ticker_nav_response.dart';
 class GetTickerNav extends MarianumConnectQuery {
   GetTickerNav({super.dio});
 
-  Future<TickerNavResponse> run() => guard(() async {
-    final response = await dio.get<Map<String, dynamic>>(
-      endpoint('ticker/pages'),
-    );
-    return TickerNavResponse.fromJson(response.data!);
-  });
+  Future<TickerNavResponse> run() =>
+      getObject('ticker/pages', TickerNavResponse.fromJson);
 }

lib/api/marianumconnect/queries/telemetry_heartbeat/telemetry_heartbeat.dart

@@ -3,39 +3,71 @@ import 'dart:convert';
 import 'dart:io';
 
 import 'package:device_info_plus/device_info_plus.dart';
+import 'package:firebase_messaging/firebase_messaging.dart';
 import 'package:package_info_plus/package_info_plus.dart';
 
+import '../../../../push/push_registration.dart';
 import '../../../../push/push_registration_store.dart';
 import '../../../../push/push_registration_type.dart';
 import '../../marianumconnect_query.dart';
 import 'telemetry_device_id.dart';
 
+typedef _PushState = ({
+  bool enabled,
+  AuthorizationStatus? permission,
+  String? pushDeviceIdentifier,
+});
+
 /// Sends a telemetry heartbeat to MarianumConnect (`POST me/telemetry`) —
 /// upserts the stable install id, platform, app version and device info. Sent
-/// once on app start and again once push registration completes that session
-/// (so a fresh registration isn't under-reported until the next launch).
+/// on app start, on resume and once push registration completes, throttled to
+/// one per 15 minutes unless the push state changed in between.
 /// Bearer-authenticated via the shared dio interceptor. Replaces the legacy
 /// mhsl.eu `server/userIndex/update` call.
 class TelemetryHeartbeat extends MarianumConnectQuery {
   TelemetryHeartbeat({super.dio});
 
+  static const Duration _interval = Duration(minutes: 15);
+
+  // Wall-clock throttle rather than Debouncer.throttle: a Timer does not tick
+  // reliably while the app is suspended, so the window would still be open on
+  // the resume it is supposed to let through.
+  static DateTime? _lastSentAt;
+  static _PushState? _lastPushState;
+
   /// Fire-and-forget: schedules a heartbeat and swallows any error, so a failed
-  /// send never disrupts app start. Used from the app shell's initState and
-  /// re-emitted once push registration completes (see `_MainState._syncPush`).
+  /// send never disrupts app start. A changed push state (toggle, OS
+  /// permission — e.g. back from the system settings — or a fresh
+  /// registration) bypasses the throttle: the server picks visible vs. silent
+  /// delivery from it, so it must not wait for the next window.
   static void report({required bool notificationsEnabled}) {
-    unawaited(
-      TelemetryHeartbeat()
-          .send(notificationsEnabled: notificationsEnabled)
-          .catchError((Object _) {}),
-    );
+    unawaited(_report(notificationsEnabled).catchError((Object _) {}));
   }
 
-  Future<void> send({required bool notificationsEnabled}) => guard(() async {
+  static Future<void> _report(bool enabled) async {
+    final pushState = (
+      enabled: enabled,
+      permission: await PushRegistration.osPermissionStatus(),
+      pushDeviceIdentifier: await const PushRegistrationStore()
+          .deviceIdentifier(PushRegistrationType.general),
+    );
+    final now = DateTime.now();
+    final last = _lastSentAt;
+    if (last != null &&
+        now.difference(last) < _interval &&
+        pushState == _lastPushState) {
+      return;
+    }
+    // Claimed before sending so overlapping triggers don't both go out.
+    _lastSentAt = now;
+    _lastPushState = pushState;
+    await TelemetryHeartbeat()._send(pushState);
+  }
+
+  Future<void> _send(_PushState push) => guard(() async {
     final info = DeviceInfoPlugin();
     final package = await PackageInfo.fromPlatform();
     final deviceIdentifier = await TelemetryDeviceId.resolve();
-    final pushDeviceIdentifier = await const PushRegistrationStore()
-        .deviceIdentifier(PushRegistrationType.general);
 
     var platform = 'unknown';
     String? deviceModel;
@@ -60,11 +92,12 @@ class TelemetryHeartbeat extends MarianumConnectQuery {
       data: {
         'deviceIdentifier': deviceIdentifier,
         // `pushDeviceIdentifier` reflects a *completed* registration and is
-        // absent until it lands; `pushEnabled` carries the user's intent
-        // (the notification toggle) so the backend can tell "user wants push"
-        // apart from "registration not finished yet".
-        'pushDeviceIdentifier': ?pushDeviceIdentifier,
-        'pushEnabled': notificationsEnabled,
+        // absent until it lands; `pushEnabled` carries the user's intent (the
+        // toggle). The server combines it with `osPermission` into the
+        // visible-vs-silent delivery decision.
+        'pushDeviceIdentifier': ?push.pushDeviceIdentifier,
+        'pushEnabled': push.enabled,
+        'osPermission': ?osPermissionWireValue(push.permission),
         'platform': platform,
         'appVersion': package.version,
         'appBuild': int.tryParse(package.buildNumber),
@@ -75,3 +108,13 @@ class TelemetryHeartbeat extends MarianumConnectQuery {
     );
   });
 }
+
+/// Wire value of the OS notification permission for the heartbeat.
+String? osPermissionWireValue(AuthorizationStatus? status) => switch (status) {
+  AuthorizationStatus.authorized => 'granted',
+  AuthorizationStatus.provisional => 'provisional',
+  AuthorizationStatus.denied ||
+  AuthorizationStatus.deniedPermanently => 'denied',
+  AuthorizationStatus.notDetermined => 'notDetermined',
+  null => null,
+};

lib/api/marianumconnect/queries/timetable_custom_events/custom_events_migration.dart

@@ -1,6 +1,6 @@
 import 'dart:developer';
 
-import 'package:localstore/localstore.dart';
+import 'package:shared_preferences/shared_preferences.dart';
 
 import '../../../../model/account_data.dart';
 import '../../../demo/demo_mode.dart';
@@ -21,9 +21,7 @@ import 'timetable_custom_events_add.dart';
 /// failure only sees the events that were not yet moved, so nothing is
 /// duplicated. The flag is set only once MHSL reports no remaining events.
 class CustomEventsMigration {
-  static const String _collection = 'MarianumMobile';
-  static const String _document = 'customEventsMigration';
-  static const String _doneKey = 'migratedToMc';
+  static const String _doneKey = 'customEventsMigratedToMc';
 
   const CustomEventsMigration._();
 
@@ -31,18 +29,23 @@ class CustomEventsMigration {
     if (DemoMode.active) return;
     if (await _isDone()) return;
 
+    final epoch = AccountData().sessionEpoch;
     try {
       final response = await GetCustomTimetableEvent(
         GetCustomTimetableEventParams(AccountData().getUserSecret()),
       ).run();
 
       for (final event in response.events) {
+        // The POST authenticates with whoever is signed in now; after a
+        // sign-out the previous account's events would land in the next one.
+        if (!AccountData().isCurrentSession(epoch)) return;
         await TimetableCustomEventsAdd().run(event);
         await RemoveCustomTimetableEvent(
           RemoveCustomTimetableEventParams(event.id),
         ).run();
       }
 
+      if (!AccountData().isCurrentSession(epoch)) return;
       await _markDone();
       log('Custom events migration: moved ${response.events.length} event(s) to Marianum-Connect.');
     } catch (e) {
@@ -52,17 +55,11 @@ class CustomEventsMigration {
     }
   }
 
-  static Future<bool> _isDone() async {
-    final data = await Localstore.instance
-        .collection(_collection)
-        .doc(_document)
-        .get();
-    return data != null && data[_doneKey] == true;
-  }
+  // SharedPreferences, like the old cache document, is cleared on sign-out,
+  // so the next account runs its own migration.
+  static Future<bool> _isDone() async =>
+      (await SharedPreferences.getInstance()).getBool(_doneKey) ?? false;
 
-  static Future<void> _markDone() async {
-    await Localstore.instance.collection(_collection).doc(_document).set({
-      _doneKey: true,
-    });
-  }
+  static Future<void> _markDone() async =>
+      (await SharedPreferences.getInstance()).setBool(_doneKey, true);
 }

lib/api/marianumconnect/queries/timetable_custom_events/timetable_custom_events_get.dart

@@ -4,10 +4,8 @@ import '../../marianumconnect_query.dart';
 class TimetableCustomEventsGet extends MarianumConnectQuery {
   TimetableCustomEventsGet({super.dio});
 
-  Future<GetCustomTimetableEventResponse> run() => guard(() async {
-    final response = await dio.get<Map<String, dynamic>>(
-      endpoint('timetable/custom-events'),
-    );
-    return GetCustomTimetableEventResponse.fromJson(response.data!);
-  });
+  Future<GetCustomTimetableEventResponse> run() => getObject(
+    'timetable/custom-events',
+    GetCustomTimetableEventResponse.fromJson,
+  );
 }